Access control method and device

Abstract

The embodiment of the invention relates to an access control method and device, and relates to the technical field of computers. The method is applied to a first node comprising a first storage space, the first storage space comprises a plurality of sub-storage spaces, and the method comprises the following steps: the first node receives an access request from a second node, the access request is used for accessing a first sub-storage space in the first storage space, the first sub-storage space is one of the plurality of sub-storage spaces, the access request comprises access space information and a first access type, and the access space information is used for indicating the first storage space and the first sub-storage space. And the first node controls the access of the second node to the first sub-storage space according to the access space information and the first access type. Since the granularity of the first sub-storage space is smaller than that of the first storage space, the method can control the access of the second node to the storage space with smaller granularity. In this way, access control can be more flexible.

Description

[0001] This application is a divisional application. The original application has the application number 202310209421.4 and the original application date is February 27, 2023. The entire contents of the original application are incorporated herein by reference. Technical Field

[0002] This application relates to the field of computer technology, and in particular to an access control method and apparatus. Background Technology

[0003] In distributed computing scenarios, it is often necessary to share a large amount of data between different nodes. Taking the second node accessing the storage space of the first node as an example, the first node registers the storage space that the second node wants to access and sends the corresponding authentication information to the second node. The first node then uses this authentication information to control the second node's access to that storage space. Existing technologies suffer from insufficient flexibility in access control. Summary of the Invention

[0004] This application provides an access control method and apparatus that solves the problem of insufficient flexibility in access control in the prior art.

[0005] To achieve the above objectives, the embodiments of this application adopt the following technical solutions:

[0006] A first aspect provides an access control method applied to a first node including a first storage space, the first storage space comprising multiple sub-storage spaces. The method includes: the first node receiving an access request from a second node, the access request being for accessing a first sub-storage space within the first storage space, the first sub-storage space being one of the multiple sub-storage spaces; the access request including access space information and a first access type, the access space information indicating the first storage space and the first sub-storage space; and the first node controlling the second node's access to the first sub-storage space based on the access space information and the first access type.

[0007] In the above technical solution, the first storage space includes multiple sub-storage spaces, and the first node controls the second node's access to the first sub-storage space based on the access request from the second node. On one hand, since the granularity of the first sub-storage space is smaller than that of the first storage space, this method can control the second node's access to the smaller-granularity storage space. On the other hand, the first node can adjust the access types corresponding to the multiple sub-storage spaces in user space, making the operation simpler. Thus, access control can be made more flexible.

[0008] In one possible implementation of the first aspect, each of the plurality of sub-storage spaces corresponds to one or more access types. The first node controls the second node's access to the target sub-storage space based on the access space information and the first access type. This includes: when the first storage space and the first sub-storage space indicated by the access space information are valid, and the first access type belongs to one or more access types corresponding to the first sub-storage space, the first node allows the second node to access the first sub-storage space. When the first storage space and the first sub-storage space indicated by the access space information are invalid, or the first access type does not belong to one or more access types corresponding to the first sub-storage space, the first node denies the second node's access to the first sub-storage space. In the above possible implementation, when the access space information is valid and the first access type belongs to the access type corresponding to the first sub-storage space, the first node allows the second node to access the first sub-storage space; otherwise, the first node denies the second node's access to the first sub-storage space. This provides a basis for the first node to control the second node's access to the first sub-storage space, thus making access control more flexible.

[0009] In one possible implementation of the first aspect, before the first node receives the access request from the second node, the method further includes: the first node receiving a registration request from the second node, the registration request requesting the registration of a sub-storage space in the first node, the registration request including a second access type, the second access type including the first access type. The first node sends a registration response to the second node, the registration response indicating the first storage space and the first sub-storage space. In the above possible implementation, the second node can register the first sub-storage space in the first node, providing a basis for the first node to control the second node's access to the first sub-storage space, thus making access control more flexible.

[0010] In one possible implementation of the first aspect, each of the plurality of sub-storage spaces corresponds to an access credential, and the access request further includes a first access credential. The method further includes: when the first access credential matches the access credential corresponding to the first sub-storage space, the first node allows the second node to access the first sub-storage space. When the first access credential does not match the access credential corresponding to the first sub-storage space, the first node denies the second node's access to the first sub-storage space. In the above possible implementation, the first node can also control the second node's access to the first sub-storage space through the first access credential, providing a basis for the first node to control the second node's access to the first sub-storage space, thus making access control more flexible.

[0011] In one possible implementation of the first aspect, before the first node receives an access request from the second node, the method further includes: the first node generating a first access credential for the first sub-storage space based on at least one of the following, and sending it to the second node: the first storage space, the access type corresponding to the first storage space, the first sub-storage space, the access type corresponding to the first sub-storage space, and a random number; the first access credential is a message authentication code or a key. In the above possible implementation, the first node generates the first access credential based on at least one of the first storage space, the access type corresponding to the first storage space, the first sub-storage space, the access type corresponding to the first sub-storage space, and a random number. The first access credential can be a message authentication code or a key, providing a basis for the first node to control the second node's access to the first sub-storage space, thus making access control more flexible.

[0012] In one possible implementation of the first aspect, the first sub-storage space is registered by multiple second nodes. The method further includes: when at least one of the multiple second nodes terminates its access permission to the first sub-storage space, the first node updates its first access credential to a second access credential. The first node then sends the second access credential to the second nodes other than the at least one of the multiple second nodes. In the above possible implementation, when the first node terminates the access permission of at least one second node, it updates the access credential and sends the updated access credential to the second node that retains the access permission. This ensures that, in scenarios where multiple users access the first sub-storage space simultaneously, other users can continue to access it even when the access permission of some users is terminated. This makes access control more flexible.

[0013] In one possible implementation of the first aspect, at least two of the multiple sub-storage spaces within the first storage space have different access types. This allows for setting different access types for different sub-storage spaces at smaller granularities, thus making access control more flexible.

[0014] Secondly, an access control method is provided, comprising: a second node sending an access request to a first node, the access request being for accessing a first sub-storage space within a first storage space, the first storage space being a storage space within the first node, the first storage space comprising multiple sub-storage spaces, the first sub-storage space being one of the multiple sub-storage spaces, the access request including access space information and a first access type, the access space information being used to indicate the first storage space and the first sub-storage space. When the first node allows access to the first sub-storage space, the second node accesses the first sub-storage space.

[0015] In the above technical solution, on the one hand, since the granularity of the first sub-storage space is smaller than that of the first storage space, this method can control the second node's access to the smaller-granularity storage space. On the other hand, the first node can adjust the access types corresponding to multiple sub-storage spaces in user space, making the operation simpler. Thus, access control can be made more flexible.

[0016] In one possible implementation of the second aspect, each of the plurality of sub-storage spaces corresponds to one or more access types. When the first node allows access to the first sub-storage space, the second node accesses the first sub-storage space, including: when the access space information indicates that the first storage space and the first sub-storage space are valid, and the first access type belongs to one or more access types corresponding to the first sub-storage space, the second node accesses the first sub-storage space. In the above possible implementation, when the access space information is valid and the first access type belongs to the access type corresponding to the first sub-storage space, the second node accesses the first sub-storage space. This provides a basis for the first node to control the second node's access to the first sub-storage space, making access control more flexible.

[0017] In one possible implementation of the second aspect, before the second node sends an access request to the first node, the method further includes: the second node sending a registration request to the first node. This registration request requests the registration of a sub-storage space with the first node. The registration request includes a second access type, which includes the first access type. The second node receives a registration response from the first node, indicating the first storage space and the first sub-storage space. In the above possible implementations, the second node can register the first sub-storage space with the first node, providing a basis for the first node to control the second node's access to the first sub-storage space, thus making access control more flexible.

[0018] In one possible implementation of the second aspect, each of the plurality of sub-storage spaces corresponds to an access credential, and the access request further includes a first access credential. The method further includes: when the first access credential matches the access credential corresponding to the first sub-storage space, the second node accesses the first sub-storage space. In the above possible implementations, the first node can also control the second node's access to the first sub-storage space through the first access credential, providing a basis for the first node to control the second node's access to the first sub-storage space, thus making access control more flexible.

[0019] In one possible implementation of the second aspect, the method further includes: the second node receiving the first access credential from the first node, the first access credential being obtained based on at least one of the following: the first storage space, the first sub-storage space, the access type corresponding to the first sub-storage space, and a random number; the first access credential is a message authentication code or a key. In the above possible implementations, the first access credential is generated based on at least one of the first storage space, the access type corresponding to the first storage space, the first sub-storage space, the access type corresponding to the first sub-storage space, and a random number. The first access credential can be a message authentication code or a key, providing a basis for the first node to control the second node's access to the first sub-storage space, thus making access control more flexible.

[0020] In one possible implementation of the second aspect, the method further includes: the second node receiving a second access credential from the first node. The second node updates the first access credential to the second access credential. In the above possible implementation, when the first node terminates the access rights of at least one second node, it updates the access credential and sends the updated access credential to the second node that retains the access rights. Thus, in scenarios where multiple users simultaneously access the first sub-storage space, even if the access rights of some users are terminated, other users can still continue to access it. This makes access control more flexible.

[0021] In one possible implementation of the second aspect, at least two of the multiple sub-storage spaces within the first storage space have different access types. This allows for setting different access types for different smaller-granularity sub-storage spaces, thus making access control more flexible.

[0022] Thirdly, an access control device is provided, wherein a first storage space in the device includes a plurality of sub-storage spaces. The device includes: a receiving unit for receiving an access request from a second node, the access request being for accessing a first sub-storage space within the first storage space, the first sub-storage space being one of the plurality of sub-storage spaces, the access request including access space information and a first access type, the access space information being used to indicate the first storage space and the first sub-storage space; and a processing unit for controlling the second node's access to the first sub-storage space based on the access space information and the first access type.

[0023] In one possible implementation of the third aspect, each of the plurality of sub-storage spaces corresponds to one or more access types. Specifically, the processing unit is configured to: allow the second node to access the first sub-storage space when the access space information indicates that the first storage space and the first sub-storage space are valid, and the first access type belongs to one or more access types corresponding to the first sub-storage space; and deny the second node's access to the first sub-storage space when the access space information indicates that the first storage space and the first sub-storage space are invalid, or the first access type does not belong to one or more access types corresponding to the first sub-storage space.

[0024] In one possible implementation of the third aspect, the apparatus further includes a sending unit. The receiving unit is further configured to receive a registration request from the second node, the registration request requesting the registration of a sub-storage space in the first node, the registration request including a second access type, the second access type including the first access type. The sending unit is configured to send a registration response to the second node, the registration response indicating the first storage space and the first sub-storage space.

[0025] In one possible implementation of the third aspect, each of the plurality of sub-storage spaces corresponds to an access credential, and the access request further includes a first access credential. The processing unit is further configured to: allow the second node to access the first sub-storage space when the first access credential matches the access credential corresponding to the first sub-storage space; and deny the second node's access to the first sub-storage space when the first access credential does not match the access credential corresponding to the first sub-storage space.

[0026] In one possible implementation of the third aspect, the processing unit is further configured to generate the first access credential for the first sub-storage space based on at least one of the following: the first storage space, the access type corresponding to the first storage space, the first sub-storage space, the access type corresponding to the first sub-storage space, and a random number. The sending unit is further configured to send the first access credential to the second node. The first access credential is a message authentication code or a key.

[0027] In one possible implementation of the third aspect, the first sub-storage space is registered by a plurality of second nodes. The processing unit is further configured to, when at least one of the plurality of second nodes terminates its access permission to the first sub-storage space, update the first access credential to a second access credential. The sending unit is further configured to send the second access credential to the second nodes other than the at least one of the plurality of second nodes.

[0028] In one possible implementation of the third aspect, among the multiple sub-storage spaces in the first storage space, at least two sub-storage spaces have different access types.

[0029] Fourthly, an access control device is provided, comprising: a sending unit for sending an access request to a first node, the access request being for accessing a first sub-storage space in a first storage space, the first storage space being a storage space in the first node, the first storage space including a plurality of sub-storage spaces, the first sub-storage space being one of the plurality of sub-storage spaces, the access request including access space information and a first access type, the access space information being used to indicate the first storage space and the first sub-storage space; and a processing unit for accessing the first sub-storage space when the first node allows access to the first sub-storage space.

[0030] In one possible implementation of the fourth aspect, each of the plurality of sub-storage spaces corresponds to one or more access types, and the processing unit is specifically used to: when the first storage space and the first sub-storage space indicated by the access space information are valid, and the first access type belongs to one or more access types corresponding to the first sub-storage space, the second node accesses the first sub-storage space.

[0031] In one possible implementation of the fourth aspect, the apparatus further includes a receiving unit; the sending unit is further configured to send a registration request to the first node, the registration request requesting the registration of a sub-storage space in the first node, the registration request including a second access type, the second access type including the first access type. The receiving unit is configured to receive a registration response from the first node, the registration response indicating the first storage space and the first sub-storage space.

[0032] In one possible implementation of the fourth aspect, each of the plurality of sub-storage spaces corresponds to an access credential, and the access request further includes a first access credential. The processing unit is further configured to: access the first sub-storage space when the first access credential matches the access credential corresponding to the first sub-storage space.

[0033] In one possible implementation of the fourth aspect, the receiving unit is further configured to: receive the first access credential from the first node, the first access credential being obtained based on at least one of the following: the first storage space, the first sub-storage space, the access type corresponding to the first sub-storage space, and a random number. The first access credential is a message authentication code or a key.

[0034] In one possible implementation of the fourth aspect, the receiving unit is further configured to receive a second access credential from the first node. The processing unit is further configured to update the first access credential to the second access credential.

[0035] In one possible implementation of the fourth aspect, among the multiple sub-storage spaces in the first storage space, at least two sub-storage spaces have different access types.

[0036] Fifthly, an access control device is provided, the device including a processor and a memory storing instructions that, when executed by the processor, cause the device to implement the access control method provided by the first aspect or any possible implementation thereof.

[0037] A sixth aspect provides an access control device including a processor and a memory storing instructions that, when executed by the processor, cause the device to implement the access control method provided by the second aspect or any possible implementation thereof.

[0038] In a seventh aspect, a computer-readable storage medium is provided, wherein a computer program or instructions are stored therein, which, when executed, implement the access control method provided by the first aspect or any possible implementation thereof.

[0039] Eighthly, a computer-readable storage medium is provided, wherein a computer program or instructions are stored therein, which, when executed, implement the access control method provided by the second aspect or any possible implementation thereof.

[0040] In another aspect of this application, an access control system is provided, comprising a first node and a second node. The first node is used to execute the access control method provided by the first aspect or any possible implementation thereof, and the second node is used to execute the access control method provided by the second aspect or any possible implementation thereof.

[0041] In another aspect of the embodiments of this application, a computer program product is provided, which, when run on a computer, causes the computer to perform the method provided by the first aspect, any possible implementation of the first aspect, the second aspect, or any possible implementation of the second aspect.

[0042] It is understood that any of the access control methods provided above, including the apparatus, system, computer storage medium, or computer program product, are used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can be referred to the beneficial effects of the corresponding methods provided above, and will not be repeated here. Attached Figure Description

[0043] Figure 1 A schematic diagram of a communication network provided in an embodiment of this application;

[0044] Figure 2 A schematic diagram of the requester and responder provided for embodiments of this application;

[0045] Figure 3 Flowchart of the access control method provided in the embodiments of this application Figure 1 ;

[0046] Figure 4 A schematic diagram of the first storage space provided in an embodiment of this application;

[0047] Figure 5 A schematic diagram of multiple storage spaces provided in the embodiments of this application. Figure 1 ;

[0048] Figure 6 Flowchart of the access control method provided in the embodiments of this application Figure 2 ;

[0049] Figure 7 A schematic diagram of multiple storage spaces provided in the embodiments of this application. Figure 2 ;

[0050] Figure 8 A schematic diagram illustrating the sending of a second access credential by a first node in an embodiment of this application;

[0051] Figure 9 Flowchart of the access control method provided in the embodiments of this application Figure 3 ;

[0052] Figure 10 Flowchart of the access control method provided in the embodiments of this application Figure 4 ;

[0053] Figure 11 A flowchart illustrating another access control method provided in an embodiment of this application;

[0054] Figure 12 A schematic diagram of an access control device provided in an embodiment of this application;

[0055] Figure 13 A schematic diagram of another access control device provided in an embodiment of this application;

[0056] Figure 14 A schematic diagram of yet another access control device provided in an embodiment of this application;

[0057] Figure 15 This is a schematic diagram of another access control device provided in an embodiment of this application. Detailed Implementation

[0058] The technical solutions in the embodiments of this application will be described below with reference to the accompanying drawings. In the embodiments of this application, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, or B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the related objects before and after are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, a and b, a and c, b and c, or a, b, and c, where a, b, and c can be single or multiple. In addition, in the embodiments of this application, the words "first," "second," etc., do not limit the quantity or order.

[0059] It should be noted that in the embodiments of this application, the words "exemplary" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0060] Before introducing the embodiments of this application, the relevant technical background involved in the embodiments of this application will first be described. In distributed computing scenarios, it is usually necessary to share a large amount of data between different nodes. Taking the second node accessing the storage space of the first node as an example, the first node registers the storage space that the second node wants to access and sends the corresponding verification information of the storage space to the second node. The first node controls the second node's access to the storage space through the verification information. Taking network transmission protocols such as infinite bandwidth technology (IB) or remote direct memory access (RDMA) as examples, multiple second nodes request access permissions to a memory range from the first node. The first node enters kernel mode to register the memory range and generates a key corresponding to the memory range. The first node stores the identification information corresponding to the memory range and the key in the permission table and sends the key to the multiple second nodes. To prevent the key from being maliciously forged, the key can be a random number with a certain width and length.

[0061] Traditional methods suffer from at least the following problems: First, the aforementioned memory range is a relatively large, pre-defined granularity memory range, making it impossible to set different access types for smaller granularity memory ranges within it. Second, while adjusting the access type corresponding to this memory range can be done in kernel mode, this operation is complex. Adjusting the access type in user mode requires binding the memory range to a memory window, but pre-registering memory windows consumes resources and has a limited number. Third, different second-nodes use the same key to access this memory range. If it's necessary to invalidate the access rights of one second-node, it's necessary to enter kernel mode to invalidate the page table corresponding to that key. This would terminate the access rights of all second-nodes. Other second-nodes would then need to re-apply for memory range access rights from the first node and receive the key before they can continue accessing the first node's memory range. Therefore, traditional methods suffer from insufficient flexibility in access control.

[0062] After introducing the relevant technical background involved in the embodiments of this application, the applicable scenarios of the embodiments of this application will be described in detail below. The technical solutions provided by the embodiments of this application can be applied to communication networks, which may include multiple network nodes. These multiple network nodes can communicate with each other through a network, and this communication can be implemented using a network transmission protocol. For example, the communication network may include a data center network (DCN), a high-performance computing (HPC) network, or a cloud network, etc. The network nodes in the communication network can also be simply referred to as nodes, and the nodes can be computers, servers, etc.

[0063] For example, such as Figure 1 As shown, the communication network 110 includes multiple nodes 120, which are connected to each other via the network 110. Different nodes 120 can share data; for example, any two nodes 120 can transmit data packets. Each node 120 may include a host 121 and a network interface card (NIC), also known as a network interface card 122. The host 121 may include a processor 123, memory 124, and a memory management unit (MMU). In one example, the processor 123 may be a central processing unit (CPU), and the memory 124 may be internal memory (simply referred to as RAM). Optionally, the RAM may be dynamic random access memory (DRAM) or double data rate (DDR) memory.

[0064] In this embodiment, when multiple nodes 120 in the communication network 110 share data, each node 120 can allocate memory based on commands. In one possible embodiment, when a node 120 needs to share data with other nodes 120, the node 120 can request memory from the other nodes 120 for storing data based on commands, and after obtaining the memory, it can send a memory access request to access the memory.

[0065] like Figure 2 As shown, when two nodes in this communication network share data, the user of memory (i.e., the node initiating the memory access request) can be called the requester 210, and the provider of memory (i.e., the node receiving the memory access request) can be called the responder 220. The responder can be the first node, and the requester can be the second node. For example, the requester 210 may include a coupled central processing unit 211 and a network interface card 212, and the responder 220 may include a central processing unit 221, a memory management unit 223, a memory 224, a system memory management unit 225 (SMMU), and a network interface card 222, all coupled sequentially.

[0066] It is understandable that the above Figure 2 The structures of requester 210 and responder 220 shown are merely exemplary. In practical applications, requester 210 and responder 220 may include more or fewer components than shown, or combine certain components, or have different component arrangements, etc. Figure 2 This does not constitute a limitation on the embodiments of this application.

[0067] The access control method in the embodiments of this application will be described in detail below. Figure 3 Flowchart of the access control method provided in the embodiments of this application Figure 1 This method can be applied to a first node that includes a first storage space, which comprises multiple sub-storage spaces, and the method may include the following steps.

[0068] S110: The first node receives an access request from the second node. The access request is for accessing a first sub-storage space in the first storage space. The first sub-storage space is one of the plurality of sub-storage spaces. The access request includes access space information and a first access type. The access space information is used to indicate the first storage space and the first sub-storage space.

[0069] The storage space can be in-memory storage. The address of the first storage space and the addresses of the multiple sub-storage spaces are virtual addresses. The first storage space can be a storage space with a preset granularity. Figure 4 This is a schematic diagram of the first storage space provided in an embodiment of this application. The first storage space 310 may include a first sub-storage space 311 and a second sub-storage space 312, and may also include other sub-storage spaces. Optionally, the first storage space 310 may be registered by the first node in kernel mode, and the first sub-storage space 311, the second sub-storage space 312, and other sub-storage spaces may be registered by the first node in user mode.

[0070] Furthermore, the first node can include multiple storage spaces, each with a corresponding number. Figure 5 A schematic diagram of multiple storage spaces provided in the embodiments of this application. Figure 1 .exist Figure 5 In this configuration, the first storage space 310 corresponds to number 1, the second storage space 320 corresponds to number 2, and the third storage space 330 corresponds to number 3. Each storage space may include at least one sub-storage space. For example, the second storage space 320 includes a third sub-storage space 321, and the third storage space 330 includes a fourth sub-storage space 331. Optionally, the first node may also have a fourth storage space. Figure 5 (Not shown in the image), the fourth storage space does not include sub-storage spaces.

[0071] Optionally, each sub-storage space within a storage space must not overlap with the others. For example, in Figure 5 In the first storage space 310, the address in the first sub-storage space 311 is completely different from the address in the second sub-storage space 312.

[0072] Optionally, sub-storage spaces within different storage spaces can overlap. For example, in... Figure 5 In this context, the addresses in the first sub-storage space 311 and the addresses in the third sub-storage space 321 are partially the same or completely identical.

[0073] Additionally, the access space information may include the number corresponding to the first storage space and the address in the first sub-storage space. The first node can determine the first storage space based on the number corresponding to the first storage space, and the first node can determine the first sub-storage space based on the first storage space and the address in the first sub-storage space. Optionally, the address in the first sub-storage space may be the address of a portion of the space in the first sub-storage space, or it may be the address of the entire first sub-storage space.

[0074] S120: The first node controls the second node's access to the first sub-storage space based on the access space information and the first access type.

[0075] Controlling the second node's access to the first sub-storage space can be achieved by allowing or denying the second node's access. For example, if the first access type is writing data, allowing the second node to access the first sub-storage space means that the first node allows the second node to write corresponding data into the first sub-storage space. Denying the second node's access to the first sub-storage space means that the first node does not allow the second node to write corresponding data into the first sub-storage space. If the first access type is reading data, allowing the second node to access the first sub-storage space means that the first node allows the second node to read data from the first sub-storage space. Denying the second node's access to the first sub-storage space means that the first node does not allow the second node to read data from the first sub-storage space.

[0076] In the access control method provided in this application embodiment, the first storage space includes multiple sub-storage spaces, and the first node controls the access of the second node to the first sub-storage space according to the access request of the second node. On the one hand, since the granularity of the first sub-storage space is smaller than that of the first storage space, this method can control the access of the second node to the smaller-granularity storage space. On the other hand, the first node can adjust the access types corresponding to the multiple sub-storage spaces in user mode, making the operation simpler. Thus, access control can be made more flexible.

[0077] In one possible embodiment, each of the plurality of sub-storage spaces corresponds to one or more access types. S120 includes: when the access space information indicates that the first storage space and the first sub-storage space are valid, and the first access type belongs to one or more access types corresponding to the first sub-storage space, the first node allows the second node to access the first sub-storage space. When the access space information indicates that the first storage space and the first sub-storage space are invalid, or the first access type does not belong to one or more access types corresponding to the first sub-storage space, the first node denies the second node's access to the first sub-storage space.

[0078] The second node can pre-register a sub-storage space with the first node. The first storage space and the first sub-storage space are valid if: the first storage space is the same as the storage space where the sub-storage space registered by the second node is located, and the first sub-storage space is the same as the sub-storage space registered by the second node. The first storage space and the first sub-storage space indicated by the access space information are invalid if: the first storage space is not the same as the storage space where the sub-storage space registered by the second node is located, or the first sub-storage space is not the same as the sub-storage space registered by the second node.

[0079] Furthermore, each storage space can correspond to multiple access types. For example, in Figure 5 In this context, the access type corresponding to the first storage space 310 can be read data, write data, or access denied. Each sub-storage space can correspond to one or more access types. The access type corresponding to each sub-storage space belongs to multiple access types of the storage space to which that sub-storage space resides. For example, in... Figure 5 In the first sub-storage space 311, the second access type can be reading data and writing data, and the third access type corresponding to the second sub-storage space 312 can be reading data.

[0080] Furthermore, the first node can determine the access type corresponding to the first storage space based on the number corresponding to the first storage space, and can also determine one or more access types corresponding to the first sub-storage space based on the addresses in the first storage space and the first sub-storage space.

[0081] In the access control method provided in this application embodiment, when the access space information is valid and the first access type belongs to the access type corresponding to the first sub-storage space, the first node allows the second node to access the first sub-storage space; otherwise, the first node denies the second node's access to the first sub-storage space. This provides a basis for the first node to control the second node's access to the first sub-storage space, thus making access control more flexible.

[0082] In one possible embodiment, among the multiple sub-storage spaces in the first storage space, at least two sub-storage spaces have different access types. This difference in access types can mean that the access types of the at least two sub-storage spaces are not entirely identical. For example, the second access type includes both reading and writing data, and the third access type is also reading data. Both the second and third access types include reading data, but the third access type does not include writing data; therefore, the second and third access types are not entirely identical.

[0083] In the access control method provided in this application embodiment, there are at least two sub-storage spaces with different access types, so that different access types can be set for different sub-storage spaces with smaller granularity, thus making access control more flexible.

[0084] Since at least two of the multiple sub-storage spaces in the first storage space have different access types, there are sub-storage spaces in the first storage space with access types different from the access types corresponding to the first storage space.

[0085] In one possible embodiment, the access types corresponding to sub-storage spaces in different storage spaces can be the same. For example, in Figure 5 In this context, the second access type can be reading data and writing data, and the fourth access type corresponding to the third sub-storage space 321 and the fifth access type corresponding to the fourth sub-storage space can also be reading data and writing data.

[0086] In one possible embodiment, prior to S110, the method further includes: the first node receiving a registration request from the second node, the registration request requesting the registration of a sub-storage space in the first node, the registration request including a second access type, the second access type including the first access type. The first node then sends a registration response to the second node, the registration response indicating the first storage space and the first sub-storage space.

[0087] in, Figure 6 Flowchart of the access control method provided in the embodiments of this application Figure 2 The interaction between the first node 410 and the second node 421 will be used as an example for explanation. The first node 410 can pre-register a first storage space and store the number of the first storage space, the address of the first storage space, and multiple access types corresponding to the first storage space.

[0088] Furthermore, the second node 421 sends a registration request to the first node 410, and the first node 410 receives the registration request from the second node 421. The registration request may include a target size, and is used to request the registration of a sub-storage space of the target size. Based on the registration request, the first node 410 registers a first sub-storage space in a pre-registered first storage space. The size of the first sub-storage space is the target size, and the access type corresponding to the first sub-storage space is a second access type. The first node 410 stores the address and the second access type of the first sub-storage space in the first storage space.

[0089] Furthermore, the first node 410 sends a registration response to the second node 421. This registration response may include the address of the first storage space and the address of the first sub-storage space. The address of the first storage space can be used to indicate the first storage space, and the address of the first sub-storage space can be used to indicate the first sub-storage space. Optionally, the registration response may also include the number corresponding to the first storage space and the second access type.

[0090] Then, the second node 421 can send an access request to the first node 410. The first node 410 receives the access request from the second node 421 and controls the second node 421's access to the first sub-storage space according to the access space information and the first access type in the access request.

[0091] Optionally, the first node may also register a fifth sub-storage space in the first storage space according to the registration request of the third node, and the fifth sub-storage space does not overlap with other sub-storage spaces in the first storage space.

[0092] Optionally, when a third node needs to register a sub-storage space that overlaps with the first sub-storage space, the first node can re-register the fifth storage space and generate a corresponding number for it. This fifth storage space can overlap with the first storage space, and its access type can be the same as that of the first storage space. The first node can register a fifth sub-storage space within the fifth storage space, and this fifth sub-storage space must not overlap with any other sub-storage spaces within the fifth storage space.

[0093] In the access control method provided in this application embodiment, the second node can register a first sub-storage space in the first node, providing a basis for the first node to control the second node's access to the first sub-storage space, thus making access control more flexible.

[0094] In one possible embodiment, each of the plurality of sub-storage spaces corresponds to an access credential, and the access request further includes a first access credential. The method further includes: when the first access credential matches the access credential corresponding to the first sub-storage space, the first node allows the second node to access the first sub-storage space; when the first access credential does not match the access credential corresponding to the first sub-storage space, the first node denies the second node's access to the first sub-storage space.

[0095] Optionally, the first node will allow the second node to access the first sub-storage space only when three conditions are met. Specifically: the first node allows the second node to access the first sub-storage space only if the access space information indicates that the first storage space and the first sub-storage space are valid; the first access type belongs to one or more access types corresponding to the first sub-storage space; and the first access credential matches the access credential corresponding to the first sub-storage space. If any one of these conditions is not met, the first node denies the second node's access to the first sub-storage space. Specifically: the first node denies the second node's access to the first sub-storage space only if the access space information indicates that the first storage space and the first sub-storage space are invalid; the first access type does not belong to one or more access types corresponding to the first sub-storage space; or the first access credential does not match the access credential corresponding to the first sub-storage space.

[0096] In the access control method provided in this application embodiment, the first node can also control the second node's access to the first sub-storage space through the first access credential, providing a basis for the first node to control the second node's access to the first sub-storage space, thus making access control more flexible.

[0097] In one possible embodiment, prior to S110, the process may further include: the first node generating the first access credential for the first sub-storage space based on at least one of the following, and sending it to the second node: the first storage space, the access type corresponding to the first storage space, the first sub-storage space, the access type corresponding to the first sub-storage space, and a random number. The first access credential is a message authentication code or a key. Optionally, the first node may also generate the first access credential based on the number corresponding to the first storage space, or based on the number corresponding to the first storage space and at least one of the above information.

[0098] Optionally, the step of the first node generating the first access credential can be performed during the process of the first node registering the first sub-storage space for the second node. For example, the first node generates the first access credential when registering the first sub-storage space according to the registration request. The first node also stores the first access credential when storing the address and second access type of the first sub-storage space in the first storage space. The step of the first node sending the first access credential to the second node can be performed when the first node sends a registration response to the second node. For example, the registration response sent by the first node to the second node may include the first access credential. Optionally, the password manager in the first node generates the first access credential.

[0099] Optionally, each sub-storage space in the first node corresponds to a random number. For example, in Figure 5 In the first sub-storage space 311, the random number A is corresponding to the first sub-storage space 312, the random number B is corresponding to the second sub-storage space 312, the random number C is corresponding to the third sub-storage space 321, and the random number D is corresponding to the fourth sub-storage space 331.

[0100] In one possible embodiment, the first access credential is a message authentication code. The first access credential is generated based on at least one of the following: the ID corresponding to the first storage space, the first storage space itself, the access type corresponding to the first storage space, the first sub-storage space, the access type corresponding to the first sub-storage space, and a random number, using a root key and a message authentication code calculation function. The derived input to the root key can be the count value of a local counter (local cnt). The message authentication code calculation function includes at least one of the following: hash-based message authentication code (HMAC), cipher-based message authentication code (CMAC), and Galois message authentication code (GMAC) calculation functions.

[0101] In this embodiment, the matching of the first access credential with the access credential corresponding to the first sub-storage space can mean that the first access credential and the access credential corresponding to the first sub-storage space are identical. The access credential corresponding to the first sub-storage space is generated using a root key and message authentication code calculation function based on at least one of the following: the number corresponding to the first storage space, the first storage space, the access type corresponding to the first storage space, the first sub-storage space, the access type corresponding to the first sub-storage space, and a random number. The access credential corresponding to the first sub-storage space can be regenerated by the first node after receiving the access request, or it can be pre-generated and stored by the first node.

[0102] In another possible embodiment, the first access credential is a key. The first access credential is generated using a root key and a key derivation function based on at least one of the following: the number of the first storage space, the first storage space itself, the access type corresponding to the first storage space, the first sub-storage space, the access type corresponding to the first sub-storage space, and a random number. The key derivation function includes at least one of the following computation functions: a password-based key derivation function 2 (PBKDF2), an HMAC-based key derivation function (HKDF), etc.

[0103] In this embodiment, the comparison information generated based on the first access credential can be represented by an integrity check value (ICV). The first access credential matches the access credential corresponding to the first sub-storage space, which can be achieved by having comparison information ICV1 generated based on the first access credential be consistent with comparison information ICV2 generated based on the access credential corresponding to the first sub-storage space. Specifically, ICV1 is generated using a function that calculates the first access credential and a message authentication code, based on at least one of the following: the number corresponding to the first storage space, the address in the first sub-storage space within the access space information, the first access type, parameter tags that change with the access request message (such as time, access request message sequence number), and other fields in the access request message.

[0104] ICV2 is generated based on at least one of the following: the ID corresponding to the first storage space, the address in the first sub-storage space within the access space information, the first access type, a parameter tag that changes with the access request message (such as time, access request message sequence number), and other field segments in the access request message, using the access credential and message authentication code calculation function corresponding to the first sub-storage space. ICV2 can be regenerated by the first node after receiving the access request, or it can be pre-generated and stored by the first node.

[0105] In the access control method provided in this application embodiment, the first node generates a first access credential based on at least one of the first storage space, the access type corresponding to the first storage space, the first sub-storage space, the access type corresponding to the first sub-storage space, and a random number. The first access credential can be a message verification code or a key, providing a basis for the first node to control the second node's access to the first sub-storage space, thus making access control more flexible.

[0106] In one possible embodiment, the first sub-storage space is registered by a plurality of second nodes, and the method further includes: when at least one of the plurality of second nodes terminates its access permission to the first sub-storage space, the first node updates the first access credential to a second access credential. The first node then sends the second access credential to the second nodes other than the at least one of the plurality of second nodes.

[0107] Specifically, the first node updates the first access credential to a second access credential, which can be achieved by generating the first access credential based on a random number. Each sub-storage space can also correspond to a spare random number. The first node updates the currently used random number to the spare random number, thereby updating the first access credential to the second access credential. For example, ... Figure 5 The random number A in the middle is updated to Figure 7 The first node uses a random number E as a backup random number to calculate a second access credential. Optionally, the first node can also update the backup random number from E to F.

[0108] Furthermore, the termination of access rights to the first sub-storage space by at least one of the plurality of second nodes can be achieved in the following ways: the at least one second node requests access rights to the first sub-storage space for a target duration, and upon the expiration of the target duration, the at least one second node terminates its access rights to the first sub-storage space. Alternatively, if the system of the at least one second node is attacked, it sends an access termination message to the first node, and the first node terminates the access rights of the at least one second node to the first sub-storage space based on the access termination message.

[0109] Figure 8 This is a schematic diagram illustrating the sending of a second access credential by a first node according to an embodiment of this application. A first sub-storage space is registered by second nodes 421, 422, and 423. The first node 410 sends the second access credential to the second nodes (excluding at least one of the first nodes) which may involve: the first node 410 needing to terminate the access rights of second node 421 to the first sub-storage space, and the first node 410 needing to maintain the access rights of second nodes 422 and 423. The first node 410 sends an updated second access credential to second nodes 422 and 423.

[0110] Optionally, the first node 410 may also send update instruction information to the second node 422 and the second node 423, which is used to instruct the second node 422 and the second node 423 to update the first access credential to the second access credential.

[0111] Optionally, the second node 422 and the second node 423 update the first access credential to the second access credential and send an update response to the first node 410. When the first node 410 receives the update response from the second node 422 and the second node 423, or when the first node 410 waits for a timeout, the first node 410 updates the access credential corresponding to the first sub-storage space to the second access credential.

[0112] The following describes the access process for a second node whose access to the first sub-storage space has not been terminated. Figure 9 Flowchart of the access control method provided in the embodiments of this application Figure 3 Before the first node 410 times out and before it receives update responses from the second nodes 422 and 423, the second node 422 may send an access request to the first node 410. This access request includes access space information, a first access type, and a first access credential. The first node 410 controls the second node 422's access to the first sub-storage space based on the access space information, the first access type, and the first access credential.

[0113] After the first node 410 times out or receives an update response from the second node 422 and the second node 423, the second node 422 sends an access request to the first node 410. This access request includes access space information, a first access type, and a second access credential. Based on the access space information, the first access type, and the second access credential, the first node 410 controls the second node 422's access to the first sub-storage space.

[0114] Specifically, when the access space information indicates that the first storage space and the first sub-storage space are valid, the first access type belongs to one or more access types corresponding to the first sub-storage space, and the second access credential matches the access credential corresponding to the first sub-storage space, the first node 410 allows the second node 422 to access the first sub-storage space.

[0115] Specifically, the matching of the second access credential with the access credential corresponding to the first sub-storage space can be achieved by: the second access credential being a message authentication code, and the second access credential being identical to the access credential corresponding to the first sub-storage space. The access credential corresponding to the first sub-storage space is generated based on the updated random number E.

[0116] Furthermore, the matching of the second access credential with the access credential corresponding to the first sub-storage space can also occur if the second access credential is a key. The comparison information ICV1 generated based on the second access credential is consistent with the comparison information ICV2 generated based on the access credential corresponding to the first sub-storage space. The access credential corresponding to the first sub-storage space is generated based on a random number E.

[0117] Optional, such as Figure 8 As shown, the first node 410 also sends an invalidation indication message to the second node 421, which indicates that the first access credential has expired. The second node 421 deletes the first access credential based on the invalidation indication message and sends an invalidation response to the first node 410. When the first node 410 receives an invalidation response from the second node 421, an update response from the second nodes 422 and 423, or when the first node 410's wait times out, the first node 410 updates the access credential corresponding to the first sub-storage space to the second access credential.

[0118] The following describes the access process for the second node whose access to the first sub-storage space has been terminated. Figure 10 Flowchart of the access control method provided in the embodiments of this application Figure 4 Before the first node 410 times out and before it receives an invalid response from the second node 421, or an update response from the second nodes 422 and 423, the second node 421 may still send an access request to the first node. This access request includes access space information, a first access type, and a first access credential. The first node 410 controls the second node 421's access to the first sub-storage space based on the access space information, the first access type, and the first access credential.

[0119] Optionally, the second node 421 does not delete the first access credential. After the first node 410 updates the first access credential to the second access credential, the second node 421 sends an access request to the first node 410. This access request includes access space information, a first access type, and the first access credential. Because the first access credential does not match the second access credential in the first node 410, the first node 410 rejects the second node 421's access to the first sub-storage space.

[0120] In the access control method provided in this application embodiment, when the first node terminates the access rights of at least one second node, it updates the access credentials and sends the updated access credentials to the second node that retains the access rights. In this way, in scenarios where multiple users simultaneously access the first sub-storage space, even if the access rights of some users are terminated, other users can still continue to access it. This makes access control more flexible.

[0121] This application also provides another access control method. Figure 11 This is a flowchart illustrating another access control method provided in an embodiment of this application. The method may include the following steps.

[0122] S210: The second node sends an access request to the first node. The access request is used to access the first sub-storage space in the first storage space. The first storage space is the storage space in the first node. The first storage space includes multiple sub-storage spaces. The first sub-storage space is one of the multiple sub-storage spaces. The access request includes access space information and a first access type. The access space information is used to indicate the first storage space and the first sub-storage space.

[0123] S220: When the first node is allowed to access the first sub-storage space, the second node accesses the first sub-storage space.

[0124] The contents of the first storage space, the first sub-storage space, access space information, and the first access type can be referred to the relevant contents in the above embodiments, and will not be repeated here in the embodiments of this application.

[0125] In the access control method provided in this application embodiment, on the one hand, since the granularity of the first sub-storage space is smaller than that of the first storage space, this method can control the access of the second node to the smaller-granularity storage space. On the other hand, the first node can adjust the access types corresponding to multiple sub-storage spaces in user mode, making the operation simpler. Thus, access control can be made more flexible.

[0126] In one possible embodiment, each of the plurality of sub-storage spaces corresponds to one or more access types. S220 may include: when the first storage space and the first sub-storage space indicated by the access space information are valid, and the first access type belongs to one or more access types corresponding to the first sub-storage space, the second node accesses the first sub-storage space. The content regarding the validity of the access space information can be referred to in the above embodiments, and will not be repeated here.

[0127] In the access control method provided in this application embodiment, the second node accesses the first sub-storage space when the access space information is valid and the first access type belongs to the access type corresponding to the first sub-storage space. This provides a basis for the first node to control the second node's access to the first sub-storage space, making access control more flexible.

[0128] In one possible embodiment, among the multiple sub-storage spaces in the first storage space, at least two sub-storage spaces have different access types. The details related to access types can be found in the above embodiments, and will not be repeated here. The access control method provided in this application allows for different access types to be set for different sub-storage spaces with smaller granularities, thus making access control more flexible.

[0129] In one possible embodiment, before S210, the process may further include: the second node sending a registration request to the first node, the registration request requesting the registration of a sub-storage space in the first node, the registration request including a second access type, the second access type including the first access type. The second node receiving a registration response from the first node, the registration response indicating the first storage space and the first sub-storage space. The registration request, second access type, registration response, etc., can be referred to in the above embodiments, and will not be repeated here.

[0130] In the access control method provided in this application embodiment, the second node can register a first sub-storage space in the first node, providing a basis for the first node to control the second node's access to the first sub-storage space, thus making access control more flexible.

[0131] In one possible embodiment, each of the plurality of sub-storage spaces corresponds to an access credential, and the access request further includes a first access credential. The method further includes: when the first access credential matches the access credential corresponding to the first sub-storage space, the second node accesses the first sub-storage space. The first access credential, the access credential corresponding to the first sub-storage space, etc., can be referred to in the above embodiments, and will not be repeated here.

[0132] In the access control method provided in this application embodiment, the first node can also control the second node's access to the first sub-storage space through the first access credential, providing a basis for the first node to control the second node's access to the first sub-storage space, thus making access control more flexible.

[0133] In one possible embodiment, the method further includes: the second node receiving the first access credential from the first node, the first access credential being obtained based on at least one of the following: the first storage space, the first sub-storage space, the access type corresponding to the first sub-storage space, and a random number. The first access credential is a message authentication code or a key. The generation method and form of the first access credential can be referred to the above embodiments, and will not be repeated here.

[0134] In the access control method provided in this application embodiment, the first access credential is generated based on at least one of the first storage space, the access type corresponding to the first storage space, the first sub-storage space, the access type corresponding to the first sub-storage space, and a random number. The first access credential can be a message verification code or a key, providing a basis for the first node to control the second node's access to the first sub-storage space, thus making access control more flexible.

[0135] In one possible embodiment, the method further includes: the second node receiving a second access credential from the first node. The second node updates the first access credential to the second access credential. The details of the second access credential, etc., can be referred to in the above embodiments, and will not be repeated here.

[0136] In the access control method provided in this application embodiment, when the first node terminates the access rights of at least one second node, it updates the access credentials and sends the updated access credentials to the second node that retains the access rights. In this way, in scenarios where multiple users simultaneously access the first sub-storage space, even if the access rights of some users are terminated, other users can still continue to access it. This makes access control more flexible.

[0137] The above mainly introduces the access control method. The access control device corresponding to this method is described below. In this application embodiment, functional modules can be divided according to the access control device corresponding to the above method example. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0138] When dividing each function into modules according to its corresponding function. Figure 12 A possible structural diagram of the access control device involved in the above embodiments is shown. The access control device 500 can serve as a first node, and the first storage space in the access control device 500 includes multiple sub-storage spaces. The device includes a receiving unit 510 and a processing unit 520. The receiving unit 510 can be used to support the execution of S110 in the method embodiment. The processing unit 520 can be used to support the execution of S120 in the method embodiment.

[0139] For example, each of the plurality of sub-storage spaces corresponds to one or more access types. The processing unit 520 is specifically configured to: allow the second node to access the first sub-storage space when the access space information indicates that the first storage space and the first sub-storage space are valid, and the first access type belongs to one or more access types corresponding to the first sub-storage space; and deny the second node's access to the first sub-storage space when the access space information indicates that the first storage space and the first sub-storage space are invalid, or the first access type does not belong to one or more access types corresponding to the first sub-storage space.

[0140] For example, the device includes a first permission registration unit, which may include a receiving unit and a sending unit. The receiving unit is configured to receive a registration request from the second node, the registration request requesting the registration of a sub-storage space, the registration request including a second access type, the second access type including the first access type. The sending unit is further configured to send a registration response to the second node, the registration response indicating the first storage space and the first sub-storage space.

[0141] For example, each of the plurality of sub-storage spaces corresponds to an access credential, and the access request further includes a first access credential. The processing unit 520 is further configured to: allow the second node to access the first sub-storage space when the first access credential matches the access credential corresponding to the first sub-storage space; and deny the second node's access to the first sub-storage space when the first access credential does not match the access credential corresponding to the first sub-storage space.

[0142] For example, the processing unit is further configured to generate the first access credential for the first sub-storage space based on at least one of the following: the first storage space, the access type corresponding to the first storage space, the first sub-storage space, the access type corresponding to the first sub-storage space, and a random number. The sending unit is further configured to send the first access credential to the second node. The first access credential is a message authentication code or a key.

[0143] For example, the first sub-storage space is registered by multiple second nodes. The processing unit is further configured to: update the first access credential to a second access credential when at least one of the multiple second nodes terminates its access permission to the first sub-storage space. The sending unit is further configured to send the second access credential to the second nodes other than the at least one of the multiple second nodes. For example, among the multiple sub-storage spaces in the first storage space, at least two sub-storage spaces have different access types.

[0144] It is understood that each component of the access control device 500 can be used to implement the corresponding steps in the aforementioned method embodiments. Since each step has been described in detail in the aforementioned access control method embodiments, it will not be repeated here.

[0145] Figure 13 A schematic diagram of another possible structure of the access control device involved in the above embodiments is shown. This access control device 600 can serve as a second node, and it includes a sending unit 610 and a processing unit 620. The sending unit 610 can be used to support S210 in the method embodiment of the device execution. The processing unit 620 can be used to support S220 in the method embodiment of the device execution.

[0146] For example, each of the plurality of sub-storage spaces corresponds to one or more access types. The processing unit 620 is specifically used to: access the first sub-storage space when the first storage space and the first sub-storage space indicated by the access space information are valid, and the first access type belongs to one or more access types corresponding to the first sub-storage space.

[0147] For example, the device further includes a second permission registration unit, which may include the sending unit and the receiving unit. The sending unit is configured to send a registration request to the first node, the registration request requesting the registration of a sub-storage space in the first node, the registration request including a second access type, the second access type including the first access type. The receiving unit is further configured to receive a registration response from the first node, the registration response indicating the first storage space and the first sub-storage space.

[0148] For example, each of the plurality of sub-storage spaces corresponds to an access credential, and the access request also includes a first access credential. The processing unit 620 is further configured to: access the first sub-storage space when the first access credential matches the access credential corresponding to the first sub-storage space.

[0149] For example, the receiving unit is further configured to: receive the first access credential from the first node, the first access credential being obtained based on at least one of the following: the first storage space, the first sub-storage space, the access type corresponding to the first sub-storage space, and a random number. The first access credential is a message authentication code or a key.

[0150] For example, the receiving unit is further configured to: receive a second access credential from the first node. The processing unit is further configured to update the first access credential to the second access credential. For example, among the multiple sub-storage spaces in the first storage space, at least two sub-storage spaces have different access types.

[0151] It is understood that each component of the access control device 600 can be used to implement the corresponding steps in the aforementioned method embodiments. Since each step has been described in detail in the aforementioned access control method embodiments, it will not be repeated here.

[0152] The above description of an access control device in this application embodiment is from the perspective of modular functional entities. The following description is from the perspective of hardware processing. This application embodiment also provides an access control device, the structure of which can be as follows: Figure 14As shown. The access control device 700 can serve as a first node. The device includes a processor 701, and may also include a memory 702, a communication interface 703, and a bus 704. The processor 701, memory 702, and communication interface 703 are connected via the bus 704.

[0153] The processor 701 is used to control and manage the operation of the device, and to execute one or more steps in the above method embodiments, or other technical processes described herein. The communication interface 703 is used to support communication by the device, such as communication between the device and a second node. In this embodiment, the processor 701 can be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field-programmable gate array, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of the embodiments of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, etc. The bus 704 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. This bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the above figures, but this does not mean that there is only one bus or one type of bus.

[0154] It is understood that each component of the access control device 700 can be used to implement the corresponding steps in the aforementioned method embodiments. Since each step has been described in detail in the aforementioned access control method embodiments, it will not be repeated here.

[0155] This application also provides an access control device, the structure of which can be as follows: Figure 15 As shown. The access control device can serve as a second node. The device includes a processor 801, and may also include a memory 802, a communication interface 803, and a bus 804. The processor 801, memory 802, and communication interface 803 are connected via the bus 804.

[0156] The processor 801 is used to control and manage the operation of the device. In one possible embodiment, the processor 801 can be used to support the device in executing one or more steps of the above-described method embodiments, as well as other technical processes described herein. The communication interface 803 is used to support the device in communication, such as supporting the device in communicating with a first node. In the embodiments of this application, the processor 801 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field-programmable gate array, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of the embodiments of this application. The processor may also be a combination that implements computing functions, such as including one or more microprocessor combinations, digital signal processors and microprocessors, etc.

[0157] The 804 bus can be a PCI bus (interconnection standard for peripheral components) or an extended industry standard EISA bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, only one thick line is used in the above diagram, but this does not indicate that there is only one bus or one type of bus.

[0158] It is understood that each component of the access control device 800 can be used to implement the corresponding steps in the aforementioned method embodiments. Since each step has been described in detail in the aforementioned access control method embodiments, it will not be repeated here.

[0159] In another aspect of this application, an access control system is provided, comprising a first node and a second node. The first node may be the first node provided in the above-described apparatus embodiments, used to execute the steps of the first node in the method embodiments. The second node may be the second node provided in the above-described apparatus embodiments, used to execute the steps of the second node in the method embodiments. Since the steps have been described in detail in the foregoing access control method embodiments, they will not be repeated here.

[0160] In another aspect of the embodiments of this application, a computer-readable storage medium is provided, which stores a computer program or instructions that, when executed, implement the steps of the first node in the above method embodiments.

[0161] In another aspect of the embodiments of this application, a computer-readable storage medium is provided, which stores a computer program or instructions that, when executed, implement the steps of the second node in the above method embodiments.

[0162] In another aspect of the embodiments of this application, a computer program product is provided, the computer program product comprising: a computer program (also referred to as code or instructions), which, when run, causes a computer to perform the steps of the first node in the above method embodiments.

[0163] In another aspect of the embodiments of this application, a computer program product is provided, which includes a computer program (also referred to as code or instructions) that, when run, causes a computer to perform the steps of the second node in the above method embodiments.

[0164] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0165] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0166] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0167] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the part of the technical solution that contributes to the embodiment of this application, or all or part of the technical solution, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory, random access memory, magnetic disks, or optical disks.

[0168] Finally, it should be noted that the above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An access control method, characterized in that, Applied to a first node, the first node comprising a first storage space with multiple sub-storage spaces, the method includes: The first node receives an access request from the second node. The access request is for accessing a first sub-storage space in the first storage space. The first sub-storage space is one of the plurality of sub-storage spaces. The access request includes access space information and a first access type. The access space information is used to indicate the first storage space and the first sub-storage space. The first node determines whether the second node allows access to the first sub-storage space based on the access space information and the first access type.

2. The method according to claim 1, characterized in that, Each of the plurality of sub-storage spaces corresponds to one or more access types. The first node, based on the access space information and the first access type, determines whether the second node allows access to the first sub-storage space, specifically including: When the access space information indicates that the first storage space and the first sub-storage space are valid, and the first access type belongs to one or more access types corresponding to the first sub-storage space, the first node allows the second node to access the first sub-storage space. When the first storage space and the first sub-storage space indicated by the access space information are invalid, or when the first access type does not belong to one or more access types corresponding to the first sub-storage space, the first node rejects the second node's access to the first sub-storage space.

3. The method according to claim 1 or 2, characterized in that, Before the first node receives the access request from the second node, it also includes: The first node receives a registration request from the second node. The registration request is for requesting to register a sub-storage space in the first node. The registration request includes a second access type, which includes the first access type. The first node sends a registration response to the second node, the registration response being used to indicate the first storage space and the first sub-storage space.

4. The method according to any one of claims 1 to 3, characterized in that, Each of the plurality of sub-storage spaces corresponds to an access credential, the access request further includes a first access credential, and the method further includes: When the first access credential matches the access credential corresponding to the first sub-storage space, the first node allows the second node to access the first sub-storage space; When the first access credential does not match the access credential corresponding to the first sub-storage space, the first node rejects the second node's access to the first sub-storage space.

5. The method according to claim 4, characterized in that, Before the first node receives the access request from the second node, it also includes: The first node generates the first access credential for the first sub-storage space based on at least one of the following, and sends it to the second node: the first storage space, the access type corresponding to the first storage space, the first sub-storage space, the access type corresponding to the first sub-storage space, and a random number; The first access credential is a message authentication code or a key.

6. The method according to claim 5, characterized in that, The first sub-storage space is registered by multiple second nodes, and the method further includes: When at least one of the plurality of second nodes terminates its access permission to the first sub-storage space, the first node updates the first access credential to a second access credential. The first node sends the second access credential to a second node among the plurality of second nodes, excluding the at least one second node.

7. The method according to any one of claims 1 to 6, characterized in that, Among the multiple sub-storage spaces in the first storage space, at least two sub-storage spaces have different access types.

8. An access control method, characterized in that, The method includes: The second node sends an access request to the first node. The access request is used to access the first sub-storage space in the first storage space. The first storage space is the storage space in the first node. The first storage space includes multiple sub-storage spaces. The first sub-storage space is one of the multiple sub-storage spaces. The access request includes access space information and a first access type. The access space information is used to indicate the first storage space and the first sub-storage space. When the first node is allowed to access the first sub-storage space, the second node accesses the first sub-storage space.

9. The method according to claim 8, characterized in that, Each of the plurality of sub-storage spaces corresponds to one or more access types. The step of the second node accessing the first sub-storage space when the first node allows access includes: When the access space information indicates that the first storage space and the first sub-storage space are valid, and the first access type belongs to one or more access types corresponding to the first sub-storage space, the second node accesses the first sub-storage space.

10. The method according to claim 8 or 9, characterized in that, Before the second node sends an access request to the first node, it also includes: The second node sends a registration request to the first node. The registration request is used to request the registration of a sub-storage space in the first node. The registration request includes a second access type, which includes the first access type. The second node receives a registration response from the first node, the registration response being used to indicate the first storage space and the first sub-storage space.

11. The method according to any one of claims 8 to 10, characterized in that, Each of the plurality of sub-storage spaces corresponds to an access credential, the access request further includes a first access credential, and the method further includes: When the first access credential matches the access credential corresponding to the first sub-storage space, the second node accesses the first sub-storage space.

12. The method according to claim 11, characterized in that, The method further includes: The second node receives the first access credential from the first node, the first access credential being obtained based on at least one of the following: the first storage space, the first sub-storage space, the access type corresponding to the first sub-storage space, and a random number; The first access credential is a message authentication code or a key.

13. The method according to claim 12, characterized in that, The method further includes: The second node receives the second access credential from the first node; The second node updates the first access credential to the second access credential.

14. The method according to any one of claims 8 to 13, characterized in that, Among the multiple sub-storage spaces in the first storage space, at least two sub-storage spaces have different access types.

15. An access control device, characterized in that, The first storage space in the device includes multiple sub-storage spaces, and the device includes: A receiving unit is configured to receive an access request from a second node, the access request being used to access a first sub-storage space in the first storage space, the first sub-storage space being one of the plurality of sub-storage spaces, the access request including access space information and a first access type, the access space information being used to indicate the first storage space and the first sub-storage space; The processing unit is configured to determine whether the second node is allowed to access the first sub-storage space based on the access space information and the first access type.

16. The apparatus according to claim 15, characterized in that, Each of the plurality of sub-storage spaces corresponds to one or more access types, and the processing unit is specifically used for: When the first storage space and the first sub-storage space indicated by the access space information are valid, and the first access type belongs to one or more access types corresponding to the first sub-storage space, the second node is allowed to access the first sub-storage space. When the first storage space and the first sub-storage space indicated by the access space information are invalid, or when the first access type does not belong to one or more access types corresponding to the first sub-storage space, the second node's access to the first sub-storage space is denied.

17. The apparatus according to claim 15 or 16, characterized in that, The device also includes a transmitting unit; The receiving unit is further configured to receive a registration request from the second node, the registration request being used to request the registration of a sub-storage space, the registration request including a second access type, the second access type including the first access type; The sending unit is used to send a registration response to the second node, the registration response being used to indicate the first storage space and the first sub-storage space.

18. The apparatus according to any one of claims 15 to 17, characterized in that, Each of the plurality of sub-storage spaces corresponds to an access credential, the access request further includes a first access credential, and the processing unit is specifically further configured to: When the first access credential matches the access credential corresponding to the first sub-storage space, the second node is allowed to access the first sub-storage space; When the first access credential does not match the access credential corresponding to the first sub-storage space, the second node's access to the first sub-storage space is denied.

19. The apparatus according to claim 18, characterized in that, The processing unit is further configured to generate the first access credential for the first sub-storage space according to at least one of the following: the first storage space, the access type corresponding to the first storage space, the first sub-storage space, the access type corresponding to the first sub-storage space, and a random number; The sending unit is further configured to send the first access credential to the second node; The first access credential is a message authentication code or a key.

20. The apparatus according to claim 19, characterized in that, The first sub-storage space is registered by multiple second nodes; The processing unit is further configured to update the first access credential to a second access credential when at least one of the plurality of second nodes terminates its access permission to the first sub-storage space. The sending unit is further configured to send the second access credential to a second node among the plurality of second nodes, excluding the at least one second node.

21. The apparatus according to any one of claims 15 to 20, characterized in that, Among the multiple sub-storage spaces in the first storage space, at least two sub-storage spaces have different access types.

22. An access control device, characterized in that, The device includes: A sending unit is configured to send an access request to a first node. The access request is used to access a first sub-storage space in a first storage space. The first storage space is a storage space in the first node. The first storage space includes multiple sub-storage spaces. The first sub-storage space is one of the multiple sub-storage spaces. The access request includes access space information and a first access type. The access space information is used to indicate the first storage space and the first sub-storage space. The processing unit is configured to access the first sub-storage space when the first node is allowed to access the first sub-storage space.

23. The apparatus according to claim 22, characterized in that, Each of the plurality of sub-storage spaces corresponds to one or more access types, and the processing unit is specifically used for: When the first storage space and the first sub-storage space indicated by the access space information are valid, and the first access type belongs to one or more access types corresponding to the first sub-storage space, the first sub-storage space is accessed.

24. The apparatus according to claim 22 or 23, characterized in that, The device also includes a receiving unit; The sending unit is further configured to send a registration request to the first node, the registration request being used to request the registration of a sub-storage space in the first node, the registration request including a second access type, the second access type including the first access type; The receiving unit is configured to receive a registration response from the first node, the registration response being used to indicate the first storage space and the first sub-storage space.

25. The apparatus according to any one of claims 22 to 24, characterized in that, Each of the plurality of sub-storage spaces corresponds to an access credential, the access request further includes a first access credential, and the processing unit is specifically further configured to: When the first access credential matches the access credential corresponding to the first sub-storage space, the first sub-storage space is accessed.

26. The apparatus according to claim 25, characterized in that, The receiving unit is also used for: Receive the first access credential from the first node, the first access credential being obtained based on at least one of the following: the first storage space, the first sub-storage space, the access type corresponding to the first sub-storage space, and a random number; The first access credential is a message authentication code or a key.

27. The apparatus according to claim 26, characterized in that, The receiving unit is further configured to receive a second access credential from the first node; The processing unit is further configured to update the first access credential to the second access credential.

28. The apparatus according to any one of claims 22 to 27, characterized in that, Among the multiple sub-storage spaces in the first storage space, at least two sub-storage spaces have different access types.

29. An access control device, characterized in that, The device includes a processor and a memory, the memory storing instructions that, when executed by the processor, cause the device to implement the access control method as described in any one of claims 1-14.

30. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program or instructions that, when executed, implement the access control method as described in any one of claims 1-14.

Images