Access control method, device, medium, program product and system

Abstract

The invention relates to the technical field of cloud services, and particularly provides an access control method, equipment, medium, program product and system, and the method comprises the steps: responding to the received user access authority information sent by a resource access management RAM server, analyzing the user access authority information to obtain a user identifier, a user identity credential and an access authority configuration parameter, wherein the user access permission information is generated after the RAM server receives an access permission configuration request sent by the user terminal; based on an association relationship among the user identity credential, the user identifier and the access permission configuration parameters, storing the association relationship in an access permission information storage object; according to the invention, the reliability of access permission control is improved.

Description

Technical Field

[0001] This disclosure relates to the field of cloud service technology, and in particular to an access control method, device, medium, program product and system. Background Technology

[0002] As the number of cloud computing users grows and its usage becomes more widespread, access control for users in the cloud has become an important guarantee for cloud security. Access control is usually implemented based on Resource Access Management (RAM) services.

[0003] In related technologies, when a user accesses an object storage service, the object storage first uses the user's security credentials to request authentication from the RAM service, and after successful authentication, the object storage continues to provide services.

[0004] However, the access control policies provided in these related technologies rely heavily on RAM services for authentication. If the RAM service fails or the link between the object storage service and the RAM service is abnormal, authentication will fail, thus affecting service reliability. Summary of the Invention

[0005] This disclosure was made in view of the above-mentioned problems. This disclosure provides an access control method, device, medium, program product and system, which improves the reliability of access control.

[0006] According to a first aspect of this disclosure, an access control method is provided, the method being applied to a cloud server, the cloud server including an information management gateway and multiple business instances, comprising: The information management gateway responds to receiving user access permission information sent by the resource access management RAM server, and parses the user access permission information to obtain user identifier, user identity credential, and access permission configuration parameters. The user access permission information is generated by the RAM server after receiving an access permission configuration request sent by the user terminal. The information management gateway stores the association between the user identity credential, the user identifier, and the access permission configuration parameters in an access permission information storage object.

[0007] According to a second aspect of this disclosure, an access control method is provided, the method being applied to a resource access management RAM server, comprising: In response to receiving an access permission configuration request sent by a user terminal, the access permission configuration information sent by the user terminal is obtained, wherein the access permission configuration information is generated by the user terminal in response to a user permission configuration operation; The access permission configuration information is parsed to obtain the user identifier, user identity credential, and access permission configuration parameters, and the association relationship between the user identity credential, the user identifier, and the access permission configuration parameters is stored. Based on the user identity credential, the user identifier, and the access permission configuration parameters, user access permission information is generated and synchronized to the cloud server.

[0008] According to a third aspect of this disclosure, an electronic device is provided, the electronic device including a memory, a processor and a computer program stored in the memory, the processor executing the computer program to implement the method of the first aspect or the second aspect.

[0009] According to a fourth aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the method described in the first or second aspect.

[0010] According to a fifth aspect of this disclosure, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the method described in the first or second aspect.

[0011] According to a sixth aspect of this disclosure, a network system is provided, including a resource access management server and a cloud server, wherein the cloud server is configured to perform the method described in the first aspect; and the resource access management server is configured to perform the method described in the second aspect.

[0012] The access control method, device, medium, program product, and system provided in this disclosure, after receiving user access permission information sent by the RAM server, can store the association between the user identifier, user identity credential, and access permission configuration parameters in an access permission information storage object. Since the user access permission information received by the cloud server is generated by the RAM server after receiving the access permission configuration request sent by the user terminal, it achieves the purpose of synchronizing the user-configured service access permission information from the RAM server to the cloud server. This allows the cloud server to directly perform authentication based on the locally stored access permission information during business request processing, without needing to authenticate through the RAM server. This prevents authentication failures caused by RAM server anomalies or link connection anomalies, improving the reliability of business request authentication on the cloud server.

[0013] It should be understood that both the foregoing general description and the following detailed description are exemplary and intended to provide further illustration of the claimed technology. Attached Figure Description

[0014] The above and other objects, features, and advantages of this disclosure will become more apparent from the more detailed description of the embodiments thereof in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this disclosure and form part of the specification. They are used together with the embodiments of this disclosure to explain the disclosure and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0015] Figure 1 This is a schematic diagram of the architecture of an access control system according to an embodiment of this disclosure.

[0016] Figure 2 This is a flowchart of an access control method according to an embodiment of the present disclosure.

[0017] Figure 3 This is a flowchart of another access control method according to an embodiment of this disclosure.

[0018] Figure 4 This is a flowchart of another access control method according to an embodiment of the present disclosure.

[0019] Figure 5 This is a schematic block diagram of the functional modules of an access control device according to an embodiment of the present disclosure.

[0020] Figure 6 This is a schematic block diagram of the functional modules of another access control device according to an embodiment of the present disclosure.

[0021] Figure 7 This is a schematic diagram of a computer program product according to an embodiment of the present disclosure.

[0022] Figure 8 This is a hardware block diagram of an electronic device according to an embodiment of the present disclosure. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this disclosure more apparent, exemplary embodiments according to this disclosure will now be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this disclosure, and not all embodiments of this disclosure. It should be understood that this disclosure is not limited to the exemplary embodiments described herein.

[0024] To address the aforementioned problems, this disclosure provides an access control scheme, such as... Figure 1 As shown, Figure 1The diagram illustrates the system architecture of the access control scheme provided in this embodiment, including a Resource Access Management (RAM) server 101 and multiple cloud servers 102. The RAM server 101 is used for terminal devices to register user access permission information and sends this information to at least one cloud server 102. This allows business instances in the cloud servers to directly perform authentication on the cloud server upon receiving an access request from the user terminal, thereby improving the reliability of user authentication. The multiple cloud servers can be different types of cloud servers in a cloud service scenario; specifically, they can be determined based on the cloud service scenario, and this embodiment does not limit this. For example, the multiple cloud servers may include computing servers, storage service servers, database servers, and network servers, etc.

[0025] The RAM server 101 and multiple cloud servers 102 can establish wired or wireless connections to implement the access control scheme provided in this embodiment.

[0026] This disclosure provides an access control method, such as... Figure 2 As shown, Figure 2 A flowchart illustrating an exemplary embodiment of this disclosure is provided. The access control method is applied to a cloud server, which includes an information management gateway and multiple service instances. The information management gateway processes information related to user access permissions, and the service instances are service containers configured on the cloud server for processing service requests. For example, a service instance could be a message forwarding service instance, or a data storage service instance, etc. Specifically, it can be determined based on the type of cloud server; for example, multiple service instances on a storage service server might be service storage instances. Figure 2 As shown, the method in this embodiment of the disclosure may include: In step S201, the information management gateway responds to the user access permission information sent by the resource access management RAM server, and parses the user access permission information to obtain the user identifier, user identity credential, and access permission configuration parameters. Among them, the user access permission information is generated by the RAM server after receiving the access permission configuration request sent by the user terminal; In step S202, the information management gateway stores the association relationship between user identity credentials, user identifier, and access permission configuration parameters in the access permission information storage object. In summary, the access control method provided in this embodiment allows the cloud server's information management gateway to store the association between the user identifier, user identity credential, and access permission configuration parameters in an access permission information storage object after receiving user access permission information from the RAM server. Since the user access permission information received by the cloud server is generated by the RAM server after receiving the access permission configuration request from the user terminal, it achieves the goal of synchronizing the user-configured service access permission information from the RAM server to the cloud server. This allows the cloud server to directly perform authentication based on the locally stored access permission information during business request processing, without needing to authenticate through the RAM server. This prevents authentication failures caused by RAM server anomalies or link connection anomalies, thus improving the reliability of business request authentication on the cloud server.

[0027] The following are Figure 2 The specific implementation methods of each step in the illustrated embodiment are described in detail below: In step S201, the information management gateway responds to receiving user access permission information sent by the resource access management RAM server, and parses the user access permission information to obtain the user identifier, user identity credential, and access permission configuration parameters.

[0028] In this embodiment of the disclosure, the user access permission information is generated by the RAM server after receiving the access permission configuration request sent by the user terminal; the user identity credential is an identity identifier assigned by the RAM server to the user to prove that the user is a registered user of the RAM server, and the user identifier is a global identity identifier used to uniquely identify the user's identity in the cloud service scenario; the access permission configuration parameters are the permission parameters of the content that the user can access on the cloud server, which can be determined based on the actual configuration results, and this embodiment of the disclosure does not limit this.

[0029] In one optional implementation, the RAM server can: in response to receiving an access permission configuration request from a user terminal, obtain access permission configuration information sent by the user terminal, wherein the access permission configuration information is generated by the user terminal in response to a user permission configuration operation; then, parse the access permission configuration information to obtain a user identifier, user identity credentials, and access permission configuration parameters, and store the association relationship between the user identity credentials, user identifier, and access permission configuration parameters; further, generate user access permission information based on the user identity credentials, user identifier, and access permission configuration parameters, and synchronize the user access permission information to the cloud server.

[0030] It is understood that, in this embodiment of the disclosure, the user can request access permission configuration from the RAM server through the RAM service page running on the user terminal, and after being redirected to the access permission configuration page on the RAM service page, create basic user information and configure the user's access permissions through access permission configuration operations on the access permission configuration page; then, after the access permission configuration operation is completed, the user terminal can generate access permission configuration information based on the user identifier, user identity credentials, and access permission configuration parameters in the basic user information, and send the access permission configuration information to the RAM server.

[0031] Creating basic user information may include generating user identity credentials for RAM service users, setting user groups, setting user roles, and setting user permission policies. Configuring user access permissions may be determined based on the user's actual permission configuration operations, and this embodiment does not limit this. Configuring user access permissions may also include associating the user and / or the user's group with the configured permission policies.

[0032] In one optional implementation, the information management gateway, in response to receiving user access permission information sent by the RAM server, parses the user access permission information to obtain a user identifier, user identity credentials, and access permission configuration parameters.

[0033] In step S202, the information management gateway stores the association relationship between user identity credentials, user identifier, and access permission configuration parameters in the access permission information storage object.

[0034] In this embodiment of the disclosure, the access permission information storage object can be a metadata cluster or a metadata database on the cloud server. Specifically, it can be determined based on actual needs, and this embodiment of the disclosure does not limit it. The access permission information storage object stores user identity identifiers and access permission configuration parameters that are associated with multiple user identifiers respectively.

[0035] Specifically, after the information management gateway parses the user access permission information to obtain the user identifier, user identity credential, and access permission configuration parameters, it stores the association relationship between the user identity credential, user identifier, and access permission configuration parameters in the access permission information storage object.

[0036] It is understood that, in this embodiment of the disclosure, when a user terminal needs to process business based on a cloud server, it can respond to the user's business processing initiation operation, generate an access request, and send the access request to the business instance on the cloud server.

[0037] It should be noted that, in order to further improve the authentication efficiency for access requests, the business instance can store the association between the new user's identity credentials, user identifier, and access permission configuration parameters in the user permission cache after the new user initiates an access request, and set an appropriate validity period. This will improve the authentication efficiency for user access requests while ensuring the reliability of access permission control after a long-connection user initiates a request.

[0038] In one optional implementation, upon receiving an access request from a user terminal, the cloud server's business instance parses the request to obtain the target user's identity credentials and target access parameters to be authenticated. Then, if the business instance determines that a target access permission configuration parameter associated with the target user identifier corresponding to the target user's identity credentials exists in the user permission cache information, and the current request time is within the validity period of the target access permission configuration parameter, then authentication is performed on the target access parameters based on the target access permission configuration parameter to obtain the authentication result. This not only enables authentication on the cloud server side based on user access permission information synchronized from the RAM server, improving authentication reliability, but also allows for rapid authentication of the target access parameters to be authenticated directly based on the access permission configuration parameters of legitimate users cached in the business instance's user permission cache information, as well as the validity period of the access permission configuration parameters, thus improving access permission control efficiency.

[0039] The validity period of the access permission configuration parameters refers to the validity period of the access permission configuration parameters in the user permission cache information. The specific duration can be determined based on actual needs, and this embodiment does not limit it. Authentication of the target access parameters based on the target access permission configuration parameters to obtain the authentication result means determining whether the target access parameters are within the allowed range of the target access permission configuration parameters. It can be understood that if the target access parameters are within the allowed range of the target access permission configuration parameters, the authentication result is authentication passed; or if the target access parameters are not within the allowed range of the target access permission configuration parameters, the authentication result is authentication failed.

[0040] In one optional implementation, after the business instance obtains the target user's identity credential and target access parameters to be authenticated, if the business instance determines that the target access permission configuration parameter associated with the target user identifier corresponding to the target user's identity credential does not exist in the user permission cache information, or if the current request time is not within the validity period of the target access permission configuration parameter, then if the target access permission configuration parameter exists in the access permission information storage object, the business instance authenticates the target access parameter based on the target access permission configuration parameter to obtain the authentication result; then, if the authentication result indicates that the authentication is successful, the business instance saves the target user's identity credential, as well as the target user identifier and target access permission configuration parameter corresponding to the target user's identity credential, to the user permission cache information, and sets the validity period of the target access permission configuration parameter. If the access permission configuration parameters of legitimate users cached in the user permission cache information of the business instance do not include the target access permission configuration parameters associated with the identity credentials of the target user to be authenticated, authentication can be performed through the access permission configuration parameters that are persistently stored in the access permission information storage object, thereby improving the reliability of access permission control. After successful authentication, the association between the target user identity credentials, the target user identifier, and the target access permission configuration parameters is stored in the user permission cache information, and a corresponding effective time period is set, so as to efficiently manage and control access permissions for long-connection users' access requests through the cached association.

[0041] It should be noted that, in this embodiment of the disclosure, after a user configures user access permissions on the RAM server, the user access permissions can be updated. After obtaining the update information of the user terminal on the access permission configuration parameters, the RAM server can synchronize the updated access permission configuration parameters to the cloud server to ensure that the cloud server updates the original access permission configuration information in a timely manner and improve the reliability of access control for users.

[0042] In one optional implementation, the RAM server, in response to receiving access permission configuration update information from the user terminal, parses the access permission configuration update information to obtain access permission configuration update parameters associated with the user identifier. Then, based on the access permission configuration update parameters, it updates the access permission configuration parameters associated with the user identifier in local storage. Further, based on the access permission configuration update parameters associated with the user identifier, it generates user access permission update information and synchronizes this information to the cloud server. This allows the updated access permission configuration parameters to be synchronized to the cloud server immediately after the user terminal updates them, enabling the cloud server to promptly obtain the updated access permission configuration parameters and improving the security of access permission control for relevant users.

[0043] Meanwhile, on the cloud server side, the information management gateway responds to the user access permission update information received from the RAM server, parses the user access permission update information to obtain the user identifier, and the access permission configuration update parameters associated with the user identifier; then, the information management gateway updates the access permission configuration parameters associated with the user identifier in the access permission information storage object based on the access permission configuration update parameters associated with the user identifier; further, the information management gateway sends the access permission configuration update parameters associated with the user identifier to the business instance; and, if the business instance determines that the access permission configuration parameters associated with the user identifier exist in the user permission cache information, it updates the access permission configuration parameters associated with the user identifier in the user permission cache information based on the access permission configuration update parameters associated with the user identifier. On the one hand, after a user updates their access permissions, the cloud server can update the corresponding user access permission configuration parameters in the persistent access permission information storage object through the user access permission update information synchronized by the RAM server, ensuring the accuracy of the access permission configuration parameters stored in the persistent storage. On the other hand, it is also necessary to synchronize the access permission configuration update parameters to the business instance, so that if the user permission cache information of the business instance contains access permission configuration parameters associated with the user identifier, the corresponding access permission configuration parameters can be updated, thereby improving the security and reliability of access permission control for long-connection users after the access permission parameters are updated.

[0044] It should be noted that, in the embodiments of this disclosure, updating user access permissions may include deleting, modifying, or adding permission items to user access permission configuration parameters. Specifically, it can be determined based on actual needs, and the embodiments of this disclosure do not limit it in this regard.

[0045] In one alternative implementation, the RAM server may also periodically generate consistency verification instructions based on all user identifiers and the access permission configuration parameters associated with each user identifier, and send the consistency verification instructions to the cloud server; so that the cloud server can periodically calibrate the access permission configuration information of each user stored on the cloud server, thereby improving the security and reliability of the cloud server's access control for users.

[0046] Meanwhile, after receiving the consistency verification command sent by the RAM server, the cloud server parses the consistency verification request to obtain the standard access permission configuration parameters associated with each user identifier. For each user identifier, it compares the standard access permission configuration parameters with the access permission configuration parameters to be calibrated stored in the information storage object associated with the user identifier. Furthermore, if the access permission configuration parameters to be calibrated are inconsistent with the quasi-access permission configuration parameters, the access permission configuration parameters to be calibrated are updated to the standard access permission configuration parameters. This ensures that the cloud server can periodically calibrate the access permission configuration parameters stored locally on the cloud server according to the standard access permission configuration parameters for each user sent by the RAM server, further improving the security and reliability of access control for user access requests by the cloud server's business instances.

[0047] It should be noted that, in the embodiments of this disclosure, the period at which the RAM server sends consistency verification requests to the cloud server can be determined based on actual needs. This disclosure does not limit this. For example, the RAM server may send consistency verification requests to the cloud server every one or two weeks.

[0048] For example, such as Figure 3 As shown, Figure 3 A flowchart illustrating an exemplary embodiment of this disclosure is shown. The access control method is applied in a business instance on a cloud server and includes: Step S301: In response to receiving an access request sent by a user terminal, parse the access request to obtain the target user identity credentials and target access parameters to be authenticated. Step S302: Determine whether the target access permission configuration parameter associated with the target user identifier corresponding to the target user identity credential exists in the user permission cache information. Step S303: If the business instance determines that the target access permission configuration parameter associated with the target user identifier corresponding to the target user identity credential does not exist in the user permission cache information, or if the current request time is not within the validity period of the target access permission configuration parameter, then if the target access permission configuration parameter exists in the access permission information storage object, the target access parameter is authenticated based on the target access permission configuration parameter to obtain the authentication result. In step S304, if the authentication result indicates that the authentication is successful, the service instance saves the target user identity credential, as well as the target user identifier and target access permission configuration parameters corresponding to the target user identity credential, to the user permission cache information, and sets the validity period of the target access permission configuration parameters.

[0049] Step S305: If the business instance determines that the user permission cache information contains a target access permission configuration parameter associated with the target user identifier corresponding to the target user identity credential, and the current request time is within the validity period of the target access permission configuration parameter, then the target access parameter is authenticated based on the target access permission configuration parameter to obtain the authentication result.

[0050] This disclosure provides an access control method, such as... Figure 4 As shown, Figure 4 A flowchart illustrating an exemplary embodiment of this disclosure is shown. The access control method is applied to a RAM server and includes: Step S401: In response to receiving an access permission configuration request sent by the user terminal, obtain the access permission configuration information sent by the user terminal; The access permission configuration information is generated by the user terminal in response to the user permission configuration operation. Step S402: Parse the access permission configuration information to obtain the user identifier, user identity credential, and access permission configuration parameters, and store the association relationship between the user identity credential, user identifier, and access permission configuration parameters; Step S403: Generate user access permission information based on user identity credentials, user identifier, and access permission configuration parameters, and synchronize the user access permission information to the cloud server.

[0051] In summary, the access control method provided in this embodiment allows the RAM server to assign user identity credentials to the user after receiving an access permission configuration request from the user terminal. The RAM server then stores and synchronizes the association between the user identity credentials, the user identifier, and the access permission configuration parameters to the cloud server. This enables the cloud server to directly perform authentication upon receiving the access request, effectively decoupling the RAM server from the authentication function. This not only reduces the resource consumption of the RAM server but also improves the reliability of access control for the user terminal.

[0052] It should be noted that, in the embodiments of this disclosure, the specific implementation scheme of the RAM server participating in the access control method can be referred to the above embodiments, and will not be repeated here.

[0053] An exemplary embodiment of this disclosure provides an access control device, which can be a cloud server. Figure 5 A schematic block diagram of the functional modules of an access control device according to an exemplary embodiment of the present disclosure is shown. Figure 5 As shown, the cloud server includes an information management gateway 501 and multiple business instances 502, wherein, The information management gateway 501 is configured to, in response to receiving user access permission information sent by the resource access management RAM server, parse the user access permission information to obtain a user identifier, a user identity credential, and access permission configuration parameters, wherein the user access permission information is generated by the RAM server after receiving an access permission configuration request sent by a user terminal; The information management gateway 501 is configured to store the association relationship between the user identity credential, the user identifier, and the access permission configuration parameters in an access permission information storage object.

[0054] Optionally, the service instance 502 is configured to, in response to receiving an access request sent by a user terminal, parse the access request to obtain the target user identity credential and target access parameters to be authenticated. If the business instance 502 determines that the user permission cache information contains a target access permission configuration parameter associated with the target user identifier corresponding to the target user identity credential, and the current request time is within the validity period of the target access permission configuration parameter, then based on the target access permission configuration parameter, the target access parameter is authenticated to obtain an authentication result.

[0055] Optionally, if the business instance 502 determines that the target access permission configuration parameter associated with the target user identifier corresponding to the target user identity credential does not exist in the user permission cache information, or if the current request time is not within the validity period of the target access permission configuration parameter, then if the target access permission configuration parameter exists in the access permission information storage object, the target access parameter is authenticated based on the target access permission configuration parameter to obtain the authentication result. When the authentication result indicates that the authentication is successful, the business instance 502 saves the target user identity credential, the target user identifier corresponding to the target user identity credential, and the target access permission configuration parameters to the user permission cache information, and sets the effective time period of the target access permission configuration parameters.

[0056] Optionally, the information management gateway 501 is configured to, in response to receiving user access permission update information sent by the RAM server, parse the user access permission update information to obtain a user identifier, and access permission configuration update parameters associated with the user identifier; The information management gateway 501 is configured to update the access permission configuration parameters associated with the user identifier in the access permission information storage object based on the access permission configuration update parameters associated with the user identifier. The information management gateway 501 is configured to send the access permission configuration update parameters associated with the user identifier to the service instance 502; If the business instance 502 determines that there is an access permission configuration parameter associated with the user identifier in the user permission cache information, it updates the access permission configuration parameter associated with the user identifier in the user permission cache information based on the access permission configuration update parameter associated with the user identifier.

[0057] An exemplary embodiment of this disclosure provides an access control device, which can be a RAM server. Figure 6 A schematic block diagram of the functional modules of an access control device according to an exemplary embodiment of the present disclosure is shown. Figure 6 As shown, the access control device includes: The acquisition module 601 is configured to acquire access permission configuration information sent by the user terminal in response to receiving an access permission configuration request sent by the user terminal. The access permission configuration information is generated by the user terminal in response to the user permission configuration operation. The parsing module 602 is configured to parse the access permission configuration information to obtain a user identifier, a user identity credential, and access permission configuration parameters, and to store the association relationship between the user identity credential, the user identifier, and the access permission configuration parameters; The generation module 603 is configured to generate user access permission information based on the user identity credential, the user identifier, and the access permission configuration parameters, and synchronize the user access permission information to the cloud server.

[0058] Optional, such as Figure 6 As shown, the RAM server 600 also includes an update module 604, configured to: In response to receiving the access permission configuration update information sent by the user terminal, the access permission configuration update information is parsed to obtain the access permission configuration update parameters associated with the user identifier; Based on the access permission configuration update parameters, update the access permission configuration parameters associated with the user identifier in the local storage; Based on the access permission configuration update parameters associated with the user identifier, user access permission update information is generated and synchronized to the cloud server.

[0059] Exemplary embodiments of this disclosure also provide an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor. The memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to cause the electronic device to perform a method according to an embodiment of this disclosure.

[0060] Exemplary embodiments of this disclosure also provide a non-transitory computer-readable storage medium storing a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform a method according to embodiments of this disclosure.

[0061] like Figure 7 As shown, an exemplary embodiment of this disclosure also provides a computer program product 700, including a computer program 701, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform a method according to an embodiment of this disclosure.

[0062] refer to Figure 8 The present invention describes a structural block diagram of an electronic device 800 that can serve as a server for this disclosure, which is an example of a hardware device that can be applied to various aspects of this disclosure. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the disclosure described and / or claimed herein.

[0063] like Figure 8 As shown, the electronic device 800 includes a computing unit 801, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 into a random access memory (RAM) 803. The RAM 803 may also store various programs and data required for the operation of the electronic device 800. The computing unit 801, ROM 802, and RAM 803 are interconnected via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0064] Multiple components in electronic device 800 are connected to I / O interface 805, including: input unit 806, output unit 807, storage unit 808, and communication unit 809. Input unit 806 can be any type of device capable of inputting information to electronic device 800. Input unit 806 can receive input digital or character information and generate key signal inputs related to user settings and / or function control of electronic device. Output unit 807 can be any type of device capable of presenting information and may include, but is not limited to, a display, speaker, video / audio output terminal, vibrator, and / or printer. Storage unit 808 may include, but is not limited to, disks and optical discs. Communication unit 809 allows electronic device 800 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks, and may include, but is not limited to, modems, network cards, infrared communication devices, wireless communication transceivers, and / or chipsets, such as Bluetooth™ devices, WiFi devices, WiMax devices, cellular communication devices, and / or the like.

[0065] The computing unit 801 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 801 performs the various methods and processes described above. For example, in some embodiments, the methods of the exemplary embodiments of this disclosure can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 808. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 800 via ROM 802 and / or communication unit 809. In some embodiments, the computing unit 801 can be configured to perform the methods of the exemplary embodiments of this disclosure by any other suitable means (e.g., by means of firmware).

[0066] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0067] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0068] As used in this disclosure, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, device, and / or apparatus (e.g., disk, optical disk, memory, programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including machine-readable media that receive machine instructions as machine-readable signals. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0069] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0070] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0071] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on a computer, the processes or functions described in the embodiments of this disclosure are performed entirely or partially. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a terminal, a user equipment, or other programmable device. The computer program or instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, the computer program or instructions can be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium, such as a floppy disk, hard disk, or magnetic tape; it can also be an optical medium, such as a digital video disc (DVD); or it can be a semiconductor medium, such as a solid-state drive (SSD).

[0072] Although this disclosure has been described in conjunction with specific features and embodiments, it will be apparent that various modifications and combinations can be made therein without departing from the spirit and scope of this disclosure. Accordingly, this specification and drawings are merely exemplary illustrations of the disclosure as defined by the appended claims and are to be considered as covering any and all modifications, variations, combinations, or equivalents within the scope of this disclosure. It is obvious that those skilled in the art can make various alterations and modifications to this disclosure without departing from its spirit and scope. Thus, this disclosure is also intended to include any such modifications and modifications that fall within the scope of the claims of this disclosure and their equivalents.

Claims

1. An access control method, characterized in that, The method is applied to a cloud server, which includes an information management gateway and multiple business instances, including: The information management gateway responds to receiving user access permission information sent by the resource access management RAM server, and parses the user access permission information to obtain user identifier, user identity credential, and access permission configuration parameters. The user access permission information is generated by the RAM server after receiving an access permission configuration request sent by the user terminal. The information management gateway stores the association between the user identity credential, the user identifier, and the access permission configuration parameters in an access permission information storage object.

2. The access control method as described in claim 1, characterized in that, The method further includes: The service instance responds to the access request sent by the user terminal by parsing the access request to obtain the target user identity credentials and target access parameters to be authenticated. If the business instance determines that the user permission cache information contains a target access permission configuration parameter associated with the target user identifier corresponding to the target user identity credential, and the current request time is within the validity period of the target access permission configuration parameter, then the target access parameter is authenticated based on the target access permission configuration parameter to obtain the authentication result.

3. The access control method as described in claim 2, characterized in that, The method further includes: If the business instance determines that the target access permission configuration parameter associated with the target user identifier corresponding to the target user identity credential does not exist in the user permission cache information, or if the current request time is not within the validity period of the target access permission configuration parameter, then if the target access permission configuration parameter exists in the access permission information storage object, the target access parameter is authenticated based on the target access permission configuration parameter to obtain the authentication result. When the authentication result indicates that the authentication is successful, the service instance saves the target user identity credential, the target user identifier corresponding to the target user identity credential, and the target access permission configuration parameters to the user permission cache information, and sets the validity period of the target access permission configuration parameters.

4. The access control method as described in claim 1, characterized in that, The method further includes: In response to receiving user access permission update information sent by the RAM server, the information management gateway parses the user access permission update information to obtain a user identifier and access permission configuration update parameters associated with the user identifier. The information management gateway updates the access permission configuration parameters associated with the user identifier in the access permission information storage object based on the access permission configuration update parameters associated with the user identifier. The information management gateway sends the access permission configuration update parameters associated with the user identifier to the service instance; If the business instance determines that there is an access permission configuration parameter associated with the user identifier in the user permission cache information, it updates the access permission configuration parameter associated with the user identifier in the user permission cache information based on the access permission configuration update parameter associated with the user identifier.

5. An access control method, characterized in that, The method is applied to a RAM (Resource Access Management) server and includes: In response to receiving an access permission configuration request sent by a user terminal, the access permission configuration information sent by the user terminal is obtained, wherein the access permission configuration information is generated by the user terminal in response to a user permission configuration operation; The access permission configuration information is parsed to obtain the user identifier, user identity credential, and access permission configuration parameters, and the association relationship between the user identity credential, the user identifier, and the access permission configuration parameters is stored. Based on the user identity credential, the user identifier, and the access permission configuration parameters, user access permission information is generated and synchronized to the cloud server.

6. The access control method as described in claim 5, characterized in that, The method further includes: In response to receiving the access permission configuration update information sent by the user terminal, the access permission configuration update information is parsed to obtain the access permission configuration update parameters associated with the user identifier; Based on the access permission configuration update parameters, update the access permission configuration parameters associated with the user identifier in the local storage; Based on the access permission configuration update parameters associated with the user identifier, user access permission update information is generated and synchronized to the cloud server.

7. An electronic device, the electronic device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the method of any one of claims 1 to 4 or claims 5 to 6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the method described in any one of claims 1 to 4 or claims 5 to 6.

9. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the method described in any one of claims 1 to 4 or claims 5 to 6.

10. A network system, characterized in that, The system includes a resource access management server and a cloud server, wherein the cloud server is used to execute the method according to any one of claims 1 to 4; and the resource access management server is used to execute the method according to any one of claims 5 to 6.

Images