Multi-tenant cloud policy conflict adaptive adjustment method and system

Abstract

The application discloses a multi-tenant cloud policy conflict adaptive adjustment method and system, and relates to the technical field of cloud computing security; the method comprises the following steps: converting access control policies of different levels in a multi-tenant cloud computing environment into a standardized policy description model; based on the standardized policy description model, an incremental policy graph with dependency relationships and conditional overlapping relationships is constructed; based on a policy change event obtained by an event listening mechanism, the incremental policy graph is analyzed in real time, potential conflict relationships between access control policies are identified, and an access conflict event record is generated; based on the access conflict event record, quantitative analysis and hierarchical evaluation are carried out, and a conflict risk evaluation record is generated; based on the conflict risk evaluation record and a pre-defined access conflict processing rule, an access conflict adjustment policy is adaptively generated and automatically executed; the application realizes real-time detection and adaptive correction of access conflict policies in a multi-tenant cloud environment, and guarantees the consistency and security of access permission authorization.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cloud computing security, and more particularly, to a multi-tenant cloud policy conflict adaptive adjustment method and system. BACKGROUND

[0002] In a multi-tenant cloud computing environment, access control policies are usually maintained and distributed by different tenants, cloud service providers and third-party security management systems, and the definition format, authorization semantics and update mechanism of the policies are quite different. In order to meet the dynamic access authorization needs of multi-tenants, cloud platforms generally need to centrally manage and real-time detect these heterogeneous policies to ensure the secure isolation of resources and the correct allocation of permissions. With the continuous expansion of cloud computing scale and the frequent occurrence of business changes, the number of access control policies grows exponentially, and policy change operations can occur at any time. How to efficiently discover conflicts, assess risks and complete corrections under a large number of policy sets has become one of the core technical challenges affecting the security governance capability and operation cost of cloud platforms.

[0003] The existing Chinese patent application with publication number CN102387145B proposes a system and method for detecting access control policy conflicts in a collaborative environment. The method is aimed at a role-mapping-based dual-domain collaborative scenario. First, the XACML policy files of the two domains are subjected to syntax-semantic analysis and numbered identification. Then, a global role-resource ontology is generated through ontology semantic mapping. Finally, a subgraph isomorphism algorithm is used to match the pre-defined conflict graph template in the integrated policy graph, thereby outputting the conflict type, reason and source policy location. The method only prompts the user to handle it manually, i.e., the technical activities are concentrated on "semantic heterogeneity resolution + offline conflict detection".

[0004] In the existing technology, conflicts are usually detected through periodic full-policy scanning, and authorization configurations are corrected through manual review or static rules. This has obvious limitations. Specifically, policy conflict detection relies on offline batch processing, which has low detection frequency and high latency, and cannot trigger real-time analysis instantaneously upon policy changes, which can easily lead to permission drift or authorization failure in a short period. For detected conflicts, existing methods generally only provide simple priority stacking or global rearrangement, lack the ability to identify change causes based on time dimension, and lack accurate dependency maintenance and sandbox verification mechanisms, which can easily cause large-scale authorization coverage or authorization voids, seriously affecting the consistency and stability of access control in a multi-tenant environment.

[0005] Therefore, there is an urgent need for an access permission method and system that can trigger detection instantaneously upon policy changes, quantify conflict risks, and implement adaptive correction based on version differences and conditional overlap, to improve the real-time, precision and traceability of access control policy governance. SUMMARY

[0006] In order to overcome the above-mentioned defects of the prior art, and achieve the above-mentioned purposes, the present application provides the following technical solutions: a multi-tenant cloud policy conflict adaptive adjustment method, comprising:

[0007] Real-time collection of access control policies of different levels in a multi-tenant cloud computing environment, and conversion of access control policies of different formats into a standardized policy description model;

[0008] Based on the standardized policy description model, an incremental policy graph with dependency relationships and conditional overlap relationships is constructed;

[0009] Based on the policy change events obtained by the event listening mechanism, real-time analysis of the incremental policy graph is performed, potential conflict relationships between access control policies are identified, and access conflict event records are generated;

[0010] Based on the access conflict event records, quantitative analysis and hierarchical evaluation are performed to determine the risk level of the access conflict events, and conflict risk evaluation records are generated;

[0011] Based on the conflict risk evaluation records and predefined access conflict handling rules, access conflict adjustment strategies are adaptively generated and automatically executed.

[0012] Further, the method of adaptively generating access conflict adjustment strategies and automatically executing them comprises:

[0013] Obtaining a comprehensive conflict risk score corresponding to the conflict risk evaluation record; based on the comprehensive conflict risk score, an access conflict risk level is divided; the access conflict risk level includes an access conflict low risk level, an access conflict medium risk level, and an access conflict high risk level;

[0014] If the access conflict risk level is the access conflict low risk level, the conflict risk evaluation record is continuously monitored;

[0015] If the access conflict risk level is not the access conflict low risk level, a policy version consistency check is performed on the conflict policy corresponding to the conflict risk evaluation record based on the conflict policy, and if the check passes, the adjustment process is continued, and if the check fails, the adjustment process is stopped and the latest conflict risk evaluation record is re-detected and obtained;

[0016] For the access conflict medium risk level, an interval adaptive promotion algorithm is used to correct the policy priority of the low priority policy;

[0017] For the access conflict high risk level, when the sandbox verification result is that the conflict will cause authorization drift or denial of service in the live network, a blocking or rollback scheme is adaptively generated and executed.

[0018] Further, the method of dividing the access conflict risk level based on the comprehensive conflict risk score comprises:

[0019] a first preset comprehensive conflict risk score threshold and a second preset comprehensive conflict risk score threshold, wherein the first preset comprehensive conflict risk score threshold is smaller than the second preset comprehensive conflict risk score threshold;

[0020] if the comprehensive conflict risk score is smaller than the first preset comprehensive conflict risk score threshold, the access conflict risk level of the comprehensive conflict risk score is a low access conflict risk level;

[0021] if the comprehensive conflict risk score is smaller than the second preset comprehensive conflict risk score threshold and greater than or equal to the first preset comprehensive conflict risk score threshold, the access conflict risk level of the comprehensive conflict risk score is a medium access conflict risk level;

[0022] if the comprehensive conflict risk score is greater than or equal to the second preset comprehensive conflict risk score threshold, the access conflict risk level of the comprehensive conflict risk score is a high access conflict risk level.

[0023] Further, the method for performing policy version consistency verification on the identification and the conflict detection timestamp based on the conflict policy pair corresponding to the conflict risk assessment record comprises:

[0024] retrieving the latest version number corresponding to the conflict policy pair in the policy version repository according to the conflict policy pair identification;

[0025] if the update time of the latest version number is earlier than the conflict detection time, the verification result of the policy version consistency verification is a verification pass;

[0026] if the update time of the latest version number is not earlier than the conflict detection time, the verification result of the policy version consistency verification is a verification fail.

[0027] Further, the method for correcting the policy priority corresponding to the low-priority policy by using the interval adaptive promotion algorithm comprises:

[0028] obtaining the policy priority values corresponding to the conflict policy pair identification, and recording the policy priority with the larger value as the high-priority policy and the policy priority with the smaller value as the low-priority policy;

[0029] calculating the remaining gap difference value between the upper limit of the policy priority and the high-priority policy;

[0030] if the remaining gap difference value is greater than a preset remaining gap difference value threshold, a rollback algorithm is enabled, the policy priority value of the high-priority policy is searched downward, the first unoccupied policy priority value is found and recorded as the gap priority value, and the policy priority of the low-priority policy is updated to the gap priority value;

[0031] If the remaining gap difference value is not greater than the preset remaining gap difference value threshold, a strategy priority value difference between the high-priority policy and the low-priority policy is calculated, a target strategy priority value is calculated based on the preset safety interval constant and the strategy priority value difference, and the strategy priority of the low-priority policy is updated to the target strategy priority value.

[0032] Further, the method of adaptively generating and executing the blocking or rollback scheme comprises:

[0033] a preset time difference threshold;

[0034] a first time difference value is obtained by subtracting the conflict detection timestamp from the latest change time of the low-priority policy;

[0035] a second time difference value is obtained by subtracting the conflict detection timestamp from the latest change time of the high-priority policy;

[0036] it is determined whether the first time difference value is greater than the time difference threshold and the second time difference value is less than the time difference threshold;

[0037] If yes, it is determined that the latest change is the conflict cause, a rollback scheme is triggered, the high-priority policy is rolled back to the previous version of the current version, the dependency relationship hash is synchronously updated, and the online high-priority policy version is replaced in an atomic writing manner;

[0038] If no, it is determined that the latest change is the solidified contradiction, a blocking scheme is triggered, the state of the low-priority policy is marked as disabled, a new cover declaration sub-policy is created, the subject, object, action and low-priority policy of the cover declaration sub-policy are consistent, the effect of the cover declaration sub-policy is rejection, and the strategy priority value of the cover declaration sub-policy is not less than the current global highest priority.

[0039] Further, the method of generating the conflict risk assessment record comprises:

[0040] a conflict policy pair identifier corresponding to the access conflict event record, a conflict relationship type set, a conflict condition expression and a conflict detection timestamp are obtained;

[0041] each conflict relationship in the conflict relationship type set is mapped to a corresponding conflict risk weight value according to a predefined conflict type weight table;

[0042] the subject corresponding to the conflict condition expression is matched with a pre-constructed subject resource impact level table to obtain a corresponding subject impact score, the object corresponding to the conflict condition expression is matched with a pre-constructed object resource sensitivity level table to obtain a corresponding object impact score, and the action corresponding to the conflict condition expression is matched with a pre-constructed action operation risk level table to obtain a corresponding action impact score;

[0043] If there is a priority conflict in the conflict relationship type set, a corresponding priority difference score is obtained based on a pre-constructed priority difference score table;

[0044] The conflict risk weight value, the subject influence score, the object influence score, the action influence score, and the priority difference score are input into a comprehensive conflict risk assessment model to obtain a comprehensive conflict risk score;

[0045] The conflict policy pair identifier, the comprehensive conflict risk score, and the conflict detection timestamp are encapsulated into a conflict risk assessment record.

[0046] Further, the method for generating the access conflict event record comprises:

[0047] According to the policy graph node number contained in the policy change event, upstream policy graph nodes and downstream policy graph nodes having a direct dependency relationship with the policy graph node are determined through a local policy subgraph, and an affected policy graph node set is constructed; the affected policy graph node set only contains policy graph node pairs having relevance to the current policy change event;

[0048] For the standardized policy metadata corresponding to any two policy graph nodes in the affected policy graph node set, conditional intersection comparison, effect difference comparison, and priority relationship analysis operations are respectively performed to generate a corresponding comparison result data set;

[0049] According to a predefined conflict judgment rule and the comparison result data set, a conflict relationship is judged, and an access conflict event record is generated.

[0050] Further, the method for constructing the incremental policy graph comprises:

[0051] For each standardized policy metadata structure contained in the standardized policy description model, a corresponding policy graph node entity is constructed according to the subject, the object, the action, the condition expression, the effect, and the policy source record index corresponding to the standardized policy metadata structure; that is, each standardized policy metadata structure and the corresponding policy graph node entity form a one-to-one mapping relationship;

[0052] Policy condition intersection detection and priority relationship analysis operations are performed on the policy graph node entity to construct a condition intersection dependency edge between the policy graph nodes;

[0053] All policy graph nodes and condition intersection dependency edges are constructed into an incremental policy graph; the incremental policy graph comprises E local policy subgraphs, and the local policy subgraph refers to a local dependency relationship subgraph composed of each policy graph node itself, all upstream policy graph nodes and downstream policy graph nodes having a condition intersection dependency or a priority coverage dependency with the policy graph node.

[0054] Further, the acquisition method of the standardized policy description model comprises:

[0055] The policy monitoring channel is respectively connected to the management plane access interface of the cloud service provider, the policy management access interface of each tenant, and the third-party policy distribution channel, and performs access control policy pulling operations through periodic polling or an event-driven mechanism to acquire basic meta-information associated with each access control policy; the basic meta-information includes a tenant identifier, a policy unique identifier, a policy version number, an effective timestamp, an invalid timestamp, a policy priority, and a scope of action;

[0056] The basic meta-information is encapsulated into a policy source record entity, and each policy is assigned a unique policy source record index;

[0057] According to the data format type of the access control policy, a matching policy parsing adapter is called to perform format parsing and normalization processing on the policy content, generate a standardized policy metadata structure body, and associate the policy source record index;

[0058] All the standardized policy metadata structure bodies are constructed into a standardized policy description model.

[0059] The multi-tenant cloud policy conflict adaptive adjustment system is used for implementing the multi-tenant cloud policy conflict adaptive adjustment method and comprises:

[0060] A policy standardization module is configured to collect access control policies of different levels in a multi-tenant cloud computing environment in real time, and convert access control policies in different formats into a standardized policy description model;

[0061] A policy graph construction module is configured to construct an incremental policy graph with dependency relationships and conditional overlap relationships based on the standardized policy description model;

[0062] An access conflict detection module is configured to perform real-time analysis on the incremental policy graph based on policy change events obtained through an event monitoring mechanism, identify potential conflict relationships between access control policies, and generate access conflict event records;

[0063] A conflict risk assessment module is configured to perform quantitative analysis and hierarchical evaluation based on the access conflict event records, determine the risk level of the access conflict events, and generate conflict risk assessment records;

[0064] A conflict intelligent adjustment module is configured to adaptively generate access conflict adjustment strategies and automatically execute the strategies based on the conflict risk assessment records and predefined access conflict processing rules.

[0065] Compared with the prior art, the multi-tenant cloud policy conflict adaptive adjustment method and system have the following technical effects and advantages:

[0066] The cloud computing access permission method and system provided by the application effectively eliminates the problems of inconsistent policy semantics and parsing delay in a multi-tenant environment by collecting and uniformly converting multiple source heterogeneous access control policies into a standardized policy description model in real time; based on the standardized policy, an incremental policy graph is constructed, and when the policy changes, only the dependent relationship of the associated local subgraph is recalculated, which significantly reduces the complexity of conditional comparison and update, and compared with the traditional full-quantity traversal detection mechanism, the time delay can be reduced to milliseconds. Through the combination of the event listening mechanism and the access conflict detection module, three-dimensional comparison of condition overlap, effect difference and priority relationship can be triggered in real time at the moment when the policy addition, modification or revocation operation occurs, and access conflict event records can be automatically generated, thereby improving the accuracy and timeliness of policy conflict identification.

[0067] In the conflict risk assessment process, the application introduces multi-dimensional quantitative factors such as conflict risk weight value, subject influence score, object influence score, action influence score and priority difference score, and quantitatively scores and classifies the conflict events through a comprehensive conflict risk assessment model, so as to ensure that the evaluation results have high objectivity and repeatability. For medium-risk conflicts, the interval adaptive promotion algorithm is used to implement smooth correction of low-priority policies, effectively avoiding global priority rearrangement caused by frequent lifting; for high-risk conflicts, the version difference based on the time difference threshold is used to distinguish the latest change root cause and the solidified contradiction, and the precise adjustment measures of rolling back high-priority policies or blocking low-priority policies are taken respectively, and after sandbox verification, the measures take effect in the form of atomic writing, so as to ensure that the correction action is quickly implemented and does not have uncontrollable impact on the authorized path of the existing network.

[0068] The application scheme as a whole realizes the closed-loop management of the multi-tenant cloud platform access control policy in the whole life cycle from standardized modeling, incremental detection, quantitative risk assessment to automatic correction, significantly improves the policy consistency and security, effectively prevents security risks such as permission drift, excessive authorization and denial of service, and at the same time reduces the policy operation and maintenance complexity and operation cost, has significant technical progress and wide industrial application value. BRIEF DESCRIPTION OF DRAWINGS

[0069] Figure 1 It is a multi-tenant cloud policy conflict adaptive adjustment system schematic diagram of embodiment 1 of the application;

[0070] Figure 2 It is a multi-tenant cloud policy conflict adaptive adjustment method flow chart of embodiment 2 of the application;

[0071] Figure 3 It is a method flow chart of adaptive generation of access conflict adjustment policy and automatic execution of embodiment 1 of the application;

[0072] Figure 4A flow chart of a method for correcting the policy priority corresponding to a low-priority policy by using an interval adaptive boosting algorithm in Embodiment 1 of the present application;

[0073] Figure 5 A flow chart of a method for adaptively generating a blocking or rollback scheme and performing in Embodiment 1 of the present application. DETAILED DESCRIPTION

[0074] The technical solutions in the embodiments of the present application will be described in detail, clearly and completely below with reference to the drawings in the embodiments of the present application. It should be particularly noted that the specific embodiments described below are only used to better illustrate and describe the technical solutions of the present application, and are intended to enable those skilled in the art to better understand and implement the present application, and should not be understood as limiting the protection scope of the present application. Those skilled in the art can modify, adjust or equivalently replace the present application according to the content disclosed in the present application without departing from the spirit and essence of the present application, and these should be regarded as the protection scope of the present application.

[0075] Embodiment 1:

[0076] Please refer to Figure 1 As shown in the figure, the embodiment discloses a multi-tenant cloud policy conflict adaptive adjustment system, which comprises a policy standardization module, a policy graph construction module, an access conflict detection module, a conflict risk assessment module and a conflict intelligent adjustment module. Each module is connected by wire and / or wireless connection to realize data transmission.

[0077] In order to further clarify the technical problems to be solved by the present application and its background, before the specific embodiments are expanded, the related reaction mechanism, the limitations of the prior art and the actual difficulties faced by the skilled in the art in the solving process will be described in detail.

[0078] Specifically, in a multi-tenant cloud computing environment, access control policies are usually defined in a multi-level form, including global security policies at the level of cloud service providers and fine-grained policies set by tenants. In principle, when determining whether an access request is legal, the policy engine needs to combine and calculate these multi-level policies to derive the final authorization decision. However, due to the high flexibility and diversity of policies in terms of scope of action, condition expression and priority setting, it is easy to form rule overlap and condition coverage. For example, the same resource may be globally prohibited from access, or may be allowed to access under certain conditions in the tenant policy, or may produce mutually contradictory authorization results in the logic of the condition expression. Such conflicts are increasingly common in cloud environments with growing numbers of resources and tenants.

[0079] The prior art relies on an offline batch detection mechanism, which periodically scans the policy database, analyzes the policy conditions, and compares the conflict relations. Such detection method is usually periodic at the minute or hour level, and cannot instantly find potential conflicts at the moment of policy creation or update, resulting in potential invalidation or incorrect authorization of the policy after it takes effect. Once the conflict condition is actually triggered, it will cause permission drift, excessive authorization or denial of service. Permission drift means that the operation that should be rejected is mistakenly released, excessive authorization means that the tenant obtains access rights beyond the expected access rights, and denial of service means that the legitimate request is mistakenly rejected. The core technical problem to be solved by the present application is how to realize real-time conflict detection, priority reconciliation and automatic correction of cross-multi-layer access policies in a multi-tenant cloud computing environment, so as to solve the problem that the prior art cannot discover and eliminate conflicts in time before the policy takes effect, resulting in permission drift, excessive authorization or denial of service.

[0080] The difficulty of solving the core technical problem of the present application lies in that the condition intersection detection, priority determination and conflict risk assessment of tens of thousands of policies need to be completed in a very short time window, such as a millisecond time window, and the correction suggestion or blocking action needs to be output without interfering with normal access requests. This requires the system to have a highly optimized incremental update mechanism and event-driven detection logic, and must guarantee policy isolation and consistency in a multi-tenant environment, while putting higher requirements on the scalability and resource occupation of the system. Therefore, the prior art cannot solve the core technical problem of the present application.

[0081] The policy standardization module is used to collect access control policies of different levels in a multi-tenant cloud computing environment in real time, and convert access control policies of different formats into a standardized policy description model, providing a consistent data basis for subsequent incremental policy graph construction and conflict detection.

[0082] The method for obtaining the standardized policy description model comprises:

[0083] The policy monitoring channel is connected to the management plane access interface API of the cloud service provider, the policy management access interface API of each tenant and the third-party policy distribution channel respectively, and the access control policy pulling operation is performed through periodic polling or event-driven mechanism to obtain the basic meta information associated with each access control policy; the basic meta information includes but is not limited to tenant identifier, policy unique identifier, policy version number, effective timestamp, invalidation timestamp, policy priority and scope. The basic meta information is used to distinguish the policies defined by different tenants in a multi-tenant environment, track the policy versions and determine the applicable boundary of the policy.

[0084] The basic meta-information is encapsulated as a policy source record entity, and a unique policy source record index is assigned to each policy; the policy source record entity is used to record the policy source, tenant identification, version information and scope of action in the whole life cycle of the access control policy, and to provide traceability basis in subsequent processing and auditing.

[0085] According to the data format type of the access control policy, a matching policy parsing adapter is called to perform format parsing and normalization processing on the policy content, generate a standardized policy metadata structure body, and associate it with the policy source record index, so as to realize one-to-one correspondence association between the parsing result and the original policy source record entity.

[0086] All standardized policy metadata structure bodies are constructed into a standardized policy description model.

[0087] The method for obtaining the standardized policy metadata structure body comprises:

[0088] Through the policy identifier or the policy source record index between the basic meta-information and the access control policy business logic, the subject, object, action, condition expression and effect corresponding to the access control policy are extracted and constructed into an initial policy metadata structure body for subsequent format conversion and semantic normalization processing; then, according to the data format type of the access control policy, a corresponding parsing adapter is selected to perform format conversion operation.

[0089] It should be noted that the effect refers to the effect field, which is used to indicate the authorization decision result of the access control policy on the access request when the matching condition is established, and the value includes "allow" and "deny", which belongs to a binary state.

[0090] Specifically, if the access control policy adopts YAML format, a YAML parsing adapter is called to perform hierarchical node expansion on the policy content, map each node to a predefined standardized field, and generate a standardized policy metadata structure body corresponding to the YAML format; if the access control policy adopts JSON format, a JSON parsing adapter is called to convert the JSON field to a standardized field structure according to the key-value mapping table, and generate a standardized policy metadata structure body corresponding to the JSON format; if the access control policy adopts script format, a script policy parser is called to perform syntax checking on the script content to verify the correctness of the rule definition, then perform semantic analysis and field extraction on the access control rules in the script, and convert to generate a standardized policy metadata structure body corresponding to the script format. Through the step of obtaining the standardized policy metadata structure body, access control policies in multiple different formats can be uniformly converted into consistent data structures, ensuring that the subsequent incremental policy graph construction and conflict prediction and detection processes have accurate and standardized policy input basis.

[0091] It should be noted that the policy standardization module plays a key role in data preprocessing and semantic normalization in the present application, and is used to solve the problems of policy analysis delay and conflict identification difficulty caused by the diversity of access control policy sources, heterogeneous formats, and inconsistent semantics of condition expressions in a multi-tenant cloud computing environment. Through the policy standardization module, the system can uniformly collect, analyze and standardize the policy data from the global security policy of the cloud service provider, the custom policy of each tenant and the policy distribution channel of the third party, and ensure that subsequent processing steps are based on consistent and standardized policy description models for calculation.

[0092] Specifically, the policy standardization module establishes a multi-channel monitoring mechanism to receive and obtain access control policies and their basic meta-information from different sources in real time, and performs parsing and semantic normalization on the policy content according to the data format type, including YAML, JSON or script format. The standardized policy meta-data structure body contains core elements such as subject, object, action, condition expression and effect, and is associated with the assigned policy source record index one by one, thereby realizing the whole traceability of policy source, version, tenant identification and scope of action.

[0093] In the technical solution of the present application, the policy standardization module closely cooperates with the subsequent policy graph construction module. The standardized policy meta-data structure body output by the policy standardization module is directly used as the input of the policy graph construction module, and the policy graph construction module establishes policy dependency relationships and conflict pointers according to the standardized subject, object and condition information, thereby significantly reducing the analysis burden and error risk in the condition comparison and graph construction process. The standardized policy description model provides accurate and unified semantic expression for subsequent conflict detection, avoiding the problem of conflict misjudgment caused by inconsistent policy formats or ambiguous condition expressions. At the same time, the policy source record index generated by the policy standardization module is used for policy version tracing and processing tracking in the conflict detection, risk assessment and resolution stages, ensuring that the system has complete operation traceability and audit compliance.

[0094] In summary, the policy standardization module not only provides high-performance data standardization support for access control policy processing in a multi-tenant cloud computing environment, but also lays a foundation for high consistency and high reliability in the core functional links of real-time conflict detection, risk quantification evaluation and automatic resolution in the system of the present application.

[0095] A policy graph construction module constructs an incremental policy graph with dependency relationships and conditional overlap relationships based on the standardized policy description model to support subsequent real-time conflict detection and risk assessment operations. Through the policy graph construction module, the system can map each standardized access control policy to a graph node and construct directed edges in accordance with the action scope, priority, and conditional overlap relationships between access control policies, thereby realizing graphical expression of policy dependency relationships and, when a policy is changed, only analyzing and updating the affected local subgraph, to significantly improve the processing performance of subsequent conflict detection operations, shorten the detection response time, and enhance the scalability of the system in processing high-concurrency policy change events in a large-scale multi-tenant environment.

[0096] The construction method of the incremental policy graph includes:

[0097] For each standardized policy metadata structure included in the standardized policy description model, a corresponding policy graph node entity is constructed according to the subject, object, action, condition expression, effect, and policy source record index corresponding to the standardized policy metadata structure; that is, each standardized policy metadata structure and the corresponding policy graph node entity form a one-to-one mapping relationship, ensuring that all access control policies have unique and complete node representations in the incremental policy graph.

[0098] The policy condition overlap detection and priority relationship analysis operations are performed on the policy graph node entities to construct conditional overlap dependency edges between the policy graph nodes.

[0099] All policy graph nodes and conditional overlap dependency edges are constructed into an incremental policy graph; the incremental policy graph includes E local policy subgraphs, which refer to local dependency subgraphs composed of each policy graph node itself, all upstream and downstream policy graph nodes that have conditional overlap dependencies or priority coverage dependencies with the policy graph node.

[0100] It should be noted that by establishing local policy subgraphs at the policy graph node level, the present application can, when a policy is added, modified, or revoked, only perform incremental updates and dependency relationship recalculation on the local policy subgraph directly associated with the changed node, thereby avoiding global reconstruction of the full policy graph, effectively reducing the computational complexity of dependency relationship maintenance, improving the response speed of policy change event processing, and enhancing the scalability of the system in managing high-concurrency access control policies in a multi-tenant environment.

[0101] The construction method of the policy graph node entity includes:

[0102] The field reading operation is performed on the standardized policy metadata structure body, and the core field information related to node construction is extracted in sequence, including subject identification, object identification, action identification, condition expression, effect, policy priority, policy effective timestamp, policy invalid timestamp, and policy source record index. The fields in the core field information are standardized, with uniform naming specification and semantic expression, ensuring the accuracy and consistency of the subsequent node generation process.

[0103] The subject identification, object identification, and action identification are normalized in format, and the three are combined to form a policy triple identification, which is used to uniquely mark the access object and operation type of the policy graph node entity in the policy graph structure.

[0104] The condition expression is stored in the data structure of a logical operation tree, which represents the logical combination relationship in the condition expression through nodes and edges, and provides efficient condition comparison capability for condition overlap detection. The logical combination relationship includes AND, OR, and NOT.

[0105] The policy priority is used to assign a priority label to the policy graph node entity, which is used to determine the relative priority between nodes in the subsequent construction process of the priority coverage edge.

[0106] The policy effective timestamp and policy invalid timestamp are recorded and encapsulated as a valid period interval attribute to identify the active state of the policy graph node entity within the policy effective period.

[0107] The effect is standardized to obtain a standardized effect binary state, which is saved in the policy graph node entity attribute, and is used to determine the authorization difference of the same subject, object, and action combination under the condition of condition overlap in the subsequent conflict detection. The binary state includes allow or deny.

[0108] The policy source record index is associated and bound to the policy graph node entity, so as to realize the tracing and auditing of the original policy source in the policy dependency graph, ensuring that the subsequent conflict detection and automatic resolution process can quickly locate the corresponding original policy and version information when policy adjustment or rollback operation occurs.

[0109] According to the global node number management mechanism, a unique node number is assigned to the policy graph node entity. The node number is calculated by the node number generator based on the policy triple identification, valid period interval attribute, and standardized binary state of the effect, ensuring the global uniqueness and distinguishability between different policy graph nodes in a multi-tenant environment. After the node number is assigned, the policy triple identification, logical operation tree, priority label, valid period interval attribute, standardized effect binary state, and node number are summarized and encapsulated to form the policy graph node entity.

[0110] The method for performing policy condition overlap detection and priority relationship analysis on policy graph node entities, and constructing condition overlap dependency edges between policy graph nodes comprises:

[0111] All policy graph nodes are grouped according to the standardized subject, object and action fields to form W policy graph node groups, so as to reduce the condition comparison overhead of irrelevant nodes. Within each policy graph node group, the condition expressions of any two access control policies are sequentially subjected to condition overlap analysis, and it is determined through comparison operation of the logical operation trees whether there is a condition coverage, condition intersection or condition mutual exclusion relationship. If there is, it is determined that the condition overlap relationship is established, and a condition overlap dependency edge is generated between the nodes corresponding to the two policies. The condition overlap dependency edge comprises a dependency relationship type, a condition overlap expression and a dependency relationship weight. The dependency relationship type comprises condition coverage, condition intersection or condition mutual exclusion. The condition overlap expression represents the overlap range.

[0112] It should be noted that by grouping policy graph node entities based on the standardized subject, object and action fields, and performing condition overlap analysis and priority relationship analysis within the group, the efficiency and accuracy of condition overlap detection can be significantly improved. Specifically, the grouping operation can effectively reduce the calculation overhead of condition comparison. Since in a multi-tenant cloud computing environment, the subjects, objects and actions of different access control policies usually have high diversity, if all policy graph nodes are directly subjected to two-by-two condition comparison, the detection complexity will increase quadratically with the number of policies, resulting in excessive consumption of computing resources and significant increase in detection time delay. By grouping according to the subject, object and action first, and performing condition logical comparison only within the same group, the number of policy pairs that actually need to be subjected to condition overlap detection can be limited to a subset with strong relevance, thereby reducing the complexity of the condition overlap detection process and improving the detection performance.

[0113] By performing comparison operation on the logical operation tree form of the condition expression, accurate identification of the condition coverage, condition intersection and condition mutual exclusion relationship can be achieved while maintaining the integrity of the condition semantics. The generation of the condition overlap dependency edge and the information contained therein, such as the dependency relationship type, the condition overlap expression and the dependency relationship weight, provides sufficient data support for subsequent conflict detection and priority reconciliation. Specifically, the dependency relationship type explicitly indicates the overlap relationship of the two policies in the condition logic, the condition overlap expression can accurately describe the specific range of the overlap condition, and the dependency relationship weight is used to quantify the influence degree of the overlap on the access control decision in conflict evaluation.

[0114] Further, by pre-establishing conditional intersection dependency edges between policy graph nodes, the application can perform incremental updates and conflict analysis on only the local policy subgraph that has a dependency relationship with the affected nodes when the policy is added, modified, or revoked, without the need to rescan the full nodes and conditional expressions, thereby significantly improving the response speed of policy change event processing and meeting the real-time requirements of high-concurrency policy operations in a multi-tenant environment.

[0115] In summary, through the above grouping and dependency edge construction mechanism, the application not only reduces the computational complexity of conditional intersection detection, but also improves the accuracy and scalability of detection, ensuring the real-time and sustainability of access control policy conflict detection in a multi-tenant cloud computing environment, significantly superior to existing technical solutions.

[0116] The access conflict detection module performs real-time analysis on the incremental policy graph based on the policy change events obtained through the event listening mechanism, identifies potential conflict relationships between access control policies, and generates access conflict event records. Through the access conflict detection module, the application can perform conditional logic comparison, effect difference determination, and priority relationship judgment on the affected policy graph nodes and their dependency relationships in the first time when the policy is added, modified, or revoked, achieving low-latency and high-accuracy conflict detection processing in high-frequency change scenarios.

[0117] It should be noted that the event listening mechanism is based on an event stream subscription model of the policy management plane and the graph structure storage layer, which can automatically generate policy change event notifications when the node state changes, and deliver the notifications to the access conflict detection module for conflict detection processing. The event listening mechanism is used to capture node addition events, node modification events, and node deletion events.

[0118] The node addition event, node modification event, and node deletion event all refer to state change events generated when the access control policy performs creation, update, revocation, etc. on the policy management plane or storage layer. The node addition event refers to the addition of an access control policy; the node modification event modifies the content of an existing access control policy, including subject, object, action, condition, effect, priority, etc.; and the node deletion event refers to the revocation or invalidation of an access control policy.

[0119] The generation method of the access conflict event record includes:

[0120] According to the policy graph node number contained in the policy change event, the upstream policy graph nodes and the downstream policy graph nodes having a direct dependency relationship with the policy graph node are determined through a local policy subgraph, and an affected policy graph node set is constructed. The affected policy graph node set only contains the policy graph node pairs associated with the current policy change event, thereby avoiding full-scan of the policy graph nodes and improving the detection processing efficiency.

[0121] For the standardized policy metadata corresponding to any two policy graph nodes in the affected policy graph node set, conditional intersection comparison, effect difference comparison and priority relationship analysis operations are respectively performed to generate a corresponding comparison result data set; the comparison result data set includes conditional intersection comparison result data, effect comparison result data and priority relationship determination result data.

[0122] Specifically, the conditional intersection comparison refers to generating conditional intersection comparison result data by cross-analyzing the conditional expressions of the logical operation trees of the two policy graph nodes; the comparison result data includes conditional intersection relationship types and conditional intersection expressions, and the conditional intersection relationship types include conditional coverage, conditional intersection and conditional mutual exclusion. The effect difference comparison refers to comparing the effect fields corresponding to the two policy graph nodes to determine whether the effect fields corresponding to the two policy graph nodes are opposite authorization decisions, and generating effect comparison result data; the effect comparison result data includes authorization decision consistency and authorization decision inconsistency. The priority relationship analysis refers to determining that there is a priority coverage relationship between the two access control policies when there is an intersection in the scope of action, there is an overlap in the effective time interval corresponding to the validity period attribute, and the priority fields are different, which is used to represent whether there is a priority coverage relationship between the policies, and generates priority relationship determination result data; the priority relationship determination result data includes existence of priority coverage relationship and non-existence of priority coverage relationship.

[0123] According to the predefined conflict determination rule and the comparison result data set, a conflict relationship is determined, and an access conflict event record is generated; the access conflict event record includes a conflict policy pair identifier, a conflict relationship type, a conflict condition expression and a conflict detection timestamp; the conflict relationship type includes conditional intersection conflict, effect conflict and priority conflict.

[0124] The method for determining the conflict relationship according to the predefined conflict determination rule and the comparison result data set, and generating the access conflict event record includes:

[0125] The conditional intersection relationship type of the conditional intersection comparison result data is obtained.

[0126] If the conditional intersection relationship type is conditional mutual exclusion, it is determined that there is no conflict relationship and the process is ended.

[0127] If the condition overlap relationship type is not condition mutual exclusion, the conflict relationship determination result exists condition overlap conflict, and the corresponding conflict relationship value is set; for example, the conflict relationship value corresponding to the condition overlap conflict is marked as 1;

[0128] If the effect comparison result data is authorization decision inconsistency, the conflict relationship determination result exists effect conflict, and the corresponding conflict relationship value is set; for example, the conflict relationship value corresponding to the effect conflict is marked as 2;

[0129] If the priority relationship determination result data is that there is a priority coverage relationship, the conflict relationship determination result exists priority conflict, and the corresponding conflict relationship value is set; for example, the conflict relationship value corresponding to the priority conflict is marked as 3;

[0130] The conflict relationship values are combined to construct a conflict relationship type set; the conflict policy pair identifier corresponding to the two policy graph nodes, the conflict relationship type set, the conflict condition expression, and the conflict detection timestamp are encapsulated into an access conflict event record.

[0131] It should be noted that the access conflict detection module plays a key role in conflict identification and event generation in the present application, and is used to solve the problem that access control policy changes cannot achieve high real-time conflict detection in the prior art. Based on the event listening mechanism, the present application can automatically capture policy change events at the moment of access control policy addition, modification or revocation operation, and perform real-time analysis on the local policy subgraph directly associated with the changed policy node in the incremental policy graph based on the policy change event as a trigger condition, thereby accurately identifying potential conflict relationships between policies in the dimensions of condition logic, authorization decision and priority coverage, and generating an access conflict event record according to the predefined conflict determination rules. Through the access conflict detection module, the present application can complete conflict relationship identification and recording within a millisecond response time, effectively reduce the impact of policy changes on access security consistency, and ensure the high real-time performance, traceability and reliability of access control policy management in a multi-tenant environment, thereby providing accurate input data support for subsequent conflict risk assessment and automatic resolution of the present application.

[0132] The conflict risk assessment module performs quantitative analysis and hierarchical evaluation based on the access conflict event record, determines the risk level of the access conflict event, and generates a conflict risk assessment record.

[0133] The method for generating the conflict risk assessment record comprises:

[0134] The conflict policy pair identifier corresponding to the access conflict event record, the conflict relationship type set, the conflict condition expression, and the conflict detection timestamp are obtained;

[0135] mapping each conflict relationship in the conflict relationship type set to a corresponding conflict risk weight value according to a predefined conflict type weight table;

[0136] matching the subject corresponding to the conflict condition expression with a pre-constructed subject resource influence level table to obtain a corresponding subject influence score; matching the object corresponding to the conflict condition expression with a pre-constructed object resource sensitivity level table to obtain a corresponding object influence score; and matching the action corresponding to the conflict condition expression with a pre-constructed action operation risk level table to obtain a corresponding action influence score;

[0137] if there is a priority conflict in the conflict relationship type set, obtaining a corresponding priority difference score based on a pre-constructed priority difference score table;

[0138] inputting the conflict risk weight value, the subject influence score, the object influence score, the action influence score, and the priority difference score into a comprehensive conflict risk assessment model to obtain a comprehensive conflict risk score;

[0139] encapsulating the conflict policy pair identifier, the comprehensive conflict risk score, and the conflict detection timestamp into a conflict risk assessment record.

[0140] The training method of the comprehensive conflict risk assessment model comprises:

[0141] pre-constructing a comprehensive conflict risk assessment dataset, the comprehensive conflict risk assessment dataset comprising CT sets of comprehensive conflict risk assessment data and comprehensive conflict risk scores corresponding to the CT sets of comprehensive conflict risk assessment data, CT being a positive integer; the comprehensive conflict risk assessment data comprising a conflict risk weight value, a subject influence score, an object influence score, an action influence score, and a priority difference score; dividing the comprehensive conflict risk assessment dataset into a training set and a validation set, the training set being used for learning parameters of the comprehensive conflict risk assessment model, and the validation set being used for monitoring generalization performance and overfitting degree of the comprehensive conflict risk assessment model in real time;

[0142] adopting a deep neural network with a multilayer perceptron as the core as the comprehensive conflict risk assessment model, inputting the comprehensive conflict risk assessment data into the deep neural network after standardization and vectorization processing, the deep neural network comprising an input layer, hidden layers, and an output layer; each hidden layer uses a nonlinear activation function to extract features, and the output layer uses a Softmax activation function to obtain a probability distribution corresponding to each comprehensive conflict risk score, and finally taking a comprehensive conflict risk score corresponding to a maximum probability as a prediction result of the comprehensive conflict risk assessment model; in the training process, a cross-entropy loss function is used as an optimization objective, a gradient descent type optimization algorithm is used to update network weights, and an early stopping strategy is set: when a prediction accuracy on the validation set reaches or exceeds a preset threshold, it is determined that the comprehensive conflict risk assessment model has converged and the training is terminated.

[0143] It should be noted that in the present application, the comprehensive conflict risk score is used to quantitatively represent the overall risk level of the access control policy conflict event in the multi-tenant cloud computing environment, which can fully reflect the risk intensity of the conflict event under the superposition of multiple factors. The value range of the comprehensive conflict risk score is 0 to 100 points, and the larger the value, the more serious the potential impact of the conflict on the consistency and security of system access control.

[0144] Specifically, the conflict risk weight value is used to quantify the basic influence degree of different conflict relationship types, the subject influence score, the object influence score and the action influence score are respectively used to represent the action range of the conflict event in the subject authorization range, the resource sensitivity and the operation risk level, and the priority difference score is used to reflect the potential severity of the conflict event due to the priority coverage relationship leading to policy failure. By inputting the above scores into the comprehensive conflict risk assessment model, the comprehensive conflict risk score is generated.

[0145] The conflict type weight table is shown in Table 1.

[0146] Table 1 Conflict type weight table

[0147]

[0148] It should be noted that, , and represent the conflict risk weight value corresponding to the conflict relationship value. According to the predefined conflict type weight table, the conflict risk weight value is set for different conflict relationship types, which is used to represent the influence degree of each type of conflict on access control consistency and security in the comprehensive conflict risk score calculation process. Specifically, the conflict type weight value is determined according to the destructiveness of the conflict relationship to access authorization, the risk of policy failure and the potential propagation effect in the multi-tenant environment.

[0149] The weight value of the conditional overlap conflict is used to reflect the risk of causing authorization judgment uncertainty when two policies partially or completely overlap in conditional logic, that is, in the multi-tenant environment, the access behavior is matched by multiple policies but the results are inconsistent. Therefore, the basic weight value is set, and the weight level is relatively low. The weight value of the effect conflict is used to indicate the direct destructiveness of the access control result when the authorization decisions of two policies conflict under the condition of overlap, which usually causes unpredictable fluctuations in the access request authorization state, so the weight value is set to be higher than that of the conditional overlap conflict The weight value of the priority conflict is used to represent the risk of invalidation of the strategy caused by the logical overriding of the low priority strategy to the high priority strategy, which will directly affect the effectiveness of the priority system and cause the high priority rejection strategy to be invalid, and thus is set to be higher than the weight values of the condition overlap conflict and the effect conflict .

[0150] Through the above weight value setting, in the conflict risk evaluation process, the application can quantitatively weight the conflict events according to the conflict relationship type, ensure that the comprehensive conflict risk score fully reflects the differentiated influence of different conflict types on safety consistency, and provide accurate basis for the reasonable formulation of subsequent conflict disposal strategies.

[0151] An example of the subject resource influence level table is shown in Table 2.

[0152] Table 2 Subject resource influence level table

[0153]

[0154] An example of the object resource sensitivity level table is shown in Table 3.

[0155] Table 3 Object resource sensitivity level table

[0156]

[0157] An example of the action operation risk level table is shown in Table 4.

[0158] Table 4 Action operation risk level table

[0159]

[0160] An example of the priority difference score table is shown in Table 5.

[0161] Table 5 Priority difference score table

[0162]

[0163] It should be noted that the priority difference score table is used to quantify the priority difference between the two access control policies as a priority difference score, which is the difference between the priority field values of the two policies. The larger the value, the more obvious the policy priority difference, and the higher the potential risk of low priority policy overriding high priority policy. Specifically, when the priority of the two access control policies is completely the same, the system sets the priority difference score to 1, which is only used to represent the same priority conflict; when the priority difference is between 1 and 2, the score is set to 2, indicating a mild priority difference; when the priority difference is between 3 and 4, the score is set to 3, indicating a moderate priority difference; when the priority difference is between 5 and 6, the score is set to 4, indicating a higher priority difference; when the priority difference is greater than or equal to 7, the score is set to 5, indicating a high priority difference, which has a high potential to destroy access control consistency.

[0164] The conflict intelligent adjustment module adaptively generates an access conflict adjustment strategy and automatically executes based on the conflict risk assessment record and the predefined access conflict processing rule.

[0165] As shown in Figure 3 The method of adaptively generating an access conflict adjustment strategy and automatically executing includes:

[0166] Obtaining a comprehensive conflict risk score corresponding to the conflict risk assessment record; dividing the comprehensive conflict risk score to obtain an access conflict risk level; the access conflict risk level includes an access conflict low risk level, an access conflict medium risk level, and an access conflict high risk level;

[0167] If the access conflict risk level is the access conflict low risk level, continue to monitor the conflict risk assessment record;

[0168] If the access conflict risk level is not the access conflict low risk level, perform a policy version consistency check on the identification and conflict detection timestamp based on the conflict policy corresponding to the conflict risk assessment record, if the check passes, continue to execute the adjustment process, if the check fails, stop the adjustment process and re-detect to obtain the latest conflict risk assessment record;

[0169] For the access conflict medium risk level, an interval adaptive promotion algorithm is used to correct the policy priority corresponding to the low priority policy.

[0170] For the access conflict high risk level, when the sandbox verification result is that the conflict will cause authorization drift or denial of service in the live network, an adaptive blocking or rollback scheme is generated and executed.

[0171] It should be noted that in the access conflict high-risk scenario, the sandbox verification environment adopts a "mirror-decision-difference" three-step joint analysis mechanism to determine whether the conflict policy will cause authorization drift or denial of service in the live network. Specifically, the system mirrors the identity directory, resource hierarchy and effective access control policy set of the production environment in the isolated container to generate a policy decision engine instance that is semantically equivalent to the online instance. The policy decision engine instance is only used for offline calculation and does not affect the live traffic.

[0172] The system extracts subject-object-action request trajectories with coverage not less than 95% from the audit stream and access log in the latest statistical period, and automatically supplements boundary requests based on the Cartesian product of triples to form a verification request set. The sandbox engine performs two rounds of judgment on each request in the verification request set: the first round loads the baseline policy set of the live network, and the second round loads the combination of "baseline policy set + conflict policy pair". The system compares the authorization results of the two rounds one by one, and records the potential denial of service when the live network baseline policy set is judged to allow and the combination of "baseline policy set + conflict policy pair" is judged to deny; records the potential over-authorization when the live network baseline policy set is judged to deny and the combination of "baseline policy set + conflict policy pair" is judged to allow.

[0173] The method for dividing the access conflict risk level based on the comprehensive conflict risk score includes:

[0174] The preset comprehensive conflict risk score threshold one and the comprehensive conflict risk score threshold two; the comprehensive conflict risk score threshold one is less than the comprehensive conflict risk score threshold two;

[0175] For example, in the preferred embodiment of the present application, the comprehensive conflict risk score threshold one can be set to 40, and the comprehensive conflict risk score threshold two can be set to 80;

[0176] If the comprehensive conflict risk score is less than the comprehensive conflict risk score threshold one, the access conflict risk level of the comprehensive conflict risk score is the access conflict low-risk level;

[0177] If the comprehensive conflict risk score is less than the comprehensive conflict risk score threshold two and greater than or equal to the comprehensive conflict risk score threshold one, the access conflict risk level of the comprehensive conflict risk score is the access conflict medium-risk level;

[0178] If the comprehensive conflict risk score is greater than or equal to the comprehensive conflict risk score threshold two, the access conflict risk level of the comprehensive conflict risk score is the access conflict high-risk level.

[0179] The method for performing policy version consistency check based on the conflict policy pair identifier and the conflict detection timestamp corresponding to the conflict risk assessment record includes:

[0180] According to the conflict policy pair, retrieve the corresponding latest version number of the conflict policy pair in the policy version repository;

[0181] If the update time of the latest version number is earlier than the conflict detection time, it indicates that the policy is not modified after detection, and the adjustment can be continued. The verification result of the policy version consistency verification is verification passed.

[0182] If the update time of the latest version number is not earlier than the conflict detection time, it indicates that the access control policy corresponding to the conflict policy pair has been modified subsequently, and the conflict risk assessment record should be abandoned immediately and re-detection should be triggered to ensure that the subsequent adjustment action is always based on the latest effective version. The verification result of the policy version consistency verification is verification failed.

[0183] As shown in Figure 4 , the method for correcting the policy priority of the low-priority policy pair by using the interval adaptive promotion algorithm comprises:

[0184] Obtain the policy priority values corresponding to the conflict policy pair, and record the policy priority with the larger value as the high-priority policy and the policy priority with the smaller value as the low-priority policy.

[0185] Calculate the remaining gap difference value between the upper limit of the policy priority and the high-priority policy. In this application, for example, the upper limit of the policy priority is set to 100.

[0186] If the remaining gap difference value is greater than the preset remaining gap difference value threshold, a rollback algorithm is enabled, the policy priority value of the high-priority policy is searched downward, the first unoccupied policy priority value is found and recorded as the gap priority value, and the policy priority of the low-priority policy is updated to the gap priority value.

[0187] If the remaining gap difference value is not greater than the preset remaining gap difference value threshold, calculate the policy priority value difference between the high-priority policy and the low-priority policy, calculate the target policy priority value based on the preset safety interval constant and the policy priority value difference, and update the policy priority of the low-priority policy to the target policy priority value. In the preferred embodiment of the application, the safety interval constant can be set to 2. The value range of the remaining gap difference value threshold is , and in the application, the remaining gap difference value threshold can be set to 5.

[0188] Complete the correction of the policy priority of the low-priority policy.

[0189] The calculation method of the target policy priority value comprises:

[0190] ;

[0191] wherein, is a target policy priority value, is a policy priority value of a priority policy, is a policy priority value difference between a high priority policy and a low priority policy, is a safety interval constant, represents rounding up.

[0192] It should be noted that the above interval adaptive promotion algorithm is used to perform localized priority correction on the low priority policy. In the technical consideration in the present application, specifically, in the multi-tenant cloud computing environment, the total amount of policies is large and the priority field is in an increasing distribution. If the low priority policy is simply uniformly raised in the manner of "priority + 1", it will inevitably cause high-density priority aggregation, destroy the existing gradient, and quickly approach the upper limit of the policy priority in the continuous conflict reconciliation process, and finally trigger global rearrangement. In addition, the policy priority gap is not uniformly distributed, and direct interpolation in adjacent positions will waste the originally available gap resources, causing redundant voids and increasing subsequent maintenance costs.

[0193] Based on this, the present application first calculates the remaining gap difference between the upper limit of the policy priority and the high priority policy, dynamically determines whether there is still enough gap in the current priority interval; when the gap is sufficient, the system enables the rollback algorithm, searches for the first unoccupied priority value from the high priority policy, and assigns it to the low priority policy, in order to make full use of the existing gap and avoid global rearrangement. If the gap is insufficient, the target priority is calculated locally between the high and low priority policies: the minimum distance is limited by the safety interval constant, and then it is smoothly raised in proportion to the difference value, which ensures that the high priority policy is still in a dominant position and maintains the original priority gradient distribution. The interval adaptive promotion algorithm ensures that any embodiment can complete the priority correction of a single policy within O(logN) complexity, significantly reducing the reconciliation delay; at the same time, it avoids triggering full priority rearrangement due to frequent conflict adjustment, maintains the overall stability and maintainability of the policy set, and plays a key supporting role in realizing the real-time conflict adaptive adjustment closed loop proposed in the present application.

[0194] As shown in Figure 5 , the method of adaptively generating a blocking or rollback scheme and performing includes:

[0195] preset a time difference threshold; for example, in the preferred embodiment of the present application, the time difference threshold is set in the range of 15 minutes to 2 hours, including the two values of 15 minutes and 2 hours, in the present application, the time difference threshold can be set to 30 minutes.

[0196] obtaining a first time difference by subtracting the conflict detection timestamp from the latest change time of the low priority policy;

[0197] obtaining a second time difference value by subtracting the conflict detection timestamp from the latest change time of the high-priority policy;

[0198] determining whether the first time difference value is greater than the time difference threshold value and the second time difference value is less than the time difference threshold value;

[0199] If yes, it is determined that the latest change is a conflict cause, a rollback solution is triggered, the high-priority policy is rolled back to the previous version of the current version, and the dependency hash is updated synchronously to replace the online high-priority policy version in an atomic writing manner.

[0200] If no, it is determined that the latest change is a solidified contradiction, a blocking solution is triggered, the low-priority policy state is marked as disabled, and a new cover declaration sub-policy is created, which has the same subject, object and action as the low-priority policy and a rejection effect, and is assigned a policy priority value not less than the current global highest priority, to ensure that the rejection rule takes effect under any condition.

[0201] It should be noted that by introducing a time difference threshold value and calculating the latest change lag of the high and low priority policies based on the conflict detection timestamp, the application can determine the trigger mechanism of the conflict within milliseconds and select the adaptive disposal path with the smallest damage. If the first time difference value is significantly greater than the time difference threshold value, that is, the last modification interval of the low-priority policy from the detection time is significantly greater than the time difference threshold value, and the second time difference value is less than the time difference threshold value, that is, the last modification interval of the high-priority policy from the detection time is less than the time difference threshold value, it can be inferred that the high-priority policy is newly added or adjusted recently, and the low-priority policy has been stable for a long time. At this time, directly rolling back the high-priority policy to its previous stable version can not only immediately resolve the authorization drift, but also avoid additional disturbance to the historical business logic; the dependency hash is recalculated synchronously during rollback and replaced with the online version in an atomic writing manner to ensure the consistency of the policy graph and the integrity of the audit chain.

[0202] On the contrary, if the time difference combination does not meet the above conditions, it means that both policies have been stable or are in long-period historical versions, and the conflict is a solidified contradiction, and further rollback cannot eliminate the hidden danger. Therefore, the system chooses to block: first, mark the low-priority policy as disabled, then automatically generate a cover declaration sub-policy with the same subject, object and action as the low-priority policy and a rejection effect, and assign a value not less than the global highest priority to the sub-policy, to fundamentally ensure that the rejection rule takes effect under any matching path. This approach not only completely cuts off the interference of the low-priority policy on the authorization result, but also preserves the original policy subject information for subsequent auditing and playback.

[0203] The determination and treatment logic can realize deterministic and adaptive decision by single threshold driving, avoid subjective judgment error under manual intervention, and significantly improve the real-time performance, accuracy and operation controllability of access control policy conflict resolution in the multi-tenant cloud platform, and provides key support for the closed-loop security control system constructed by the application.

[0204] Embodiment 2:

[0205] Please refer to Figure 2 The embodiment provides a multi-tenant cloud policy conflict adaptive adjustment method, which comprises the following steps of:

[0206] Real-time collection of access control policies at different levels in the multi-tenant cloud computing environment, and conversion of access control policies in different formats into a standardized policy description model;

[0207] Based on the standardized policy description model, an incremental policy graph with dependency relationship and conditional overlap relationship is constructed;

[0208] Real-time analysis of the incremental policy graph based on the policy change events obtained by the event listening mechanism, identification of potential conflict relationships between access control policies, and generation of access conflict event records;

[0209] Quantitative analysis and hierarchical evaluation based on the access conflict event records, determination of the risk level of the access conflict events, and generation of conflict risk evaluation records;

[0210] Based on the conflict risk evaluation records and the pre-defined access conflict processing rules, an access conflict adjustment strategy is adaptively generated and automatically executed.

[0211] The above is only a specific embodiment of the application, but the protection scope of the application is not limited thereto, any skilled person in the art can easily think of changes or replacements within the technical range disclosed by the application, which should be covered within the protection scope of the application. Therefore, the protection scope of the application should be subject to the protection scope of the claims.

[0212] Finally: the above is only a preferred embodiment of the application and is not used to limit the application, any modification, equivalent replacement, improvement, etc. within the spirit and principles of the application should be included in the protection scope of the application.

Claims

1. A method for multi-tenant cloud policy conflict adaptive adjustment, characterized in that, The method comprises the following steps: Real-time collection of access control policies at different levels in a multi-tenant cloud computing environment, and conversion of access control policies in different formats into a standardized policy description model; Based on the standardized policy description model, an incremental policy graph with dependency relationships and conditional overlap relationships is constructed; the construction method of the incremental policy graph comprises: For each standardized policy metadata structure contained in the standardized policy description model, a corresponding policy graph node entity is constructed according to the subject, object, action, condition expression, effect and policy source record index corresponding to the standardized policy metadata structure; that is, each standardized policy metadata structure and the corresponding policy graph node entity form a one-to-one mapping relationship; Performing policy condition overlap detection and priority relationship analysis operations on the policy graph node entity, and constructing conditional overlap dependency edges between policy graph nodes; All policy graph nodes and conditional overlap dependency edges are constructed into an incremental policy graph; the incremental policy graph comprises E local policy subgraphs, which are local dependency subgraphs composed of each policy graph node itself, all upstream and downstream policy graph nodes that have conditional overlap dependencies or priority coverage dependencies with the policy graph node; Based on the policy change events obtained through the event listening mechanism, the incremental policy graph is analyzed in real time, potential conflict relationships between access control policies are identified, and access conflict event records are generated; Based on the access conflict event records, quantitative analysis and hierarchical evaluation are performed to determine the risk level of the access conflict events, and conflict risk evaluation records are generated; Based on the conflict risk evaluation records and the pre-defined access conflict processing rules, an access conflict adjustment strategy is adaptively generated and automatically executed.

2. The multi-tenant cloud policy conflict self-adaptive adjustment method according to claim 1, characterized in that, The method of adaptively generating an access conflict adjustment strategy and automatically executing it comprises: Obtaining a comprehensive conflict risk score corresponding to the conflict risk evaluation record; based on the comprehensive conflict risk score, an access conflict risk level is divided; the access conflict risk level comprises an access conflict low risk level, an access conflict medium risk level and an access conflict high risk level; If the access conflict risk level is the access conflict low risk level, the conflict risk evaluation record is continuously monitored; If the access conflict risk level is not the access conflict low risk level, a policy version consistency check is performed on the conflict policy corresponding to the conflict risk evaluation record based on the conflict policy, and if the check passes, the adjustment process is continued, and if the check fails, the adjustment process is stopped and the latest conflict risk evaluation record is re-detected and obtained; For the access conflict medium risk level, an interval adaptive promotion algorithm is used to correct the policy priority of the low-priority policy. For the access conflict high risk level, when the sandbox verification result is that the conflict will cause authorization drift or denial of service in the live network, a blocking or rollback scheme is adaptively generated and executed.

3. The multi-tenant cloud policy conflict self-adaptive adjustment method according to claim 2, characterized in that, The method of dividing the access conflict risk level based on the comprehensive conflict risk score comprises: Predefining a comprehensive conflict risk score threshold one and a comprehensive conflict risk score threshold two; the comprehensive conflict risk score threshold one is less than the comprehensive conflict risk score threshold two; If the comprehensive conflict risk score is less than the comprehensive conflict risk score threshold one, the access conflict risk level of the comprehensive conflict risk score is the access conflict low risk level; If the comprehensive conflict risk score is less than the comprehensive conflict risk score threshold two and greater than or equal to the comprehensive conflict risk score threshold one, the access conflict risk level of the comprehensive conflict risk score is the access conflict medium risk level; If the comprehensive conflict risk score is greater than or equal to the comprehensive conflict risk score threshold two, the access conflict risk level of the comprehensive conflict risk score is the access conflict high risk level.

4. The multi-tenant cloud policy conflict self-adaptive adjustment method according to claim 2, characterized in that, The method for performing policy version consistency verification on the identification and conflict detection timestamp based on the conflict policy pair corresponding to the conflict risk assessment record comprises: Retrieving the latest version number corresponding to the conflict policy pair in the policy version repository according to the identification of the conflict policy pair; If the update time of the latest version number is earlier than the conflict detection time, the verification result of the policy version consistency verification is verification pass; If the update time of the latest version number is not earlier than the conflict detection time, the verification result of the policy version consistency verification is verification fail.

5. The multi-tenant cloud policy conflict self-adaptive adjustment method according to claim 2, characterized in that, The method for correcting the policy priority corresponding to the low-priority policy by using the interval adaptive promotion algorithm comprises: Obtaining the policy priority values corresponding to the identification of the conflict policy pair, and recording the policy priority with the larger value as the high-priority policy and the policy priority with the smaller value as the low-priority policy; Calculating the remaining gap difference value between the upper limit of the policy priority and the high-priority policy; If the remaining gap difference value is greater than the preset remaining gap difference value threshold, a rollback algorithm is enabled, the policy priority value of the high-priority policy is searched downward, the first unoccupied policy priority value is found and recorded as the gap priority value, and the policy priority of the low-priority policy is updated to the gap priority value; If the remaining gap difference value is not greater than the preset remaining gap difference value threshold, the policy priority value difference between the high-priority policy and the low-priority policy is calculated, the target policy priority value is calculated based on the preset safety interval constant and the policy priority value difference, and the policy priority of the low-priority policy is updated to the target policy priority value.

6. The multi-tenant cloud policy conflict self-adaptive adjustment method according to claim 5, characterized in that, The method for adaptively generating a blocking or rollback scheme and executing the scheme comprises: Presetting a time difference value threshold; Obtaining a first time difference value by subtracting the latest change time of the low-priority policy from the conflict detection timestamp; Obtaining a second time difference value by subtracting the latest change time of the high-priority policy from the conflict detection timestamp; Determining whether the first time difference value is greater than the time difference value threshold and the second time difference value is less than the time difference value threshold; If the determination is yes, it is determined that the latest change is the conflict root cause, a rollback scheme is triggered, the high-priority policy is rolled back to the previous version of the current version, the dependency relationship hash is synchronously updated, and the online high-priority policy version is replaced in an atomic writing manner; If not, it is determined that the latest change is a solidified contradiction, a blocking solution is triggered, a low-priority policy state is marked as disabled, and a new subject, object, action, and low-priority policy consistent coverage declaration sub-policy with a rejection effect are built, and the coverage declaration sub-policy is assigned a policy priority value not lower than the current global highest priority.

7. The multi-tenant cloud policy conflict adaptive adjustment method of claim 1, wherein, The method for generating the conflict risk assessment record comprises: obtaining a conflict policy pair identifier, a conflict relationship type set, a conflict condition expression, and a conflict detection timestamp corresponding to the access conflict event record; mapping each conflict relationship in the conflict relationship type set to a corresponding conflict risk weight value according to a predefined conflict type weight table; matching the subject corresponding to the conflict condition expression with a pre-built subject resource impact level table to obtain a corresponding subject impact score; matching the object corresponding to the conflict condition expression with a pre-built object resource sensitivity level table to obtain a corresponding object impact score; and matching the action corresponding to the conflict condition expression with a pre-built action operation risk level table to obtain a corresponding action impact score; if there is a priority conflict in the conflict relationship type set, obtaining a corresponding priority difference score based on a pre-built priority difference score table; inputting the conflict risk weight value, the subject impact score, the object impact score, the action impact score, and the priority difference score into a comprehensive conflict risk assessment model to obtain a comprehensive conflict risk score; encapsulating the conflict policy pair identifier, the comprehensive conflict risk score, and the conflict detection timestamp into a conflict risk assessment record.

8. The multi-tenant cloud policy conflict self-adaptive adjustment method according to claim 1, characterized in that, The method for generating the access conflict event record comprises: determining upstream and downstream policy graph nodes having a direct dependency relationship with the policy graph node through a local policy subgraph according to a policy graph node number contained in the policy change event, and constructing a set of affected policy graph nodes; the set of affected policy graph nodes only contains policy graph node pairs having relevance to the current policy change event; respectively performing conditional overlap comparison, effect difference comparison, and priority relationship analysis operations on the standardized policy metadata corresponding to any two policy graph nodes in the set of affected policy graph nodes to generate a set of corresponding comparison result data; determining a conflict relationship according to a predefined conflict determination rule and the set of comparison result data, and generating an access conflict event record.

9. The multi-tenant cloud policy conflict adaptive adjustment method of claim 1, wherein, The method for obtaining the standardized policy description model comprises: respectively connecting the policy monitoring channel to a management plane access interface of a cloud service provider, a policy management access interface of each tenant, and a third-party policy distribution channel, and performing access control policy pulling operations through periodic polling or an event-driven mechanism to obtain basic meta-information associated with each access control policy; the basic meta-information includes a tenant identifier, a policy unique identifier, a policy version number, an effective timestamp, an invalid timestamp, a policy priority, and a scope of action; encapsulating the basic meta-information into a policy source record entity, and assigning a unique policy source record index to each policy; According to the data format type of the access control policy, a matching policy analysis adapter is called to perform format analysis and normalization processing on the policy content, generate a standardized policy metadata structure, and associate the standardized policy metadata structure with a policy source record index; All standardized policy metadata structures are constructed into a standardized policy description model.

10. A multi-tenant cloud policy conflict adaptive adjustment system for implementing the multi-tenant cloud policy conflict adaptive adjustment method of any one of claims 1-9, characterized in that, The method comprises the following steps: A policy standardization module is configured to collect access control policies of different levels in a multi-tenant cloud computing environment in real time, and convert access control policies in different formats into a standardized policy description model; A policy graph construction module is configured to construct an incremental policy graph with dependency relationships and conditional overlap relationships based on the standardized policy description model; An access conflict detection module is configured to perform real-time analysis on the incremental policy graph based on policy change events obtained through an event listening mechanism, identify potential conflict relationships between access control policies, and generate access conflict event records; A conflict risk assessment module is configured to perform quantitative analysis and hierarchical evaluation based on the access conflict event records, determine the risk level of the access conflict events, and generate conflict risk assessment records; A conflict intelligent adjustment module is configured to adaptively generate access conflict adjustment strategies and automatically execute the access conflict adjustment strategies based on the conflict risk assessment records and predefined access conflict processing rules.

Images