Access control method and device

Abstract

The invention provides an access control method and device. The method comprises the steps of obtaining a first ACL configured for a first file, wherein the first file is a file under a first directory; when a second ACL consistent with the first ACL exists in the first ACL set and an identifier of the second ACL is recorded in the data table, the identifier of the second ACL recorded in the data table is included in metadata of the first file; receiving a first access request for the first file; obtaining a second ACL from the first ACL set based on the identifier of the second ACL in the metadata of the first file; and controlling the first access request based on the second ACL. According to the method, the data volume and storage overhead of the metadata of the file can be reduced.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an access control method and device. Background Art

[0002] Authentication is a basic function of the file system, which is used to ensure file security and to ensure the stable and efficient operation of the file system. Authentication refers to the use of the file's access control list (ACL) to control access requests to the file in order to deny or allow certain types of users or operations.

[0003] In the current file system, the ACL of a file is stored as the file's metadata. The number of ACLs is large, which leads to a large amount of file metadata data and a large storage overhead. In addition, in the current file system, a file inherits the ACL of the directory where the file is located, that is, the ACL of the directory where the file is located is also included in the file's metadata, which further increases the file's metadata data volume and storage overhead. Summary of the invention

[0004] The present application provides an access control method and device, which can reduce the data volume and storage overhead of file metadata.

[0005] In a first aspect, an access control method is provided, wherein a first directory corresponds to a data table and a first access control list (ACL) set; wherein the first ACL set includes an ACL related to the first directory, and identifiers of all or part of the ACLs in the first ACL set are recorded in the data table; the method includes: obtaining a first ACL configured for a first file, where the first file is a file under the first directory; when a second ACL consistent with the first ACL exists in the first ACL set, and the identifier of the second ACL is recorded in the data table, including the identifier of the second ACL recorded in the data table into metadata of the first file; receiving a first access request for the first file; obtaining the second ACL from the first ACL set based on the identifier of the second ACL in the metadata of the first file; and controlling the first access request based on the second ACL.

[0006] The ACL related to the first directory refers to the ACL of the first directory itself and / or the ACL of files under the first directory.

[0007] In this implementation, by using a data table, files in the same directory and the directory can share an ACL. For files in the same directory and the same ACL for the directory, only one copy of the ACL needs to be stored, saving storage resources. In addition, including the ACL identifier in the file's metadata can reduce the amount of metadata data for the file, saving storage resources.

[0008] In a possible implementation, the method further includes: when the identifier of the ACL recorded in the data table is different from the identifier of the first ACL, adding the first ACL to the first ACL set and including the identifier of the first ACL in the metadata of the first file; receiving a second access request for the first file; obtaining the first ACL from the first ACL set based on the identifier of the first ACL in the metadata of the first file; and controlling the second access request based on the first ACL.

[0009] In this implementation, the identifier of the ACL of the file can be included in the metadata of the file, which can reduce the data volume of the metadata of the file and save storage resources.

[0010] In a possible implementation manner, the method further includes: recording the identifier of the first ACL in a data table.

[0011] In this implementation, the identifier of the first ACL is recorded in the data table, so that the first ACL is called a shareable ACL in the first directory. When the ACL configured for other files in the first directory is consistent with the first ACL, the first ACL can be used to control access requests for the file, thereby saving storage resources while implementing the access control function.

[0012] In a possible implementation, the method further includes: when deleting the first directory, deleting the data table, and deleting the ACL represented by the identifier of the ACL recorded in the data table.

[0013] In this implementation, when the first directory is deleted, the data table and the related ACL are deleted at the same time. Thus, the related data table and ACL can be deleted without the user issuing a special delete operation for the data table and ACL, thereby improving the deletion efficiency.

[0014] In a possible implementation, the first directory also includes a second file, the metadata of the second file includes a first identifier of a third ACL, and the first identifier of the third ACL is recorded in a data table; the method also includes: creating a third file related to the second file in the second directory, the second directory corresponds to a second ACL set; including the second identifier of the third ACL into the metadata of the third file, and adding a copy of the third ACL to the second ACL set; wherein the second identifier represents a copy of the third ACL, and the second identifier is not in the data table; receiving a third access request for the third file; obtaining a copy of the third ACL from the second ACL set based on the second identifier in the metadata of the third file; and controlling the third access request based on the copy of the third ACL.

[0015] In this implementation, the second identifier of the third ACL is specially configured for the files related to the second file to represent the copy of the third ACL. In this way, when the ACL represented by the first identifier is deleted due to the deletion of the first identifier of the third ACL, the copy of the third ACL is guaranteed not to be deleted, thereby ensuring the access control function for the files related to the second file.

[0016] In a possible implementation, the method further includes: calculating a mapping value of the first ACL; and when the mapping value of the first ACL is consistent with the mapping value of the second ACL, comparing the first ACL and the second ACL to identify whether the first ACL and the second ACL are consistent.

[0017] In this implementation, the mapping values ​​of the ACLs may be compared first, and if the mapping values ​​are consistent, the ACLs may be compared, thereby improving the efficiency of identifying whether the ACLs are consistent.

[0018] In a second aspect, an access control device is provided, wherein a first directory corresponds to a data table and a first ACL set; wherein the first ACL set includes an ACL related to the first directory, and identifiers of all or part of the ACLs in the first ACL set are recorded in the data table; the device includes: a first acquisition module, used to acquire a first ACL configured for a first file, the first file being a file under the first directory; an inclusion module, used to include the identifier of the second ACL recorded in the data table into the metadata of the first file when there is a second ACL consistent with the first ACL in the first ACL set and the identifier of the second ACL is recorded in the data table; a receiving module, used to receive a first access request for the first file; a second acquisition module, used to acquire the second ACL from the first ACL set based on the identifier of the second ACL in the metadata of the first file; and a control module, used to control the first access request based on the second ACL.

[0019] In a possible implementation, the inclusion module is further used to: when the identifier of the ACL recorded in the data table is different from the identifier of the first ACL, add the first ACL to the first ACL set, and include the identifier of the first ACL in the metadata of the first file; the receiving module is further used to: receive a second access request for the first file; the second acquisition module is further used to: based on the identifier of the first ACL in the metadata of the first file, obtain the first ACL from the first ACL set; the control module is further used to: control the second access request based on the first ACL.

[0020] In a possible implementation manner, the inclusion module is further configured to: record the identifier of the first ACL in a data table.

[0021] In a possible implementation manner, the control module is further configured to: when deleting the first directory, delete the data table, and delete the ACL represented by the identifier of the ACL recorded in the data table.

[0022] In a possible implementation, the first directory also includes a second file, the metadata of the second file includes a first identifier of a third ACL, and the first identifier of the third ACL is recorded in a data table; the first acquisition module is also used to: create a third file related to the second file in the second directory, and the second directory corresponds to a second ACL set; the inclusion module is also used to: include the second identifier of the third ACL into the metadata of the third file, and add a copy of the third ACL to the second ACL set; wherein the second identifier represents a copy of the third ACL, and the second identifier is not in the data table; the receiving module is also used to: receive a third access request for the third file; the second acquisition module is also used to: obtain a copy of the third ACL from the second ACL set based on the second identifier in the metadata of the third file; the control module is also used to: control the third access request based on the copy of the third ACL.

[0023] In a possible implementation, the module is further used to: calculate a mapping value of the first ACL; and when the mapping value of the first ACL is consistent with the mapping value of the second ACL, compare the first ACL and the second ACL to identify whether the first ACL and the second ACL are consistent.

[0024] In a third aspect, a computing device cluster is provided, comprising at least one computing device, each computing device comprising a processor and a memory; the processor of at least one computing device is used to execute instructions stored in the memory of at least one computing device, so that the computing device cluster performs the method provided in the first aspect.

[0025] In a fourth aspect, a computer-readable storage medium is provided, comprising computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the method provided in the first aspect.

[0026] According to a fifth aspect, a computer program product comprising instructions is provided. When the instructions are executed by a computer device cluster, the computer device cluster executes the method provided in the first aspect.

[0027] The beneficial effects of the second to fifth aspects can be referred to the above introduction to the beneficial effects of the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 It is a schematic diagram of a system architecture provided by an embodiment of the present application;

[0029] Figure 2is a schematic diagram of the structure of an access control device provided in an embodiment of the present application;

[0030] Figure 3 is a schematic diagram of an ACL set provided in an embodiment of the present application;

[0031] Figure 4 is a schematic diagram of a data table provided in an embodiment of the present application;

[0032] Figure 5 is a flow chart of an access control method provided by an embodiment of the present application;

[0033] Figure 6 is a schematic diagram of an access control method provided by an embodiment of the present application;

[0034] Figure 7 is a schematic diagram of an access control method provided by an embodiment of the present application;

[0035] Figure 8 is a schematic diagram of an access control method provided by an embodiment of the present application;

[0036] Fig. 9 is a schematic diagram of the structure of an access control device provided in an embodiment of the present application;

[0037] Fig.10 is a schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0038] Fig.11 is a schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application;

[0039] Fig.12 It is a structural diagram of a computing device cluster provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] The scheme provided by the embodiment of the present application will be described below in conjunction with the accompanying drawings. In the embodiment of the present application, "multiple" means two or more, and "multiple" means two or more. "First", "second", etc. are only used to distinguish similar objects and are not necessarily used to describe a specific order or number of objects.

[0041] To facilitate understanding of the solutions provided by the embodiments of the present application, the technical terms that may be involved in the embodiments of the present application are first introduced.

[0042] Access control list (ACL): refers to a list of rules for files or directories configured by users. ACL may include at least one routing information, and each routing information includes at least one rule. If the access request matches at least one rule of the routing information, it can be confirmed that the access request matches the routing information, that is, the routing information is hit. Among them, when at least one rule is multiple rules, there is a matching order between the multiple rules. When performing access control on the access request, according to the matching order, it is judged in turn whether the access request matches the multiple rules. In addition, access control based on ACL follows the "stop matching once hit" mechanism. Once the matching result that the access request matches a routing information is obtained, the matching is interrupted, and there is no need to judge whether the access request matches other routing information. Among them, if the ACL is a whitelist, when the access request does not match all routing information, the data packet is blocked from passing, that is, the access request is blocked from accessing the corresponding file or directory. Correspondingly, when the access request packet matches any routing information, the access request is allowed to pass, that is, the access request is allowed to access the corresponding file or directory. If the ACL is a blacklist, when the access request matches any routing information, the access request is blocked. Correspondingly, when the access request does not match any routing information, the access request is allowed.

[0043] Access request: refers to information used to request an operation to be performed on an object, such as creating an object, modifying the content or metadata of an object, or reading the content or metadata of an object. An object can be a file or a directory.

[0044] Persistent storage: also known as disk flushing, refers to storing data in memory to the hard disk to achieve permanent storage of data.

[0045] Object metadata: a type of data used to describe an object. An object can be a file, and the file metadata includes the file name, file identifier (ID), last modification time, size, directory, etc. An object can be a directory, and the directory metadata includes the directory name, directory ID, creation time, and the ID of the parent directory (i.e., parent directory).

[0046] Atomicity: It means that multiple operations are either all executed successfully or not executed at all, without partial execution.

[0047] Mapped value: refers to the mapping value corresponding to the object obtained by mapping the identifier of the object (such as the name of the object) according to a preset mapping algorithm (such as a hash range partitioning algorithm, a key range partitioning algorithm, etc.). The mapped value corresponding to the object may also be referred to as the mapped value of the object. The mapped value has a size and can be represented by a positive integer. When the mapping algorithm is a hash range partitioning algorithm, the mapped value may also be referred to as a hash value.

[0048] Mapping algorithm: refers to the algorithm that maps the key of an object to a mapping value. Common mapping algorithms include hash range partitioning algorithm, key range partitioning algorithm, etc.

[0049] Consistent hashing algorithm: A hash algorithm used to calculate the mapping value of an object, which belongs to the hash range partitioning algorithm. In an embodiment of the present application, the consistent hashing algorithm is an algorithm that performs hash calculation on the identifier (such as the name) of the object based on the total number of assignable mapping values, wherein the obtained hash value is used as the mapping value of the object. The commonly used consistent hashing algorithm is: taking the remainder based on the total number of assignable mapping values. For example, the name of the object is hashed, and the obtained hash value is divided by the total number of assignable mapping values, and the remainder obtained is used as the mapping value of the object.

[0050] As described above, the ACL includes at least one routing information, and each routing information includes at least one rule. Therefore, the data volume of the ACL is relatively large. In the related art, the ACL of a file is included in the metadata of the file, which increases the data volume of the metadata of the file. In addition, this technology also includes the ACL of the directory to which the file belongs into the metadata of the file, which further increases the data volume of the metadata of the file. In order to avoid metadata loss, the metadata of the file is persistently stored. The data volume of the metadata is large, resulting in a large overhead of persistent storage resources. In addition, in order to improve the access efficiency of the file, the metadata of the file is usually cached. The data volume of the metadata is large, resulting in a large overhead of cache resources.

[0051] The embodiment of the present application provides an access control method. The access control method includes the ID of the file's ACL into the file's metadata, rather than including the file's ACL into the file's metadata. The data volume of the ACL ID is much smaller than the data volume of the ACL. Therefore, the data volume of the file's metadata is greatly reduced, saving storage resources. In addition, files in the same directory and the directory can share the ACL. For files in the same directory and the same ACL of the directory, only one copy of the ACL needs to be stored, which further saves storage resources.

[0052] Next, the access control method provided in the embodiment of the present application is described.

[0053] Figure 1 A system architecture that can be used to implement the method is shown. The system architecture may include a user, an access control device 100, and a directory 200. The directory 200 may contain at least one file, such as a file 230, a file 240, a file 250, etc. The directory 200 corresponds to a data table 210 and an ACL set 220. The ACL set 220 may be referred to as a first ACL set.

[0054] ACL set 220 refers to a set of ACLs related to directory 200, that is, ACL set 220 includes ACLs related to directory 200, or in other words, ACLs related to directory 200 constitute ACL set 220. In some embodiments, directory-related ACLs refer to the ACL of the directory itself and the ACLs of the files under the directory. That is, the ACL of the directory itself and the ACLs of the files under the directory both belong to directory-related ACLs. In some embodiments, directory-related ACLs refer to the ACLs of the files under the directory.

[0055] The ACL of a directory refers to the ACL used to control access requests to the directory, and the ACL of a file refers to the ACL used to control access requests to the file. Files under a directory refer to files located in the directory.

[0056] Each ACL has an identifier, where the identifiers of different ACLs are different. For example, the identifier of ACL1 is identifier A1, the identifier of ACL2 is identifier A2, and the identifier of ACL3 is identifier A4. Exemplarily, the identifier of ACL can be the ID of ACL.

[0057] In some embodiments, a portion of the ACLs in the ACL set 220 are shareable ACLs, and another portion of the ACLs are exclusive ACLs. The shareable ACL refers to an ACL that can be shared by two or more objects in the directory 200, that is, the ACL is used to control access requests to any of the two or more objects in the directory 200. An exclusive ACL is used only to control access requests to the object to which the exclusive ACL belongs. The object in the directory 200 can be a file in the directory 200 or the directory 200 itself.

[0058] The data table 210 records the identifiers of all or part of the ACLs in the ACL set 220. In other words, the identifiers of all or part of the ACLs in the ACL set 220 are recorded in the data table 210. The ACL represented by the identifier recorded in the data table 210 is a subset of the ACL set 220. In other words, the ACL represented by the identifier recorded in the data table 210 is in the ACL set 220, the identifiers of the ACLs in the ACL set 220 are not necessarily recorded in the data table 210, and the identifiers of the ACLs that do not exist in the ACL set 220 are not recorded in the data table 210.

[0059] In some embodiments, as described above, a portion of the ACLs in the ACL set 220 are shareable ACLs, and another portion of the ACLs are exclusive ACLs. The data table 210 records the identifiers of the shareable ACLs in the ACL set 220, but does not record the identifiers of the exclusive ACLs in the ACL set 220. Among them, the data table 210 belongs to the metadata of the directory 200. In order to avoid the metadata of the directory 200 being too large, the capacity of the data packet 210 is limited. This results in that the data table 210 may not be able to accommodate all the relevant ACLs of the directory 200. Among them, the ACLs in the ACL set 220 that are identified and recorded in the data table 210 are shareable ACLs. Due to the full capacity of the data table 210 or other reasons, the identifiers of some ACLs in the ACL set 220 are not recorded in the data table 210, and the part of the ACL is an exclusive ACL.

[0060] In some embodiments, Figure 2 As shown, the ACL in the ACL set 220 can be stored in a key-value pair, wherein the key is the identifier of the ACL and the value is the ACL.

[0061] In some embodiments, Figure 3 As shown, data table 210 records the association between the identifier of the ACL and the mapping value of the ACL, for example, the association between the mapping value V1 of ACL1 and the identifier A1, the association between the mapping value V2 of ACL2 and the identifier A2, and the association between the mapping value V3 of ACL3 and the identifier A3.

[0062] The directory 200 and the files in the directory 200 can be stored in the cache or in the hard disk (ie, persistent storage). The data table 210 can be stored in the cache or in the hard disk. The ACL set 220 can be stored in the cache or in the hard disk.

[0063] The access control device 100 is used to manage the ACL related to the directory 200 and control the access request related to the directory 200 based on the ACL.

[0064] The access control device 100 may be any device, equipment, platform or cluster with data processing function, etc. In some embodiments, the access control device 100 may be a metadata server (MDS).

[0065] like Figure 4 As shown, the access control device 100 may include an acquisition module 110, a recording module 120, a receiving module 130, an acquisition module 140, and a control module 150. The acquisition module 110 may acquire an ACL (e.g., ACL3') configured for a file (e.g., file 250) in the directory 200. The recording module 120 may include the identifier of the ACL that is the same as ACL3' in the data table 210 into the metadata of the file 250 when the ACL that is the same as ACL3' exists in the ACL set 220. For the convenience of description, it may be assumed that the ACL that is the same as ACL3' that exists in the ACL set 220 is ACL3, that is, the identifier A3 is included in the metadata of the file 250. The receiving module 130 may receive an access request for the file 250. The acquisition module 140 may acquire ACL3 from the ACL set 220 based on the identifier A3 in the metadata of the file 250. The control module 150 may control the access request for the file 250 based on the ACL3 acquired by the acquisition module 140.

[0066] In an example of this embodiment, the recording module 120 may include a cache module 121 and a storage submodule 122. The cache module 121 may store the metadata of the file in the cache. The storage submodule 122 may store the metadata of the file in the hard disk to implement persistent storage of the metadata of the file.

[0067] In another example of this embodiment, the acquisition module 140 may include an index submodule 141. The index submodule 141 may identify ACL3 in the ACL set 220 based on the identifier A3 to acquire ACL3.

[0068] The above example introduces the system architecture provided by the embodiment of the present application. Next, taking the implementation in the system architecture as an example, the process of the access control method provided by the embodiment of the present application is introduced. Among them, the method is specifically executed by the access control device 100. Figure 5 As shown, the method includes the following steps.

[0069] Step 501 : The access control device 100 obtains a first ACL configured for a first file, where the first file is a file under the directory 200 .

[0070] Among them, files that are about to be created in directory 200, files that are being created in directory 200, and files that already exist in directory 200 can all be referred to as files under directory 200.

[0071] In some embodiments, the first file may be a file that the access control device 100 is about to create or is creating in the directory 200 , and the ACL configured for the first file is referred to as a first ACL.

[0072] In some embodiments, the first file may be any existing file in directory 200, such as file 250, file 240 or file 230. For the first file, the ACL may be modified or reconfigured, wherein the modified ACL or the reconfigured ACL is referred to as the first ACL.

[0073] In some embodiments, when creating directory 200, the ACL of directory 200 (i.e., the ACL of the directory itself) may be configured.

[0074] Step 502: When there is a second ACL consistent with the first ACL in the ACL set 220 and the identifier of the second ACL is recorded in the data table 210, the access control device 100 includes the identifier of the second ACL recorded in the data table 210 into the metadata of the first file. Exemplarily, two ACLs being consistent may mean that the two ACLs are the same.

[0075] As described above, the ACL represented by the identifier recorded in the data table 210 is in the ACL set 220. The data table 210 records the identifier of the second ACL, and the ACL set 220 includes the second ACL.

[0076] In some embodiments, as described above, a portion of the ACLs in the ACL set 220 are shareable ACLs, and another portion of the ACLs are exclusive ACLs. The second ACL is specifically a shareable ACL. The data table 210 records the identifier of the shareable ACL. In other words, when the shareable ACL of the ACL set 220 stores a second ACL that is consistent with the first ACL, in step 502, the access control device 100 can obtain the identifier of the second ACL from the data table 210.

[0077] In some embodiments, as described above, the data table 210 records the association between the identifier of the ACL and the mapping value of the ACL. The mapping value of the ACL is obtained by calculating the ACL according to a preset mapping algorithm. The access control device 100 can calculate the first ACL according to the preset mapping algorithm to obtain the mapping value of the first ACL. Then, the mapping value that is the same as the mapping value of the first ACL is queried in the data table 210. If the mapping value of the second ACL queried in the data table 210 is the same as the mapping value of the first ACL, the second ACL is obtained from the ACL set 220 using the identifier of the second ACL associated with the mapping value of the second ACL. Then, the first ACL and the second ACL are compared to identify whether the first ACL and the second ACL are consistent.

[0078] Exemplarily, comparing the first ACL and the second ACL means comparing the content of the first ACL and the content of the second ACL to identify whether the content of the first ACL and the content of the second ACL are consistent. In one example, the comparison can be byte by byte. If the content of the first ACL is consistent with the content of the second ACL, then the first ACL and the second ACL are consistent.

[0079] Step 503: The access control device 100 receives a first access request for the first file.

[0080] The user may issue an access request for the first file, and the access control device 100 may intercept the access request and authenticate the access request. For ease of description, the access request for the first file received in step 503 may be referred to as a first access request.

[0081] In some embodiments, the first access request may be a request for requesting an operation such as query, modification, writing or deletion.

[0082] Step 504: the access control device 100 obtains the second ACL from the ACL set 220 based on the identifier of the second ACL in the metadata of the first file.

[0083] As described above, the identifier of the second ACL is included in the metadata of the first file. When the first access request is received, the identifier of the second ACL can be obtained from the metadata of the first file, and the second ACL can be obtained from the ACL set 220 based on the identifier of the second ACL.

[0084] In some embodiments, if the cache has metadata of the first file, the identifier of the second ACL can be obtained from the metadata of the first file in the cache. If the cache does not have metadata of the first file, the identifier of the second ACL can be obtained from the metadata of the first file in persistent storage.

[0085] Step 505: The access control device 100 controls the first access request based on the second ACL.

[0086] In some embodiments, the second ACL may be a whitelist. When the first access request matches any rule in the second ACL, the first access request may be allowed, that is, the first access request passes authentication, and the operation requested by the first access request may be performed on the first file. When the first access request does not match any rule in the second ACL, the first access request is rejected, that is, the first access request does not pass authentication, and the operation requested by the first access request is rejected for the first file.

[0087] In some embodiments, the second ACL is a blacklist. When the first access request matches any rule in the second ACL, the first access request is rejected, that is, the first access request fails to pass authentication, and the operation requested by the first access request for the first file is rejected. When the first access request does not match all rules in the second ACL, the first access request is allowed, that is, the first access request passes authentication, and the operation requested by the first access request for the first file can be performed.

[0088] In some embodiments, Figure 5 As shown, the access control device 100 may further execute step 506, when the identifier of the ACL recorded in the data table 210 is different from the identifier of the first ACL, the first ACL is added to the ACL set 220, and the identifier of the first ACL is included in the metadata of the first file.

[0089] In an example of this embodiment, as described above, the data table 210 records the association between the identifier of the ACL and the mapping value of the ACL. The mapping value of the ACL is obtained by calculating the ACL according to a preset mapping algorithm. The access control device 100 can calculate the first ACL according to the preset mapping algorithm to obtain the mapping value of the first ACL. Then, the mapping value that is the same as the mapping value of the first ACL is queried in the data table 210. If the mapping value that is the same as the mapping value of the first ACL is not queried, it can be confirmed that there is no ACL that is the same as the first ACL in the ACL set 220.

[0090] In another example of this embodiment, as described above, a portion of the ACLs in the ACL set 220 are shareable ACLs, and another portion of the ACLs are exclusive ACLs. The second ACL is specifically a shareable ACL. The data table 210 records the identifier of the shareable ACL. The absence of an ACL identical to the first ACL in the ACL set 220 specifically means that: the absence of a shareable ACL identical to the first ACL in the ACL set 220.

[0091] In yet another example of this embodiment, in step 506, the access control device 100 may also record the identifier of the first ACL in the data table 210. Thus, the first ACL may become a shared ACL.

[0092] In one example of this embodiment, when the data table 210 has available capacity, the identifier of the first ACL is recorded in the data table 210. Figure 6 , taking the first file as file 260 as an example, the ACL of the first file can be set to ACL4, and the identifier of ACL4 is identifier A4. Figure 6As shown, when the identifier of the ACL recorded in the data table 210 is different from the identifier of the first ACL, and the data table 210 has available capacity, ACL4 can be added to the ACL set 220, the identifier A4 can be included in the metadata of the first file, and the identifier A4 can be recorded in the data table 210. Exemplarily, ACL4 can also be calculated according to a preset mapping algorithm to obtain a mapping value of ACL4, and then the association relationship between the identifier A4 and the mapping value of ACL4 is recorded in the data table 210.

[0093] In yet another example of this embodiment, when the data table 210 has available capacity, the first ACL is not recorded in the data table 210. In this case, the first ACL is an exclusive ACL for the first file. Figure 7 , taking the first file as file 260 as an example, the ACL of the first file can be set to ACL4, and the identifier of ACL4 is identifier A4. Figure 7 As shown, when the identifier of the ACL recorded in the data table 210 is different from the identifier of the first ACL, and the data table 210 has available capacity, ACL4 can be added to the ACL set 220, and the identifier A4 can be included in the metadata of the first file without recording the identifier A4 in the data table 210.

[0094] Continue reading Figure 5 The method further includes step 507, where the access control device 100 receives a second access request for the first file.

[0095] The user may issue an access request for the first file, and the access control device 100 may intercept the access request and authenticate the access request. For ease of description, the access request for the first file received in step 507 may be referred to as a second access request.

[0096] Exemplarily, the second access request may be a request for requesting operations such as query, modification, writing or deletion.

[0097] Step 508 : The access control device 100 obtains the first ACL from the ACL set 220 based on the identifier of the first ACL in the metadata of the first file.

[0098] As described above, the identifier of the first ACL is included in the metadata of the first file. When receiving the second access request, the identifier of the first ACL can be obtained from the metadata of the first file, and the first ACL can be obtained from the ACL set 220 based on the identifier of the first ACL.

[0099] Exemplarily, if the cache has metadata of the first file, the identifier of the second ACL can be obtained from the metadata of the first file in the cache. If the cache does not have metadata of the first file, the identifier of the second ACL can be obtained from the metadata of the first file in persistent storage.

[0100] In step 509, the access control device 100 controls the second access request based on the first ACL. The control of the access request based on the ACL is specifically implemented with reference to the above description of step 505, which will not be described in detail here.

[0101] In some embodiments, when the access control device 100 deletes a directory, it can also delete the data table corresponding to the directory and the ACL represented by the identifier of the ACL recorded in the data table. In other words, directory deletion triggers the deletion of the data table corresponding to the directory, and the deletion of the data table triggers the deletion of the ACL represented by the identifier of the ACL recorded in the data table. In this way, the relevant data tables and ACLs can be deleted without special deletion operations on the data tables and ACLs, thereby improving the deletion efficiency. In other words, when the access control device 100 deletes the directory 200, the access control device 100 spontaneously deletes the data table 210, and spontaneously deletes the ACL represented by the identifier recorded in the data table 210.

[0102] In an example of this embodiment, the directory 200 also includes a second file. The metadata of the second file includes a first identifier of a third ACL, and the first identifier of the third ACL is recorded in the data table 210. The access control device 100 can create a third file related to the second file in the directory 300, and the directory 300 corresponds to the second ACL set; the access control device 100 can configure a second identifier for the third ACL, wherein the second identifier is not in the data table 210; the second identifier is included in the metadata of the third file, and a copy of the third ACL is added to the second ACL set. When a file related to a file in the directory 200 is created in the directory 300, the ACL of the related file can be set as an exclusive ACL to avoid being affected by the deletion of the directory 200. In addition, the access control device 100 can receive a third access request for the third file; the access control device 100 can obtain a copy of the third ACL from the second ACL set based on the second identifier in the metadata of the third file; wherein the second identifier represents a copy of the third ACL; the access control device 100 can control the third access request based on the copy of the third ACL.

[0103] The second file is any file in the directory 200. Next, the second file is described by taking the file 250 as an example. The third ACL is ACL3, and the first identifier of ACL3 is identifier A3.

[0104] See also Figure 8 , it can be set to create a file 250' related to the file 250 in the directory 300. An identifier A3' can be configured for the file 250'. Among them, the identifier A3' is different from the identifier A3, and the identifier A3' is not in the data table 210. In addition, the directory 300 corresponds to the ACL set 310, and the relevant ACLs of the directory 300 constitute the second ACL set. The identifier A3' can be included in the metadata of the file 250', and a copy of ACL3 can be added to the second ACL set. Among them, the identifier A3' represents a copy of ACL3 in the ACL set 310. When an operation for the file 250' is received, the access control device 100 can obtain a copy of ACL3 from the second ACL set based on the identifier A3' in the metadata of the file 250'. Then, the access request is controlled based on the copy of the ACL3.

[0105] Exemplarily, the related files of a file may be a copy, a shortcut, etc. of the file. That is, file 250' may be a copy, a shortcut, etc. of file 250. A copy of a file is also called a copy of a file. Exemplarily, the related files of a file may be created by operations such as renaming or hard linking.

[0106] Exemplarily, directory 300 and directory 200 may be sub-directories of directory 400 , that is, directory 300 and directory 200 are located in directory 400 .

[0107] In some embodiments, as described above, ACL can be divided into a sharable ACL and an exclusive ACL. The deletion of a file can trigger the deletion of the exclusive ACL of the file. That is, when a file is deleted, the exclusive ACL of the file is automatically deleted.

[0108] The access control method provided by the embodiment of the present application can be applied to a variety of file systems. In some embodiments, directory 200 and / or directory 300 can be a directory in a common internet file system (CIFS), that is, the access control method provided by the embodiment of the present application can be applied to CIFS. In some embodiments, directory 200 and / or directory 300 can be a directory in a new technology file system (NTFS), that is, the access control method provided by the embodiment of the present application can be applied to NTFS.

[0109] In some embodiments, the ACL described above may be a new technology (NT) ACL. In some embodiments, the ACL described above may be a Posix ACL. In some embodiments, the ACL described above may be an NFSv4 ACL.

[0110] In summary, the access control method provided by the embodiment of the present application can reduce the amount of metadata data of the file and save storage resources. In addition, the files in the same directory and the directory can share the ACL. For the files in the same directory and the directory with the same ACL, only one copy of the ACL needs to be stored, which further saves storage resources.

[0111] Based on the above description, the embodiment of the present application provides an access control device 900. A first directory corresponds to a data table and a first ACL set; wherein the first ACL set includes the ACL related to the first directory, and the identifiers of all or part of the ACLs in the first ACL set are recorded in the data table. Fig. 9 As shown, the device 900 includes:

[0112] A first acquisition module 910 is used to acquire a first ACL configured for a first file, where the first file is a file in the first directory;

[0113] an inclusion module 920, configured to include the identifier of the second ACL recorded in the data table into the metadata of the first file when there is a second ACL consistent with the first ACL in the first ACL set and the identifier of the second ACL is recorded in the data table;

[0114] A receiving module 930, configured to receive a first access request for the first file;

[0115] A second acquisition module 940, configured to acquire the second ACL from the first ACL set based on an identifier of the second ACL in the metadata of the first file;

[0116] The control module 950 is configured to control the first access request based on the second ACL.

[0117] Among them, the first acquisition module 910, the inclusion module 920, the receiving module 930, the second acquisition module 940 and the control module 950 can all be implemented by software, or can be implemented by hardware. Exemplarily, the implementation of the first acquisition module 910 is introduced below by taking the first acquisition module 910 as an example. Similarly, the implementation of the inclusion module 920, the receiving module 930, the second acquisition module 940 and the control module 950 can refer to the implementation of the first acquisition module 910.

[0118] As an example of a software functional unit, the first acquisition module 910 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the first acquisition module 910 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code can be distributed in the same region (region) or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code can be distributed in the same availability zone (AZ) or in different AZs, each AZ including a data center or multiple data centers with close geographical locations. Among them, usually a region can include multiple AZs.

[0119] Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

[0120] As an example of a hardware functional unit, the first acquisition module 910 may include at least one computing device, such as a server, etc. Alternatively, the first acquisition module 910 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0121] The multiple computing devices included in the first acquisition module 910 can be distributed in the same region or in different regions. The multiple computing devices included in the first acquisition module 910 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the first acquisition module 910 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0122] It should be noted that, in other embodiments, the first acquisition module 910 may be used to execute Figure 5 Any step in the method shown, including module 920, can be used to perform Figure 5 In any step of the method shown, the receiving module 930 can be used to perform Figure 5 In any step of the method shown, the second acquisition module 940 can be used to perform Figure 5 In any step of the method shown, the control module 950 can be used to perform Figure 5 The steps implemented by the first acquisition module 910, the inclusion module 920, the receiving module 930, the second acquisition module 940 and the control module 950 can be specified as needed, and the ... Figure 5 The different steps in the method shown implement the overall functionality of the apparatus 900 .

[0123] The present application also provides a computing device 1000. Fig.10 As shown, computing device 1000 includes: bus 1002, processor 1004, memory 1006 and communication interface 1008. Processor 1004, memory 1006 and communication interface 1008 communicate through bus 1002. Computing device 1000 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in computing device 1000.

[0124] The bus 1002 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.10The bus 1002 may include a path for transmitting information between various components of the computing device 1000 (eg, the memory 1006, the processor 1004, and the communication interface 1008).

[0125] The processor 1004 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0126] The memory 1006 may include a volatile memory, such as a random access memory (RAM). The memory 1006 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0127] The memory 1006 stores executable program codes, and the processor 1004 executes the executable program codes to respectively implement the functions of the first acquisition module 910, the inclusion module 920, the receiving module 930, the second acquisition module 940 and the control module 950, thereby implementing Figure 5 That is, the memory 1006 stores the method for executing Figure 5 Instructions for the method shown.

[0128] The communication interface 1008 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 1000 and other devices or a communication network.

[0129] The embodiment of the present application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.

[0130] like Fig.11As shown, the computing device cluster includes at least one computing device 1000. The memory 1006 in one or more computing devices 1000 in the computing device cluster may store the same Figure 5 Instructions for the method shown.

[0131] In some possible implementations, the memory 1006 of one or more computing devices 1000 in the computing device cluster may also store a memory for executing Figure 5 In other words, a combination of one or more computing devices 1000 can jointly execute instructions for executing Figure 5 Instructions for the method shown.

[0132] It should be noted that the memory 1006 in different computing devices 1000 in the computing device cluster may store different instructions, which are respectively used to execute part of the functions of the apparatus 1000. That is, the instructions stored in the memory 1006 in different computing devices 1000 may implement the functions of one or more of the first acquisition module 910, the inclusion module 920, the receiving module 930, the second acquisition module 940 and the control module 950.

[0133] In some possible implementations, one or more computing devices in the computing device cluster may be connected via a network, which may be a wide area network or a local area network. Fig.12 A possible implementation is shown. Fig.12 As shown, two computing devices 1000A and 1000B are connected via a network. Specifically, the network is connected via a communication interface in each computing device. In this type of possible implementation, the memory 1006 in the computing device 1000A stores instructions for executing the functions of the first acquisition module 910 and the inclusion module 920. At the same time, the memory 1006 in the computing device 1000B stores instructions for the functions of the receiving module 930, the second acquisition module 940 and the control module 950.

[0134] It should be understood that Fig.12 The functions of the computing device 1000A shown in FIG. 1000A may also be completed by multiple computing devices 1000. Similarly, the functions of the computing device 1000B may also be completed by multiple computing devices 1000.

[0135] The present application embodiment also provides another computing device cluster. The connection relationship between the computing devices in the computing device cluster can be similar to that of Fig.11 and Fig.12 The difference is that the memory 1006 in one or more computing devices 1000 in the computing device cluster may store the same memory for executing Figure 5Instructions for the method shown.

[0136] In some possible implementations, the memory 1006 of one or more computing devices 1000 in the computing device cluster may also store a memory for executing Figure 5 In other words, a combination of one or more computing devices 1000 can jointly execute instructions for executing Figure 5 Instructions for the method shown.

[0137] The present application also provides a computer program product including instructions. The computer program product may be software or a program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes Figure 5 The method shown.

[0138] The present application also provides a computer-readable storage medium. The computer-readable storage medium may be any available medium that can be stored by a computing device or a host migration device such as a data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute Figure 5 The method shown.

[0139] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. An access control method, characterized in that: The first directory corresponds to a data table and a first access control list (ACL) set; wherein the first ACL set includes an ACL related to the first directory, and the identifiers of all or part of the ACLs in the first ACL set are recorded in the data table; the method includes: Obtain a first ACL configured for a first file, where the first file is a file under the first directory; When there is a second ACL consistent with the first ACL in the first ACL set, and the identifier of the second ACL is recorded in the data table, including the identifier of the second ACL recorded in the data table into the metadata of the first file; receiving a first access request for the first file; Acquire the second ACL from the first ACL set based on the identifier of the second ACL in the metadata of the first file; Based on the second ACL, the first access request is controlled.

2. The method according to claim 1, characterized in that The method further comprises: When the identifier of the ACL recorded in the data table is different from the identifier of the first ACL, adding the first ACL to the first ACL set, and including the identifier of the first ACL in the metadata of the first file; receiving a second access request for the first file; Acquire the first ACL from the first ACL set based on the identifier of the first ACL in the metadata of the first file; Based on the first ACL, the second access request is controlled.

3. The method according to claim 2, characterized in that The method further includes: recording the identifier of the first ACL in the data table.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: When the first directory is deleted, the data table is deleted, and the ACL represented by the identifier of the ACL recorded in the data table is deleted.

5. The method according to claim 4, characterized in that The first directory also includes a second file, the metadata of the second file includes a first identifier of a third ACL, and the first identifier of the third ACL is recorded in the data table; The method further comprises: Creating a third file related to the second file in a second directory, where the second directory corresponds to a second ACL set; Including the second identifier of the third ACL into the metadata of the third file, and adding a copy of the third ACL to the second ACL set; wherein the second identifier represents the copy of the third ACL, and the second identifier is not in the data table; receiving a third access request for the third file; Based on the second identifier in the metadata of the third file, obtaining a copy of the third ACL from the second ACL set; The third access request is controlled based on the copy of the third ACL.

6. The method according to any one of claims 1 to 5, characterized in that The method further comprises: Calculating a mapping value of the first ACL; When the mapping value of the first ACL is consistent with the mapping value of the second ACL, the first ACL is compared with the second ACL to identify whether the first ACL is consistent with the second ACL.

7. An access control device, characterized in that: The first directory corresponds to a data table and a first ACL set; wherein the first ACL set includes an ACL related to the first directory, and the identifiers of all or part of the ACLs in the first ACL set are recorded in the data table; the device includes: A first acquisition module, configured to acquire a first ACL configured for a first file, where the first file is a file in the first directory; an inclusion module, configured to include the identifier of the second ACL recorded in the data table into the metadata of the first file when there is a second ACL consistent with the first ACL in the first ACL set and the identifier of the second ACL is recorded in the data table; A receiving module, used for receiving a first access request for the first file; A second acquisition module, configured to acquire the second ACL from the first ACL set based on an identifier of the second ACL in the metadata of the first file; A control module is used to control the first access request based on the second ACL.

8. A computing device cluster, characterized in that: comprising at least one computing device, each computing device comprising a processor and a memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The method comprises computer program instructions, and when the computer program instructions are executed by a computing device cluster, the computing device cluster performs the method according to any one of claims 1 to 6.

10. A computer program product comprising instructions, characterized in that When the instructions are executed by a computer device cluster, the computer device cluster executes the method according to any one of claims 1 to 6.

Images