Cloud resource access control method and device, electronic equipment and storage medium

Abstract

The invention provides a cloud resource access control method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining a first model parameter of a first permission prediction model when a first permission prediction model is trained through sample data iteration at the time and a convergence condition is determined not to be satisfied, sending the first model parameter to a server; second model parameters sent by the server are received, the second model parameters are determined based on the multiple first model parameters, and different first model parameters are sent to the server by different clients; and next iterative training is carried out on the first permission prediction model according to the sample data and the second model parameter until it is determined that the convergence condition is met, a target permission prediction model is obtained, and the target permission prediction model is used for determining whether a user is allowed to access cloud resources or not. The technical problems that in the prior art, cloud resource access control is not high in efficiency, not flexible enough and poor in effect are solved.

Description

Technical Field

[0001] This disclosure relates to the fields of cloud computing, big data, and edge computing technologies, and in particular to a cloud resource access control method, apparatus, electronic device, and storage medium. Background Technology

[0002] With the development of cloud computing technology, using multi-cloud strategies to manage stored data has become an increasingly popular approach. However, the accompanying security issues have become one of the major challenges facing the cloud security field. In a multi-cloud storage environment, access control technology is directly related to the privacy protection of data in the cloud and plays a crucial role in cloud data security.

[0003] Access control technologies in related fields lack security protection for user information, and the complexity and diversity of multi-cloud environments increase the difficulty of access control, resulting in low efficiency, inflexibility, and poor effectiveness of cloud resource access control. Summary of the Invention

[0004] This disclosure aims to at least partially address one of the technical problems in the related art.

[0005] To this end, this disclosure proposes a cloud resource access control method, device, electronic device, computer-readable storage medium, and computer program product, which can greatly improve the security of user information and allocate personalized access permissions that meet security requirements based on user attribute characteristics, thereby improving the efficiency, flexibility, and effectiveness of cloud resource access control.

[0006] The first aspect of this disclosure proposes a cloud resource access control method applied to a client, comprising: in the case of iteratively training a first permission prediction model using sample data and determining that the convergence condition is not met, obtaining first model parameters of the first permission prediction model and sending the first model parameters to a server; receiving second model parameters sent by the server, wherein the second model parameters are determined based on multiple first model parameters, and different first model parameters are sent to the server by different clients; and performing a next iteration of training on the first permission prediction model based on the sample data and the second model parameters until it is determined that the convergence condition is met, thereby obtaining a target permission prediction model, wherein the target permission prediction model is used to determine whether a user is allowed to access cloud resources.

[0007] A second aspect of this disclosure provides a cloud resource access control method applied to a server, comprising: receiving first model parameters sent by each client, wherein the first model parameters are parameters of a first permission prediction model, and the first model parameters are obtained by the client when it iteratively trains the first permission prediction model with sample data in the current iteration and determines that the convergence condition has not been met; determining second model parameters based on multiple first model parameters; and sending the second model parameters to each client, wherein the second model parameters are used by the client to perform the next iteration training of the first permission prediction model until it is determined that the convergence condition is met to obtain a target permission prediction model, wherein the target permission prediction model is used to determine whether to allow a user to access cloud resources. A third aspect of this disclosure provides a cloud resource access control device configured on a client, comprising: an acquisition module, configured to acquire first model parameters of the first permission prediction model and send the first model parameters to a server when, in the current iteration of training a first permission prediction model using sample data and it is determined that the convergence condition has not been met; a first receiving module, configured to receive second model parameters sent by the server, wherein the second model parameters are determined based on multiple first model parameters, and different first model parameters are sent to the server by different clients; and a training module, configured to perform a next iteration of training on the first permission prediction model based on the sample data and the second model parameters until it is determined that the convergence condition is met, thereby obtaining a target permission prediction model, wherein the target permission prediction model is used to determine whether a user is allowed to access cloud resources.

[0008] This fourth aspect of the disclosure provides a cloud resource access control device configured on a server, comprising: a second receiving module for receiving first model parameters sent by each client, wherein the first model parameters are parameters of a first permission prediction model, obtained by the client during the current iteration of training the first permission prediction model with sample data and determining that the convergence condition has not been met; a determining module for determining second model parameters based on multiple first model parameters; and a sending module for sending the second model parameters to each client, wherein the second model parameters are used by the client to perform the next iteration of training on the first permission prediction model until the convergence condition is met, thereby obtaining a target permission prediction model, wherein the target permission prediction model is used to determine whether to allow a user to access cloud resources.

[0009] A fifth aspect of this disclosure provides an electronic device, including: a processor and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the cloud resource access control method as proposed in the first aspect of this disclosure, or to implement the cloud resource access control method as proposed in the second aspect of this disclosure.

[0010] A sixth aspect of this disclosure provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, are used to implement the cloud resource access control method as proposed in the first aspect of this disclosure, or to implement the cloud resource access control method as proposed in the second aspect of this disclosure.

[0011] A seventh aspect of this disclosure provides a computer program product, including a computer program that, when executed by a processor, implements the cloud resource access control method as proposed in the first aspect of this disclosure, or implements the cloud resource access control method as proposed in the second aspect of this disclosure.

[0012] The cloud resource access control method, apparatus, electronic device, computer-readable storage medium, and computer program product disclosed herein, through iterative training of a first permission prediction model using sample data and determining that the convergence condition has not been met, obtains first model parameters of the first permission prediction model, sends the first model parameters to the server, and receives second model parameters sent by the server. The second model parameters are determined based on multiple first model parameters, which are sent to the server by different clients. The first permission prediction model is then iteratively trained again based on the sample data and the second model parameters until the convergence condition is met, resulting in a target permission prediction model. This target permission prediction model is used to determine whether a user is allowed to access cloud resources. Thus, through a federated learning framework, high-performance distributed training of the permission prediction model is achieved by coordinating multiple sample data sources while ensuring the privacy of local data on each client. In this process, the client can iteratively update the first permission prediction model using local data and upload the first model parameters to the server. The server aggregates the first model parameters from multiple clients to generate global second model parameters and distributes them. Each client updates its local model accordingly and performs the next round of training. Through multiple iterations, the dispersed model knowledge is effectively fused, ultimately resulting in a global target permission prediction model with stronger generalization ability and the ability to accurately determine user cloud resource access permissions. Simultaneously, it ensures that the original training data does not leave the local machine, meeting privacy protection requirements. In summary, the method provided in this embodiment can greatly improve the security of user information. Furthermore, by applying a federated learning framework, personalized access permissions that meet security requirements can be assigned based on user attribute characteristics, improving the efficiency, flexibility, and effectiveness of cloud resource access control.

[0013] Additional aspects and advantages of this disclosure will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this disclosure. Attached Figure Description

[0014] The above and / or additional aspects and advantages of this disclosure will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, in which: Figure 1 This is a flowchart illustrating a cloud resource access control method provided in an embodiment of the present disclosure. Figure 2 This is a flowchart illustrating another cloud resource access control method provided in an embodiment of this disclosure; Figure 3 This is a flowchart illustrating yet another cloud resource access control method provided in an embodiment of this disclosure; Figure 4 This is a schematic diagram of the ABAC cloud resource access policy control scheme based on FCF in the embodiments of this disclosure; Figure 5 This is a schematic diagram of the structure of a cloud resource access control device provided in an embodiment of the present disclosure; Figure 6 This is a schematic diagram of another cloud resource access control device provided in an embodiment of the present disclosure; Figure 7 A block diagram of an exemplary electronic device suitable for implementing embodiments of the present disclosure is shown. Detailed Implementation

[0015] Embodiments of this disclosure are described in detail below. Examples of these embodiments are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this disclosure, and should not be construed as limiting this disclosure.

[0016] It should be noted that all information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.), and signals involved in this disclosure are authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. The acquisition, transmission, storage, use, and processing of data in the technical solution of this disclosure all comply with the relevant provisions of national laws and regulations.

[0017] It should be noted that in the embodiments disclosed herein, certain software, components, models, and other existing solutions in the industry may be mentioned. These should be considered as exemplary and are intended only to illustrate the feasibility of implementing the technical solutions disclosed herein. However, they do not mean that the applicant has used or necessarily used such solutions.

[0018] Figure 1 This is a flowchart illustrating a cloud resource access control method provided in an embodiment of the present disclosure.

[0019] This embodiment illustrates the example of a cloud resource access control method being configured in a cloud resource access control device. In this embodiment, the cloud resource access control method can be configured in a cloud resource access control device, and the cloud resource access control device can be set in an electronic device, such as in a client running on an electronic device, without limitation.

[0020] like Figure 1 As shown, the cloud resource access control method includes: S101: If the first permission prediction model is trained iteratively using sample data in this iteration and it is determined that the convergence condition has not been met, the first model parameters of the first permission prediction model are obtained and sent to the server.

[0021] Optionally, the first permission prediction model is a permission prediction model under training. The permission prediction model is used to predict whether a user (or client) is allowed to access cloud resources. There can be one or more cloud resources, and the permission prediction model can be used to predict whether a user (or client) is allowed to access one or more specific cloud resources.

[0022] Optionally, sample data can be collected and used to iteratively train the first-authority prediction model.

[0023] Optionally, the sample data may include at least one of the following: user attribute data, cloud resource attribute data, and cloud resource access data.

[0024] Optionally, at least one of the collected user attribute data, cloud resource attribute data, and cloud resource access data can be used as input to the first permission prediction model. The prediction result output by the first permission prediction model is then determined. Based on the prediction result and the label result, it is determined whether the convergence condition is met. If the convergence condition is not met, the first model parameters of the first permission prediction model are obtained and sent to the server. In other words, the first model parameters are the model parameters of the first permission prediction model after training iteratively, assuming that the first permission prediction model has not met the convergence condition.

[0025] Optionally, in some embodiments, the process of obtaining the first model parameters of the first permission prediction model may involve determining a loss function and then determining the first model parameters of the first permission prediction model based on the loss function and cloud resource attribute data in the sample data. Thus, by defining a loss function and performing forward and backward propagation calculations based on cloud resource attribute data in the sample data, the prediction error of the model on local samples is quantified into an optimizable objective. Then, optimization algorithms such as gradient descent are used to iteratively update the model parameters, thereby generating first model parameters that can minimize prediction loss and accurately capture cloud resource access control patterns. This provides a model foundation effectively trained on local data for subsequent federated aggregation.

[0026] Optionally, in some embodiments, in the process of obtaining the first model parameters of the first permission prediction model, the prediction output of the model on the cloud resource attribute sample data is calculated by forward propagation, the difference between the prediction result and the real permission label is quantified based on a preset loss function (such as cross-entropy), and the gradient of the loss function with respect to the weights of each layer of the model is automatically calculated by backpropagation algorithm, and the network parameters are iteratively updated by gradient descent method, thereby obtaining the first model parameters trained on the current local data.

[0027] Optionally, if the first permission prediction model is trained in the current iteration and it is determined that the convergence condition is not met, the first model parameters of the first permission prediction model can be obtained and then sent to the server.

[0028] Optionally, there can be multiple clients, in which case each client can execute the process to send the first model parameter to the server, so that the server can aggregate the multiple first model parameters sent by multiple clients respectively.

[0029] S102: Receive the second model parameters sent by the server, wherein the second model parameters are determined based on multiple first model parameters, and different first model parameters are sent to the server by different clients.

[0030] Optionally, after sending the first model parameters to the server, the client can receive the second model parameters sent by the server. The second model parameters are determined based on multiple first model parameters, and different first model parameters are sent to the server by different clients.

[0031] Optionally, the server can aggregate multiple first model parameters to obtain second model parameters. For example, it can perform weighted fusion of multiple first model parameters to obtain second model parameters. Alternatively, the server can fuse multiple first model parameters and update the server's local global model based on the fused model parameters. After the update is complete, the model parameters of the global model are obtained as the second model parameters. There are no restrictions on this.

[0032] S103: The first permission prediction model is trained in the next iteration based on the sample data and the second model parameters until the convergence condition is met, and the target permission prediction model is obtained. The target permission prediction model is used to determine whether to allow a user to access cloud resources.

[0033] Optionally, after receiving the second model parameters, the client can perform another iteration training on the local first permission prediction model based on the user attribute data, cloud resource attribute data, cloud resource access data and the second model parameters in the sample data, until it is determined that the first permission prediction model meets the convergence condition after the second iteration training, and the trained first permission prediction model is determined as the target permission prediction model.

[0034] Optionally, after obtaining the target permission prediction model, the target permission prediction model can be used to determine whether to allow a user to access cloud resources.

[0035] In this embodiment, if the first permission prediction model is not converged during iterative training using sample data, the first model parameters of the first permission prediction model are obtained and sent to the server. The server then sends second model parameters, which are determined based on multiple first model parameters sent by different clients. The first permission prediction model is then iteratively trained again using the sample data and second model parameters until convergence is achieved, resulting in a target permission prediction model. This target permission prediction model is used to determine whether a user is allowed to access cloud resources. Thus, through a federated learning framework, high-performance distributed training of the permission prediction model is achieved by collaborating with multiple sample data sources while ensuring the privacy of each client's local data. During this process, clients can iteratively update the first permission prediction model using local data and upload the first model parameters to the server. The server aggregates the first model parameters from multiple clients to generate global second model parameters and distributes them. Each client updates its local model accordingly and performs the next round of training. Through multiple iterations, the dispersed model knowledge is effectively integrated, ultimately resulting in a global target permission prediction model with stronger generalization ability and accurate judgment of user cloud resource access permissions. This ensures that the original training data does not leave the local machine, meeting privacy protection requirements. In summary, the method provided in this disclosure can greatly improve the security of user information. Furthermore, by applying a federated learning framework, personalized access permissions that meet security requirements can be assigned based on user attribute characteristics, improving the efficiency, flexibility, and effectiveness of cloud resource access control.

[0036] Figure 2 This is a flowchart illustrating another cloud resource access control method provided in an embodiment of this disclosure.

[0037] This embodiment illustrates the example of a cloud resource access control method being configured in a cloud resource access control device. In this embodiment, the cloud resource access control method can be configured in a cloud resource access control device, and the cloud resource access control device can be set in an electronic device, such as in a client running on an electronic device, without limitation.

[0038] like Figure 2 As shown, the cloud resource access control method includes: S201: Receive the third model parameters sent by the server, wherein the third model parameters are used to configure the initial permission prediction model to obtain the first permission prediction model.

[0039] Optionally, the server can initialize a global model (e.g., a Federated Collaborative Filtering (FCF) model), set its parameters and structure, and then use these global model parameters as parameters for a third model, which is then sent to the client. The client can receive the third model parameters sent by the server and configure an initial permission prediction model to obtain a first permission prediction model.

[0040] Optionally, the aforementioned third model parameters can also be considered as a copy of a model. After the server sends the third model parameters to the client, the client can use the third model parameters to configure the initial permission prediction model to obtain the first permission prediction model, and then iteratively train the first permission prediction model based on local sample data.

[0041] Optionally, if there are multiple clients, each client can receive the third model parameters sent by the server and configure the initial permission prediction model locally to obtain the first permission prediction model.

[0042] S202: Based on the user attribute data, cloud resource attribute data, and cloud resource access data in the sample data, train the first permission prediction model for the current iteration.

[0043] Optionally, user attribute data, cloud resource attribute data, and cloud resource access data from the sample data can be used as input to the first permission prediction model. The first permission prediction model performs permission prediction based on the user attribute data, cloud resource attribute data, and cloud resource access data to obtain first prediction information. The first prediction information can be used to indicate whether the user to which the user attribute data belongs is allowed to access which cloud resources(s). Then, the prediction information can be compared with the tag information to determine whether the convergence condition is met.

[0044] S203: If the first permission prediction model is trained iteratively using sample data in this iteration and it is determined that the convergence condition has not been met, obtain the first model parameters of the first permission prediction model and send the first model parameters to the server.

[0045] For a description of S203, please refer to the above embodiments, and it will not be repeated here.

[0046] S204: Receive the second model parameters sent by the server, wherein the second model parameters are determined based on multiple first model parameters, and different first model parameters are sent to the server by different clients.

[0047] Optionally, after sending the first model parameters to the server, the client can receive the second model parameters sent by the server. The second model parameters are determined based on multiple first model parameters, and different first model parameters are sent to the server by different clients.

[0048] Optionally, the server can aggregate multiple first model parameters to obtain second model parameters. For example, it can perform weighted fusion of multiple first model parameters to obtain second model parameters. Alternatively, the server can fuse multiple first model parameters and update the server's local global model based on the fused model parameters. After the update is complete, the model parameters of the global model are obtained as the second model parameters. There are no restrictions on this.

[0049] S205: Update the first permission prediction model according to the second model parameters to obtain the second permission prediction model.

[0050] Optionally, after receiving the second model parameters, the client can update the first permission prediction model based on the second model parameters to obtain the second permission prediction model. This process can be viewed as the server redistributing a copy of the global model to each client. The distributed copy of the global model may contain the aforementioned second model parameters to support the client in performing the next iteration training of the local second permission prediction model.

[0051] S206: Train the second permission prediction model in the next iteration based on the sample data until the convergence condition is met, and obtain the target permission prediction model, which is used to determine whether to allow users to access cloud resources.

[0052] Optionally, user attribute data, cloud resource attribute data, and cloud resource access data from the sample data can be used as input to the second permission prediction model. The second permission prediction model performs permission prediction based on the user attribute data, cloud resource attribute data, and cloud resource access data to obtain second prediction information. The second prediction information can be used to indicate whether the user to which the user attribute data belongs is allowed to access which cloud resources(s). Then, the prediction information can be compared with the tag information to determine whether the convergence condition is met.

[0053] Optionally, during the next iteration training of the second permission prediction model based on sample data, a loss function can be determined, and user attribute data, cloud resource attribute data, and cloud resource access data from the sample data can be input into the second permission prediction model to obtain the prediction information output by the second permission prediction model. This prediction information represents the degree of matching between user and cloud resource access permissions. Furthermore, based on the loss function and the prediction information, it is determined whether the convergence condition is met. Thus, by introducing a loss function as a quantitative evaluation index for the model training process, user attribute data, cloud resource attribute data, and cloud resource access data are input into the second permission prediction model in each iteration to generate predicted values ​​representing the degree of permission matching. The model's convergence condition is dynamically determined based on the error value calculated using the loss function. This mechanism achieves closed-loop control of the training process, enabling continuous optimization of model parameters based on feedback, ultimately improving the accuracy and generalization ability of permission prediction. Simultaneously, it ensures that the training process automatically terminates when the expected performance threshold is reached, avoiding overfitting and improving training efficiency.

[0054] In this embodiment, if the first permission prediction model is not converged during iterative training using sample data, the first model parameters of the first permission prediction model are obtained and sent to the server. The server then sends second model parameters, which are determined based on multiple first model parameters sent by different clients. The first permission prediction model is then iteratively trained again using the sample data and second model parameters until convergence is achieved, resulting in a target permission prediction model. This target permission prediction model is used to determine whether a user is allowed to access cloud resources. Thus, through a federated learning framework, high-performance distributed training of the permission prediction model is achieved by collaborating with multiple sample data sources while ensuring the privacy of each client's local data. During this process, clients can iteratively update the first permission prediction model using local data and upload the first model parameters to the server. The server aggregates the first model parameters from multiple clients to generate global second model parameters and distributes them. Each client updates its local model accordingly and performs the next round of training. Through multiple iterations, the dispersed model knowledge is effectively integrated, ultimately resulting in a global target permission prediction model with stronger generalization ability and accurate judgment of user cloud resource access permissions. This ensures that the original training data does not leave the local machine, meeting privacy protection requirements. In summary, the method provided in this disclosure can greatly improve the security of user information. Furthermore, by applying a federated learning framework, personalized access permissions that meet security requirements can be assigned based on user attribute characteristics, improving the efficiency, flexibility, and effectiveness of cloud resource access control.

[0055] It should be noted that in the following embodiments, the descriptions of the same or corresponding terms and method steps can be found in the above embodiments, and will not be repeated here.

[0056] Figure 3 This is a flowchart illustrating yet another cloud resource access control method provided in an embodiment of this disclosure.

[0057] This embodiment illustrates the example of configuring a cloud resource access control method within a cloud resource access control device. In this embodiment, the cloud resource access control method can be configured within the cloud resource access control device, and the cloud resource access control device can be located on a server; there are no restrictions on this.

[0058] like Figure 3 As shown, the cloud resource access control method includes: S301: Receive the first model parameters sent by each client, wherein the first model parameters are the parameters of the first permission prediction model, and the first model parameters are obtained by the client when it iteratively trains the first permission prediction model with sample data in the current instance and determines that the convergence condition has not been met.

[0059] S302: Determine the second model parameters based on multiple first model parameters.

[0060] Optionally, in the process of determining the second model parameters based on multiple first model parameters, the multiple first model parameters can be aggregated to obtain aggregated model parameters. The fourth permission prediction model (the fourth permission prediction model refers to the global model deployed locally on the server) is then trained iteratively based on these aggregated model parameters. During this iterative training, the model parameters of the fourth permission prediction model are obtained as the second model parameters. The fourth permission prediction model is the global permission prediction model. If the convergence condition is not met, the fourth permission prediction model is trained in the next iteration. Thus, by aggregating the first model parameters from multiple clients, a better global model parameter (i.e., the aggregated model parameter) is generated, and the fourth permission prediction model (global model) on the server is directly updated using the aggregated model parameter. This approach efficiently integrates discrete client knowledge into a unified global model. Through multiple iterations, the global model continuously learns and approaches the optimal state until convergence, ultimately ensuring the production of a global permission prediction model that can represent the data distribution of all clients and has strong generalization capabilities.

[0061] For example, a federated averaging algorithm can be used to calculate a weighted average of the received first model parameters based on the size of each client's local dataset, resulting in aggregated model parameters. These aggregated model parameters serve as the update direction for the global model (an optional example of the aforementioned fourth-permission prediction model) in this iteration. Then, the server configures its local fourth-permission prediction model (i.e., the global model) based on the aggregated model parameters, completing a substantial model synchronization and iterative update. The updated global model parameters are then defined as the second model parameters for distribution to clients in the next round. This process is executed cyclically, continuously fusing the training results of distributed nodes (i.e., multiple clients) through multiple iterations, driving the global model to continuously optimize before convergence is met. The ultimate goal is to progressively approach the ideal performance of the global model under centralized data training, while ensuring data privacy.

[0062] S303: Send the second model parameters to each client, wherein the second model parameters are used by the client to train the first permission prediction model in the next iteration until the convergence condition is met, and obtain the target permission prediction model, wherein the target permission prediction model is used to determine whether to allow the user to access cloud resources.

[0063] In this embodiment, the server receives first model parameters sent by each client. These first model parameters are parameters of a first permission prediction model, obtained by the client during the iterative training of the first permission prediction model using sample data, after determining that the convergence condition has not been met. Based on multiple first model parameters, the server determines second model parameters and sends these second model parameters to each client. These second model parameters are used by the client to train the first permission prediction model in the next iteration until the convergence condition is met, resulting in a target permission prediction model. This target permission prediction model is used to determine whether a user is allowed to access cloud resources. Therefore, the server aggregates local model parameters (first model parameters) from multiple clients to generate global model parameters (second model parameters). Through multiple rounds of "local training - parameter upload - global aggregation - parameter distribution" closed loops, while ensuring that the user's original data does not leave the local machine, the server collaboratively optimizes and ultimately obtains a high-performance, generalizable global target permission prediction model, thereby achieving precise and unified control over user access to cloud resources.

[0064] Examples of the above embodiments are illustrated below: Optionally, the server can be referred to as the central server or the main server.

[0065] The method provided in this disclosure proposes an attribute-based access control (ABAC) cloud resource access policy control scheme based on the FCF federated recommendation algorithm. It recommends the optimal ABAC policy combination by analyzing contextual information such as historical access logs and user attributes using AI. First, it collects client access data to cloud resources and distributes an initialized model (an optional example of the third model parameters mentioned above) to each client. Each client trains the model (an optional example of the first permission prediction model mentioned above) and calculates its gradient based on its local dataset (an optional example of the sample data mentioned above), with different clients isolated from each other. Then, the client uploads the trained gradient (an optional example of the first model parameters mentioned above) to the central server. The central server aggregates the uploaded gradients to update the global model and then distributes the updated global model back to each client (an optional example of the second model parameters mentioned above). The client trains the new model locally using the new model (an optional example of the second permission prediction model mentioned above) and repeats the above training process. The iterative process continues until the model converges and can be used for inference to obtain the ABAC policy classification result.

[0066] like Figure 4 As shown, Figure 4 This is a schematic diagram of the ABAC cloud resource access policy control scheme based on FCF in the embodiments of this disclosure.

[0067] Optionally, the model can be initialized by collecting historical data on user access to multiple cloud resources from various clients (such as different companies, departments, or user devices). This data should include key ABAC information such as basic user attributes (e.g., name, role, position, department), accessed cloud resources (e.g., databases, file servers, API interfaces), access time, and access result (success or failure). It should also include access permissions used as tags. The collected data is then cleaned to remove duplicate, invalid, or abnormal records. Features are encoded, standardized, and vectorized for any user. Its eigenvector is denoted as .

[0068] Optionally, the Federated Collaborative Filtering (FCF) model can be initialized on the server side, setting its parameters and structure. The FCF federated recommendation algorithm employs a federated learning paradigm. The idea is that the server distributes the master model (factor matrix) to the client. The client trains its own factor matrix based on local implicit feedback data (such as permissions and attribute records), uploading only the updated model weights, not the original data. The server then aggregates the client weights, updates the master model, and redistributes the model, forming an iterative optimization loop.

[0069] Optional, local model training: The initialized model is distributed to each client, and each client receives a copy of the model. The client trains the model locally using its local dataset, calculating gradients or updating parameters. The client first calculates the loss function based on its local data, as follows:

[0070] Among them, the loss function for model training Used to measure recommendation scores The goal is to minimize the loss to improve model accuracy by minimizing the deviation from actual access permissions. , A recommended score is assigned to user u for access to cloud resource i. This score measures the degree of matching between user u and resource i's access permissions. A higher score indicates that the user is more suitable to obtain access to that resource. The matching degree is calculated by performing an inner product operation on the user feature vector (which can be determined based on user attribute data) and the resource feature vector (which can be determined based on cloud resource attribute data). This result serves as the base score for recommending access permissions. is the feature vector of user u, which contains the numerical features of user attributes (such as role, department, etc.) after vectorization. Let be the feature vector of cloud resource i, containing the numerical features of resource attributes (such as resource type, sensitivity level, etc.) after vectorization. The inner product result can effectively reflect the synergy across feature dimensions, providing a quantitative basis for subsequent permission allocation. Adjustment factor This is used to control the weight of the recommendation score on the loss. Regularization coefficient. This is used to prevent overfitting and balance model complexity with fitting performance. The regularization term is the user feature vector. and resource feature vectors The sum of the squares of the L2 norm.

[0071] Optionally, the client updates the local model parameters using gradient descent:

[0072]

[0073] Among them, the loss function For resource feature vectors The partial derivatives reflect The extent to which small changes affect the loss. This is an intermediate function that integrates the recommendation score. With user feature vector The relationship is as follows. Then, local parameters are updated using the following formula:

[0074] Specifically, the client updates the resource feature vector locally based on the gradient descent algorithm, along the direction of decreasing loss function (i.e., the negative gradient direction). By iterating through this process, the loss function J is gradually reduced, thus improving the recommendation score. To provide closer access to actual data, the iterative process continues until the model converges or reaches the predetermined number of training epochs. Instead of transmitting the raw data, the client then uploads the updated gradients (or local model parameters) to the central server to ensure data privacy.

[0075] Optional, gradient aggregation: Each client uploads the gradients or parameters obtained during training to the main server. The main server aggregates the uploaded gradients or parameters and updates the global model. A weighted average method is used during the aggregation process to ensure the accuracy and robustness of the model.

[0076] Optional, model update and iteration: The server calculates the global loss function and redistributes the updated global model to each client. For user i's request score to access resource j... It can automatically generate ABAC strategy rules, such as: "When the user feature vector..." With resource feature vector Access is allowed when the inner product is ≥0.8; otherwise, it is rejected. If the loss function converges, the iteration terminates.

[0077] Optionally, the training data and model of the FCF algorithm can be continuously updated as user attributes and cloud resources change. New user access data can be collected periodically, cleaned and preprocessed, and then added to the training dataset.

[0078] This disclosure implements cross-domain federated learning: in a multi-cloud environment, collaborative learning of cross-domain user attributes is achieved through local client training and parameter aggregation. This generates unified access policies without centralized storage of cross-domain attribute data, solving the problems of difficult attribute recognition and data silos in traditional cross-domain access control. It also provides a dynamic policy generation method based on federated learning: automatically generating and updating ABAC policies using the iterative training results of the FCF model. Through real-time mapping of user attribute features and access permissions, the policy is dynamically adjusted according to changes in user attributes and resources, replacing traditional manual configuration or static rule update modes. Finally, it includes a privacy-preserving parameter aggregation strategy: by aggregating client model parameters, centralized transmission and storage of original user attribute data are avoided, ensuring user privacy while optimizing policies, unlike access control schemes that rely on centralized data training.

[0079] The method provided in this disclosure, through a distributed training architecture of a federated recommendation algorithm, enables clients in different cloud domains to retain attribute data locally and only upload model parameters for aggregation. This achieves collaborative learning of cross-domain attributes and unified generation of access policies, overcoming the limitations of "attribute silos" and "policy barriers" in traditional cross-domain access control. It significantly improves cross-domain access control capabilities. Based on the federated learning paradigm, the server only collects intermediate model parameters (not raw data), while client data is stored and trained locally. The global model is updated through parameter aggregation, reducing privacy leakage risks and improving user information security from the data flow stage. Through continuous iterative training of the FCF model (client-side local updates + server-side global aggregation), changes in user attributes (such as role changes, department adjustments) and cloud resources (such as new API interfaces, database permission changes) can be captured in real time, automatically updating the attribute-permission mapping relationship. This allows ABAC policies to dynamically adapt to changes in multi-cloud environments without manual intervention. By using the FCF federated recommendation algorithm to machine learn historical access data, the potential correlation between user attributes and access permissions is automatically extracted, reducing the cost of manual rule design. Simultaneously, federated learning integrates multi-domain data to improve the global adaptability of policies and reduce the technical complexity of cross-domain access control.

[0080] Figure 5 This is a schematic diagram of the structure of a cloud resource access control device provided in an embodiment of this disclosure.

[0081] like Figure 5As shown, the cloud resource access control device 50 is configured on the client, and the cloud resource access control device 50 includes: The acquisition module 501 is used to acquire the first model parameters of the first permission prediction model when the first permission prediction model is trained iteratively with sample data and it is determined that the convergence condition has not been met, and to send the first model parameters to the server.

[0082] The first receiving module 502 is used to receive the second model parameters sent by the server. The second model parameters are determined based on multiple first model parameters, and different first model parameters are sent to the server by different clients.

[0083] The training module 503 is used to train the first permission prediction model in the next iteration based on the sample data and the second model parameters until the convergence condition is met, so as to obtain the target permission prediction model. The target permission prediction model is used to determine whether to allow a user to access cloud resources.

[0084] It should be noted that the foregoing explanation of the cloud resource access control method also applies to the cloud resource access control device of this embodiment, and will not be repeated here.

[0085] In this embodiment, if the first permission prediction model is not converged during iterative training using sample data, the first model parameters of the first permission prediction model are obtained and sent to the server. The server then sends second model parameters, which are determined based on multiple first model parameters sent by different clients. The first permission prediction model is then iteratively trained again using the sample data and second model parameters until convergence is achieved, resulting in a target permission prediction model. This target permission prediction model is used to determine whether a user is allowed to access cloud resources. Thus, through a federated learning framework, high-performance distributed training of the permission prediction model is achieved by collaborating with multiple sample data sources while ensuring the privacy of each client's local data. During this process, clients can iteratively update the first permission prediction model using local data and upload the first model parameters to the server. The server aggregates the first model parameters from multiple clients to generate global second model parameters and distributes them. Each client updates its local model accordingly and performs the next round of training. Through multiple iterations, the dispersed model knowledge is effectively integrated, ultimately resulting in a global target permission prediction model with stronger generalization ability and accurate judgment of user cloud resource access permissions. This ensures that the original training data does not leave the local machine, meeting privacy protection requirements. In summary, the method provided in this disclosure can greatly improve the security of user information. Furthermore, by applying a federated learning framework, personalized access permissions that meet security requirements can be assigned based on user attribute characteristics, improving the efficiency, flexibility, and effectiveness of cloud resource access control.

[0086] Figure 6 This is a schematic diagram of another cloud resource access control device provided in an embodiment of this disclosure.

[0087] like Figure 6 As shown, the cloud resource access control device 60 is configured on the server, and the cloud resource access control device 60 includes: The second receiving module 601 is used to receive the first model parameters sent by each client, wherein the first model parameters are the parameters of the first permission prediction model, and the first model parameters are obtained by the client when it iteratively trains the first permission prediction model with sample data in the current instance and determines that the convergence condition has not been met.

[0088] The determination module 602 is used to determine the second model parameters based on multiple first model parameters.

[0089] The sending module 603 is used to send the second model parameters to each client. The second model parameters are used by the client to train the first permission prediction model in the next iteration until the convergence condition is met, so as to obtain the target permission prediction model. The target permission prediction model is used to determine whether to allow a user to access cloud resources.

[0090] It should be noted that the foregoing explanation of the cloud resource access control method also applies to the cloud resource access control device of this embodiment, and will not be repeated here.

[0091] In this embodiment, the server receives first model parameters sent by each client. These first model parameters are parameters of a first permission prediction model, obtained by the client during the iterative training of the first permission prediction model using sample data, after determining that the convergence condition has not been met. Based on multiple first model parameters, the server determines second model parameters and sends these second model parameters to each client. These second model parameters are used by the client to train the first permission prediction model in the next iteration until the convergence condition is met, resulting in a target permission prediction model. This target permission prediction model is used to determine whether a user is allowed to access cloud resources. Therefore, the server aggregates local model parameters (first model parameters) from multiple clients to generate global model parameters (second model parameters). Through multiple rounds of "local training - parameter upload - global aggregation - parameter distribution" closed loops, while ensuring that the user's original data does not leave the local machine, the server collaboratively optimizes and ultimately obtains a high-performance, generalizable global target permission prediction model, thereby achieving precise and unified control over user access to cloud resources.

[0092] To implement the above embodiments, this disclosure also proposes an electronic device, including: a processor and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method provided in the foregoing embodiments. To implement the above embodiments, this disclosure also proposes a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods provided in the foregoing embodiments.

[0093] To implement the above embodiments, this disclosure also proposes a computer program product, including a computer program that, when executed by a processor, implements the methods provided in the foregoing embodiments.

[0094] Figure 7 A block diagram of an exemplary electronic device suitable for implementing embodiments of the present disclosure is shown. Figure 7 The electronic device 12 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0095] like Figure 7 As shown, the electronic device 12 is represented in the form of a general-purpose computing device. The components of the electronic device 12 may include, but are not limited to: one or more processors or processing units 16, memory 28, and bus 18 connecting different system components (including memory 28 and processing unit 16).

[0096] Bus 18 represents one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any of the various bus architectures. Examples of these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0097] Electronic device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by electronic device 12, including volatile and non-volatile media, removable and non-removable media.

[0098] Memory 28 may include computer system readable media in the form of volatile memory, such as Random Access Memory (RAM) 30 and / or cache 32. Electronic device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 34 may be used to read and write non-removable, non-volatile magnetic media (… Figure 7 Not shown; usually referred to as a "hard drive".

[0099] although Figure 7 As not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk") and an optical disc drive for reading and writing to a removable non-volatile optical disc (e.g., a compact disc read-only memory (CD-ROM), a digital video disc read-only memory (DVD-ROM), or other optical media) may be provided. In these cases, each drive may be connected to bus 18 via one or more data media interfaces. Memory 28 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of the embodiments of this disclosure.

[0100] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in memory 28. Such program modules 42 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment. Program modules 42 typically perform the functions and / or methods described in the embodiments of this disclosure.

[0101] Electronic device 12 can also communicate with one or more external devices 14 (e.g., keyboard, pointing device, display 24, etc.), and with one or more devices that enable human interaction with electronic device 12, and / or with any device that enables electronic device 12 to communicate with one or more other computing devices (e.g., network card, modem, etc.). This communication can be performed via input / output (I / O) interface 22. Furthermore, electronic device 12 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 20. As shown, network adapter 20 communicates with other modules of electronic device 12 via bus 18. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0102] The processing unit 16 executes various functional applications and data processing by running programs stored in the memory 28, such as implementing the cloud resource access control method mentioned in the foregoing embodiments.

[0103] To implement the above embodiments, this disclosure also proposes an electronic device, including: a processor and a memory communicatively connected to the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method provided in the foregoing embodiments. To implement the above embodiments, this disclosure also proposes a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods provided in the foregoing embodiments.

[0104] To implement the above embodiments, this disclosure also proposes a computer program product, including a computer program that, when executed by a processor, implements the methods provided in the foregoing embodiments.

[0105] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in this disclosure all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0106] It should be noted that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. Furthermore, such collection / sharing should only be conducted after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes authorization of relevant user information before the user uses the function. In addition, any necessary steps must be taken to protect and safeguard access to such personal information data and ensure that others with access to personal information data comply with their privacy policies and procedures.

[0107] This disclosure is intended to provide implementation schemes for users to selectively prevent the use or access to their personal information data. Specifically, this disclosure is intended to provide hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, risks can be minimized by restricting data collection and deleting data. Furthermore, where applicable, such personal information is de-identified to protect user privacy.

[0108] In the foregoing descriptions of the embodiments, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this disclosure. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0109] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this disclosure, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0110] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of preferred embodiments of this disclosure includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of this disclosure pertain.

[0111] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0112] It should be understood that various parts of this disclosure can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0113] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0114] Furthermore, the functional units in the various embodiments of this disclosure can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0115] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of the present disclosure have been shown and described above, it is to be understood that the above embodiments are exemplary and should not be construed as limiting the present disclosure. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present disclosure.

Claims

1. A cloud resource access control method, characterized in that, Applied to a client, the method includes: If the first permission prediction model is trained iteratively using sample data and it is determined that the convergence condition is not met, the first model parameters of the first permission prediction model are obtained and sent to the server. Receive second model parameters sent by the server, wherein the second model parameters are determined based on multiple first model parameters, and different first model parameters are sent to the server by different clients; and The first permission prediction model is trained in the next iteration based on the sample data and the second model parameters until the convergence condition is met, thereby obtaining the target permission prediction model, wherein the target permission prediction model is used to determine whether to allow a user to access cloud resources.

2. The method according to claim 1, characterized in that, The sample data includes at least one of the following: user attribute data, cloud resource attribute data, and cloud resource access data.

3. The method according to claim 2, characterized in that, The method further includes: The server sends a third model parameter, wherein the third model parameter is used to configure an initial permission prediction model to obtain the first permission prediction model. The first permission prediction model is trained in the current iteration based on the user attribute data, cloud resource attribute data, and cloud resource access data.

4. The method according to claim 2, characterized in that, The step of obtaining the first model parameters of the first permission prediction model includes: Determine the loss function; Based on the loss function and the cloud resource attribute data in the sample data, the first model parameters of the first permission prediction model are determined.

5. The method according to claim 1, characterized in that, The step of training the first permission prediction model for the next iteration based on the sample data and the second model parameters includes: The first permission prediction model is updated according to the second model parameters to obtain the second permission prediction model; The second permission prediction model will be trained in the next iteration based on the sample data.

6. The method according to claim 5, characterized in that, The step of training the second permission prediction model in the next iteration based on the sample data includes: Determine the loss function; The user attribute data, cloud resource attribute data, and cloud resource access data in the sample data are input into the second permission prediction model to obtain the prediction information output by the second permission prediction model. The prediction information is used to represent the degree of matching between the user's and the cloud resource's access permissions. Based on the loss function and the prediction information, determine whether the convergence condition is met.

7. A cloud resource access control method, characterized in that, Applied to a server, the method includes: Receive first model parameters sent by each client, wherein the first model parameters are parameters of the first permission prediction model, and the first model parameters are obtained by the client when it iteratively trains the first permission prediction model with sample data in the current instance and determines that the convergence condition has not been met; The second model parameters are determined based on multiple first model parameters; The second model parameters are sent to each client, wherein the second model parameters are used by the client to train the first permission prediction model in the next iteration until the convergence condition is met, thereby obtaining the target permission prediction model, wherein the target permission prediction model is used to determine whether to allow a user to access cloud resources.

8. The method according to claim 7, characterized in that, The sample data includes at least one of the following: user attribute data, cloud resource attribute data, and cloud resource access data.

9. The method according to claim 7, characterized in that, The step of determining the second model parameters based on multiple first model parameters includes: The multiple first model parameters are aggregated to obtain aggregated model parameters; The fourth permission prediction model is trained in the current iteration based on the aggregated model parameters. During the current iteration of training the fourth permission prediction model, the model parameters of the fourth permission prediction model are obtained as the second model parameters. The fourth permission prediction model is a global permission prediction model. If the convergence condition is not met, the fourth permission prediction model is trained in the next iteration.

10. A cloud resource access control device, characterized in that, Configured on a client, the device includes: The acquisition module is used to acquire the first model parameters of the first permission prediction model when the first permission prediction model is trained iteratively with sample data and it is determined that the convergence condition has not been met, and to send the first model parameters to the server. A first receiving module is configured to receive second model parameters sent by the server, wherein the second model parameters are determined based on multiple first model parameters, and different first model parameters are sent to the server by different clients; and The training module is used to perform the next iteration training of the first permission prediction model based on the sample data and the second model parameters until the convergence condition is met, thereby obtaining the target permission prediction model, wherein the target permission prediction model is used to determine whether to allow a user to access cloud resources.

11. A cloud resource access control device, characterized in that, Configured on a server, the device includes: The second receiving module is used to receive the first model parameters sent by each client, wherein the first model parameters are the parameters of the first permission prediction model, and the first model parameters are obtained by the client when it iteratively trains the first permission prediction model with sample data in the current instance and determines that the convergence condition has not been met. The determining module is used to determine the second model parameters based on multiple first model parameters; The sending module is used to send the second model parameters to each client, wherein the second model parameters are used by the client to perform the next iteration training of the first permission prediction model until the convergence condition is met to obtain the target permission prediction model, wherein the target permission prediction model is used to determine whether to allow a user to access cloud resources.

12. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-6, or to implement the method as described in any one of claims 7-9.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-6, or to implement the method as described in any one of claims 7-9.

14. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the method of any one of claims 1-6, or implements the method of any one of claims 7-9.

Images