A cloud service-based data isolation interaction method and system

Abstract

The application discloses a kind of data isolation interaction method and system based on cloud service, it is related to cloud computing security technical field, including, to cloud service data access request is carried out identity correlation analysis, extract the data access operation type and resource identification to be accessed, according to user unique identification and active unique identification query effective active membership card identification and set as access isolation root key, generate request access context;Cloud service attenuation permission chain is issued to each cloud service node along cloud service call chain gradually, and each cloud service node determines node access boundary according to attenuation access permission and the data isolation label of resource to be accessed, and carries out access rule compilation to node access boundary, generates cloud service isolation interaction data stream.The application realizes the two-way logic closed loop of permission reachability and resource ownership relationship, strengthens the traceability of permission source in access control process, improves the rigor of permission determination.

Description

Technical Field

[0001] This invention relates to the field of cloud computing security technology, and in particular to a data isolation and interaction method and system based on cloud services. Background Technology

[0002] Data isolation and interaction in cloud service environments are typically geared towards multi-tenant resource sharing, cross-service calls, and distributed data processing scenarios. Conventional methods establish access control rules through tenant identifiers and role attributes, and use interface tokens to perform authorization judgments at gateways or service nodes based on the request subject, target resource, and operation type. For data interaction processes formed by continuous calls, the scope of resource access is usually limited by combining data tags and call chains, and the authorization process is recorded through access logs to maintain data boundaries between different business domains.

[0003] However, conventional permission determination methods often unfold along a one-way authorization chain from the subject to the resource, lacking reverse closed verification of the boundary of the accessed resource. Permission reachability does not necessarily indicate that the resource belongs to the same isolation domain. Access permissions are often passed through inheritance between multiple levels of calls, making it difficult to shrink according to the data processing scope of each cloud service node, resulting in excessive expansion of the permission boundary along the call chain. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a cloud service-based data isolation and interaction method to solve the problems of excessive boundary expansion when access permissions are passed along the call chain, and cross-domain access risks caused by the lack of bidirectional closed-loop verification for resource ownership verification.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, the present invention provides a data isolation interaction method based on cloud services, comprising: performing identity association parsing on cloud service data access requests, extracting the identifier of the resource to be accessed and the data access operation type, querying a valid activity membership card identifier based on the user's unique identifier and the activity's unique identifier and setting it as the access isolation root key, and generating a request access context; based on the request access context, constructing a forward permission subgraph from the access isolation root key to the resource to be accessed, and constructing a resource ownership subgraph in reverse along the data isolation label of the resource to be accessed; using the VF2 subgraph isomorphism algorithm to perform constraint matching on the forward permission subgraph and the resource ownership subgraph, and retaining access paths that are accessible and belong to the same access isolation root key. Generate a bidirectional access closed subgraph; trim the data access operation boundaries of the bidirectional access closed subgraph, extract the minimum resource boundary and operation boundary, generate a closed minimum access domain, generate an entry access permit based on the closed minimum access domain, perform service identity binding and permission projection on the entry access permit according to the cloud service call task, generate attenuated access permits level by level, and connect them along the call dependency to form a cloud service attenuated permit chain; distribute the cloud service attenuated permit chain level by level to each cloud service node along the cloud service call chain, each cloud service node determines the node access boundary based on the attenuated access permit and the data isolation label of the resource to be accessed, and compiles the access rules for the node access boundary to generate a cloud service isolated interactive data stream.

[0007] As a preferred embodiment of the cloud service-based data isolation and interaction method of the present invention, the steps for generating the request access context are as follows: The identity token and resource call parameters carried in cloud service data access requests are decoupled and semantically normalized. The user's unique identifier and the activity's unique identifier are encoded into a combined identity index, and the identifier of the resource to be accessed and the data access operation type are encoded into a resource operation description to generate a request access attribute set. Retrieve the active member relationship based on the federated identity index in the requested access attribute set, perform a two-condition cross-determination based on the member card activation status and the effective activity period, exclude active member card records with invalid status or mismatched effective activity periods, write the retained effective active member card identifier into the resource operation description as the access isolation root key, and generate the requested access context.

[0008] As a preferred embodiment of the cloud service-based data isolation and interaction method described in this invention, the steps for constructing the positive permission subgraph are as follows: Based on the access isolation root key and data access operation type in the request access context, a directed graph projection is performed on the authorization relationship pointing to the resource to be accessed, and the authorization inheritance relationship is encoded as permission transitive edges with operation constraints to form a positive permission candidate graph; Perform permission boundary recursion on the positive permission candidate graph, project the authorization scope of the predecessor node to the successor node layer by layer, and prune mismatched branches according to the matching status of the resource to be accessed and the data access operation type according to the authorization scope, and generate a positive permission subgraph.

[0009] As a preferred embodiment of the cloud service-based data isolation and interaction method of the present invention, the steps of constructing a resource ownership subgraph in reverse along the data isolation label of the resource to be accessed are as follows: The data isolation labels of the resource to be accessed are semantically decoded to extract the label fields pointing from the resource to be accessed to the access isolation root key and converted into reverse pointing edges. The access isolation root key is traced back level by level with the resource to be accessed as the reverse starting point to form a candidate path for resource ownership. The candidate paths for resource ownership are transformed into reverse ownership structures that start from the resource to be accessed and end at the access isolation root key. Overlapping path segments pointing to the same access isolation root key are merged, and path branches that do not converge to the access isolation root key are removed to generate a resource ownership subgraph.

[0010] As a preferred embodiment of the cloud service-based data isolation and interaction method of the present invention, the steps for generating a bidirectional access closed subgraph are as follows: Using the access isolation root key and the identifier of the resource to be accessed as the two-end anchoring conditions, the permission transfer edge in the forward permission subgraph and the reverse home edge in the resource home graph that match the endpoint identifier and are opposite in direction are encoded as mutually inverse equivalent edges. The connection relationship of the node identifier and the mutually inverse equivalent edges is encoded with isomorphic constraints. The adjacency-preserving incremental node mapping is performed using the VF2 subgraph isomorphic algorithm to generate a candidate closed mapping set. Perform bidirectional reachable closure reconstruction on the candidate closed mapping set, close the connection between the forward permission path and the reverse attribution path according to the isomorphic mapping position, and remove closed paths with mismatched permission ranges according to the data access operation type, retain access paths that are reachable and converge to the same access isolation root key, and generate a bidirectional access closed subgraph.

[0011] As a preferred embodiment of the cloud service-based data isolation and interaction method described in this invention, the steps for generating a closed minimum access domain are as follows: Based on the data access operation type, mark the path segments that meet the access requirements of the resource to be accessed in the bidirectional access closed subgraph, and prune the unmarked branches and path segments that exceed the operation range step by step from the resource to be accessed as the reverse starting point to the access isolation root key to generate the boundary pruning access subgraph. The overlapping segments of the retained paths in the boundary pruning access subgraph are merged and the end-to-end connectivity is converged. The minimum closed range of the connected access isolation root key and the resource to be accessed is determined as the minimum resource boundary. The effective authorization range of the data access operation type on the retained path is converged as the operation boundary, generating a closed minimum access domain.

[0012] As a preferred embodiment of the cloud service-based data isolation and interaction method described in this invention, the steps for forming the cloud service attenuation permission chain are as follows: Encode the closed minimum access domain according to the access isolation root key to form a permission structure, solidify the minimum resource boundary and operation boundary into a permission boundary that only allows shrinking, and generate an entry access permission. Extract the primary cloud service identity and primary call parameters from the cloud service call task, bind the entry access permission to the primary cloud service identity, and perform permission projection on the permission boundary using the resource identifier to be accessed and the data access operation type in the primary call parameters to generate attenuated access permission. The previous level decayed access permission is used as the upper bound of the subsequent level permission projection. The identity of the subsequent cloud service and the subsequent level call parameters are extracted level by level along the cloud service call task. The subsequent level decayed access permission is generated by the overlapping projection of the subsequent level call parameters and the previous level permission boundary. The cloud service decayed permission chain is formed by connecting them according to the call order.

[0013] As a preferred embodiment of the cloud service-based data isolation and interaction method of the present invention, the steps for determining the node access boundary are as follows: According to the calling order in the cloud service calling task, the identity of the first-level cloud service and the identity of the subsequent cloud service are encoded as topology nodes. Based on the call points between cloud services, the topology edges are connected to construct the cloud service call chain. Then, according to the call level, the attenuation access permissions at each level in the cloud service attenuation permission chain are loaded into the matching topology nodes to generate node permission mapping. The permission boundary is parsed for the decayed access permission in the node permission mapping, the resource range and data access operation type limited by the decayed access permission are extracted, the access isolation root key is matched with the data isolation label of the resource to be accessed, and the resource range is projected to the range of the matched data isolation label to generate the node candidate access boundary. The node access boundary is calculated by performing inclusion constraint calculation on the candidate access boundary and the closed minimum access domain, and the boundary is recursively calculated according to the order of the preceding and following permissions in the cloud service decay permission chain. Boundary segments that exceed the preceding decay access permission and the closed minimum access domain are removed to generate the node access boundary.

[0014] As a preferred embodiment of the cloud service-based data isolation and interaction method of the present invention, the steps for generating the cloud service isolation and interaction data stream are as follows: The resource boundaries in the node access boundary are expanded into resource boundary predicates according to the data isolation label field. The operation boundaries are converted into operation permission rules according to the data access operation type. The resource boundary predicates and operation permission rules are combined, compiled, and parameter bound to generate node access rules. By utilizing node access rules, read predicate rewriting and write domain locking are performed on data requests to each cloud service node to generate isolated interactive data streams for cloud services.

[0015] Secondly, this invention provides a cloud service-based data isolation and interaction system, comprising: an isolation root key generation module, used to perform identity association parsing on cloud service data access requests, extract the identifier of the resource to be accessed and the data access operation type, query a valid activity membership card identifier based on the user's unique identifier and the activity's unique identifier and set it as the access isolation root key, and generate a request access context; and a bidirectional access closure module, used to construct a forward permission subgraph from the access isolation root key to the resource to be accessed based on the request access context, and construct a resource ownership subgraph in reverse along the data isolation label of the resource to be accessed, and use the VF2 subgraph isomorphism algorithm to perform constraint matching on the forward permission subgraph and the resource ownership subgraph, retaining access paths that are accessible and belong to the same access isolation root key. The system generates a bidirectional access closed subgraph; the access permission decay module is used to trim the data access operation boundaries of the bidirectional access closed subgraph, extract the minimum resource boundary and operation boundary, generate a closed minimum access domain, generate an entry access permission based on the closed minimum access domain, perform service identity binding and permission projection on the entry access permission according to the cloud service call task, generate decayed access permissions level by level, and connect them along the call dependency to form a cloud service decayed permission chain; the isolation rule compilation module is used to distribute the cloud service decayed permission chain level by level to each cloud service node along the cloud service call chain, each cloud service node determines the node access boundary based on the decayed access permission and the data isolation label of the resource to be accessed, and compiles the access rules for the node access boundary to generate a cloud service isolation interaction data stream.

[0016] The beneficial effects of this invention are as follows: By constructing a positive permission subgraph and a resource ownership subgraph and using the VF2 subgraph isomorphism algorithm for constraint matching, a two-way logical closed loop of permission reachability and resource ownership relationship is realized, which strengthens the traceability of permission source in the access control process and improves the rigor of permission judgment; by generating attenuated access permissions step by step according to the closed minimum access domain and connecting them to form a cloud service attenuation permission chain, the dynamic and refined shrinkage of access permissions with the depth of the call chain is realized, the data processing boundary of each cloud service node is clarified, and the generalization of permissions in the process of cross-node flow is avoided. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of a cloud service-based data isolation and interaction method.

[0019] Figure 2 This is a schematic diagram of a cloud-based data isolation and interaction system.

[0020] Figure 3 This chart compares the incidence of wrongful releases across domains under different cross-domain ownership conflict ratios.

[0021] Figure 4 A comparison chart of permission boundary retention rates at different cloud service call levels. Detailed Implementation

[0022] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0023] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0024] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0025] Reference Figures 1-4 As one embodiment of the present invention, this embodiment provides a data isolation and interaction method based on cloud services, including the following steps: S1. Perform identity association parsing on cloud service data access requests, extract the identifier of the resource to be accessed and the data access operation type, query the valid activity membership card identifier based on the user's unique identifier and the activity's unique identifier and set it as the access isolation root key, and generate the request access context.

[0026] S1.1: Decouple and semantically normalize the identity token and resource call parameters carried in the cloud service data access request, encode the user unique identifier and activity unique identifier into a combined identity index, and encode the resource identifier to be accessed and the data access operation type into a resource operation description, generating a request access attribute set.

[0027] Specifically, the process involves reading the identity token and resource call parameters from the cloud service data access request, splitting the identity token payload and resource call parameter fields according to the field mapping relationship, separating the user unique identifier and activity unique identifier from the identity token payload, and extracting the resource location content and operation declaration from the resource call parameters to determine the identifier of the resource to be accessed and the data access operation type (e.g., read type: query, read, and retrieve data; write type: add, modify, and delete data). Invalid whitespace in each identifier is removed, and character encoding and case sensitivity are converted to a unified format. The field length is written in the order of user unique identifier first, followed by activity unique identifier, and the encoding is concatenated to form a combined identity index. A unified path separation method and resource hierarchy expression are used for the identifier of the resource to be accessed, and the operation declaration is converted to a unified data access operation type encoding. Then, the resource operation description is formed by combining the identifier of the resource to be accessed and the data access operation type in a fixed order. Finally, the combined identity index and resource operation description are associated and aggregated according to the same cloud service data access request to generate a request access attribute set.

[0028] S1.2: Retrieve the active member relationship based on the federated identity index in the requested access attribute set, perform a dual-condition cross-determination based on the member card activation status and the effective activity period, exclude active member card records with invalid status or mismatched effective activity periods, write the retained effective active member card identifier into the resource operation description as the access isolation root key, and generate the requested access context.

[0029] Specifically, the activity membership relationship is located by locating the user's unique identifier and the activity's unique identifier using the joint identity index in the request access attribute set. The membership card activation status, activity validity period, and valid activity membership card identifier in the activity membership relationship are read. When the membership card activation status is recorded as "activated", it indicates that the activity membership is still valid and has the basis for access authorization, and the membership card activation status is determined to be valid. When the membership card activation status is recorded as "inactive", it indicates that the activity membership has been suspended or terminated, and the membership card activation status is determined to be invalid. The receiving time of the cloud service data access request is compared with the valid time period of the activity. Only the activity member card records with the membership card activation status being valid and the receiving time of the cloud service data access request falling within the valid time period of the activity are retained. The retained valid activity member card identifier is written into the resource operation description as the access isolation root key, and the federated identity index is associated and encapsulated with the resource operation description written into the access isolation root key to generate the request access context.

[0030] It should be noted that the requested access context is associated with the resource operation description using a federated identity index, and the valid active membership card identifier is fixed as the access isolation root key. This ensures that the identity attribution and resource operation in a single cloud service data access request are limited to the same active membership relationship, avoiding authorization misuse and data access boundary interference between different active membership cards.

[0031] S2. Based on the request access context, construct a forward permission subgraph from the access isolation root key to the resource to be accessed, and construct a resource ownership subgraph in reverse along the data isolation label of the resource to be accessed. Use the VF2 subgraph isomorphism algorithm to perform constraint matching on the forward permission subgraph and the resource ownership subgraph, retain access paths that are accessible and belong to the same access isolation root key, and generate a bidirectional access closed subgraph.

[0032] S2.1: Based on the access isolation root key and data access operation type in the request access context, perform directed graph projection on the authorization relationship pointing to the resource to be accessed, encode the authorization inheritance relationship as permission transit edges with operation constraints, and form a positive permission candidate graph.

[0033] Specifically, starting with the access isolation root key in the request access context, the authorization relationship registered in the cloud service is retrieved from the authorization relationship that is directly authorized by the access isolation root key or is authorized through inheritance and points to the resource to be accessed. The relationship is expanded level by level in the direction from the authorizing party to the authorizing party, and the identifiers at both ends of the authorization relationship are written into the graph nodes and connected along the authorization direction. Read the operation scope defined by each authorization relationship, determine the inclusion of the operation scope with the data access operation type, retain the authorization relationship where the operation scope includes the data access operation type, and when there is continuous authorization inheritance, take the overlapping range of the previous authorization scope and the subsequent authorization scope as the operation constraint for continued transmission, and write the authorization inheritance direction and operation constraint into the permission transmission edge; gather the graph nodes and permission transmission edges that start from the access isolation root key and can reach the resource to be accessed along the permission transmission edge to form a positive permission candidate graph.

[0034] S2.2: Perform permission boundary recursion on the positive permission candidate graph, project the authorization scope of the predecessor node to the successor node layer by layer, and prune mismatched branches according to the matching status of the resource to be accessed and the data access operation type according to the authorization scope, and generate a positive permission subgraph.

[0035] Specifically, starting from the access isolation root key node in the positive permission candidate graph, the resource range and operation range defined by the access isolation root key node are read as the initial authorization range, and the successor nodes are traversed layer by layer along the connection direction of the permission transmission edge. For each successor node, the resource path prefix and resource level boundary defined by the predecessor node are overlapped with the resource path prefix and resource level boundary allowed by the successor node, and the resource portion that falls within both the authorization range of the predecessor node and the authorization range of the successor node is retained. The operation range of the predecessor node, the operation constraints defined by the permission transmission edge, and the operation range allowed by the successor node are overlapped, and the commonly allowed data access operation types are retained. The retained resource portion and data access operation type form the effective authorization range of the successor node. When the successor node is a resource node to be accessed, the effective authorization range of the successor node is compared with the identifier of the resource to be accessed for inclusion judgment. When the effective authorization scope cannot cover the resource to be accessed or does not contain the data access operation type in the request access context, the successor node and the connected permission transfer branch are removed. When the effective authorization scope can cover the resource to be accessed and contains the data access operation type, the successor node is retained and the effective authorization scope is used as the next level of permission boundary to continue to push forward until the graph nodes and permission transfer edges pointing from the access isolation root key to the resource to be accessed and the authorization scopes at all levels are continuously valid are gathered to generate a positive permission subgraph.

[0036] It should be noted that the resource path prefix is ​​a continuous preceding field in the resource identifier or resource scope path that represents the ownership relationship of the superior resource. It is obtained by unifying the path format, splitting it according to the path separator, and extracting the path fields of each level before the last level resource identifier. The forward permission subgraph converges the authorization scope from the access isolation root key to the resource to be accessed step by step, retaining only the permission path that continuously matches the resource scope and data access operation type, thus avoiding resource out-of-bounds and operation permission expansion during the authorization inheritance process.

[0037] S2.3: Perform attribution semantic decoding on the data isolation labels of the resource to be accessed, extract the label fields pointing from the resource to be accessed to the access isolation root key and convert them into reverse pointing edges, and trace back the access isolation root key level by level with the resource to be accessed as the reverse starting point to form a candidate path for resource attribution.

[0038] Specifically, taking the identifier of the resource to be accessed as the first current-level resource identifier, the upper-level identifier of the record belonging to the resource to be accessed in the data isolation label of the resource to be accessed is located; when the upper-level identifier is different from the current-level resource identifier and the label level is higher than the current-level resource identifier, it is determined that the current-level resource identifier belongs to the upper-level identifier, and is converted into a reverse pointing edge according to the direction of the current-level resource identifier pointing to the upper-level identifier. The parent-level identifier is used as the new current-level resource identifier. The higher-level parent-level identifier is located and the reverse pointing edge is connected. The current backtracking is completed when the parent-level identifier is the same as the access isolation root key in the request access context. The current backtracking branch is terminated when there is no higher-level parent-level identifier. The reverse pointing edges starting from the resource identifier to be accessed and pointing to the access isolation root key level by level are collected to form the resource ownership candidate path.

[0039] S2.4: Convert the candidate resource ownership path into a reverse ownership structure that starts with the resource to be accessed and ends with the access isolation root key. Merge overlapping path segments that point to the same access isolation root key and remove path branches that have not converged to the access isolation root key to generate a resource ownership subgraph.

[0040] Specifically, the path nodes are arranged according to the connection order of the reverse pointing edges in the resource ownership candidate path. The resource to be accessed is set as the starting node, the access isolation root key is set as the ending node, and the previous level ownership identifier obtained by backtracking level by level is written between the starting node and the ending node in sequence, maintaining the edge direction from the resource to be accessed to the access isolation root key, thus forming a reverse ownership structure. For reverse attribution structures where all terminating nodes are the same access isolation root key, a segment-by-segment comparison is performed. When adjacent nodes in two paths have the same identifier and the starting and ending points of the reverse pointing edges are the same, they are determined to be overlapping path segments. Only one set of overlapping path segments is retained, and the non-overlapping path branches before and after the overlapping path segment are connected to the retained overlapping path segment. The continuity of the reverse pointing edges is checked step by step from the resource to be accessed along each merged path. Paths that can continuously reach the access isolation root key are retained, and path branches with broken connections, terminating nodes that are not access isolation root keys, or that cannot continue to extend to the access isolation root key are removed. The retained path nodes and reverse pointing edges are combined to generate a resource attribution subgraph.

[0041] S2.5: Using the access isolation root key and the identifier of the resource to be accessed as the two-end anchoring conditions, the permission transfer edge in the forward permission subgraph and the reverse home edge in the resource home graph that match the endpoint identifier and are opposite in direction are encoded as mutually inverse equivalent edges. The connection relationship of the node identifier and the mutually inverse equivalent edges is encoded with isomorphic constraints. The adjacency-preserving incremental node mapping is performed using the VF2 subgraph isomorphism algorithm to generate a candidate closed mapping set.

[0042] Specifically, the access isolation root key node and the resource identification node to be accessed in the forward permission subgraph and the resource ownership subgraph are fixedly paired to form the initial mapping set of the VF2 subgraph isomorphism algorithm; the endpoint identifiers of permission transmission edges and reverse ownership edges are compared one by one, and the edge pairs where the starting identifier of the permission transmission edge is equal to the ending identifier of the reverse ownership edge and the ending identifier of the permission transmission edge is equal to the starting identifier of the reverse ownership edge are encoded as mutually inverse equivalent edges. Starting with the initial mapping set, select unmapped nodes adjacent to mapped nodes from the forward permission subgraph, and extract candidate nodes with the same node identifier from the resource ownership subgraph. Calculate the coverage rate of the reciprocal equivalent edges between the permission propagation edges connecting unmapped nodes to mapped nodes and the reverse ownership edges connecting candidate nodes to mapped nodes, and verify the number of unmapped adjacent nodes extending in opposite directions between the unmapped node and the candidate node. When the reciprocal equivalent edge coverage rate is one, and the number of unmapped adjacent nodes that the candidate node can extend along the reverse ownership edge is not less than the number of unmapped adjacent nodes that the unmapped node can extend along the permission propagation edge, add the unmapped node and the candidate node to the mapping set and continue expanding. If the mapping conditions are not met, cancel the current node pairing and switch the candidate node until the adjacency-maintaining mapping of the path nodes between the access isolation root key and the identifier of the resource to be accessed is completed. Gather all complete mappings and generate a candidate closed mapping set.

[0043] It should be noted that the VF2 subgraph isomorphism algorithm establishes node mapping incrementally and uses node identifiers, adjacency relationships, and connection edge constraints to back off candidate mappings that do not meet the isomorphism conditions in advance. In this embodiment, the VF2 subgraph isomorphism algorithm uses the access isolation root key and the identifier of the resource to be accessed for double-end anchoring, and combines mutually inverse equivalent edges to match the forward permission path and the reverse attribution path, thereby accurately identifying the access path that is accessible by permissions and has closed resource attribution, and avoiding permission cross-use between different access isolation root keys.

[0044] It should also be noted that when a complete mapping is not formed after traversing all candidate nodes, the candidate closed mapping set is recorded as an empty set. The current cloud service data access request is determined to not meet the bidirectional access closure condition. The current cloud service data access request is terminated and an access denial result is returned. The bidirectional reachable closure reconstruction and subsequent cloud service isolation interaction data flow generation process are no longer executed.

[0045] S2.6: Perform bidirectional reachable closure reconstruction on the candidate closed mapping set, close the connection between the forward permission path and the reverse attribution path according to the isomorphic mapping position, and remove closed paths with mismatched permission ranges according to the data access operation type, retain access paths that are reachable and converge to the same access isolation root key, and generate a bidirectional access closed subgraph.

[0046] Specifically, according to the node pairing order of each group of complete mappings in the candidate closed mapping set, the forward permission path from the access isolation root key to the resource to be accessed in the forward permission subgraph and the reverse home path from the resource to be accessed to the access isolation root key in the resource home subgraph are extracted respectively. Forward reachability traversal is performed on the forward permission path and reverse reachability traversal is performed on the reverse home path. The isomorphic mapping positions of the reachable nodes on both sides in the candidate closed mapping set are calculated. The mapping positions with the same node identifier and consistent adjacency relationship are set as closed connection positions. According to the relationship that the permission transmission edge and the reverse home edge are opposite in direction, the forward permission path and the reverse home path are closed connection end to end. The operation range defined by the permission transmission edges is extracted step by step along the forward permission path after the closed connection. The operation ranges of continuous permission transmission edges are overlapped and converged to form the permission range of the closed path. Then, the permission range of the closed path is matched with the data access operation type in the request access context, and closed paths whose permission range does not contain the data access operation type are removed. It is checked whether the forward permission path can continuously reach the resource to be accessed from the access isolation root key, and whether the reverse home path can continuously return from the resource to be accessed to the access isolation root key at the beginning of the forward permission path. Closed paths with broken path connections and reverse home paths that converge to different access isolation root keys are removed. Access paths and connection edges that are accessible by permissions and converge to the same access isolation root key are collected to generate a bidirectional access closed subgraph.

[0047] It should be noted that the bidirectional access closed subgraph identifies access paths that are accessible but whose resource ownership is not closed by simultaneously verifying the forward permission reachability relationship and the reverse resource ownership relationship, thereby reducing the risk of data being mistakenly allowed between different access isolation root keys.

[0048] Figure 3 This paper demonstrates the overall trend of cross-domain false access rate changing with the proportion of cross-domain ownership conflicts under different access determination methods. The one-way access reachability determination method only judges whether access is allowed based on the forward access path from the access isolation root key to the resource to be accessed, which makes it difficult to identify cases where the resource to be accessed actually belongs to other access isolation root keys. The end data isolation label verification method further verifies the data isolation label at the end of the resource to be accessed based on the forward access reachability determination, but it may still produce misjudgments in cases of abnormal intermediate resource ownership paths and inconsistent adjacency relationships. The bidirectional access closure method of this invention constructs a forward access subgraph and a resource ownership subgraph respectively, and uses the VF2 subgraph isomorphism algorithm to perform constraint matching on node identifiers, adjacency relationships and connecting edges, retaining access paths that are accessible and whose resource ownership paths converge to the same access isolation root key.

[0049] As can be seen from the curve changes, with the increase in the proportion of cross-domain ownership conflicts, the cross-domain false access rates of both the one-way access reachability determination method and the end-data isolation label verification method show a significant upward trend, while the bidirectional access closure method of this invention remains in a lower range with smaller overall fluctuations; therefore, Figure 3 This invention demonstrates that it can effectively identify access paths where permissions are accessible but resource ownership relationships are not closed, reducing the risk of data being mistakenly allowed between different access isolation root keys, and realizing a two-way logical closed loop between permission accessibility and resource ownership relationships, thereby strengthening the traceability of permission sources and improving the rigor of permission determination.

[0050] S3. Prune the data access operation boundary of the bidirectional access closed subgraph, extract the minimum resource boundary and operation boundary, generate a closed minimum access domain, generate an entry access permit based on the closed minimum access domain, perform service identity binding and permission projection on the entry access permit according to the cloud service call task, generate attenuated access permits step by step, and form a cloud service attenuated permit chain along the call dependency.

[0051] S3.1: Based on the data access operation type, mark the path segments that meet the access requirements of the resource to be accessed in the bidirectional access closed subgraph, and prune the unmarked branches and path segments that exceed the operation range level by level from the resource to be accessed as the reverse starting point towards the access isolation root key, generating a boundary pruning access subgraph.

[0052] Specifically, extract the operation range limited by the permission transfer edge and the resource range limited by the path node in the bidirectional access closed subgraph. Use the condition that the operation range includes the data access operation type and the resource range covers the identifier of the resource to be accessed as the path segment marking condition. Write access retention tags on the permission transfer edge, reverse attribution edge and connected path node that meet the access requirements of the resource to be accessed. Starting from the resource to be accessed, traverse step by step along the reverse attribution edge towards the access isolation root key. The operation range of the current path segment overlaps and converges with the operation range retained by the previous path segment. If the overlapping range contains data access operation type, the current path segment is retained. If the overlapping range is empty or does not contain data access operation type, the current path segment and subsequent branches are pruned. Continue to prune path branches that have not been written with access retention flags, cannot be continuously traced back to the access isolation root key, or whose resource range exceeds the access requirements of the resource to be accessed. Gather the retained path nodes, permission transfer edges, and reverse attribution edges to generate a boundary pruning access subgraph.

[0053] S3.2: Perform overlapping segment merging and end-to-end connectivity convergence on the retained paths in the boundary clipping access subgraph, determine the minimum closed range of the connected access isolation root key and the resource to be accessed as the minimum resource boundary, and converge the effective authorization range of the data access operation type on the retained path as the operation boundary, generating a closed minimum access domain.

[0054] Specifically, according to the node arrangement order and connection endpoints of each retained path in the boundary clipping access subgraph, segment by segment is compared. Overlapping segments with the same start and end nodes, consistent node sequences, and the same connection direction are merged into a single retained segment, and non-overlapping segments are continued to the merged retained segment. Starting from the access isolation root key, the process traverses the retained path step by step to the resource to be accessed, extracting complete paths that can continuously connect the access isolation root key and the resource to be accessed. Then, from the resource to be accessed to the access isolation root key, segment by segment is removed and verified. After removing the current path segment, a complete path still exists connecting the access isolation root key and the resource to be accessed. When resources are removed, the current path segment is removed. If the end-to-end connection of the current path segment is interrupted, the current path segment is retained. The removal verification is repeated until the remaining path segments are all path segments required to maintain end-to-end connectivity. The resource range covered by the remaining path segments is determined as the minimum resource boundary. The operation range limited by the permission passing edges is extracted level by level along the remaining path. The operation ranges at each level are overlapped and converged. The valid authorized range that is allowed by all permission passing edges and contains data access operation types is retained as the operation boundary. The minimum resource boundary and the operation boundary are associated and encapsulated to generate a closed minimum access domain.

[0055] S3.3: Encode the closed minimum access domain according to the access isolation root key to solidify the minimum resource boundary and operation boundary into a permission boundary that only allows shrinking, and generate an entry access permission.

[0056] Specifically, using the access isolation root key as the primary index for the permission structure encoding, the minimum resource boundary in the closed minimum access domain is written into the resource permission scope according to the resource hierarchy and path connection order, and the data access operation type and valid authorization scope limited by the operation boundary are written into the operation permission scope. The minimum resource boundary and the operation boundary are set as the upper bound of the resource permission scope and the upper bound of the operation permission scope, respectively, so that subsequent permission projections are only allowed to retain the overlapping part of the resource permission scope and the called resource scope, as well as the overlapping part of the operation permission scope and the called operation scope, and it is prohibited to write resource paths that exceed the minimum resource boundary or add data access operation types not included in the operation boundary. The access isolation root key, resource permission scope, operation permission scope and boundary contraction constraints are associated and encapsulated to generate the entry access permission.

[0057] S3.4: Extract the primary cloud service identity and primary call parameters from the cloud service call task, bind the entry access permission to the primary cloud service identity, and perform permission projection on the permission boundary using the resource identifier to be accessed and the data access operation type in the primary call parameters to generate a decayed access permission.

[0058] Specifically, the primary cloud service identity is extracted based on the first call relationship in the cloud service call task, and written into the entry access permission. This primary cloud service identity is then bound to the access isolation root key in the entry access permission, restricting the entry access permission to be held only by the primary cloud service identity. The resource identifier to be accessed and the data access operation type are parsed from the primary call parameters. The resource identifier to be accessed is projected along the resource hierarchy to the minimum resource boundary in the entry access permission, retaining continuous resource paths that cover the resource identifier to be accessed and are located within the minimum resource boundary, and removing resource ranges that deviate from the resource identifier to be accessed or exceed the access requirements of the primary call parameters, forming the projected resource boundary. The data access operation type is projected to the operation boundary in the entry access permission, retaining data access operation types that are allowed by the operation boundary and requested by the primary call parameters, and removing operation authorizations not requested by the primary call parameters, forming the projected operation boundary. The primary cloud service identity, access isolation root key, projected resource boundary, and projected operation boundary are associated and encapsulated to generate a decayed access permission.

[0059] S3.5: Using the previous level decayed access permission as the upper bound of the subsequent level permission projection, extract the identity of the subsequent cloud service and the subsequent level call parameters level by level along the cloud service call task. Generate the subsequent level decayed access permission by projecting the overlapping of the subsequent level call parameters and the previous level permission boundary. Connect them according to the call order to form a cloud service decayed permission chain.

[0060] Specifically, the identity of the subsequent cloud service and the subsequent call parameters are extracted level by level along the call order in the cloud service call task. The resource boundary and operation boundary in the pre-level attenuated access permission are set as the upper bound of the subsequent permission projection. The resource identifier to be accessed in the subsequent call parameters is split into a resource path prefix and a resource level sequence, which are aligned level by level with the resource boundary in the pre-level attenuated access permission. The number of consecutive overlapping resource path levels is counted, and the resource overlap projection value is obtained by normalizing and fusing the hierarchical coverage of the resource identifier to be accessed and the continuity of the overlapping paths in the pre-level attenuated access permission. The expression is: ; in, Indicates the first The resource overlap projection value between the subsequent call parameters and the previous attenuated access permission; It is the call level sequence number arranged according to the call order in the cloud service call task; This represents the same-domain constraint value between the access isolation root key and the resource path start prefix. It is 1 if the access isolation root key and the resource path start prefix are the same, and 0 otherwise. This indicates the number of resource levels at which the resource identifier to be accessed and the resource boundary in the preceding attenuation access permission continuously overlap, starting from the beginning of the resource path. This indicates the total number of resource levels contained in the resource identifier to be accessed in the subsequent call parameters; This indicates the number of resource levels in the resource identifier to be accessed that fall within the boundary of the preceding attenuated access permission resource; This indicates the number of resource levels that can be continuously reached along the resource path after falling into the boundary of the preceding attenuated access permission resource; , and These represent the weights for resource path prefix overlap, resource level coverage, and continuous reachability, respectively. Based on historical cloud service call samples, and with the goal of minimizing the matching error between the resource overlap projection value and the actual permission boundary, they are determined through grid search and normalized to ensure the sum of the fusion weights is 1. When the value is 0, the resource overlap projection value is directly recorded as 0.

[0061] The resource overlap projection value is used to determine whether there is a valid resource overlap between the subsequent call parameters and the preceding attenuated access permission. When the resource overlap projection value is zero, the corresponding call branch is directly pruned, and the operation overlap projection value is no longer calculated. When the resource overlap projection value is greater than zero, the resource segment where the resource identifier to be accessed and the resource boundary of the preceding attenuated access permission continuously coincide from the start position of the resource path and can reach the last position of the resource identifier to be accessed are determined as the reserved resource segment. The data access operation type in the subsequent call parameters and the operation boundary in the preceding attenuated access permission are converted into a unified operation code, and the operation codes that are commonly allowed on both sides are extracted. The operation overlap projection value is obtained by taking the proportion of the encoding to the subsequent call parameter request operation encoding. Then, the data access operation types allowed by the previous level attenuation access permit are retained based on the operation overlap projection value. When the operation overlap projection value is zero, the corresponding call branch is pruned. When the operation overlap projection value is greater than zero, the retained resource segment and data access operation type are bound to the subsequent cloud service identity and access isolation root key to generate the subsequent level attenuation access permit. The subsequent level attenuation access permit is used as the previous level attenuation access permit of the next call level to repeatedly perform overlap projection. The attenuation access permits at each level are connected according to the call order from the previous level cloud service identity to the subsequent level cloud service identity to form a cloud service attenuation permit chain.

[0062] It should be noted that the cloud service attenuation permission chain uses the attenuation access permission of the previous level as the upper limit of the subsequent level permission projection, so that the access permissions shrink step by step along the cloud service call chain, and prevent the subsequent cloud service nodes from regaining access ranges that exceed the actual processing needs.

[0063] S4. The cloud service attenuation permission chain is distributed to each cloud service node level by level along the cloud service call chain. Each cloud service node determines the node access boundary based on the attenuation access permission and the data isolation label of the resource to be accessed, and compiles the access rules for the node access boundary to generate the cloud service isolation interaction data stream.

[0064] S4.1: According to the calling order in the cloud service calling task, the identity of the first-level cloud service and the identity of the subsequent cloud service are encoded as topology nodes. Based on the calling points between cloud services, the topology edges are connected to construct the cloud service calling chain. Then, according to the calling level, the attenuation access permissions at each level in the cloud service attenuation permission chain are loaded into the matching topology nodes to generate node permission mapping.

[0065] Specifically, the identity of the primary cloud service and the identity of the secondary cloud services are extracted according to the call order of the cloud service call task records. The identity of the primary cloud service is written into the topology node with a call level number of one, and the call level number of the secondary cloud service is incremented level by level along the call order. Records with the same cloud service identity and the same call level number are merged into the same topology node. Based on the call initiator and call receiver in the adjacent call relationship, the topology node where the call initiator is located is pointed to the topology node where the call receiver is located and the topology edge is connected. The topology nodes and topology edges are connected in the order of the calls to construct the cloud service call chain. The cloud service identity bound to each level of attenuation access permission is compared with the cloud service identity recorded in the topology node. The sequence number of each level of attenuation access permission in the cloud service attenuation permission chain is also compared with the call level sequence number of the topology node. When the cloud service identity identifier value is the same and the sequence number is equal to the call level sequence number, the attenuation access permission is loaded into the topology node. For the preceding and following topology nodes connected by the topology edge, when the call level sequence numbers of the preceding and following topology nodes are consecutive and the attenuation access permissions loaded into the preceding and following topology nodes are adjacent in the cloud service attenuation permission chain, the permission level and call level are considered to be consecutive. When there are missing, duplicate, or cross-level sequence numbers, or when the permission arrangement direction is opposite to the topology edge direction, the corresponding loading relationship is removed, and a node permission mapping is generated.

[0066] S4.2: Perform permission boundary resolution on the decayed access permission in the node permission mapping, extract the resource range and data access operation type limited by the decayed access permission, perform same-domain matching between the access isolation root key and the data isolation label of the resource to be accessed, and project the resource range to the range of the matched data isolation label to generate candidate access boundaries for the node.

[0067] Specifically, the attenuated access permits loaded in each topology node in the parsing node permission mapping are resolved. The resource boundaries in the attenuated access permits are expanded into resource ranges according to the resource path prefix, resource level range, and last-level resource identifier. The operation boundaries are decoded into allowed data access operation types. The attribution access isolation root key, label resource path prefix, and label resource level range are extracted from the data isolation label of the resource to be accessed. The encoding format of the attribution access isolation root key is unified with that of the access isolation root key bound to the attenuated access permit, and the identifier value is compared. If the identifier values ​​are the same and the data isolation label ultimately points to the same access isolation root key along the attribution level, the data isolation label is retained. If the identifier values ​​are different or the attribution level points to other access isolation root keys, the data isolation label is excluded. Align the resource path prefix of the resource range with the tag resource path prefix in the reserved data isolation label level by level, and overlap the resource level range with the tag resource level range. Reserve resource segments with consecutive identical path prefixes that fall into both level ranges. Then, associate and encapsulate the reserved resource segments with the data access operation type to generate candidate node access boundaries.

[0068] S4.3: Perform inclusion constraint calculation on the candidate access boundary of the node and the closed minimum access domain, and perform boundary recursion according to the order of succession of the preceding and following levels in the cloud service decay permission chain. Remove the boundary segments that exceed the preceding decay access permission and the closed minimum access domain to generate the node access boundary.

[0069] Specifically, the resource range defined by the node candidate access boundary is aligned with the minimum resource boundary in the closed minimum access domain according to the resource path prefix and resource level. The resource inclusion constraint value is the proportion of the number of consecutive resource levels that simultaneously fall within both the node candidate access boundary and the minimum resource boundary to the total number of resource levels contained in the node candidate access boundary. The data access operation types defined by the node candidate access boundary overlap with the operation boundaries in the closed minimum access domain. The operation inclusion constraint value is the proportion of the number of commonly allowed data access operation types to the total number of data access operation types contained in the node candidate access boundary. The expression is as follows: ; ; in, Indicates the first The resources of a topology node include constraint values; Indicates the call hierarchy number of the topology node; This indicates the total number of resource levels included in the candidate access boundary of a node; It is the resource level sequence number; Indicates the first The hierarchical weight of each resource level is set in reverse order of the path distance from the resource level to the resource to be accessed. Indicates the first The containment flag of each resource level is set to 1 if it falls within both the boundary of the preceding attenuated access permitted resource and the boundary of the closed minimum access domain minimum resource; otherwise, it is set to 0. This represents the number of resource levels that simultaneously satisfy the inclusion constraint and are continuous along the resource path. Indicates the first Operations on topology nodes include constraint values; This indicates the total number of data access operation types contained within the candidate access boundary of a node; Indicates the first The operation weight for each data access operation type is set according to the degree of change to the resource content caused by the data access operation type. Indicates the first The inclusion flag for each data access operation type is set to 1 if it is allowed by both the preceding attenuation access permission operation boundary and the closed minimum access domain operation boundary; otherwise, it is set to 0.

[0070] It should be noted that the resource inclusion constraint value is used to characterize the degree to which the resource range in the candidate access boundary of a node is simultaneously restricted by the preceding attenuated access permission resource boundary and the closed minimum access domain minimum resource boundary. The operation inclusion constraint value is used to characterize the degree to which the data access operation type in the candidate access boundary of a node is simultaneously restricted by the preceding attenuated access permission operation boundary and the closed minimum access domain operation boundary. When either inclusion constraint value is zero, the current candidate access boundary of the node is truncated. When both inclusion constraint values ​​are greater than zero, the node access boundary is generated according to the continuous overlap of the resource range and the data access operation type.

[0071] Following the order of permission succession in the cloud service attenuation permission chain, the first-level topology node takes the overlap between the node candidate access boundary and the closed minimum access domain as the permission boundary. The subsequent topology node uses the resource boundary and operation boundary in the previous attenuation access permission as the upper bound, and performs continuous overlap between the resource range defined by the node candidate access boundary and the resource boundary in the previous attenuation access permission and the minimum resource boundary in the closed minimum access domain, respectively. It also performs continuous overlap between the data access operation type defined by the node candidate access boundary and the operation boundary in the previous attenuation access permission and the operation boundary in the closed minimum access domain, respectively. Resource ranges that do not fall within both the resource boundary of the previous attenuation access permission and the minimum resource boundary of the closed minimum access domain are removed, as are data access operation types that are not allowed by both the operation boundary of the previous attenuation access permission and the operation boundary of the closed minimum access domain. Resource ranges and data access operation types with continuous resource paths and progressively shrinking permission ranges are retained to generate the node access boundary.

[0072] Figure 4This paper demonstrates the overall trend of permission boundary retention rate as a function of cloud service call hierarchy under different access permission passing methods. The static permission inheritance method directly passes the entry access permission along the cloud service call chain, and the resource range and data access operation type obtained by each cloud service node change little, so the permission boundary retention rate remains at a high level for a long time. The node independent authorization method redetermines the access range by each cloud service node based on the current call parameters. Although the permission boundary decreases overall, some call levels show fluctuations and rebounds, indicating that downstream cloud service nodes may still regain access permissions that exceed the processing needs of upstream nodes. The cloud service attenuation permission chain method of this invention generates the entry access permission based on the closed minimum access domain, and uses the upstream attenuation access permission as the upper bound of the downstream permission projection. It generates the downstream attenuation access permission step by step through the overlapping projection of the downstream call parameters and the upstream permission boundary.

[0073] As can be seen from the curve changes, the permission boundary retention rate of the method of this invention continuously decreases as the cloud service call level increases. Local fluctuations reflect the differences in data processing needs among different cloud service nodes, but the overall permission boundary of the later level does not exceed the limitation of the decaying access permission of the earlier level; therefore, Figure 4 This invention demonstrates that the scope of resources and the type of data access operations can be dynamically and finely reduced as the call chain depth increases, clarifying the data processing boundaries of each cloud service node, reducing the transmission of irrelevant resource scopes and redundant data access operation types to downstream nodes, thereby preventing the generalization of permissions during cross-node transfer.

[0074] S4.4: Expand the resource boundaries in the node access boundary into resource boundary predicates according to the data isolation label field, convert the operation boundaries into operation permission rules according to the data access operation type, and perform conjunction compilation and parameter binding on the resource boundary predicates and operation permission rules to generate node access rules.

[0075] Specifically, the resource boundaries in the node access boundary are decomposed according to the field name and field type of the data isolation label field. An equality comparison operator is written to the access isolation root key field, a prefix matching operator is written to the resource path prefix field, and an interval comparison operator between the start level and the end level is written to the resource level field. The field name, comparison operator and boundary value are combined in sequence to form the resource boundary predicate. Based on the fixed mapping relationship between data access operation types and operation codes, the data access operation types allowed by the operation boundary are encoded into a set of allowed operations, and the request operation code belonging to the set of allowed operations is used as the operation permission rule. A conjunctive syntax tree is constructed according to the logical relationship that the resource boundary predicate is true and the operation permission rule is true. The comparison of access isolation root key, resource path prefix, resource level range, and operation code are written into the leaf nodes respectively. The leaf nodes are connected by logical AND and compiled into conditional instructions to be executed sequentially. The access isolation root key, resource path prefix, resource level start and end values ​​and data access operation types in the node access boundary are bound to the parameter positions of the corresponding conditional instructions to generate node access rules.

[0076] It should be noted that the node access rules compile the resource scope and data access operation type in the node access boundary into executable resource boundary predicates and operation permission rules, so that read-type data requests can only return data within the boundary, write-type data requests can only act on the locked write domain, and the hierarchical shrinking permissions formed by the cloud service decay permission chain are implemented to each cloud service node, avoiding permission expansion and data crosstalk between different access isolation root keys during the call transmission process.

[0077] S4.5: Utilize node access rules to perform read predicate rewriting and write domain locking on data requests for each cloud service node, generating isolated interactive data streams for cloud services.

[0078] Specifically, read data requests and write data requests are distinguished according to the data access operation type of each cloud service node. For read data requests, the resource boundary predicate in the node access rules is inserted into the query conditions of the data request. The resource boundary predicate and the original query conditions of the data request are connected by logical AND. The access isolation root key, resource path prefix and resource level range are then bound to the query parameters. This ensures that the reading range is restricted by both the original query conditions of the data request and the node access boundary, and the reading content that does not meet the resource boundary predicate and operation permission rules is removed. For write-type data requests, the identifier of the resource to be accessed by the write target is matched item by item with the access rules of the same node using the data isolation label. The resource range with the same access isolation root key, resource path falling within the resource boundary, and data access operation type allowed by the operation permission rules is set as the write domain. During the write execution, the access isolation root key and resource range of the write domain are fixed to prevent the write target from expanding outside the write domain. The read-type data requests with read predicate rewriting, the write-type data requests limited to the write domain, and the corresponding interaction content are concatenated according to the call order in the cloud service call chain to generate the cloud service isolated interaction data stream.

[0079] This embodiment also provides a cloud service-based data isolation and interaction system, including: The isolation root key generation module is used to perform identity association parsing on cloud service data access requests, extract the identifier of the resource to be accessed and the data access operation type, query the valid activity member card identifier based on the user's unique identifier and the activity's unique identifier and set it as the access isolation root key, and generate the request access context. The bidirectional access closure module is used to construct a forward permission subgraph from the access isolation root key to the resource to be accessed based on the request access context, and to construct a resource ownership subgraph in reverse along the data isolation label of the resource to be accessed. The VF2 subgraph isomorphism algorithm is used to perform constraint matching on the forward permission subgraph and the resource ownership subgraph, retaining the access paths that are accessible and belong to the same access isolation root key, and generating a bidirectional access closure subgraph. The access permission decay module is used to trim the data access operation boundary of the bidirectional access closed subgraph, extract the minimum resource boundary and operation boundary, generate a closed minimum access domain, generate an entry access permission based on the closed minimum access domain, perform service identity binding and permission projection on the entry access permission according to the cloud service call task, generate decayed access permissions level by level, and form a cloud service decay permission chain by connecting along the call dependency. The isolation rule compilation module is used to distribute the cloud service attenuation permission chain down the cloud service call chain to each cloud service node. Each cloud service node determines the node access boundary based on the attenuation access permission and the data isolation label of the resource to be accessed, and compiles the access rules for the node access boundary to generate the cloud service isolation interaction data stream.

[0080] In summary, this invention achieves a two-way logical closed loop between accessibility and resource ownership by constructing a positive permission subgraph and a resource ownership subgraph and using the VF2 subgraph isomorphism algorithm for constraint matching. This strengthens the traceability of permission sources during access control and improves the rigor of permission determination. Furthermore, by generating attenuated access permissions level by level based on the closed minimum access domain and connecting them to form a cloud service attenuation permission chain, this invention achieves dynamic and refined shrinkage of access permissions with the depth of the call chain, clarifies the data processing boundaries of each cloud service node, and avoids the generalization of permissions during cross-node flow.

[0081] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A data isolation and interaction method based on cloud services, characterized in that, include: Perform identity association parsing on cloud service data access requests, extract the identifier of the resource to be accessed and the data access operation type, query the valid activity membership card identifier based on the user's unique identifier and the activity's unique identifier and set it as the access isolation root key, and generate the request access context. Based on the request access context, a forward permission subgraph is constructed from the access isolation root key to the resource to be accessed, and a resource ownership subgraph is constructed in reverse along the data isolation label of the resource to be accessed. The VF2 subgraph isomorphism algorithm is used to perform constraint matching on the forward permission subgraph and the resource ownership subgraph, retaining the access paths that are accessible and belong to the same access isolation root key, and generating a bidirectional access closed subgraph. Data access operation boundaries are clipped on the bidirectional access closed subgraph to extract the minimum resource boundary and operation boundary, generating a closed minimum access domain. An entry access permit is generated based on the closed minimum access domain. Service identity binding and permission projection are performed on the entry access permit according to the cloud service call task. Attenuated access permits are generated level by level and connected along the call dependency to form a cloud service attenuated permit chain. The cloud service attenuation permission chain is distributed level by level along the cloud service call chain to each cloud service node. Each cloud service node determines the node access boundary based on the attenuation access permission and the data isolation label of the resource to be accessed, and compiles the access rules for the node access boundary to generate the cloud service isolation interaction data stream.

2. The data isolation and interaction method based on cloud services as described in claim 1, characterized in that, The steps for generating the request access context are as follows: The identity token and resource call parameters carried in cloud service data access requests are decoupled and semantically normalized. The user's unique identifier and the activity's unique identifier are encoded into a combined identity index, and the identifier of the resource to be accessed and the data access operation type are encoded into a resource operation description to generate a request access attribute set. Retrieve the active member relationship based on the federated identity index in the requested access attribute set, perform a two-condition cross-determination based on the member card activation status and the effective activity period, exclude active member card records with invalid status or mismatched effective activity periods, write the retained effective active member card identifier into the resource operation description as the access isolation root key, and generate the requested access context.

3. The data isolation and interaction method based on cloud services as described in claim 2, characterized in that, The steps for constructing the positive permission subgraph are as follows: Based on the access isolation root key and data access operation type in the request access context, a directed graph projection is performed on the authorization relationship pointing to the resource to be accessed, and the authorization inheritance relationship is encoded as permission transitive edges with operation constraints to form a positive permission candidate graph; Perform permission boundary recursion on the positive permission candidate graph, project the authorization scope of the predecessor node to the successor node layer by layer, and prune mismatched branches according to the matching status of the resource to be accessed and the data access operation type according to the authorization scope, and generate a positive permission subgraph.

4. The data isolation and interaction method based on cloud services as described in claim 3, characterized in that, The steps for constructing a resource ownership subgraph by reverse-engineering the data isolation labels of the resources to be accessed are as follows: The data isolation labels of the resource to be accessed are semantically decoded to extract the label fields pointing from the resource to be accessed to the access isolation root key and converted into reverse pointing edges. The access isolation root key is traced back level by level with the resource to be accessed as the reverse starting point to form a candidate path for resource ownership. The candidate paths for resource ownership are transformed into reverse ownership structures that start from the resource to be accessed and end at the access isolation root key. Overlapping path segments pointing to the same access isolation root key are merged, and path branches that do not converge to the access isolation root key are removed to generate a resource ownership subgraph.

5. The data isolation and interaction method based on cloud services as described in claim 4, characterized in that, The steps for generating a bidirectional access closed subgraph are as follows: Using the access isolation root key and the identifier of the resource to be accessed as the two-end anchoring conditions, the permission transfer edge in the forward permission subgraph and the reverse home edge in the resource home graph that match the endpoint identifier and are opposite in direction are encoded as mutually inverse equivalent edges. The connection relationship of the node identifier and the mutually inverse equivalent edges is encoded with isomorphic constraints. The adjacency-preserving incremental node mapping is performed using the VF2 subgraph isomorphic algorithm to generate a candidate closed mapping set. Perform bidirectional reachable closure reconstruction on the candidate closed mapping set, close the connection between the forward permission path and the reverse attribution path according to the isomorphic mapping position, and remove closed paths with mismatched permission ranges according to the data access operation type, retain access paths that are reachable and converge to the same access isolation root key, and generate a bidirectional access closed subgraph.

6. The data isolation and interaction method based on cloud services as described in claim 5, characterized in that, The steps for generating the closed minimum access domain are as follows: Based on the data access operation type, mark the path segments that meet the access requirements of the resource to be accessed in the bidirectional access closed subgraph, and prune the unmarked branches and path segments that exceed the operation range step by step from the resource to be accessed as the reverse starting point to the access isolation root key to generate the boundary pruning access subgraph. The overlapping segments of the retained paths in the boundary pruning access subgraph are merged and the end-to-end connectivity is converged. The minimum closed range of the connected access isolation root key and the resource to be accessed is determined as the minimum resource boundary. The effective authorization range of the data access operation type on the retained path is converged as the operation boundary, generating a closed minimum access domain.

7. The data isolation and interaction method based on cloud services as described in claim 6, characterized in that, The steps for forming the cloud service attenuation permission chain are as follows: Encode the closed minimum access domain according to the access isolation root key to form a permission structure, solidify the minimum resource boundary and operation boundary into a permission boundary that only allows shrinking, and generate an entry access permission. Extract the primary cloud service identity and primary call parameters from the cloud service call task, bind the entry access permission to the primary cloud service identity, and perform permission projection on the permission boundary using the resource identifier to be accessed and the data access operation type in the primary call parameters to generate attenuated access permission. The previous level decayed access permission is used as the upper bound of the subsequent level permission projection. The identity of the subsequent cloud service and the subsequent level call parameters are extracted level by level along the cloud service call task. The subsequent level decayed access permission is generated by the overlapping projection of the subsequent level call parameters and the previous level permission boundary. The cloud service decayed permission chain is formed by connecting them according to the call order.

8. The data isolation and interaction method based on cloud services as described in claim 7, characterized in that, The steps for determining the node access boundary are as follows: According to the calling order in the cloud service calling task, the identity of the first-level cloud service and the identity of the subsequent cloud service are encoded as topology nodes. Based on the call points between cloud services, the topology edges are connected to construct the cloud service call chain. Then, according to the call level, the attenuation access permissions at each level in the cloud service attenuation permission chain are loaded into the matching topology nodes to generate node permission mapping. The permission boundary is parsed for the decayed access permission in the node permission mapping, the resource range and data access operation type limited by the decayed access permission are extracted, the access isolation root key is matched with the data isolation label of the resource to be accessed, and the resource range is projected to the range of the matched data isolation label to generate the node candidate access boundary. The node access boundary is calculated by performing inclusion constraint calculation on the candidate access boundary and the closed minimum access domain, and the boundary is recursively calculated according to the order of the preceding and following permissions in the cloud service decay permission chain. Boundary segments that exceed the preceding decay access permission and the closed minimum access domain are removed to generate the node access boundary.

9. The data isolation and interaction method based on cloud services as described in claim 8, characterized in that, The steps for generating isolated interactive data streams for cloud services are as follows: The resource boundaries in the node access boundary are expanded into resource boundary predicates according to the data isolation label field. The operation boundaries are converted into operation permission rules according to the data access operation type. The resource boundary predicates and operation permission rules are combined, compiled, and parameter bound to generate node access rules. By utilizing node access rules, read predicate rewriting and write domain locking are performed on data requests to each cloud service node to generate isolated interactive data streams for cloud services.

10. A cloud-based data isolation and interaction system, based on the cloud-based data isolation and interaction method according to any one of claims 1 to 9, characterized in that, include: The isolation root key generation module is used to perform identity association parsing on cloud service data access requests, extract the identifier of the resource to be accessed and the data access operation type, query the valid activity member card identifier based on the user's unique identifier and the activity's unique identifier and set it as the access isolation root key, and generate the request access context. The bidirectional access closure module is used to construct a forward permission subgraph from the access isolation root key to the resource to be accessed based on the request access context, and to construct a resource ownership subgraph in reverse along the data isolation label of the resource to be accessed. The VF2 subgraph isomorphism algorithm is used to perform constraint matching on the forward permission subgraph and the resource ownership subgraph, retaining the access paths that are accessible and belong to the same access isolation root key, and generating a bidirectional access closure subgraph. The access permission decay module is used to trim the data access operation boundary of the bidirectional access closed subgraph, extract the minimum resource boundary and operation boundary, generate a closed minimum access domain, generate an entry access permission based on the closed minimum access domain, perform service identity binding and permission projection on the entry access permission according to the cloud service call task, generate decayed access permissions level by level, and form a cloud service decay permission chain by connecting along the call dependency. The isolation rule compilation module is used to distribute the cloud service attenuation permission chain down the cloud service call chain to each cloud service node. Each cloud service node determines the node access boundary based on the attenuation access permission and the data isolation label of the resource to be accessed, and compiles the access rules for the node access boundary to generate the cloud service isolation interaction data stream.

Images