Method, device and equipment for checking user authority based on cloud service and medium

Abstract

Embodiments of the present application provide a method, device, equipment and medium for user permission verification based on cloud services, the cloud services include a plurality of service products, the method includes: obtaining a target operation request of a target user on a target service product; calling a preset personal account permission model and an enterprise project permission model to perform a composite verification of the target operation request on personal account permission and enterprise project permission; and responding to the target operation request according to the result of the composite verification. Through the embodiments of the present application, the operation request of the target user on the target service product is finely verified and responded, the composite verification is performed by comprehensively considering the personal account permission and the enterprise project permission, and the priority is set, so that the flexibility and security of the permission management are ensured, unauthorized access and operation are prevented, and the user experience and system security are improved.

Description

Technical Field

[0001] This invention relates to the field of Internet technology, and in particular to methods, apparatus, devices and media for user permission verification based on cloud services. Background Technology

[0002] With the rapid development of cloud computing technology, cloud service providers offer users a wide variety of cloud service products, covering multiple areas such as data storage, computing resources, application deployment, and data analysis. These cloud service products have greatly promoted the flexibility and scalability of enterprise businesses, but they have also brought about a significant problem: due to the lack of unified policy specifications and authentication specifications among the various products, their authentication logic exhibits a high degree of diversity and inconsistency.

[0003] In existing technologies, most cloud service permission verification methods are designed only for personal accounts, aiming to meet the permission control needs of individual users for resource access.

[0004] However, in enterprise environments, this single method of permission verification is clearly insufficient, and enterprises often face numerous challenges in employee access management. On the one hand, it is difficult for enterprises to ensure that employees can only access the data and resources necessary for their work, thus preventing unauthorized access to sensitive information. On the other hand, with the increasing number of enterprise projects and frequent staff turnover, the allocation and revoke of permissions become complex and error-prone, increasing the enterprise's security risks and management costs. Consequently, existing cloud service permission verification methods cannot meet the needs of enterprises for controlling and managing employee account permissions. Summary of the Invention

[0005] In view of the above problems, methods, apparatus, devices, and media for cloud service-based user permission verification are proposed to overcome or at least partially solve the above problems, including:

[0006] A method for user permission verification based on cloud services, wherein the cloud services include multiple service products, including:

[0007] Obtain the target user's target operation request for the target service product;

[0008] The system invokes the pre-defined personal account permission model and enterprise project permission model to perform a combined verification of personal account permissions and enterprise project permissions on the target operation request. The personal account permission model has a list of personal account permission policies, and the enterprise project permission model has a list of enterprise project permission policies. The priority of personal account permission policies in the personal account permission policy list is higher than the priority of enterprise project permission policies in the enterprise project permission policy list.

[0009] Based on the result of the composite verification, respond to the target operation request.

[0010] A device for user permission verification based on cloud services, wherein the cloud services include multiple service products, including:

[0011] The operation request acquisition module is used to acquire the target user's target operation request for the target service product;

[0012] The composite verification module is used to call the preset personal account permission model and enterprise project permission model to perform composite verification of personal account permissions and enterprise project permissions on the target operation request. The personal account permission model has a personal account permission policy list, and the enterprise project permission model has an enterprise project permission policy list. The priority of personal account permission policies in the personal account permission policy list is higher than the priority of enterprise project permission policies in the enterprise project permission policy list.

[0013] The request-response module is used to respond to the target operation request based on the result of the composite validation.

[0014] An electronic device includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the method described above.

[0015] A computer-readable storage medium on which a computer program is stored, which, when executed by a processor, implements the method described above.

[0016] The embodiments of the present invention have the following advantages:

[0017] In this embodiment of the invention, the target user's target operation request for the target service product is obtained; a pre-set personal account permission model and enterprise project permission model are invoked to perform a composite verification of personal account permissions and enterprise project permissions on the target operation request; the personal account permission model has a personal account permission policy list, and the enterprise project permission model has an enterprise project permission policy list, with the priority of personal account permission policies in the personal account permission policy list being higher than the priority of enterprise project permission policies in the enterprise project permission policy list; based on the result of the composite verification, the target operation request is responded to, realizing refined permission verification and response for the target user's operation request for the target service product. By comprehensively considering personal account permissions and enterprise project permissions to perform composite verification and setting priorities, the flexibility and security of permission management are ensured, which helps prevent unauthorized access and operation, while improving user experience and system security. Attached Figure Description

[0018] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description of the present invention will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart of the steps of a user permission verification method based on cloud services provided in some embodiments of the present invention;

[0020] Figure 2 This is a schematic diagram of a preset strategy structure model provided in some embodiments of the present invention;

[0021] Figure 3 This is a flowchart of the steps of a composite verification method provided in some embodiments of the present invention;

[0022] Figure 4 This is a flowchart of the steps of a method for verifying personal account permissions provided in some embodiments of the present invention;

[0023] Figure 5 This is a flowchart illustrating the steps of a method for verifying enterprise project permissions according to some embodiments of the present invention;

[0024] Figure 6 This is a structural block diagram of a user permission verification device based on cloud services provided in some embodiments of the present invention. Detailed Implementation

[0025] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0026] Reference Figure 1 The diagram illustrates a flowchart of steps for a user permission verification method based on cloud services, provided by some embodiments of the present invention. The cloud services include multiple service products.

[0027] Specifically, it may include the following steps:

[0028] Step 101: Obtain the target user's target operation request for the target service product.

[0029] In this context, the target user refers to the user who initiates the operation request; the target service product is the service or product that the user wishes to operate or interact with.

[0030] In practical applications, the identity and access management system can obtain users' operation requests for service products, authenticate users, and allow users to access resources if they have access rights to the service products; if users do not have access rights to the service products, the system can deny access.

[0031] Identity and Access Management (IAM) is a customer-facing system that provides multi-product identity management and access control to ensure that customers can securely and efficiently control and access the resources they need.

[0032] The main functions provided by IAM include: granular permission management, secure access, sensitive operations, and user permission management. The core technology is the permission verification method, which can determine the permissions of any user, enabling user management of resources and improving the security of user access.

[0033] In some embodiments of the present invention, the target operation request carries the identifier of the target user, the identifier of the target service product, and user operation information.

[0034] The target operation request carries the identifier of the target user; that is, it contains information that can uniquely identify or locate a specific user. This identifier can be any information that can uniquely represent a user, such as a username, user ID, email address, or mobile phone number. By including the user identifier, the system can accurately determine which user initiated the operation request.

[0035] The target operation request carries an identifier for the target service product; that is, the request contains information that uniquely identifies or locates the specific service product. This identifier can be a product ID, product name, version number, etc. By including the service product identifier, the system can accurately determine which specific product or service the user wishes to operate on.

[0036] The target operation request carries user operation information, meaning the request contains the specific operation or instruction the user wishes to perform. For example, if a user wants to access a data item, the operation information will include the access instruction and relevant parameters (such as the data item's ID). User operation information is crucial information necessary for the system to execute the user request.

[0037] In practical applications, by obtaining the target user's target operation request for the target service product (the target user's identifier, the target service product's identifier, and the user's operation information), the identity and access management system can accurately identify the user's identity, locate the target service product, and execute the specific operation that the user wishes to perform after successful authentication.

[0038] Step 102: Invoke the preset personal account permission model and enterprise project permission model to perform a composite verification of personal account permissions and enterprise project permissions on the target operation request; the personal account permission model has a personal account permission policy list, and the enterprise project permission model has an enterprise project permission policy list. The priority of personal account permission policies in the personal account permission policy list is higher than the priority of enterprise project permission policies in the enterprise project permission policy list.

[0039] In this context, permissions belong to the product and are triples used to describe specific operations on resources. For example, "ecs:cloudServers:create" belongs to the ECS product and describes the operation permission for creating cloud servers.

[0040] A policy is a language for describing a set of permissions. It can precisely describe the set of resources and operations that are authorized. Through policies, users can freely combine the sets of permissions that need to be granted.

[0041] An Enterprise Project (EP) refers to the management of cloud resources and enterprise members by enterprise project. Through an enterprise project, cloud resources and user groups with permissions are bound together, and the user's access to cloud resources within the enterprise project is restricted by the user group's authorization.

[0042] A pre-defined personal account permission model is used to manage and verify user permissions within their personal accounts. It contains a list of personal account permission policies, which details the various operations a user can perform under their personal account and their corresponding permission policies. These permission policies define which resources, data, or services a user can access or operate under their personal account.

[0043] The pre-defined enterprise project permission model is used to manage and validate user permissions within their respective enterprise projects. It contains a list of enterprise project permission policies, which details the various operations a user can perform within their assigned enterprise project and their corresponding permission policies. These permission policies define which project resources, data, or services a user can access or operate within an enterprise project.

[0044] Composite authentication refers to the system simultaneously invoking two permission models (personal account permission model and enterprise project permission model) for authentication. The system first checks whether the user has permission to perform the operation under their personal account (based on the personal account permission policy list), and then checks whether the user has permission to perform the operation under their enterprise project (based on the enterprise project permission policy list). For example, if a user does not have permission for this operation in their personal account, but their enterprise project has granted this permission, then the user's permission will be approved during the authentication process.

[0045] In this embodiment, the priority of personal account permission policies in the personal account permission policy list is higher than that of enterprise project permission policies in the enterprise project permission policy list. That is, when personal account permissions and enterprise project permissions conflict (i.e., a user has different permission settings for the same operation under their personal account and under an enterprise project), the system will prioritize the settings in the personal account permission policy list. This priority setting ensures that the user's personalized permission settings under their personal account are respected and executed with priority.

[0046] For example, if a user sets permission to deny this operation under their personal account, but allows this operation under the enterprise project to which the user belongs, a permission conflict will occur. Since the priority of the personal account permission policy is higher than that of the enterprise project permission policy in this invention, when a permission conflict occurs, it can be determined that the user has denied permission for this operation, and thus access will be denied.

[0047] As examples, the lists of permission policies for individual accounts and enterprise projects can be designed based on a pre-defined policy structure model. For instance... Figure 2 The pre-defined policy structure model can include a policy version number (Version) and a list of policy authorization statements (Statement). A policy version number represents a policy, and a policy can include a list of policy authorization statements consisting of multiple policy authorization statements.

[0048] The policy authorization statement contains basic elements: action, permission set, resource path, and conditions. In other words, a policy authorization statement contains the action and permission set of the policy authorization statement. The policy authorization statement can be composed of permission set (Action) and action (Effect). The permission set consists of triples, such as "ecs:cloudServers:create", where ecs represents the product, cloudServers represents the resource type, and create represents the operation. The action includes two types: Allow and Deny.

[0049] In some examples, a policy can contain multiple policy authorization statements. When verifying user policy permissions, the multiple policy authorization statements within the policy will be verified. If there are permission conflicts among the policy authorization statements, the policy can be rejected first.

[0050] In some embodiments of the present invention, a preset personal account permission model and an enterprise project permission model are invoked to perform a composite verification of personal account permissions and enterprise project permissions on the target operation request. This includes: invoking the preset personal account permission model to perform personal account permission verification on the target operation request and obtaining a personal account permission verification result; if the personal account permission verification result indicates that the personal account permission policy list has a personal account permission policy that matches the target operation request, then the personal account permission verification result is determined as the composite verification result; if the personal account permission verification result indicates that the personal account permission policy list does not have a personal account permission policy that matches the target operation request, then the preset enterprise project permission model is invoked to perform enterprise project permission verification on the target operation request, obtaining an enterprise project permission verification result, and then the enterprise project permission verification result is determined as the composite verification result.

[0051] In practical applications, when the system receives a request for a target operation, it first invokes a pre-set personal account permission model to check whether the personal account initiating the request has the necessary permissions to execute the operation. The personal account permission verification result indicates whether a personal account permission policy matching the target operation request exists in the personal account permission policy list. If the verification result shows that a personal account permission policy matching the target operation request exists in the personal account permission policy list, then the personal account has the permission to execute the operation. In this case, the system directly determines the personal account permission verification result as the result of the composite verification, without further verification.

[0052] If the personal account permission verification result shows that no personal account permission policy matching the target operation request is set in the personal account permission policy list, further inspection is required. The system can call the enterprise project permission model to further verify whether the operation request falls within the permission scope of a certain enterprise project, so as to determine whether the operation falls within the authorized operation scope of a certain enterprise project.

[0053] For example, if the personal account permission verification fails (i.e., there is no matching personal account permission policy), but the enterprise project permission verification result shows that the operation falls within the authorization scope of a certain enterprise project, then the operation request is also allowed. In this case, the system will determine the enterprise project permission verification result as the result of the composite verification.

[0054] like Figure 3 The flowchart shown is for composite verification:

[0055] [1] Determine whether the user is a primary user or in the primary user group. If yes, jump to [5], otherwise go to [2].

[0056] [2] Determine IAM permissions (determine personal account permissions). If IAM permissions impose constraints on specific operations or resources, proceed to [3], otherwise proceed to [4].

[0057] [3] Decision: If allowed, proceed to [5]; if rejected, proceed to [6].

[0058] [4] Determine enterprise project permissions (determine EP permissions), the specific determination process is as follows: Figure 5 If permitted, proceed to [5]; if refused, proceed to [6].

[0059] [5] Allows user operation.

[0060] [6] Deny user action.

[0061] The primary user refers to a user who has full access to the resources they own, including the ability to reset user passwords and assign user permissions. If multiple users need to share resources, sub-users can be created for daily management to ensure account security.

[0062] Sub-users are created in the user center by users with IAM privileges. The username and password of the sub-user are controlled by the user with IAM privileges. Sub-users can also log in and access the resource console; the login entry is the same as the primary user, and they are subject to the permissions granted to them.

[0063] A user group refers to a collection of users. IAM can use user groups to authorize users. When an IAM user is created and joined to a specific user group, they will have the permissions of that user group. When a user is joined to multiple user groups, that user will have the permissions of all the user groups simultaneously, that is, the complete set of permissions of the multiple user groups.

[0064] In some embodiments of the present invention, a preset personal account permission model is invoked to perform personal account permission verification on the target operation request, and a personal account permission verification result is obtained, including:

[0065] When the target operation request is a request for the target resource pool, the personal account permission policy of the target resource pool is selected from the list of personal account permission policies; the preset personal account permission model is invoked, and the personal account permission policy of the target resource pool is used to perform personal account permission verification on the target operation request, and the personal account permission verification result is obtained.

[0066] In practical applications, cloud service providers can use resource pools to provide virtual machines and storage services, allowing customers to dynamically acquire and release resources as needed. A resource pool refers to a set of resources that are centrally managed, allocated, and used; the target resource pool is determined based on the identifier of the target service product in the target user's operation request.

[0067] As examples, personal account permission policies for the target resource pool can be filtered from the list of personal account permission policies based on the identifier of the target service product in the target operation request; then, the pre-built personal account permission model is called, and the personal account permission policy of the target resource pool is used to perform personal account permission verification on the target operation request to obtain the personal account permission verification result.

[0068] In some embodiments of the present invention, a preset personal account permission model is invoked, and the personal account permission policy of the target resource pool is adopted to perform personal account permission verification on the target operation request to obtain a personal account permission verification result. This includes: when the target operation request is a request for a specified resource path, selecting the personal account permission policy for the specified resource path from the personal account permission policies of the target resource pool; invoking the preset personal account permission model, adopting the personal account permission policy for the specified resource path, and performing personal account permission verification on the target operation request to obtain a personal account permission verification result.

[0069] In some examples, if the target operation request is for a specific resource path (such as a specific file or database table), the system will first filter out the personal account permission policy for the target resource pool from the personal account permission policy list based on the identifier of the target service product in the target operation request, then filter out the permission policy related to this resource path from the personal account permission policy for the target resource pool, and then call the preset personal account permission model to perform the verification using the finally filtered permission policy related to the specified resource path to obtain the personal account permission verification result for the request for the specified resource path.

[0070] In some embodiments of the present invention, before invoking a preset personal account permission model, adopting a personal account permission policy for a specified resource path, verifying the personal account permission of the target operation request, and obtaining the personal account permission verification result, the method further includes: if the personal account permission policy for the specified resource path has an effective condition, determining whether the current state meets the effective condition; if the current state meets the effective condition, executing the invocation of the preset personal account permission model, adopting the personal account permission policy for the specified resource path, verifying the personal account permission of the target operation request, and obtaining the personal account permission verification result.

[0071] As examples, setting effective conditions for personal account permission policies for specified resource paths means that, in addition to defining which users can perform which operations on these resources, additional conditions are set for the permission policies to take effect. These conditions can be time-related (e.g., only valid on weekdays), environment-related (e.g., only valid on the company intranet), or any other custom conditions.

[0072] Before performing permission verification, the system checks whether the current status (such as current time, current network environment, current user status, etc.) meets the effective conditions defined in the permission policy. After confirming that the effective conditions are met, the system calls the preset personal account permission model and uses the personal account permission policy of the specified resource path to perform permission verification on the target operation request, generating a permission verification result indicating whether the user has permission to execute the operation.

[0073] As shown in Example 1, suppose a non-primary user and not in the primary user group has a userId of "123" and makes an operation request of "ctiam(product ID):user:query" on November 8, 2023. The following is the data structure of the user's permission policy for the target resource pool:

[0074]

[0075] "Action":[ / / The content of Action is a set of permission triples. The first element of the triple is the product code, corresponding to the entire product line. The second element is the operation group defined by the product, such as user for user attribute operations. The third element is the specific operation content, such as query for querying. Combined, ctiam:user:query means having the permission to query users.

[0076]

[0077] "Condition":{ / / Condition is the condition for the permission to take effect, StringEquals is the key of the condition, marked as the operation operator, the value of UserId is "123", which means that this permission will only take effect for the user with userId 123, and DateGreaterThan means that the permission will only take effect after midnight on November 7, 2023.

[0078]

[0079] "Effect":"Allow", / / Effect specifies the specific effect of the permission. Allow means permission is granted. If Effect is Deny, then permission is denied, meaning that the user with userId 123 does not have permission to query users after midnight on November 7, 2023.

[0080]

[0081] "Version":"1.1" / / This is the version number of the policy. The policy specification will be continuously updated.

[0082]

[0083] "regionId":"global" / / This is a global-level permission and does not apply to a specific resource pool.

[0084]

[0085] In the data structure of Example 1 above, the policy version number is 1.1. The user's personal account permission policy iamPolicyList contains one iam personal account policy. The policyContent contains the specific content of the policy. The effect of the policy is Allow. The Action contains three items, which respectively mean querying a single user, getting user details, and viewing all users under the account. The resource in the policy is global, which means wildcard access to all resource paths (Resource Name RN). The Action can also include the identifier of the target service product.

[0086] Perform permission verification on the user described in Example 1, such as... Figure 4 It can include:

[0087] [1] Get Request (Get Target Operation Request).

[0088] [2] Determine whether you have resource-level permissions. If yes, proceed [3], otherwise proceed [4].

[0089] [3] Obtain the resource pool corresponding to the resource.

[0090] [4] Filter the IAM permission policy (personal account permission policy) of the corresponding resource pool.

[0091] [5] Determine if it is a specified resource path. If yes, proceed to [6], otherwise proceed to [7].

[0092] [6] Filter the permission content corresponding to the resource path.

[0093] [7] Determine whether the specified conditions are met. If yes, proceed [8], otherwise proceed [9].

[0094] [8] Check if the condition is met. If yes, proceed [9], otherwise proceed

[11] .

[0095] [9] Parse the permission content into a set of allow and deny permissions, parse and verify the permission content, if allow, proceed

[10] , if deny, proceed

[11] , if they do not match, proceed

[12] .

[0096]

[10] Allows user operation.

[0097]

[11] User operation rejected, permission error returned.

[0098]

[12] Perform enterprise project permission judgment (call the preset enterprise project permission model to perform enterprise project permission verification on the target operation request).

[0099] Based on the data structure of the user's personal account permission policy for the target resource pool in Example 1, it can be seen that the user is not a primary user and is not under the primary user group. Therefore, personal account permission verification is performed, and the corresponding process is as follows: Figure 4 Since the region ID (a unique identifier used to identify the region where the cloud service is located) in the user's configured permission policy is global (global, overall resource), it is not a resource-level permission. The process is called to determine whether a resource path is specified. Since the Resource in the user's permission is "*", it means that all resource paths are matched, so any resource path request will pass the verification. Since there are conditional settings in the user's personal permissions, condition verification will be performed at this time. The set condition restriction will only take effect if the user with userId "123" operates after 0:00 on November 7, 2023. If the current status matches the condition, the condition verification will pass.

[0100] After the condition verification passes, it verifies whether the requested action matches the set action and verifies the permission effect. Since the effect is set to Allow in the embodiment and the requested action "ctiam:user:query" matches the setting, it is Allowed when performing IAM personal account permission verification, and this is taken as the personal account permission verification result.

[0101] In some embodiments of the present invention, a preset enterprise project permission model is invoked to perform enterprise project permission verification on the target operation request, and the enterprise project permission verification result is obtained, including:

[0102] When the target operation request is for a target resource pool, the first and second enterprise project permission policies for the target resource pool are selected from the enterprise project permission policy list. The first enterprise project permission policy includes enterprise project permission policies that indicate whether user operation is allowed, and the second enterprise project permission policy includes enterprise project permission policies that indicate whether user operation is denied. A preset enterprise project permission model is invoked, and the first and second enterprise project permission policies are used to perform enterprise project permission verification on the target operation request to obtain the enterprise project permission verification result.

[0103] As examples, an enterprise project permission policy list is a collection of multiple enterprise project permission policies. Each policy defines which users or user groups are authorized to perform which operations on which resources. These policies are used to control and manage access to and use of resources within the enterprise.

[0104] The first enterprise project permission policy includes enterprise project permission policies that allow users to perform operations. In other words, these policies explicitly specify which users or user groups are authorized to perform the requested operations on the target resource pool.

[0105] The second type of enterprise project permission policy includes policies that deny users the right to perform operations. In other words, these policies specify which users or user groups are explicitly prohibited from performing the requested operations on the target resource pool.

[0106] If the target operation request is for a target resource pool, and the personal account permission verification result indicates that the personal account permission policy list does not have a personal account permission policy that matches the target operation request, a preset enterprise project permission model can be invoked. From the enterprise project permission policy list set in the enterprise project permission model, the first enterprise project permission policy and the second enterprise project permission policy for the target resource pool can be selected. The first enterprise project permission policy and the second enterprise project permission policy are then used to perform enterprise project permission verification on the target operation request to obtain the enterprise project permission verification result.

[0107] As in Example 2, suppose a non-primary user, not in the primary user group, has a userId of "123" and makes an operation request "ctiam:user:query" on November 8, 2023. The following is the data structure of the user's permission policy for the target resource pool:

[0108] {

[0109] "data":{

[0110] "returnObj":{

[0111] "epPolicyList":[

[0112] {

[0113] "epId":"4ca496c5c5014bf787f2ad409c208e4e", / / Enterprise project ID, meaning that this permission is only effective under a specific enterprise project.

[0114]

[0115] "Effect":"Deny", / / Effect is the specific manifestation of the permission taking effect, Allow means permission is allowed, and if Effect is Deny, then permission is denied.

[0116]

[0117] "Version":"1.1" / / This is the version number of the policy. The policy specification will be continuously updated.

[0118]

[0119] "regionId":"global" / / This is a global-level permission and does not apply to a specific resource pool.

[0120]

[0121] "Action":[ / / The content of Action is a set of permission triples. The first element of the triple is the product code, which corresponds to the specific product permission. The second element is the operation group defined by the product, such as user for user attribute operations. The third element is the specific operation content, such as query for querying. Combined, ctiam:user:query means having the permission to query users.

[0122]

[0123] "Condition":{ / / Condition is the condition for the permission to take effect, StringEquals is the key of the condition, marked as the operation operator, the value of UserId is "123", which means that this permission will only take effect for the user with userId 123, and DateGreaterThan means that the permission will only take effect after midnight on November 7, 2023.

[0124]

[0125] "Effect":"Allow", / / Effect specifies the specific effect of the permission. Allow means permission is granted. If Effect is Deny, then permission is denied, meaning that the user with userId 123 does not have permission to query users after midnight on November 7, 2023.

[0126]

[0127] In the data architecture of Example 2 above, the policy version number is 1.1. The user's enterprise project policy epPolicyList contains one enterprise project policy, and policyContent contains the specific content of the policy. This enterprise project policy contains a policy authorization statement. The effect of the statement is Deny, and the action contains three options: querying a single user, retrieving user details, and viewing all users under this account. The resource in policy authorization statement 1 is global, meaning it applies to all resource paths. In addition, the user also has a personal account policy iamPolicyList, which contains a policy authorization statement with the Effect set to Allow. This means that the policy authorization statement allows the Action set within it. The Action sets two operation request sets: "ctiam:user:get" and "ctiam:user:list". The Resource is consistent with the enterprise project. There are two Conditions set, which mean that the policy will only take effect when the UserId of the user using this policy is 123 and the usage time is after 00:00 on November 7, 2023.

[0128] Perform permission verification on the user described in Example 2, such as... Figure 4 It can include:

[0129] [1] Get Request (Get Target Operation Request).

[0130] [2] Determine whether you have resource-level permissions. If yes, proceed [3], otherwise proceed [4].

[0131] [3] Obtain the resource pool corresponding to the resource.

[0132] [4] Filter the IAM permission policy (personal account permission policy) of the corresponding resource pool.

[0133] [5] Determine if it is a specified resource path. If yes, proceed to [6], otherwise proceed to [7].

[0134] [6] Filter the permission content corresponding to the resource path.

[0135] [7] Determine whether the specified conditions are met. If yes, proceed [8], otherwise proceed [9].

[0136] [8] Check if the condition is met. If yes, proceed [9], otherwise proceed

[11] .

[0137] [9] Parse the permission content into a set of allow and deny permissions, parse and verify the permission content, if allow, proceed

[10] , if deny, proceed

[11] , if they do not match, proceed

[12] .

[0138]

[10] Allows user operation.

[0139]

[11] User operation rejected, permission error returned.

[0140]

[12] Perform enterprise project permission judgment (call the preset enterprise project permission model to perform enterprise project permission verification on the target operation request).

[0141] Since the region ID (a unique identifier used to identify the region where the cloud service is located) in the user's configured permission policy is global, it is not a resource-level permission. It is necessary to determine whether a resource path is specified. Since the Resource in the user's permissions is "*", it means that all resource paths are matched, so any resource path request will pass the verification. Since there are conditional settings in the user's personal permissions, condition verification will be performed at this time. The set condition restriction will only take effect if the user with userId "123" operates after 0:00 on November 7, 2023. If the current status matches the condition, the condition verification will pass.

[0142] After the condition validation passes, permission parsing and matching are performed. Because the Action (permission set) set for this policy does not specify the actual user request "ctiam:user:query", the validation result returns a mismatch. Then, enterprise project permission checks are performed, such as... Figure 5 It can include:

[0143] [1] Determine the enterprise's project permissions.

[0144] [2] Determine whether it is a resource-level permission (determine whether the target operation request is a request for the target resource pool). If yes, proceed [3]. Otherwise, determine whether it matches the strategy in [6] or [7].

[0145] [3] Obtain the enterprise project corresponding to the resource (obtain the list of enterprise project permission policies for the target resource pool).

[0146] [4] Filter the enterprise project policies of the corresponding enterprise projects (from the list of enterprise project permission policies, filter out the first enterprise project permission policy and the second enterprise project permission policy for the target resource pool).

[0147] [5] Parse the permission content into a set of allow and deny permissions.

[0148] [6] Match denial policy (second enterprise project permission policy), if it matches, proceed[9], if it does not match, proceed[7].

[0149] [7] Match the allowed policy (first enterprise project permission policy). If it matches, proceed [8], otherwise proceed [9].

[0150] [8] Allow the user to operate.

[0151] [9] User operation rejected, permission error returned.

[0152] When verifying the user's enterprise project permissions, since the regionId (a unique identifier used to identify the region where the cloud service is located) in the data architecture of the permission policy in Example 2 is set to global, it does not match the resource-level permission. The process then jumps to matching the denial policy. Since the request with the Action (permission set) of "ctiam:user:query" in the enterprise project permissions is set, and the Effect of the enterprise project is Deny, the matching result is to deny this request operation. Therefore, the enterprise project permission verification result is returned as Deny.

[0153] Step 103: Respond to the target operation request based on the result of the composite verification.

[0154] After invoking the pre-defined personal account permission model and enterprise project permission model, the system performs a combined validation of personal account permissions and enterprise project permissions on the target operation request. Based on the validation result, the system can respond accordingly. If the validation passes, the system may execute the operation specified in the request and return a successful result or related data. If the validation fails, the system may refuse to execute the request and return an error message or prompt the user that they do not have data access permissions.

[0155] In this embodiment of the invention, the target user's target operation request for the target service product is obtained; a pre-set personal account permission model and enterprise project permission model are invoked to perform a composite verification of personal account permissions and enterprise project permissions on the target operation request; the personal account permission model has a personal account permission policy list, and the enterprise project permission model has an enterprise project permission policy list, with the priority of personal account permission policies in the personal account permission policy list being higher than the priority of enterprise project permission policies in the enterprise project permission policy list; based on the result of the composite verification, the target operation request is responded to, realizing refined permission verification and response for the target user's operation request for the target service product. By comprehensively considering personal account permissions and enterprise project permissions to perform composite verification and setting priorities, the flexibility and security of permission management are ensured, which helps prevent unauthorized access and operation, while improving user experience and system security.

[0156] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0157] Reference Figure 6 The diagram illustrates the structure of a user permission verification device based on cloud services according to some embodiments of the present invention, which may specifically include the following modules:

[0158] The operation request acquisition module 601 is used to acquire the target user's target operation request for the target service product;

[0159] The composite verification module 602 is used to call the preset personal account permission model and enterprise project permission model to perform composite verification of personal account permissions and enterprise project permissions on the target operation request; the personal account permission model is set with a personal account permission policy list, and the enterprise project permission model is set with an enterprise project permission policy list. The priority of personal account permission policies in the personal account permission policy list is higher than the priority of enterprise project permission policies in the enterprise project permission policy list.

[0160] The request-response module 603 is used to respond to the target operation request based on the result of the composite verification.

[0161] In some embodiments of the present invention, the composite verification module 602 is used for:

[0162] The pre-defined personal account permission model is invoked to perform personal account permission verification on the target operation request and obtain the personal account permission verification result.

[0163] If the personal account permission verification result indicates that the personal account permission policy list has a personal account permission policy that matches the target operation request, the personal account permission verification result will be determined as the result of the composite verification.

[0164] If the personal account permission verification result indicates that the personal account permission policy list does not have a personal account permission policy that matches the target operation request, the preset enterprise project permission model is invoked to perform enterprise project permission verification on the target operation request, and the enterprise project permission verification result is obtained and determined as the result of the composite verification.

[0165] In some embodiments of the present invention, a preset personal account permission model is invoked to perform personal account permission verification on the target operation request, and a personal account permission verification result is obtained, including:

[0166] If the target operation request is a request for the target resource pool, filter out the personal account permission policies for the target resource pool from the personal account permission policy list;

[0167] The pre-defined personal account permission model is invoked, and the personal account permission policy of the target resource pool is adopted to perform personal account permission verification on the target operation request, and the personal account permission verification result is obtained.

[0168] In some embodiments of the present invention, a preset personal account permission model is invoked, and the personal account permission policy of the target resource pool is adopted to perform personal account permission verification on the target operation request, thereby obtaining the personal account permission verification result, including:

[0169] When the target operation request is a request for a specified resource path, filter out the personal account permission policies for the specified resource path from the personal account permission policies of the target resource pool;

[0170] The system invokes a pre-defined personal account permission model, adopts a personal account permission policy for a specified resource path, performs personal account permission verification on the target operation request, and obtains the personal account permission verification result.

[0171] In some embodiments of the present invention, the apparatus further includes:

[0172] The condition judgment module is used to determine whether the current status meets the effective conditions if the personal account permission policy settings for the specified resource path have effective conditions.

[0173] The execution module is used to execute and call the preset personal account permission model when the current state meets the effective conditions, adopt the personal account permission policy of the specified resource path, perform personal account permission verification on the target operation request, and obtain the personal account permission verification result.

[0174] In some embodiments of the present invention, a preset enterprise project permission model is invoked to perform enterprise project permission verification on the target operation request, and the enterprise project permission verification result is obtained, including:

[0175] When the target operation request is a request for the target resource pool, the first enterprise project permission policy and the second enterprise project permission policy for the target resource pool are filtered from the enterprise project permission policy list; wherein, the first enterprise project permission policy includes an enterprise project permission policy for indicating that the user is allowed to operate, and the second enterprise project permission policy includes an enterprise project permission policy for indicating that the user is denied to operate.

[0176] The pre-defined enterprise project permission model is invoked, and the first and second enterprise project permission policies are adopted to perform enterprise project permission verification on the target operation request, and the enterprise project permission verification result is obtained.

[0177] In some embodiments of the present invention, the target operation request carries the identifier of the target user, the identifier of the target service product, and user operation information.

[0178] Some embodiments of the present invention also provide an electronic device, including a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the method described above.

[0179] Some embodiments of the present invention also provide a computer-readable storage medium on which a computer program is stored, and which, when executed by a processor, implements the method described above.

[0180] Some embodiments of the present invention also provide a computer program product, including a computer program that, when executed by a processor, implements the method described above.

[0181] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0182] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0183] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0184] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0185] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0186] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0187] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0188] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present invention.

[0189] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes the aforementioned element.

[0190] The above provides a detailed description of the user permission verification method, apparatus, device, and medium based on cloud services. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for user permission verification based on cloud services, characterized in that, The cloud service includes multiple service products, and the method includes: Obtain the target user's target operation request for the target service product; The system invokes a pre-defined personal account permission model and an enterprise project permission model to perform a combined verification of personal account permissions and enterprise project permissions on the target operation request. The personal account permission model has a personal account permission policy list, and the enterprise project permission model has an enterprise project permission policy list. The priority of personal account permission policies in the personal account permission policy list is higher than the priority of enterprise project permission policies in the enterprise project permission policy list. Based on the result of the composite verification, respond to the target operation request; The step of invoking the pre-set personal account permission model and enterprise project permission model to perform a composite verification of personal account permissions and enterprise project permissions on the target operation request includes: The preset personal account permission model is invoked to perform personal account permission verification on the target operation request, and the personal account permission verification result is obtained. If the personal account permission verification result indicates that the personal account permission policy list has a personal account permission policy that matches the target operation request, the personal account permission verification result is determined as the result of the composite verification. If the personal account permission verification result indicates that the personal account permission policy list does not have a personal account permission policy that matches the target operation request, a preset enterprise project permission model is invoked to perform enterprise project permission verification on the target operation request, and the enterprise project permission verification result is obtained and determined as the result of the composite verification.

2. The method according to claim 1, characterized in that, The step of invoking a pre-set personal account permission model to perform personal account permission verification on the target operation request and obtaining the personal account permission verification result includes: If the target operation request is a request for a target resource pool, then the personal account permission policy for the target resource pool is selected from the list of personal account permission policies. The preset personal account permission model is invoked, and the personal account permission policy of the target resource pool is adopted to perform personal account permission verification on the target operation request, and the personal account permission verification result is obtained.

3. The method according to claim 2, characterized in that, The process of invoking the pre-set personal account permission model and employing the personal account permission policy of the target resource pool to perform personal account permission verification on the target operation request, and obtaining the personal account permission verification result, includes: If the target operation request is a request for a specified resource path, the personal account permission policy for the specified resource path is selected from the personal account permission policies of the target resource pool. The preset personal account permission model is invoked, and the personal account permission policy of the specified resource path is used to perform personal account permission verification on the target operation request, thereby obtaining the personal account permission verification result.

4. The method according to claim 3, characterized in that, Before invoking the preset personal account permission model, applying the personal account permission policy of the specified resource path, performing personal account permission verification on the target operation request, and obtaining the personal account permission verification result, the method further includes: If the personal account permission policy settings for the specified resource path have effective conditions, determine whether the current state meets the effective conditions; If the current state meets the aforementioned effective conditions, the preset personal account permission model is invoked, and the personal account permission policy of the specified resource path is used to perform personal account permission verification on the target operation request, thereby obtaining the personal account permission verification result.

5. The method according to any one of claims 2 to 4, characterized in that, The step of invoking a pre-set enterprise project permission model to perform enterprise project permission verification on the target operation request and obtaining the enterprise project permission verification result includes: When the target operation request is a request for a target resource pool, the first enterprise project permission policy and the second enterprise project permission policy for the target resource pool are filtered from the enterprise project permission policy list; wherein, the first enterprise project permission policy includes an enterprise project permission policy for indicating that the user is allowed to operate, and the second enterprise project permission policy includes an enterprise project permission policy for indicating that the user is denied to operate. The preset enterprise project permission model is invoked, and the first enterprise project permission policy and the second enterprise project permission policy are used to perform enterprise project permission verification on the target operation request to obtain the enterprise project permission verification result.

6. The method according to claim 1, characterized in that, The target operation request carries the identifier of the target user, the identifier of the target service product, and user operation information.

7. A device for user permission verification based on cloud services, characterized in that, The cloud service includes multiple service products, and the device includes: The operation request acquisition module is used to acquire the target user's target operation request for the target service product; The composite verification module is used to call the preset personal account permission model and enterprise project permission model to perform composite verification of personal account permissions and enterprise project permissions on the target operation request; the personal account permission model is set with a personal account permission policy list, and the enterprise project permission model is set with an enterprise project permission policy list, wherein the priority of personal account permission policies in the personal account permission policy list is higher than the priority of enterprise project permission policies in the enterprise project permission policy list. The request-response module is used to respond to the target operation request based on the result of the composite verification. The composite verification module is used for: The pre-defined personal account permission model is invoked to perform personal account permission verification on the target operation request and obtain the personal account permission verification result. If the personal account permission verification result indicates that the personal account permission policy list has a personal account permission policy that matches the target operation request, the personal account permission verification result will be determined as the result of the composite verification. If the personal account permission verification result indicates that the personal account permission policy list does not have a personal account permission policy that matches the target operation request, the preset enterprise project permission model is invoked to perform enterprise project permission verification on the target operation request, and the enterprise project permission verification result is obtained and determined as the result of the composite verification.

8. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, which, when executed by a processor, implements the method as described in any one of claims 1 to 6.

Images