User permission verification method, device and equipment based on cloud service and medium

Abstract

The embodiment of the invention provides a user permission verification method, device and equipment based on a cloud service and a medium, the cloud service comprises a plurality of service products, and the method comprises the following steps: obtaining a target operation request of a target user for a target service product; calling a preset personal account permission model and an enterprise project permission model, and performing composite verification of personal account permission and enterprise project permission on the target operation request; and responding to the target operation request according to a composite verification result. According to the embodiment of the invention, the method achieves the refined authority verification and response of the operation request of the target user for the target service product, carries out the composite verification through the comprehensive consideration of the personal account authority and the enterprise project authority, and sets the priority, guarantees the flexibility and safety of authority management, and improves the user experience. Unauthorized access and operation can be prevented, and meanwhile, the user experience and the system security are improved.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to a method, device, equipment and medium for verifying user rights based on cloud services. Background Art

[0002] With the rapid development of cloud computing technology, cloud service providers have provided users with a wide variety of cloud service products, covering data storage, computing resources, application deployment, data analysis, etc. These cloud service products have greatly promoted the flexibility and scalability of enterprise business, but at the same time have also brought a significant problem: due to the lack of unified policy specifications and authentication specifications among products, their authentication logic is highly diverse and inconsistent.

[0003] In the prior art, cloud service permission verification methods are mostly designed only for personal accounts, aiming to meet the permission control needs of individual users for resource access.

[0004] However, in an enterprise environment, this single permission verification method is obviously not enough, and enterprises often face many challenges in employee permission management. On the one hand, it is difficult for enterprises to ensure that employees can only access the data and resources required for their work and avoid illegal access to sensitive information; on the other hand, with the increasing number of enterprise projects and the frequent turnover of personnel, the allocation and recovery of permissions have become complicated and prone to errors, increasing the security risks and management costs of enterprises. As a result, the cloud service permission verification method in the existing technology cannot meet the permission control management of enterprise employee accounts. Summary of the invention

[0005] In view of the above problems, a method, apparatus, device and medium for user authority verification based on cloud services are proposed to overcome the above problems or at least partially solve the above problems, including:

[0006] A method for verifying user rights based on a cloud service, wherein the cloud service includes multiple service products, including:

[0007] Obtain target user's target operation request for target service product;

[0008] Call the preset personal account permission model and enterprise project permission model to perform a composite check of personal account permission and enterprise project permission on the target operation request; the personal account permission model is set with a personal account permission policy list, and the enterprise project permission model is set with an enterprise project permission policy list. The priority of the personal account permission policy in the personal account permission policy list is higher than the priority of the enterprise project permission policy in the enterprise project permission policy list;

[0009] Respond to the target operation request based on the result of the composite verification.

[0010] A device for verifying user rights based on cloud services, wherein the cloud services include multiple service products, including:

[0011] An operation request acquisition module is used to acquire a target operation request of a target user for a target service product;

[0012] A composite verification module is used to call the preset personal account permission model and enterprise project permission model to perform composite verification of personal account permissions and enterprise project permissions on target operation requests; the personal account permission model is provided with a personal account permission policy list, and the enterprise project permission model is provided with an enterprise project permission policy list, and the priority of the personal account permission policy in the personal account permission policy list is higher than the priority of the enterprise project permission policy in the enterprise project permission policy list;

[0013] The request response module is used to respond to the target operation request according to the result of the composite verification.

[0014] An electronic device comprises a processor, a memory and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the method described above when executed by the processor.

[0015] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described above is implemented.

[0016] The embodiments of the present invention have the following advantages:

[0017] In an embodiment of the present invention, a target operation request of a target user for a target service product is obtained; a preset personal account permission model and an enterprise project permission model are called to perform a composite check of personal account permissions and enterprise project permissions on the target operation request; the personal account permission model is provided with a personal account permission policy list, and the enterprise project permission model is provided with an enterprise project permission policy list, and the priority of the personal account permission policy in the personal account permission policy list is higher than the priority of the enterprise project permission policy in the enterprise project permission policy list; according to the result of the composite check, the target operation request is responded to, thereby realizing refined permission check and response to the target user's operation request for the target service product, and by comprehensively considering personal account permissions and enterprise project permissions to perform composite checks and set priorities, the flexibility and security of permission management are ensured, which helps to prevent unauthorized access and operations, while improving user experience and system security. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solution of the present invention, the accompanying drawings required for use in the description of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0019] Figure 1 It is a flowchart of the steps of a method for verifying user rights based on cloud services provided by some embodiments of the present invention;

[0020] Figure 2 is a schematic diagram of a preset strategy structure model provided by some embodiments of the present invention;

[0021] Figure 3 is a flowchart of steps of a composite verification method provided by some embodiments of the present invention;

[0022] Figure 4 is a flowchart of a method for verifying personal account permissions provided by some embodiments of the present invention;

[0023] Figure 5 It is a flowchart of the steps of a method for verifying enterprise project permissions provided by some embodiments of the present invention;

[0024] Figure 6 It is a structural block diagram of a device for verifying user rights based on cloud services provided by some embodiments of the present invention. DETAILED DESCRIPTION

[0025] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] Reference Figure 1 , showing a step flow chart of a method for user authority verification based on cloud services provided in some embodiments of the present invention, where the cloud service includes multiple service products.

[0027] Specifically, the following steps may be included:

[0028] Step 101: Obtain a target operation request of a target user for a target service product.

[0029] The target user refers to the user who initiates the operation request; the target service product refers to the service or product that the user hopes to operate or interact with.

[0030] In actual applications, the identity and access management system can obtain the user's operation request for the service product and authenticate the user. If the user has access rights to the service product, the system allows the user to access the resource; if the user does not have access rights to the service product, the system can deny access.

[0031] Identity and Access Management (IAM) is a customer-oriented system that provides multi-product identity management and access control to ensure that customers can control and access the resources they need securely and efficiently.

[0032] The main functions provided by IAM include: sophisticated permission management, secure access, sensitive operations, management of user permissions, etc. Among them, the core technology is the permission verification method, through which the permission verification method can be used to determine the permissions of any user, realize the user's management of resources, and improve the security of user access.

[0033] In some embodiments of the present invention, the target operation request carries the identifier of the target user, the identifier of the target service product, and user operation information.

[0034] The target operation request carries the target user's identifier, that is, the target operation request contains information that can uniquely identify or locate a specific user. This identifier can be any information that can uniquely represent the user's identity, such as a user name, user ID, email address, mobile phone number, etc. By including the user identifier, the system can accurately know which user initiated the operation request.

[0035] The target operation request carries the identifier of the target service product, that is, the target operation request contains information that can uniquely identify or locate a specific service product. This identifier can be a product ID, product name, version number, etc. By including the service product identifier, the system can accurately know which specific product or service the user wants to operate.

[0036] The target operation request carries user operation information, that is, the operation request contains the specific operation content or instructions that the user wants to perform. For example, if the user wants to access a certain data item, the operation information will contain the access operation instructions and related parameters (such as the ID of the data item). User operation information is the key information required for the system to execute the user request.

[0037] In actual applications, by obtaining the target user's target operation request for the target service product (the target user's identification, the target service product's identification, and user operation information), the identity and access management system can accurately identify the user's identity, locate the target service product, and execute the specific operation the user wants to perform after successful authentication.

[0038] Step 102, call the preset personal account permission model and enterprise project permission model, and perform a composite check of personal account permissions and enterprise project permissions on the target operation request; the personal account permission model is provided with a personal account permission policy list, and the enterprise project permission model is provided with an enterprise project permission policy list, and the priority of the personal account permission policy in the personal account permission policy list is higher than the priority of the enterprise project permission policy in the enterprise project permission policy list.

[0039] Among them, permissions belong to the product and are triples used to describe specific operations on resources. For example, "ecs:cloudServers:create" belongs to the ecs product and describes the operation permission to create a cloud server.

[0040] Policy is a language that describes a set of permission sets. It can accurately describe the authorized resource set and operation set. Through policy, users can freely match the permission sets that need to be granted.

[0041] An enterprise project (EP) refers to the management of cloud resources and enterprise members according to enterprise projects. Cloud resources and user groups with permissions are bound together through enterprise projects. Users' permissions to use cloud resources in enterprise projects are subject to authorization restrictions of user groups.

[0042] The preset personal account permission model is a model used to manage and verify the permissions of users in their personal accounts. It contains a list of personal account permission policies, which lists in detail the various operations that users can perform in their personal accounts and their corresponding permission policies. These permission policies define which resources, data, or services users can access or operate in their personal accounts.

[0043] The pre-set enterprise project permission model is a model used to manage and verify the permissions of users in their enterprise projects. It contains an enterprise project permission policy list, which lists in detail the various operations that users can perform in their enterprise projects and their corresponding permission policies. These permission policies define which project resources, data, or services users can access or operate in enterprise projects.

[0044] Composite verification means that the system will call these two permission models (personal account permission model and enterprise project permission model) for authentication at the same time; the system will first check whether the user has the permission to perform the operation in his personal account (according to the personal account permission policy list), and then the system will check whether the user has the permission to perform the operation in the enterprise project to which he belongs (according to the enterprise project permission policy list). For example, if the user does not have the permission for this operation in his personal account, but the enterprise project to which the user belongs has the permission for this operation, then the user's permission will be judged to pass during the permission verification.

[0045] In this embodiment, the priority of the personal account permission policy in the personal account permission policy list is higher than the priority of the enterprise project permission policy in the enterprise project permission policy list; that is, when the personal account permission and the enterprise project permission conflict (that is, the user has different permission settings for the same operation under his personal account and under the enterprise project), the system will give priority to the settings in the personal account permission policy list. Priority settings can ensure that the personalized permission settings of users in their personal accounts are respected and executed first

[0046] For example, if a user sets the permission to deny for this operation in a personal account, but the permission to allow for this operation in the enterprise project to which the user belongs, a permission conflict will occur. Since the present invention sets the priority of the personal account permission policy to be higher than the priority of the enterprise project permission policy, when a permission conflict occurs, it can be determined that the user has the permission to deny for this operation, thereby denying access.

[0047] As some examples, the personal account permission policy list and the enterprise project permission policy list can be designed according to the preset policy structure model. Figure 2 The preset policy structure model may include a policy version number (Version) and a policy authorization statement (Statement) list. A policy version number represents a policy, and a policy may include a policy authorization statement list consisting of multiple policy authorization statements.

[0048] Among them, the policy authorization statement includes the basic elements of action, permission set, resource path and condition, that is, a policy authorization statement includes the action of the policy authorization statement and the permission set of the policy authorization statement; the policy authorization statement can be composed of permission set (Action) and effect (Effect); the permission set is composed of triples, for example: "ecs:cloudServers:create", ecs represents the product, cloudServers represents the resource type, and create represents the operation; there are two types of effects: allow (Allow) and deny (Deny).

[0049] In some examples, a policy may contain multiple policy authorization statements. When performing permission verification on a user policy, multiple policy authorization statements in the policy will be verified. If there is a permission conflict in the policy authorization statements, the rejection may take precedence.

[0050] In some embodiments of the present invention, a preset personal account permission model and an enterprise project permission model are called to perform a composite check of personal account permissions and enterprise project permissions on a target operation request, including: calling a preset personal account permission model to perform a personal account permission check on the target operation request to obtain a personal account permission check result; when the personal account permission check result indicates that a personal account permission policy list is set with a personal account permission policy that matches the target operation request, determining the personal account permission check result as a composite check result; when the personal account permission check result indicates that a personal account permission policy list is not set with a personal account permission policy that matches the target operation request, calling a preset enterprise project permission model to perform an enterprise project permission check on the target operation request to obtain an enterprise project permission check result, and determining the enterprise project permission check result as a composite check result.

[0051] In actual applications, when the system receives a target operation request, it will first call a pre-set personal account permission model to check whether the personal account that initiated the request has the required permissions to perform the operation. The personal account permission verification result can indicate whether there is a personal account permission policy that matches the target operation request in the personal account permission policy list. If the personal account permission verification result shows that a personal account permission policy that matches the target operation request is set in the personal account permission policy list, then the personal account has the permission to perform the operation. In this case, the system directly determines the personal account permission verification result as the result of the composite verification without further verification.

[0052] If the personal account permission check result shows that there is no personal account permission policy matching the target operation request in the personal account permission policy list, further inspection is required. The system can call the enterprise project permission model to further verify whether the operation request falls within the permission scope of a certain enterprise project to determine whether the operation falls within the scope of operations authorized by a certain enterprise project.

[0053] For example, if the personal account permission check fails (that is, there is no matching personal account permission policy), but the enterprise project permission check result shows that the operation falls within the authorization scope of a certain enterprise project, then the operation request is also allowed. In this case, the system determines the enterprise project permission check result as the result of the composite check.

[0054] like Figure 3 The following is a flow chart of the composite calibration:

[0055] [1] Determine whether the user is a primary user or is in the primary user group. If so, jump to [5]; if not, go to [2].

[0056] [2] Determine IAM permissions (determine personal account permissions). If the IAM permissions have constraints on specific operations or resources, jump to [3]; if there are no constraints, jump to [4].

[0057] [3] Judge the result. If it is allowed, go to [5]. If it is rejected, go to [6].

[0058] [4] Determine the enterprise project authority (determine EP authority). The specific determination process is as follows: Figure 5 If you allow it, go to [5]; if you deny it, go to [6].

[0059] [5] Allow user operation.

[0060] [6] User operation is denied.

[0061] The main user is the user who has full access to the resources he owns, and can reset user passwords, assign user permissions, etc. If multiple people need to use resources together, in order to ensure account security, you can create sub-users to perform daily management work.

[0062] A sub-user is a sub-user created in the User Center by a user with IAM permissions. The user name and password of the sub-user are controlled by the user with IAM permissions. The sub-user can also log in to access the resource console. The login entrance is the same as that of the main user and is subject to the permissions granted.

[0063] A user group refers to a collection of users. IAM can implement user authorization through the user group function. When a created IAM user joins a specific user group, he or she will have the permissions of the corresponding user group. When a user joins multiple user groups, this user will have the permissions of multiple user groups at the same time, that is, the full set of permissions of multiple user groups.

[0064] In some embodiments of the present invention, a preset personal account permission model is called to perform personal account permission verification on a target operation request to obtain a personal account permission verification result, including:

[0065] When the target operation request is a request for the target resource pool, the personal account permission policy of the target resource pool is filtered out from the personal account permission policy list; the preset personal account permission model is called, and the personal account permission policy of the target resource pool is adopted to perform personal account permission verification on the target operation request to obtain the personal account permission verification result.

[0066] In actual applications, cloud service providers can use resource pools to provide virtual machines and storage services, and customers can dynamically acquire and release resources as needed. A resource pool refers to a set of resources that are centrally managed, allocated, and used; a target resource pool is a resource pool determined by the identifier of the target service product in the target user's operation request.

[0067] As some examples, the personal account permission policy for the target resource pool can be filtered out from the personal account permission policy list according to the identifier of the target service product in the target operation request; then the preset personal account permission model is called, and the personal account permission policy of the target resource pool is adopted to perform personal account permission verification on the target operation request to obtain the personal account permission verification result.

[0068] In some embodiments of the present invention, a preset personal account permission model is called, and the personal account permission policy of the target resource pool is adopted to perform personal account permission verification on the target operation request to obtain a personal account permission verification result, including: when the target operation request is a request for a specified resource path, the personal account permission policy of the specified resource path is filtered out from the personal account permission policy of the target resource pool; the preset personal account permission model is called, and the personal account permission policy of the specified resource path is adopted to perform personal account permission verification on the target operation request to obtain a personal account permission verification result.

[0069] In some examples, if the target operation request is for a specific resource path (such as a specific file or database table), the system will first filter out the personal account permission policy for the target resource pool from the personal account permission policy list based on the identifier of the target service product in the target operation request, and then filter out the permission policy related to this resource path from the personal account permission policy for the target resource pool, and then call the preset personal account permission model, and use the last filtered permission policy related to the specified resource path for verification, to obtain the personal account permission verification result for the request for the specified resource path.

[0070] In some embodiments of the present invention, before calling a preset personal account permission model, adopting the personal account permission policy of the specified resource path, and performing personal account permission verification on the target operation request, and obtaining the personal account permission verification result, it also includes: when the personal account permission policy of the specified resource path is set with an effectiveness condition, judging whether the current state meets the effectiveness condition; when the current state meets the effectiveness condition, executing the call to the preset personal account permission model, adopting the personal account permission policy of the specified resource path, and performing personal account permission verification on the target operation request to obtain the personal account permission verification result.

[0071] As some examples, the personal account permission policy for a specified resource path has an effective condition, which means that for certain resource paths, in addition to defining which users can perform which operations on these resources, the permission policy also sets additional effective conditions. These conditions can be time-related (such as only valid on weekdays), environment-related (such as only valid on the company intranet), or any other custom conditions.

[0072] Before executing the permission check, the system will check whether the current status (such as the current time, current network environment, current user status, etc.) meets the validity conditions defined in the permission policy. After confirming that the validity conditions are met, the system calls the preset personal account permission model and uses the personal account permission policy of the specified resource path to perform permission check on the target operation request and generate a permission check result indicating whether the user has the permission to perform the operation.

[0073] For example, in Example 1, assume that a user ID of a non-primary user who is not in the primary user group is "123", and an operation request of "ctiam(product ID):user:query" occurs on November 8, 2023. The following is the data structure of the user's permission policy for the target resource pool:

[0074]

[0075] "Action":[ / / The content of Action is a permission triplet set. The first element of the triplet is the product code, corresponding to the entire line of specific products. The second element is the operation group defined by the product. For example, user is the operation of user attributes. The third element is the specific operation content, such as query is query. The combination of ctiam:user:query means the permission to query users.

[0076]

[0077] "Condition":{ / / Condition is the condition for the permission to take effect, StringEquals is the key of the condition, Mark is the operation operator, the value of UserId is "123", which means that this permission is only effective for users with userId 123, and DateGreaterThan means that the permission will take effect after 00:00 on November 7, 2023.

[0078]

[0079] "Effect":"Allow", / / Effect is the specific manifestation of the effectiveness of the permission. Allow is to allow the permission. If Effect is Deny, it means to deny the permission, which means that the user with userId 123 will not have the permission to query users after 00:00 on November 7, 2023.

[0080]

[0081] "Version":"1.1" / / is the version number of the policy. The policy specifications will be continuously updated.

[0082]

[0083] "regionId":"global" / / This is a global permission and does not apply to a specific resource pool.

[0084]

[0085] In the data structure of Example 1 above, the version number of the policy is 1.1. The user's personal account permission policy iamPolicyList contains an iam personal account policy. The policyContent contains the specific content of the policy. The Effect in the policy is Allow. The Action (permission set) contains three contents, which respectively mean querying a single user, obtaining user details and viewing all users under the account. The Resource in the policy is global (global, overall resource), which means wildcard all resource paths (Resource Name RN); among them, the Action can also include the identifier of the target service product.

[0086] Perform permission verification on the user described in Example 1, such as Figure 4 , which may include:

[0087] [1] Get request (get target operation request).

[0088] [2] Determine whether the user has resource-level permissions. If yes, proceed to [3]; otherwise, proceed to [4].

[0089] [3] Get the resource pool corresponding to the resource.

[0090] [4] Filter the IAM permission policy (personal account permission policy) of the corresponding resource pool.

[0091] [5] Determine whether it is a specified resource path. If so, proceed to [6]; otherwise, proceed to [7].

[0092] [6] Filter the permission content corresponding to the resource path.

[0093] [7] Determine whether the specified conditions are met. If yes, proceed to [8]; otherwise, proceed to [9].

[0094] [8] Check whether the condition is met. If yes, proceed to [9]; otherwise, proceed to

[11] .

[0095] [9] Parse the permission content into the permission set of allow and deny, parse and verify the permission content, and proceed to

[10] if allowed,

[11] if denied, and

[12] if mismatched.

[0096]

[10] Allow user operation.

[0097]

[11] User operation is denied and permission error is returned.

[0098]

[12] Perform enterprise project permission judgment (call the preset enterprise project permission model to perform enterprise project permission verification on the target operation request).

[0099] According to the data structure of the user's personal account permission policy for the target resource pool in Example 1, the user is a non-primary user and is not in the primary user group. Therefore, a personal account permission check is performed. The corresponding process is as follows: Figure 4 , since the region Id (a unique identifier used to identify the region where the cloud service is located) in the permission policy configured by the user is global (global, overall resource), it is not a resource-level permission. The process is adjusted to determine whether to specify a resource path. Since the resource in the user permission is "*", it means matching all resource paths, and any resource path request will be verified. Since there are conditional settings in the user's personal permissions, a conditional check will be performed at this time. The set conditional restrictions can only take effect for users with userId "123" when the operation time is later than 0:00 on November 7, 2023. If the current status matches the condition, the conditional check passes.

[0100] After the conditional check is passed, check whether the requested action matches the set action, and check the Effect of the permission. Since the Effect set in the embodiment is Allow and the requested action "ctiam:user:query" matches the setting, it is Allow when performing IAM personal account permission verification, which is used as the personal account permission verification result.

[0101] In some embodiments of the present invention, a preset enterprise project permission model is called to perform enterprise project permission verification on a target operation request to obtain an enterprise project permission verification result, including:

[0102] When the target operation request is a request for a target resource pool, the first enterprise project permission policy and the second enterprise project permission policy of the target resource pool are screened out from the enterprise project permission policy list; wherein the first enterprise project permission policy includes an enterprise project permission policy for indicating that user operations are allowed, and the second enterprise project permission policy includes an enterprise project permission policy for indicating that user operations are denied; the preset enterprise project permission model is called, and the first enterprise project permission policy and the second enterprise project permission policy are adopted to perform enterprise project permission verification on the target operation request to obtain an enterprise project permission verification result.

[0103] As some examples, an enterprise project permission policy list is a collection of multiple enterprise project permission policies, where each policy defines which users or user groups have the right to perform which operations on which resources, and these policies are used to control and manage the access and use of resources within the enterprise.

[0104] The first enterprise project permission policy includes enterprise project permission policies that allow users to perform operations. That is, these policies clearly indicate which users or user groups are authorized to perform the requested operations on the target resource pool.

[0105] The second enterprise project permission policy includes enterprise project permission policies that deny users from performing operations. That is, these policies indicate which users or user groups are explicitly prohibited from performing the requested operations on the target resource pool.

[0106] When the target operation request is a request for a target resource pool, and the personal account permission verification result indicates that the personal account permission policy list does not set a personal account permission policy that matches the target operation request, the preset enterprise project permission model can be called to filter out the first enterprise project permission policy and the second enterprise project permission policy for the target resource pool from the enterprise project permission policy list set by the enterprise project permission model; the first enterprise project permission policy and the second enterprise project permission policy are used to perform enterprise project permission verification on the target operation request to obtain the enterprise project permission verification result.

[0107] As in Example 2, assume that a user whose user ID is "123" is not a primary user and is not in the primary user group, and an operation request of "ctiam:user:query" occurs on November 8, 2023. The following is the data structure of the user's permission policy for the target resource pool:

[0108] {

[0109] "data":{

[0110] "returnObj":{

[0111] "epPolicyList":[

[0112] {

[0113] "epId":"4ca496c5c5014bf787f2ad409c208e4e", / / Enterprise project id, which means that this permission is only effective under a specific enterprise project.

[0114]

[0115] "Effect":"Deny", / / Effect is the specific performance of the permission taking effect. Allow is to allow the permission. If Effect is Deny, it means to deny the permission.

[0116]

[0117] "Version":"1.1" / / is the version number of the policy. The policy specifications will be continuously updated.

[0118]

[0119] "regionId":"global" / / This is a global permission and does not apply to a specific resource pool.

[0120]

[0121] "Action":[ / / The content of Action is a permission triplet set. The first element of the triplet is the product code, which corresponds to the specific product permission. The second element is the operation group defined by the product. For example, user is the operation of user attributes. The third element is the specific operation content. For example, query is a query. The combination of ctiam:user:query means the permission to query users.

[0122]

[0123] "Condition":{ / / Condition is the condition for the permission to take effect, StringEquals is the key of the condition, Mark is the operation operator, the value of UserId is "123", which means that this permission is only effective for users with userId 123, and DateGreaterThan means that the permission will take effect after 00:00 on November 7, 2023.

[0124]

[0125] "Effect":"Allow", / / Effect is the specific manifestation of the effectiveness of the permission. Allow is to allow the permission. If Effect is Deny, it means to deny the permission, which means that the user with userId 123 will not have the permission to query users after 00:00 on November 7, 2023.

[0126]

[0127] In the data architecture of Example 2 above, the policy version number is 1.1. The user's enterprise project policy epPolicyList contains an enterprise project policy, policyContent contains the specific content of the policy, and the enterprise project policy contains a policy authorization statement. The Effect in the statement is Deny, and the Action contains three contents, which respectively mean querying a single user, obtaining user details, and viewing all users under the account. The Resource in policy authorization statement 1 is global (global, overall resource), which means wildcarding all resource paths. In addition, the user also has a personal account policy iamPolicyList, which contains a policy authorization statement with Effect as Allow, indicating that the policy authorization statement allows the Action to take effect. Two operation request sets, "ctiam:user:get" and "ctiam:user:list", are set in Action. The Resource is consistent with the enterprise project. There are two Condition settings, which respectively mean that the policy will take effect only when the UserId of the user using this policy is 123 and the usage time is after 0:00 on November 7, 2023.

[0128] Perform permission verification on the user described in Example 2, such as Figure 4 , which may include:

[0129] [1] Get request (get target operation request).

[0130] [2] Determine whether the user has resource-level permissions. If yes, proceed to [3]; otherwise, proceed to [4].

[0131] [3] Get the resource pool corresponding to the resource.

[0132] [4] Filter the IAM permission policy (personal account permission policy) of the corresponding resource pool.

[0133] [5] Determine whether it is a specified resource path. If so, proceed to [6]; otherwise, proceed to [7].

[0134] [6] Filter the permission content corresponding to the resource path.

[0135] [7] Determine whether the specified conditions are met. If yes, proceed to [8]; otherwise, proceed to [9].

[0136] [8] Check whether the condition is met. If yes, proceed to [9]; otherwise, proceed to

[11] .

[0137] [9] Parse the permission content into the permission set of allow and deny, parse and verify the permission content, and proceed to

[10] if allowed,

[11] if denied, and

[12] if mismatched.

[0138]

[10] Allow user operation.

[0139]

[11] User operation is denied and permission error is returned.

[0140]

[12] Perform enterprise project permission judgment (call the preset enterprise project permission model to perform enterprise project permission verification on the target operation request).

[0141] Since the region Id (a unique identifier used to identify the region where the cloud service is located) in the permission policy configured by the user is global (global, overall resource), it is not a resource-level permission. It is necessary to determine whether to specify a resource path. Since the Resource in the user permission is "*", it means matching all resource paths, any resource path request will be verified. Since there are conditional settings in the user's personal permissions, a conditional check will be performed at this time. The set conditional restrictions will only take effect for users with userId "123" when the operation time is later than 0:00 on November 7, 2023. If the current status matches the condition, the conditional check passes.

[0142] After the condition check is passed, permission parsing and matching verification are performed. Since the Action (permission set) set in this policy does not set the actual request "ctiam:user:query" of this user, the verification result returns mismatch, and then the enterprise project permission judgment is performed, such as Figure 5 , which may include:

[0143] [1] Determine the enterprise project authority.

[0144] [2] Determine whether it is a resource-level permission (determine whether the target operation request is a request for the target resource pool). If so, proceed to [3]. Otherwise, determine whether it matches the policy in [6] or [7].

[0145] [3] Obtain the enterprise project corresponding to the resource (obtain the list of enterprise project permission policies for the target resource pool).

[0146] [4] Filter the enterprise project policy of the corresponding enterprise project (select the first enterprise project permission policy and the second enterprise project permission policy for the target resource pool from the enterprise project permission policy list).

[0147] [5] Parse the permission content into allow and deny permission sets.

[0148] [6] Matches the deny policy (second enterprise project permission policy). If it matches, proceed to [9]. If it does not match, proceed to [7].

[0149] [7] Match the permission policy (first enterprise project permission policy). If it matches, proceed to [8]. If it does not match, proceed to [9].

[0150] [8] Allow the user to operate.

[0151] [9] User operation is denied and permission error is returned.

[0152] When checking the enterprise project permissions of the user, since the regionId (a unique identifier used to identify the region where the cloud service is located) set in the data architecture of the permission policy in Example 2 is global (global, overall resource), it does not match the resource-level permissions and jumps to matching the deny policy. Since the Action (permission set) in the enterprise project permissions is set for the "ctiam:user:query" request and the Effect (effect) of the enterprise project is Deny, the matching result is to deny this request operation, and the enterprise project permission verification result returned is deny.

[0153] Step 103: respond to the target operation request according to the result of the composite verification.

[0154] After calling the preset personal account permission model and enterprise project permission model, the system can make a corresponding response to the target operation request after performing a composite check of personal account permissions and enterprise project permissions on the target operation request and obtaining the result of the composite check. If the check passes, the system may execute the operation specified by the request and return the result of the successful operation or related data. If the check fails, the system may refuse to execute the request and return an error message or prompt the user that he does not have data access rights.

[0155] In an embodiment of the present invention, a target operation request of a target user for a target service product is obtained; a preset personal account permission model and an enterprise project permission model are called to perform a composite check of personal account permissions and enterprise project permissions on the target operation request; the personal account permission model is provided with a personal account permission policy list, and the enterprise project permission model is provided with an enterprise project permission policy list, and the priority of the personal account permission policy in the personal account permission policy list is higher than the priority of the enterprise project permission policy in the enterprise project permission policy list; according to the result of the composite check, the target operation request is responded to, thereby realizing refined permission check and response to the target user's operation request for the target service product, and by comprehensively considering personal account permissions and enterprise project permissions to perform composite checks and set priorities, the flexibility and security of permission management are ensured, which helps to prevent unauthorized access and operations, while improving user experience and system security.

[0156] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0157] Reference Figure 6 , shows a schematic diagram of the structure of a device for user authority verification based on cloud services provided by some embodiments of the present invention, which may specifically include the following modules:

[0158] An operation request acquisition module 601 is used to acquire a target operation request of a target user for a target service product;

[0159] The composite verification module 602 is used to call the preset personal account permission model and enterprise project permission model to perform composite verification of personal account permission and enterprise project permission on the target operation request; the personal account permission model is provided with a personal account permission policy list, and the enterprise project permission model is provided with an enterprise project permission policy list, and the priority of the personal account permission policy in the personal account permission policy list is higher than the priority of the enterprise project permission policy in the enterprise project permission policy list;

[0160] The request response module 603 is used to respond to the target operation request according to the result of the composite verification.

[0161] In some embodiments of the present invention, the composite verification module 602 is used to:

[0162] Call the preset personal account permission model, perform personal account permission verification on the target operation request, and obtain the personal account permission verification result;

[0163] If the personal account permission verification result indicates that the personal account permission policy list is set with a personal account permission policy that matches the target operation request, determining the personal account permission verification result as a composite verification result;

[0164] When the personal account permission verification result indicates that the personal account permission policy list does not set a personal account permission policy that matches the target operation request, call the preset enterprise project permission model, perform enterprise project permission verification on the target operation request, obtain the enterprise project permission verification result, and determine the enterprise project permission verification result as the result of the composite verification.

[0165] In some embodiments of the present invention, a preset personal account permission model is called to perform personal account permission verification on a target operation request to obtain a personal account permission verification result, including:

[0166] When the target operation request is a request for a target resource pool, the personal account permission policy of the target resource pool is filtered out from the personal account permission policy list;

[0167] The preset personal account permission model is called, the personal account permission policy of the target resource pool is adopted, the personal account permission verification is performed on the target operation request, and the personal account permission verification result is obtained.

[0168] In some embodiments of the present invention, a preset personal account permission model is called, and the personal account permission policy of the target resource pool is adopted to perform personal account permission verification on the target operation request to obtain a personal account permission verification result, including:

[0169] When the target operation request is a request for a specified resource path, the personal account permission policy for the specified resource path is filtered out from the personal account permission policies of the target resource pool;

[0170] The preset personal account permission model is called, and the personal account permission policy of the specified resource path is adopted to perform personal account permission verification on the target operation request to obtain the personal account permission verification result.

[0171] In some embodiments of the present invention, the apparatus further comprises:

[0172] The condition judgment module is used to judge whether the current state meets the effectiveness conditions when the personal account permission policy of the specified resource path has effectiveness conditions;

[0173] The execution module is used to execute and call the preset personal account permission model when the current state meets the effectiveness conditions, adopt the personal account permission policy of the specified resource path, perform personal account permission verification on the target operation request, and obtain the personal account permission verification result.

[0174] In some embodiments of the present invention, a preset enterprise project permission model is called to perform enterprise project permission verification on a target operation request to obtain an enterprise project permission verification result, including:

[0175] In the case where the target operation request is a request for a target resource pool, a first enterprise project permission policy and a second enterprise project permission policy of the target resource pool are screened out from the enterprise project permission policy list; wherein the first enterprise project permission policy includes an enterprise project permission policy for indicating that the user operation is allowed, and the second enterprise project permission policy includes an enterprise project permission policy for indicating that the user operation is denied;

[0176] A preset enterprise project permission model is called, and the first enterprise project permission strategy and the second enterprise project permission strategy are adopted to perform an enterprise project permission verification on the target operation request to obtain an enterprise project permission verification result.

[0177] In some embodiments of the present invention, the target operation request carries the identifier of the target user, the identifier of the target service product, and user operation information.

[0178] Some embodiments of the present invention further provide an electronic device, comprising a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the above method is implemented when the computer program is executed by the processor.

[0179] Some embodiments of the present invention further provide a computer-readable storage medium, on which a computer program is stored, and the computer program implements the above method when executed by a processor.

[0180] Some embodiments of the present invention further provide a computer program product, including a computer program, which implements the above method when executed by a processor.

[0181] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0182] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0183] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0184] Those skilled in the art will appreciate that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0185] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0186] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0187] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0188] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0189] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the above elements.

[0190] The above is a detailed introduction to the method, device, equipment and medium for user authority verification based on cloud services. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for verifying user rights based on cloud services, characterized in that: The cloud service includes multiple service products, and the method includes: Obtain target user's target operation request for target service product; Calling a preset personal account permission model and an enterprise project permission model to perform a composite check of personal account permissions and enterprise project permissions on the target operation request; the personal account permission model is provided with a personal account permission policy list, and the enterprise project permission model is provided with an enterprise project permission policy list, and the priority of the personal account permission policy in the personal account permission policy list is higher than the priority of the enterprise project permission policy in the enterprise project permission policy list; The target operation request is responded to according to the result of the composite verification.

2. The method according to claim 1, characterized in that The calling of the preset personal account permission model and enterprise project permission model to perform a composite verification of the personal account permission and the enterprise project permission on the target operation request includes: Calling a preset personal account permission model, performing personal account permission verification on the target operation request, and obtaining a personal account permission verification result; If the personal account permission verification result indicates that the personal account permission policy list is provided with a personal account permission policy that matches the target operation request, determining the personal account permission verification result as a composite verification result; When the personal account permission verification result indicates that the personal account permission policy list does not set a personal account permission policy that matches the target operation request, call a preset enterprise project permission model, perform an enterprise project permission verification on the target operation request, obtain an enterprise project permission verification result, and determine the enterprise project permission verification result as a composite verification result.

3. The method according to claim 2, characterized in that The calling of a preset personal account permission model, performing personal account permission verification on the target operation request, and obtaining a personal account permission verification result includes: In a case where the target operation request is a request for a target resource pool, filtering out the personal account permission policy of the target resource pool from the personal account permission policy list; A preset personal account permission model is called, and the personal account permission policy of the target resource pool is adopted to perform a personal account permission check on the target operation request to obtain a personal account permission check result.

4. The method according to claim 3, characterized in that The calling of a preset personal account permission model, adopting the personal account permission policy of the target resource pool, performing personal account permission verification on the target operation request, and obtaining a personal account permission verification result includes: In a case where the target operation request is a request for a specified resource path, filtering out the personal account permission policy for the specified resource path from the personal account permission policies of the target resource pool; The preset personal account permission model is called, and the personal account permission policy of the specified resource path is adopted to perform personal account permission verification on the target operation request to obtain a personal account permission verification result.

5. The method according to claim 4, characterized in that Before calling the preset personal account permission model, adopting the personal account permission policy of the specified resource path, performing personal account permission verification on the target operation request, and obtaining the personal account permission verification result, the method further includes: In the case where the personal account permission policy of the specified resource path has an effectiveness condition, determining whether the current state satisfies the effectiveness condition; When the current state satisfies the validation condition, the preset personal account permission model is called, the personal account permission policy of the specified resource path is adopted, and the personal account permission check is performed on the target operation request to obtain a personal account permission check result.

6. The method according to any one of claims 2 to 5, characterized in that: The calling of a preset enterprise project permission model, performing enterprise project permission verification on the target operation request, and obtaining an enterprise project permission verification result includes: In the case where the target operation request is a request for a target resource pool, a first enterprise project permission policy and a second enterprise project permission policy of the target resource pool are screened out from the enterprise project permission policy list; wherein the first enterprise project permission policy includes an enterprise project permission policy for indicating that user operation is allowed, and the second enterprise project permission policy includes an enterprise project permission policy for indicating that user operation is denied; The preset enterprise project permission model is called, and the first enterprise project permission policy and the second enterprise project permission policy are adopted to perform an enterprise project permission verification on the target operation request to obtain an enterprise project permission verification result.

7. The method according to claim 1, characterized in that The target operation request carries the identifier of the target user, the identifier of the target service product, and user operation information.

8. A device for verifying user rights based on cloud services, characterized in that: The cloud service includes multiple service products, and the device includes: An operation request acquisition module is used to acquire a target operation request of a target user for a target service product; A composite verification module is used to call a preset personal account permission model and an enterprise project permission model to perform a composite verification of the personal account permission and the enterprise project permission on the target operation request; the personal account permission model is provided with a personal account permission policy list, and the enterprise project permission model is provided with an enterprise project permission policy list, and the priority of the personal account permission policy in the personal account permission policy list is higher than the priority of the enterprise project permission policy in the enterprise project permission policy list; The request response module is used to respond to the target operation request according to the result of the composite verification.

9. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the method according to any one of claims 1 to 7 when executed by the processor.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images