Access control policy configuration method, device and system, and storage medium

Abstract

The present disclosure provides an access control policy configuration method, device and system, and a storage medium. Said method comprises: receiving a request to create a target resource; determining, on the basis of the request, whether an access control policy inheriting attribute is set for the target resource, the access control policy inheriting attribute indicating an inheriting relationship between the access control policy of the target resource and the access control policy of a parent resource thereof; and configuring the access control policy of the target resource according to the determination result. Thus, the efficiency of configuring the access control policy for a resource is improved. Drawing of the abstract: Figure 2

Description

Access control policy configuration methods, apparatus and systems, and storage media

[0001] Related applications

[0002] This application claims the benefit of Chinese Patent Application No. 201810962847.6, filed on August 22, 2018, the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] This disclosure relates to the field of Internet of Things (IoT) technology, and in particular to an access control policy configuration method, apparatus, system, and storage medium. Background Technology

[0004] In the Internet of Things (IoT), resource access control is typically attribute-based, meaning access is controlled by setting resource attributes. The access control policy resource stores the content of the access control policies, which are the criteria used to assess whether a request can be authorized. The target resource and the access control policy resource are linked through the access control policy IDs attribute in the target resource. A request to access the target resource must be authorized and verified by one or more access control policy resources indicated by the access control policy IDs attribute before the authorization request can be completed.

[0005] In related technologies, security policies can be deployed in various ways. However, in proactive security policy deployment, once an access control policy identifier value is sent to the recipient when a resource is created, it means that the policy permissions of the parent resource of that resource are relinquished without application-layer intervention. Alternatively, if an access control policy identifier value is added to a resource that originally did not have one, the addition of that attribute value means that the policy permissions of the parent resource of that resource are relinquished. This makes access control policies independent between hierarchical resources and between parent and child resources. In current M2M (machine-to-machine) systems, due to the large variety of devices and the potential for each device to have its own unique access control policy requirements, only independent access control policies can be implemented.

[0006] Summary of the Invention

[0007] According to a first aspect of the present disclosure, a method for configuring access control policies is provided. The method includes: receiving a request to create a target resource; determining, based on the request, whether an access control policy inheritance attribute is set for the target resource, the access control policy inheritance attribute indicating the inheritance relationship between the access control policies of the target resource and its parent resource; and configuring the access control policy of the target resource according to the determination result.

[0008] In some embodiments, configuring the access control policy of the target resource according to the determination result includes: if the target resource has an access control policy inheritance attribute, determining whether the target resource inherits the access control policy of its parent resource based on the attribute value of the access control policy inheritance attribute; and configuring the access control policy of the target resource according to the determination result.

[0009] In some embodiments, determining whether the target resource inherits the access control policy of its parent resource includes: if the attribute value of the access control policy inheritance attribute is a first preset value, then determining that the target resource should inherit the access control policy of the parent resource; if the attribute value of the access control policy inheritance attribute is a second preset value, then determining that the target resource does not inherit the access control policy of the parent resource; and if the attribute value of the access control policy inheritance attribute is a third preset value, then determining whether the target resource inherits the access control policy of the parent resource according to a preset setting rule.

[0010] In some embodiments, configuring the access control policy of the target resource includes: when it is determined that the target resource should inherit the access control policy of the parent resource, setting the access control policy identifier attribute of the target resource according to the access control policy identifier attribute of the parent resource; when it is determined that the target resource does not inherit the access control policy of the parent resource, determining the access control policy identifier attribute used therefor; determining the access control policy identifier attribute used therefor includes: formulating the access control policy identifier attribute used therefor for the target resource, or requesting other entities to formulate the access control policy identifier attribute used therefor for the target resource; the preset setting rule indicates the default inheritance relationship between the access control policies of the target resource and its parent resource, and the default inheritance relationship includes inheritance or non-inheritance.

[0011] In some embodiments, the method further includes: determining, based on the request, whether a personalized access control policy identifier attribute value is set for the target resource; and if the personalized access control policy identifier attribute value is set for the target resource, adding the personalized access control policy identifier attribute value to the access control policy identifier attribute of the target resource.

[0012] In some embodiments, the method further includes: when the target resource has been created and the attribute value of its access control policy inheritance attribute indicates that it should inherit the access control policy of the parent resource, in response to detecting a change in the access control policy identifier attribute of the parent resource, updating the access control policy identifier attribute of the target resource according to the changed access control policy identifier attribute of the parent resource.

[0013] In some embodiments, the request takes the form of a resource creation message. The method includes: extracting the attribute value of the access control policy inherited attribute from the resource creation message, or extracting the attribute value of the access control policy inherited attribute and the personalized access control policy identifier attribute value from the resource creation message.

[0014] In some embodiments, the method further includes: if the access control policy inheritance attribute is not set for the target resource, then configuring the access control policy of the target resource based on the default policy configuration rules.

[0015] According to a second aspect of the present disclosure, a method for configuring access control policies is provided. The method includes: determining an inheritance relationship between access control policies of a target resource and its parent resource; sending a request to create the target resource, the request being set with an access control policy inheritance attribute indicating the inheritance relationship for configuring the access control policy of the target resource; and receiving a resource creation response to the request.

[0016] According to a third aspect of the present disclosure, an apparatus for configuring access control policies is provided. The apparatus includes: a receiving module configured to receive a request to create a target resource; an attribute determining module configured to determine, based on the request, whether an access control policy inheritance attribute is set for the target resource, the access control policy inheritance attribute indicating the inheritance relationship between the access control policies of the target resource and its parent resource; and a policy configuring module configured to configure the access control policy of the target resource according to the determining result.

[0017] In some embodiments, the policy configuration module includes: an inheritance judgment unit, configured to, in response to the access control policy inheritance attribute being set for the target resource, determine whether the target resource inherits the access control policy of its parent resource based on the attribute value of the access control policy inheritance attribute; and a policy setting unit, configured to set the access control policy of the target resource according to the judgment result.

[0018] In some embodiments, the inheritance determination unit is configured to: determine that the target resource should inherit the access control policy of the parent resource when the attribute value of the access control policy inheritance attribute is a first preset value; determine that the target resource does not inherit the access control policy of the parent resource when the attribute value of the access control policy inheritance attribute is a second preset value; and determine whether the target resource inherits the access control policy of the parent resource according to a preset setting rule when the attribute value of the access control policy inheritance attribute is a third preset value.

[0019] In some embodiments, the policy setting unit is configured to, when it is determined that the target resource should inherit the access control policy of the parent resource, set the access control policy identifier attribute of the target resource according to the access control policy identifier attribute of the parent resource; when it is determined that the target resource does not inherit the access control policy of the parent resource, determine the access control policy identifier attribute for it; determining the access control policy identifier attribute for it includes: formulating the access control policy identifier attribute for the target resource, or requesting other entities to formulate the access control policy identifier attribute for the target resource; and the preset setting rule indicates the default inheritance relationship between the access control policies of the target resource and its parent resource, the default inheritance relationship including inheritance or non-inheritance.

[0020] In some embodiments, the attribute determination module is configured to determine, based on the request, whether a personalized access control policy identifier attribute value is set for the target resource; and the policy setting unit is configured to, in response to the personalized access control policy identifier attribute value being set for the target resource, add the personalized access control policy identifier attribute to the access control policy identifier attribute of the target resource.

[0021] In some embodiments, the policy configuration module further includes: a policy update unit, configured to, when the target resource has been created and the attribute value of its access control policy inheritance attribute indicates that it should inherit the access control policy of the parent resource, update the access control policy identifier attribute of the target resource according to the changed access control policy identifier attribute of the parent resource in response to detecting a change in the access control policy identifier attribute of the parent resource.

[0022] In some embodiments, the request takes the form of a resource creation message. The attribute determination module is configured to extract the attribute value of the access control policy inherited attribute from the resource creation message, or to extract the attribute value of the access control policy inherited attribute and the personalized access control policy identifier attribute value from the resource creation message.

[0023] In some embodiments, the policy setting unit is configured to configure the access control policy of the target resource based on the default policy configuration rules in response to the fact that the access control policy inheritance attribute is not set for the target resource.

[0024] According to a fourth aspect of the present disclosure, an apparatus for configuring access control policies is provided. The apparatus includes: a determining module configured to determine an inheritance relationship between access control policies of a target resource and its parent resource; a sending module configured to send a request to create the target resource, the request being provided with an access control policy inheritance attribute indicating the inheritance relationship for configuring the access control policy of the target resource; and a receiving module configured to receive a resource creation response to the request.

[0025] According to a fifth aspect of this disclosure, a computing device for configuring access control policies is provided. The computing device includes: a memory configured to store executable instructions; and a processor coupled to the memory, the processor being configured to execute the executable instructions to implement the method described above according to embodiments of this disclosure.

[0026] According to a sixth aspect of the present disclosure, a computer-readable storage medium is provided. The computer-readable storage medium stores computer program instructions that, when executed by one or more processors, cause the processors to perform the methods described above according to the embodiments of the present disclosure.

[0027] According to a seventh aspect of this disclosure, a system for configuring access control policies is provided. The system includes: a first entity for sending a request to create a target resource; and a second entity including the means as described in any one of claims 10 to 18.

[0028] In some embodiments, the first entity includes an application entity, and the second entity includes a general service entity.

[0029] In some embodiments, the first entity includes means as described in the fourth aspect of the present disclosure. Attached Figure Description

[0030] The above and other features and advantages of this disclosure will become more apparent when specific embodiments are described in detail with reference to the accompanying drawings.

[0031] Figure 1 is a schematic diagram of an environment in which embodiments of the present disclosure can be applied.

[0032] Figure 2 is a flowchart illustrating an embodiment of the method of this disclosure;

[0033] Figure 3 is a flowchart illustrating another embodiment of the method of this disclosure;

[0034] Figure 4 is a flowchart illustrating another embodiment of the method of this disclosure;

[0035] Figure 5 is a flowchart illustrating another embodiment of the method of this disclosure;

[0036] Figure 6 is a schematic diagram of the tree structure of parent and child resources;

[0037] Figure 7 is a structural block diagram of an embodiment of the apparatus of this disclosure;

[0038] Figure 8 is a structural block diagram of another embodiment of the device disclosed herein; and

[0039] Figure 9 is a structural block diagram of another embodiment of the device disclosed herein. Detailed Implementation

[0040] In the following description, certain specific details of the disclosed embodiments, such as architecture, interfaces, and techniques, are set forth for explanation rather than limitation, in order to provide a clear and thorough understanding of this disclosure. However, those skilled in the art will readily understand that this disclosure may be practiced in other embodiments that are not precisely consistent with the details set forth herein, without materially departing from the spirit and scope of this disclosure. Furthermore, in this context, detailed descriptions of familiar devices, circuits, and methods have been omitted for the sake of simplicity and clarity, to avoid redundant details and possible confusion.

[0041] Furthermore, unless otherwise specified, "first" and / or "second," etc., are not intended to imply temporal, spatial, or sequential aspects. Rather, such terms are used merely as identifiers or names for features, units, items, etc. For example, the first object and the second object generally correspond to object A and object B, or two different or two identical objects, or the same object.

[0042] The Internet of Things (IoT) comprises three layers: the perception layer, the network layer, and the application layer. The perception layer consists of various sensors, including sensing terminals such as infrared sensors, electronic tags, card readers, and sensors. The perception layer is the source for IoT object identification and information collection. The network layer consists of various networks, including the Internet, broadcast networks, network management systems, and cloud computing platforms, responsible for transmitting and processing the information acquired by the perception layer. The application layer is the interface between the IoT and users; it integrates with industry needs to realize intelligent applications of the IoT. At the application layer, corresponding to the M2M architecture, Application Entities (AEs) in various devices and sensors provide standardized interfaces for managing and interacting with applications. At the service layer between the application and network layers, Common Services Entities (CSEs) support resource sharing and interoperability. In the IoT, access control policies are already deployed at the security layer. These policies include, for example, restrictions on known blacklisted users, allowing / restricting access to internal big data analysis hosts, allowing / restricting local permissions for specific organizations, and deploying regional control permissions. In existing access control policy configuration schemes, the access control policy (accessControlPolicy) resource stores the access control policy content. An access control policy includes attribute permissions representing a set of access control rules. Multiple access control policy resources can be configured. Each access control policy resource has a corresponding identifier.

[0043] Access control policies can be configured under the root resource. The target resource under the root resource can have an access control policy ID (accessControlPolicyIDs) attribute. The value of the access control policy ID attribute can contain a list of access control policy identifiers. The list must include at least one access control policy identifier. The target resource and the access control policy resource are linked through the access control policy ID attribute value.

[0044] Requests to access a target resource require authorization verification through an access control policy resource corresponding to one or more identifiers in the identifier list of the access control policy in its access control policy identifier attribute before authorization can be granted. If the target resource does not have an access control policy identifier attribute, authorization is evaluated based on the access control policy identifier attribute value of its parent resource, or based on the requester-related content in the local policy.

[0045] Existing access control policy configuration schemes have serious vulnerabilities: First, as the initiator, once a proactive security policy is deployed, such as sending the access control policy identifier attribute value as one of the attribute values ​​to the receiver when creating a resource, it means that the policy permissions of the parent resource are relinquished without application-layer intervention; Second, when a resource does not initially have an access control policy identifier attribute value, it will follow the access control policy of the parent resource. However, if an access control policy identifier attribute value is added separately for it, it means that the policy permissions of the parent resource are relinquished.

[0046] The following example illustrates a scenario involving the management of large-scale IoT devices. Large-scale IoT device management platforms possess a large number of registered devices and a vast amount of access interaction data. In this scenario, existing access control policy configuration methods involve independently deploying and configuring access control policies for each resource; that is, each user has their own access control policy configured independently. In other words, related technologies employ independent access control policies, meaning that policies are independent between hierarchical levels and between parent and child systems.

[0047] However, in this scenario, the platform uses user hierarchies, and these hierarchical relationships may exist. For example, in a highly confidential organization, users managing device information are categorized into different confidentiality levels; the higher the confidentiality level, the more information they can access. In this case, adopting independent access control policies could lead to problems. For instance, the global access control policy information of a large IoT device management platform, which is accessible to any resource on that platform, should be considered confidential information and should not be known to ordinary users. Furthermore, the sheer volume of global access control policies makes it impractical for users to obtain them all. Acquiring and reassembling global access control policy information to generate new sets of access control policies is also impractical for most IoT devices with limited computing power. Therefore, existing independent access control policy configuration methods limit the expression of user intent regarding access security control.

[0048] Figure 1 illustrates a schematic diagram of an environment in which embodiments of the present disclosure may be applied. As shown in Figure 1, the environment may include an initiator 110 and a Common Service Entity (CSE) 120. The initiator 110 may be an application entity (AE).

[0049] Initiator 110 can first determine the inheritance relationship 101 between the access control policies of the target resource and its parent resource. The target resource is the resource that initiator 110 intends to create. Then, initiator 110 sends a request 102 to create the target resource to the general service entity 120. The request includes an access control policy inheritance attribute indicating the inheritance relationship for configuring the access control policy of the target resource. Resources may include resources for CSEs, application entities (AEs) in various devices and sensors, containers, software, etc. The resource creation request 101 may include attribute values ​​related to the attributes of the resource to be created. These attribute values ​​may include access control policy inheritance attribute values.

[0050] The general service entity 120 processes the received resource creation request 103. The general service entity 120 can analyze the resource creation request and extract attribute values ​​from it to create the resource accordingly. In some embodiments, when an access control policy inheritance attribute value is extracted from the request, the general service entity 120 can set the access control policy identification attribute of the resource accordingly during the resource creation process based on the extracted access control policy inheritance attribute value.

[0051] After completing resource creation, the general service entity 120 sends a create resource response 104 to the initiator 110. Optionally, the create resource response 104 includes details of the created resource. The initiator 110 receives the create resource response 104 in response to the request. Optionally, the initiator 110 may locally store the details included in the create resource response 104.

[0052] According to embodiments of this disclosure, the access control policy inheritance attribute can be provided by the entity intending to create the target resource. A generic service entity (CSE) can configure the access control policy of the target resource based on the access control policy inheritance attribute in the current request. This allows for flexible configuration of different access control policies based on different requests or access control policies that meet the initiator's preferences.

[0053] Figure 2 illustrates a flowchart of an embodiment of the access control policy configuration method of this disclosure. This access control policy configuration method can be executed through a generic service entity.

[0054] In step 201, a request to create the target resource is received. This request may be received from AE.

[0055] In step 202, based on the request, it is determined whether an access control policy inheritance attribute is set for the target resource. The access control policy inheritance attribute indicates the inheritance relationship between the target resource and its parent resource's access control policies. This inheritance relationship can be either inherited or not. Generally, inheritance is a mechanism that allows an object to be based on another object while retaining a similar implementation. When used in this document, "resource A inherits" resource B's access control policy means that resource A is a child resource of resource B, resource B is the parent resource of resource A, and "inheritance" allows child resource A to possess all the access control policies of parent resource B.

[0056] In practical implementations, the parent-child relationship between resources can take many forms due to the different entities they represent. In one example, the parent resource could be a black box installed in a car, and its child resources could be fault code recording devices, fuel consumption recording devices, etc., installed inside the black box. In another example, the parent resource could be an air conditioner installed indoors, and its child resources could be temperature sensors, humidity sensors, etc., installed inside the air conditioner. In a tree-like device or resource topology diagram, the parent resource corresponds to the parent node, and the child resource corresponds to the child node of the parent node.

[0057] In some embodiments, this determination is made by searching the request for user indications regarding inheritance relationships. When the request contains indications regarding inheritance relationships, it is determined that an access control policy inheritance attribute is set for the target resource. The indication may be a user-specified attribute value for the access control policy inheritance attribute.

[0058] In step 203, the access control policy for the target resource is configured based on the determination result. The configured access control policy will be used to control subsequent access to the target resource. In some embodiments, the determination result may indicate that an access control policy inheritance attribute is set for the target resource, indicating that the target resource inherits the access control policy of its parent resource (if any). Therefore, the access control policy of the target resource can be configured according to the access control policy of the parent resource. The determination result may also indicate that an access control policy inheritance attribute is not set for the target resource. In some embodiments, this may mean that the initiator does not yet support setting the access control policy inheritance attribute. In this case, the access control policy of the target resource can be configured according to the default policy configuration rules in the related art to ensure backward compatibility with such legacy initiators.

[0059] According to the method of this disclosure, it is possible to determine whether to inherit the access policy permissions of the parent resource based on the access control policy inheritance attribute, thereby enabling efficient setting and modification of the access control policy of the child resource. Furthermore, since the access control policy can be configured and modified according to the user's instructions regarding the inheritance relationship, it allows for flexible configuration of the access control policy according to the user's wishes, thus improving the user experience.

[0060] Figure 3 illustrates a flowchart of configuring access control policies in one embodiment of this disclosure.

[0061] Step 301: If it is determined that an access control policy inheritance attribute is set for the target resource, then it is determined whether the target resource inherits the access control policy of its parent resource based on the attribute value of the access control policy inheritance attribute. For example, the attribute value of the access control policy inheritance attribute may have a first setting value indicating "inheritance" and a second setting value indicating "no inheritance". Optionally, the attribute value of the access control policy inheritance attribute may also have a third setting value, indicating that any inheritance relationship can be accepted.

[0062] Step 302: Configure the access control policy for the target resource based on the judgment result. The attribute value of the access control policy inheritance attribute indicates the request initiator's intention regarding access control of the target resource and its intention regarding the inheritance relationship of access control policies between the target resource and its parent resource. This attribute value determines whether to inherit the access control policy permissions of its parent resource or to adopt other (including the default) access control policies.

[0063] In one embodiment, if the access control policy inheritance attribute value is a first preset value, then the target resource inherits the access control policy of its parent resource. If the access control policy inheritance attribute value is a second preset value, then the target resource does not inherit the access control policy of its parent resource. If the access control policy inheritance attribute value is a third preset value, then the access control policy can be configured according to a preset configuration rule. The preset configuration rule can indicate the default inheritance relationship between the access control policies of the target resource and its parent resource. The default inheritance relationship includes inheritance or no inheritance.

[0064] The first, second, and third settings can be appropriately assigned values. For example, the first setting can be 1, the second setting can be 0, and the third setting can be empty. Thus, when the attribute value is 1, it indicates that the target resource inherits the access control policy of its parent resource, and therefore the target resource's access control policy identifier attribute is set according to the parent resource's access control policy identifier attribute. When the attribute value is 0, it indicates that the target resource does not inherit the parent resource's access control policy. In this case, a request can be made to define the access control policy identifier attribute for the target resource. For example, the first entity located at the request initiator can be requested to define it. Alternatively, the general service entity can define it itself. The definition of the access control policy identifier attribute can be completed by the entity's application layer. When the attribute value is empty, the target resource's access control policy identifier attribute can be set according to the default inheritance relationship indicated by the preset configuration rules, or according to the parent resource's access control policy identifier attribute, or the application layer can be requested to define the target resource's access control policy identifier attribute.

[0065] According to embodiments of this disclosure, since the access control policy inheritance attribute carried in the request is set simply (e.g., it can be 0, 1, or null), the solution of this disclosure is applicable not only to non-lightweight devices (such as mobile phones) but also to lightweight devices with simple logic, no computing power, or only low computing power. For example, a thermometer device is a logically simple device, and the setting value of the access control policy inheritance attribute according to embodiments of this disclosure is simple and fixed for the thermometer device.

[0066] The access control policy identifier attribute value may contain a list of identifiers for access control policies. Each identifier list contains an identifier for at least one access control policy. In some embodiments, setting the access control policy identifier attribute of the target resource based on the parent resource's access control policy identifier attribute includes copying the list of identifiers for the parent resource's access control policies into the target resource's access control policy identifier attribute.

[0067] Figure 4 illustrates a flowchart of configuring access control policies in another embodiment of this disclosure.

[0068] Step 401: When creating the target resource, determine whether a personalized access control policy identifier attribute value is set for the target resource. The personalized access control policy identifier attribute value may contain a list of identifiers for personalized access control policies that the user wishes to adopt. In some embodiments, when an access control policy identifier attribute value is included in the message request for creating the target resource, it can be regarded as a personalized access control policy identifier attribute value.

[0069] Step 402: If a personalized access control policy identifier attribute value is set, then add the personalized access control policy identifier attribute value to the access control policy identifier attribute of the target resource.

[0070] In one embodiment, when a target resource is created, if the value of the access control policy inheritance attribute is 1 and no personalized access control policy identifier attribute is set for the target resource, then the Generic Service Entity (CSE) copies the value of the access control policy identifier attribute of the parent resource to the target resource, using it as the target resource's access control policy identifier attribute. The value of the parent resource's access control policy identifier attribute contains a list of identifiers for the access control policies adopted by the parent resource.

[0071] If the inherited access control policy attribute for the target resource has a value of 1, and the target resource also has a personalized access control policy identifier attribute value, then the general service entity will copy the access control policy identifier attribute value from the parent resource to the target resource, and simultaneously add the personalized access control policy identifier attribute value to the target resource as its access control policy identifier attribute. In this way, the target resource's access control policy identifier attribute includes both the parent resource's access control policy identifier attribute value and the personalized access control policy identifier attribute value.

[0072] In another embodiment, when the target resource is created, if the inherited access control policy attribute value is 0 and no personalized access control policy identifier attribute value is set for the target resource, the generic service entity requests the access control policy identifier for the target resource from the application layer. The generic service entity adds the list of identifiers for the access control policies defined by the application layer to the target resource as the access control policy identifier attribute value for the target resource.

[0073] If the inherited access control policy attribute for the target resource has a value of 0, and the target resource also has a personalized access control policy identifier attribute, then the general service entity will copy the application-layer defined access control policy identifier to the target resource and add the personalized access control policy identifier attribute value to the target resource, making it the target resource's access control policy identifier attribute. Thus, the target resource's access control policy identifier attribute includes: a list of identifiers for the application-layer defined access control policies and a list of identifiers for the personalized access control policies the user wishes to use.

[0074] In one embodiment, the request takes the form of a resource creation message, which carries the attribute value of an access control policy inheritance attribute. Alternatively, the resource creation request may carry both the attribute value of the access control policy inheritance attribute and the attribute value of a personalized access control policy identifier attribute. A generic service entity can configure the access control policy for a resource based on the information related to the resource's access control policy inheritance attribute in the resource creation message.

[0075] Additionally, the general service entity can also update the access control policy inheritance attribute of the target resource accordingly based on other requests for operating resources, such as the attribute value of the access control policy inheritance attribute included in the resource update request, and update the access control policy of the target resource according to the inheritance relationship indicated by its attribute value.

[0076] Figure 5 shows a flowchart of another embodiment of the access control policy configuration method of this disclosure.

[0077] Step 501: Receive a resource creation message for creating the target resource.

[0078] Step 502: Determine whether the resource creation message carries attribute information for access control policy inheritance. If yes, proceed to step 504; otherwise, proceed to step 503. For example, the `inheritance` field can be set in the resource creation message to include attribute information for access control policy inheritance. The value of the `inheritance` field is the attribute value of the access control policy inheritance attribute.

[0079] Step 503: If the resource creation message does not carry attribute information for the access control policy inheritance attribute (e.g., the resource creation message does not contain the field "inheritance"), then the access control policy for the target resource is configured based on the default policy configuration rule. The default policy configuration rule can be an access control policy configuration rule currently used in related technologies, such as an independent access control policy rule. Alternatively, the default policy configuration rule can also be another policy configuration rule set by the hosting CSE of the target resource itself. For example, the default policy configuration rule could be: copy the access control policy identifier attribute value of the parent resource of the target resource to the target resource as the access control policy identifier attribute of the target resource.

[0080] Step 504: If the resource creation message carries attribute information for access control policy inheritance, determine whether the attribute value of the access control policy inheritance attribute (e.g., the value of inheritance) is 1. If yes, proceed to step 505; otherwise, proceed to step 508.

[0081] When creating a new resource, if the initiator wants the resource to inherit the access control policy of its parent resource, it can set the value of the access control policy inheritance attribute to 1. For example, in the case of no proactive defense, the value of the access control policy inheritance attribute can be set to 1, and the resource creation message does not carry the personalized access control policy identifier attribute value set for the target resource. In the case of proactive defense, in addition to the access control policy inheritance attribute being set to 1, the resource creation message also carries the personalized access control policy identifier attribute value set for the target resource.

[0082] Step 505: When the attribute value of the access control policy inheritance attribute is 1, further determine whether the resource creation message carries a personalized access control policy identifier attribute value.

[0083] Step 506: If the resource creation message does not carry a personalized access control policy identifier attribute value, copy the access control policy identifier attribute value of the parent resource to the newly created target resource.

[0084] Step 507: When the resource creation message carries a personalized access control policy identifier attribute value, in addition to copying the access control policy identifier attribute value of the parent resource to the newly created target resource, the personalized access control policy identifier attribute value is also copied to the newly created target resource.

[0085] Step 508: Determine if the attribute value of the access control policy inheritance attribute is 0. If yes, proceed to step 509; otherwise, proceed to step 512.

[0086] When creating a new resource, if the initiator wishes for the resource not to inherit the access control policy of its parent resource, it can set the value of the access control policy inheritance attribute to 0. In the absence of proactive defense, the access control policy inheritance attribute is set to 0, and the resource creation message does not include a personalized access control policy identifier value set for the target resource. In the presence of proactive defense, the access control policy inheritance attribute is set to 0, and the resource creation message includes a personalized access control policy identifier value set for the target resource.

[0087] Step 509: Determine whether the creation message carries a personalized access control policy identifier attribute value. If yes, proceed to step 510; otherwise, proceed to step 511.

[0088] Step 510: If the resource creation message does not carry a personalized access control policy identifier attribute value, copy the access control policy identifier attribute value defined by the application layer to the newly created target resource.

[0089] If the access control policy inheritance attribute value is set to 0 and resource creation is approved, Hosting CSE will request the application layer to formulate the relevant access control policy for the target resource.

[0090] Step 511: When the resource creation message carries a personalized access control policy identifier attribute value, in addition to copying the application-layer defined access control policy identifier attribute value to the newly created target resource, the personalized access control policy identifier attribute value is also copied to the newly created target resource. That is, the personalized access control policy identifier attribute value from the creation message is added to the target resource's access control policy identifier attribute value. The access control policy identifier attribute value can be a list of identifiers for access control policies.

[0091] Step 512: If the attribute value of the access control policy inheritance attribute is not set to 1 or 0, i.e., it is empty, determine whether the creation message carries a personalized access control policy identifier attribute value. If not, proceed to step 513; if yes, proceed to step 514.

[0092] In some embodiments, if the value of the access control policy inheritance attribute is set to empty, it means: 1. The initiator may be a lightweight IoT device; 2. The initiator does not know whether it should inherit the access control policy of the parent resource. In this case, Hosting CSE sets the inheritance relationship for the created resource according to the predetermined setting rules, that is, it specifies the attribute value (1, 0, empty) of the access control policy inheritance attribute according to the default inheritance relationship, and configures the access control policy accordingly based on the specified attribute value.

[0093] Step 513: Hosting CSE copies the access control policy identifier attribute value of the parent resource or the access control policy identifier attribute value specified by the application layer to the newly created target resource.

[0094] Step 514: Hosting CSE copies the access control policy identifier attribute value of the parent resource or the access control policy identifier attribute value defined by the application layer to the newly created target resource, and also copies the personalized access control policy identifier attribute value to the newly created target resource.

[0095] In one embodiment, for any child resource whose access control policy inheritance attribute value is a first set value and therefore inherits the access control policy of its parent resource, its access control policy will change as the parent resource's access control policy changes. For example, if an access control policy identifier (e.g., an access control policy identifier) ​​is added, modified, or deleted in the parent resource's access control policy identifier attribute, then the corresponding access control policy identifier will also be added, modified, or deleted in the child resource's access control policy identifier attribute. It can be understood that the addition, modification, and deletion of access control policy identifiers can be an iterative reaction; that is, a change in the parent access control policy identifier attribute always leads to a change in the child access control policy identifier attribute. For example, suppose there are three resources R1, R2, and R3, and resources R1 and R2 have a first parent-child relationship, and resources R2 and R3 have a second parent-child relationship. When the access control policy identifier in the access control policy identifier attribute of resource R1 (the parent resource in the first parent-child relationship) changes, the access control policy identifier in the access control policy identifier attribute of resource R2 (the child resource in the first parent-child relationship) also changes accordingly. Since resource R2 acts as the parent resource in the second parent-child relationship, a change in the access control policy identifier in the access control policy identifier attribute of resource R2 also leads to a change in the access control policy identifier in the access control policy identifier attribute of resource R3 (the child resource in the second parent-child relationship).

[0096] Figure 6 illustrates the tree structure of parent and child resources, as well as a schematic diagram of the attributes set for parent and child resources. As shown in Figure 6, in the resource tree, General Service Entity 1 is the root node, and it has an Access Control Policy Identifier attribute 1. The attribute value of Access Control Policy Identifier attribute 1 is a list of identifiers for access control policies. List 1 can be instantiated as {ACP_1, ACP_2, ACP_3}. General Service Entity 1 can have multiple child nodes, such as Application Entity 2, Application Entity 3, and Application Entity 5.

[0097] Application entity 2 has an access control policy inheritance attribute 2 and an access control policy identifier attribute 2. The value of access control policy inheritance attribute 2 is specified as 1, indicating that application entity 2 inherits the access control policy of its parent resource (i.e., general service entity 1). The attribute value of access control policy identifier attribute 2 is a list 2 of identifiers for the access control policies associated with application entity 2. List 2 is specified as {ACP_1, ACP_2, ACP_3}, which is consistent with the identifier list 1 of the access control policies of general service entity 1.

[0098] Application entity 3 has an access control policy inheritance attribute 3 and an access control policy identifier attribute 3. The value of the access control policy inheritance attribute 3 is specified as 1, indicating that application entity 3 inherits the access control policy of its parent resource (i.e., general service entity 1). The attribute value of the access control policy identifier attribute 3 is a list 3 of identifiers of the access control policies associated with application entity 3. List 3 can be specified as {ACP_1, ACP_2, ACP_3}.

[0099] Application entity 5 has an access control policy inheritance attribute 5 and an access control policy identifier attribute 5. The value of the access control policy inheritance attribute 5 is specified as 0, indicating that application entity 5 does not inherit the access control policy of its parent resource (i.e., general service entity 1). The attribute value of the access control policy identifier attribute 5 is a list 5 of identifiers for the access control policies associated with application entity 5. List 5 is specified as {ACP_1, ACP_5}, which is different from the list 1 of identifiers for the access control policies of general service entity 1.

[0100] Application entity 3 has one child node, application entity 4. Application entity 4 has an access control policy inheritance attribute 4 and an access control policy identifier attribute 4. The value of the access control policy inheritance attribute 4 is specified as 1, indicating that application entity 4 inherits the access control policy of its parent resource (i.e., application entity 3). The attribute value of the access control policy identifier attribute 4 is a list 4 of identifiers for the access control policies associated with application entity 4. List 4 is specified as {ACP_1, ACP_2, ACP_3, ACP_6}, where ACP_1, ACP_2, and ACP_3 are consistent with the access control policy identifier list 3 of application entity 3, and thus with the access control policy identifier list 1 of general service entity 1, while ACP_6 can be a personalized access control policy identifier for application entity 4.

[0101] The following example, illustrated with Figure 6, illustrates an exemplary application scenario of this disclosure. In this scenario, suppose a suspected attacker, A, is using web scraping to obtain IoT data (e.g., data from application entities 2-5). To protect data security, temporary protection of the resources of all application entities is required. In this case, an access control policy B can be established for user A. Access control policy B states that any resource acquisition request initiated by user A will be blocked. To achieve this, the identifier ACP_4 for access control policy B can be added to the access control policy identifier attribute 1 of the general service entity 1. Thus, list 1 is modified to {ACP_1, ACP_2, ACP_3, ACP_4}.

[0102] Since the access control policy inheritance attribute values ​​of application entities 2, 3, and their descendant application entity 4 are all 1, indicating that they inherit the access control policy of their parent resource, the access control policy identifier attributes of these application entities are updated accordingly with the general service entity 1. That is, the identifier ACP_4 for user A's access control policy B is added to the attribute value of its access control policy identifier attribute. As a result, lists 2 and 3 are automatically updated to {ACP_1, ACP_2, ACP_3, ACP_4}, and list 4 is automatically updated to {ACP_1, ACP_2, ACP_3, ACP_4, ACP_6}.

[0103] Since the access control policy inheritance attribute of application entity 5 has a value of 0, indicating that it does not inherit the access control policy of its parent resource, the access control policy identifier attribute 5 is not updated, and list 5 remains unchanged, still being {ACP_1, ACP_5}. In some embodiments, to protect the data of application entity 5, ACP_4 can also be manually added to list 5.

[0104] In some embodiments, if general service entity 1 removes the access control policy identifier ACP_3 from the attribute value of its access control policy identifier attribute 1, then list 1 is modified to {ACP_1, ACP_2}. At this time, the access control policy identifier attributes of application entity 2, application entity 3, and its descendant application entity 4, which have an access control policy inheritance attribute with an attribute value of 1, are all updated accordingly, that is, the access control policy identifier ACP_3 is removed from their attribute values. Therefore, lists 2, 3, and 4 are automatically modified to {ACP_1, ACP_2}, {ACP_1, ACP_2}, and {ACP_1, ACP_2, ACP_6}, respectively.

[0105] Since the access control policy inheritance attribute of application entity 5 has a value of 0, indicating that it does not inherit the access control policy of its parent resource, the access control policy identifier attribute 5 is not updated, and list 5 remains unchanged, still being {ACP_1, ACP_5}.

[0106] According to embodiments of this disclosure, regardless of the diversity of a resource, as long as it possesses inheritance attributes, modifying access control policies can be highly efficient. In particular, in emergency situations requiring modification of access control policies for all resources, this can be achieved simply by deploying the access control policy at the root node of the resource tree and modifying the access control policies for resources without inheritance attributes. This significantly reduces the workload for users, improving efficiency and emergency response speed.

[0107] Figure 7 shows a structural block diagram of an embodiment of the access control policy configuration device of this disclosure. As shown in Figure 7, the access control policy configuration device 70 includes: a receiving module 71, an attribute determination module 72, and a policy configuration module 73. The access control policy configuration device 70 can be implemented as a generic service entity.

[0108] The receiving module 71 is configured to receive a request to create a target resource. The receiving module 71 can receive this request from an application entity. The receiving can be done via wired or wireless means. The request can be in the form of a resource creation message. The resource creation message can carry attribute values ​​for access control policy inheritance attributes. Additionally, the resource creation message can also carry attribute values ​​for setting access control policy identifier attributes.

[0109] The attribute determination module 72 is configured to determine, based on the request, whether an access control policy inheritance attribute is set for the target resource. The attribute determination module 72 can analyze the request to determine whether it contains attribute information related to the access control policy inheritance attribute. In one embodiment, the attribute determination module 72 can determine that an access control policy inheritance attribute is set for the target resource if the request contains the field `inheritance`. In some embodiments, the attribute determination module 72 can transmit the attribute information related to the access control policy inheritance attribute contained in the request to the policy configuration module 73. Exemplarily, the attribute information may include an attribute value for setting the access control policy inheritance attribute, i.e., an access control policy inheritance attribute value, in the `inheritance` field.

[0110] The policy configuration module 73 is configured to configure the access control policy for the target resource based on the determination result. The policy configuration module 73 can configure the access control policy based on the attribute values ​​inherited from the access control policy obtained from the attribute determination module 72.

[0111] In some embodiments, the policy configuration module 73 may include an inheritance judgment unit 731 and a policy setting unit 732. The inheritance judgment unit 731 is configured to determine whether a target resource inherits the access control policy of its parent resource based on the attribute values ​​of the relevant access control policy inheritance attributes. The policy setting unit 732 is configured to set the access control policy attributes of the target resource according to the judgment result of the inheritance judgment unit 731.

[0112] In one embodiment, if the access control policy inheritance attribute value is a first preset value, the inheritance determination unit 731 determines that the target resource should inherit the access control policy of its parent resource. If the access control policy inheritance attribute value is a second preset value, the inheritance determination unit 731 determines that the target resource should not inherit the access control policy of its parent resource. If the access control policy inheritance attribute value is a third preset value, the inheritance determination unit 731 determines whether the target resource inherits the access control policy of the parent resource according to a preset setting rule. The preset setting rule indicates the default inheritance relationship between the access control policies of the target resource and its parent resource, and the default inheritance relationship includes inheritance or non-inheritance.

[0113] When the inheritance determination unit 731 determines that the target resource should inherit the access control policy of its parent resource, the policy setting unit 732 sets the access control policy identifier attribute of the target resource according to the access control policy identifier attribute of the parent resource. When the inheritance determination unit 731 determines that the target resource does not inherit the access control policy of its parent resource, the policy setting unit 732 requests the application layer to formulate the access control policy identifier attribute for the target resource.

[0114] In some embodiments, the attribute determination module 72 is configured to analyze the request to determine whether a personalized access control policy identification attribute is set for the target resource. If the attribute determination module 72 determines that a personalized access control policy identification attribute is set for the target resource, the policy setting unit 732 adds a personalized access control policy identification attribute value to the access control policy identification attribute of the target resource.

[0115] In some embodiments, the policy configuration module 73 may further include a policy update unit 733. The policy update unit 733 is configured to update the access control policy identifier attribute of the target resource according to the changed access control policy identifier attribute of the parent resource when the inheritance determination unit 731 determines that the target resource should inherit the access control policy of its parent resource and the access control policy of the parent resource changes, for example, when access control policy identifier information is added, modified, or deleted in the access control policy identifier attribute of the parent resource. That is, the policy update unit 733 adds, modifies, or deletes access control policy identifier information accordingly in the access control policy identifier attribute of the target resource.

[0116] Figure 8 shows a structural block diagram of another embodiment of the apparatus of this disclosure. As shown in Figure 8, the apparatus 80 includes a determining module 81, a sending module 82, and a receiving module 83. The access control policy configuration apparatus 80 can be implemented as an application entity.

[0117] The determining module 81 is configured to determine the inheritance relationship between the access control policies of the target resource and its parent resource. The sending module 82 is configured to send a request to create the target resource. The request includes an access control policy inheritance attribute indicating the inheritance relationship for configuring the access control policy of the target resource. The receiving module 83 is configured to receive a resource creation response in response to the request.

[0118] In one embodiment, this disclosure provides an access control policy configuration system. The access control policy configuration system includes a first entity and a second entity. The first entity is used to send a request to create a target resource. In some embodiments, the first entity may include the apparatus 80 as described above with reference to FIG8. The second entity includes the access control policy configuration apparatus 70 as described above with reference to FIG7. The first entity may be an application entity (AE), etc., while the second entity may be a general service entity (CSE), etc.

[0119] Figure 9 is a structural block diagram of another embodiment of the apparatus of this disclosure. As shown in Figure 9, an access control policy configuration apparatus implemented in a computing device is provided. The computing device may be, for example, a server of a service provider, a device associated with a client (e.g., a client device), a system-on-a-chip, and / or any other suitable computing device or computing system.

[0120] The apparatus may include a memory 901 and a processor 902. The memory 901 is used to store instructions, and the processor 902 is coupled to the memory 901. The processor 902 is configured to execute the instructions to implement the access control policy configuration method of any of the above embodiments.

[0121] The device also includes a communication interface 903 for exchanging information with other devices. Additionally, the device includes a bus 904. The processor 902, communication interface 903, and memory 901 can communicate with each other via the bus 904.

[0122] Memory 901 represents the capacity of a memory / storage device associated with one or more computer-readable media. Memory 901 may include various types of memory cells, such as read-only memory (ROM), random access memory (RAM), dynamic RAM (DRAM), dual data rate DRAM (DDRAM), synchronous DRAM (SDRAM), static RAM (SRAM), programmable ROM (PROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, polymer memory (such as ferroelectric polymer memory, ovonic memory, phase-change or ferroelectric memory, silicon-oxygen-nitrogen-oxygen-silicon (SONOS) memory), magnetic cards or optical cards, and any other type of media suitable for storing information.

[0123] Processor 902 may be a central processing unit (CPU). Processor 902 may also include other logic devices implemented in hardware as application-specific integrated circuits (ASICs) or formed using one or more semiconductors. Such hardware units are not limited by the materials forming them or the processing mechanisms employed therein. For example, processor 902 may include one or more semiconductors and / or transistors (e.g., integrated circuits (ICs)).

[0124] In one embodiment, this disclosure provides a computer-readable storage medium. Examples of a computer-readable storage medium may include one or more types of storage media capable of storing electronic data, including volatile or non-volatile memory, removable or non-removable memory, erasable or non-erasable memory, writable or rewritable memory, and so on. The computer-readable storage medium stores computer instructions that, when executed by a processor, cause the processor to implement the access control policy configuration method as described in any of the preceding embodiments.

[0125] The access control policy configuration method, apparatus, system, and storage medium provided in the above embodiments can determine whether to inherit the access policy permissions of the parent resource based on the access control policy inheritance attribute, enabling efficient setting and modification of the access control policy of the child resource. Because it allows users to configure and modify access control policies by indicating the inheritance relationship, it improves the efficiency of access control policy configuration and modification, and perfects existing standards related to access control policies.

[0126] Generally, any functionality described herein can be implemented using software, firmware, hardware (e.g., fixed logic circuitry), manual processing, or a combination of these methods. The terms “module,” “function,” and “logic” as used herein generally refer to software, firmware, hardware, or a combination thereof. In the case of a software implementation, a module, function, or logic represents program code that performs a specified task when on or executed by a processor (e.g., one or more CPUs). This program code may be stored in one or more computer-readable storage devices. The characteristics of the access control policy configurations described above are platform-independent, meaning that these techniques can be implemented on a wide variety of commercial computing platforms with a wide range of processors.

[0127] Although this disclosure has been described in conjunction with various exemplary embodiments, those skilled in the art will understand that many modifications can be made therein within the scope of the appended claims. Therefore, it is not intended to limit the scope of this disclosure in any way to the foregoing description, but rather it should be determined entirely by reference to the appended claims.

Claims

1. A method for configuring access control policies, comprising: Receive a request to create the target resource; Based on this request, it is determined whether an access control policy inheritance attribute is set for the target resource, wherein the access control policy inheritance attribute indicates the inheritance relationship between the access control policies of the target resource and its parent resource; and Configure the access control policy for the target resource based on the determined results.

2. The method as described in claim 1, wherein, Configuring the access control policy for the target resource based on the determined results includes: If the target resource has an access control policy inheritance attribute, then based on the attribute value of the access control policy inheritance attribute, it is determined whether the target resource inherits the access control policy of its parent resource; and Configure the access control policy for the target resource based on the judgment result.

3. The method as described in claim 2, wherein, Determining whether the target resource inherits the access control policy of its parent resource includes: If the attribute value of the access control policy inheritance attribute is a first set value, then it is determined that the target resource should inherit the access control policy of the parent resource. If the attribute value of the access control policy inheritance attribute is a second set value, then it is determined that the target resource does not inherit the access control policy of the parent resource; and If the attribute value of the access control policy inheritance attribute is a third set value, then it is determined whether the target resource inherits the access control policy of the parent resource according to the preset setting rules.

4. The method of claim 3, wherein, Configuring the access control policy for the target resource includes: When it is determined that the target resource should inherit the access control policy of the parent resource, the access control policy identifier attribute of the target resource is set according to the access control policy identifier attribute of the parent resource; When it is determined that the target resource does not inherit the access control policy of the parent resource, an access control policy identifier attribute is determined for it; determining the access control policy identifier attribute for it includes: formulating an access control policy identifier attribute for the target resource, or requesting another entity to formulate an access control policy identifier attribute for the target resource; and The preset setting rule indicates the default inheritance relationship between the access control policies of the target resource and its parent resource, and the default inheritance relationship includes inheritance or no inheritance.

5. The method according to any one of claims 1-4, further comprising: Based on the request, determine whether a personalized access control policy identifier attribute value is set for the target resource; as well as If the personalized access control policy identifier attribute value is set for the target resource, then the personalized access control policy identifier attribute value is added to the access control policy identifier attribute of the target resource.

6. The method according to any one of claims 1-5, further comprising: When the target resource has been created and the attribute value of its access control policy inheritance attribute indicates that it should inherit the access control policy of the parent resource, in response to detecting a change in the access control policy identifier attribute of the parent resource, the access control policy identifier attribute of the target resource is updated according to the changed access control policy identifier attribute of the parent resource.

7. The method of claim 5, wherein the request takes the form of a resource creation message, and the method comprises: Extract the attribute value of the access control policy inherited attribute from the resource creation message, or extract the attribute value of the access control policy inherited attribute and the personalized access control policy identifier attribute value from the resource creation message.

8. The method of claim 1, further comprising: If the access control policy inheritance attribute is not set for the target resource, the access control policy for the target resource is configured based on the default policy configuration rules.

9. A method for configuring access control policies, comprising: Determine the inheritance relationship between the access control policies of the target resource and its parent resource; Send a request to create the target resource, the request having an access control policy inheritance attribute indicating the inheritance relationship for configuring the access control policy of the target resource; as well as Receive the resource creation response in response to the request.

10. An apparatus for configuring access control policies, comprising: The receiving module is configured to receive requests to create the target resource; The attribute determination module is configured to determine, based on the request, whether an access control policy inheritance attribute is set for the target resource, wherein the access control policy inheritance attribute indicates the inheritance relationship between the access control policies of the target resource and its parent resource; and The policy configuration module is configured to configure the access control policy for the target resource based on the determined result.

11. The apparatus of claim 10, wherein, The policy configuration module includes: An inheritance determination unit is configured to, in response to the presence of an access control policy inheritance attribute set for the target resource, determine whether the target resource inherits the access control policy of its parent resource based on the attribute value of the access control policy inheritance attribute; and The policy setting unit is used to set the access control policy for the target resource based on the judgment result.

12. The apparatus of claim 11, wherein, The inheritance determination unit is used to determine whether the target resource should inherit the access control policy of the parent resource when the attribute value of the access control policy inheritance attribute is a first preset value; to determine whether the target resource does not inherit the access control policy of the parent resource when the attribute value of the access control policy inheritance attribute is a second preset value; and to determine whether the target resource inherits the access control policy of the parent resource according to a preset setting rule when the attribute value of the access control policy inheritance attribute is a third preset value.

13. The apparatus of claim 12, wherein, The policy setting unit is used to set the access control policy identifier attribute of the target resource according to the access control policy identifier attribute of the parent resource when it is determined that the target resource should inherit the access control policy of the parent resource; and to determine the access control policy identifier attribute used for the target resource when it is determined that the target resource does not inherit the access control policy of the parent resource. Determining the access control policy identification attribute for it includes: defining an access control policy identification attribute for the target resource, or requesting another entity to define an access control policy identification attribute for the target resource. The preset setting rules indicate the default inheritance relationship between the access control policies of the target resource and its parent resource, and the default inheritance relationship includes inheritance or no inheritance.

14. The apparatus according to any one of claims 10-13, wherein, The attribute determination module is configured to determine, based on the request, whether a personalized access control policy identifier attribute value is set for the target resource; and the policy setting unit is configured to, in response to the setting of the personalized access control policy identifier attribute value for the target resource, add the personalized access control policy identifier attribute to the access control policy identifier attribute of the target resource.

15. The apparatus according to any one of claims 10-14, wherein, The policy configuration module further includes a policy update unit, configured to update the access control policy identifier attribute of the target resource according to the changed access control policy identifier attribute of the parent resource when the target resource has been created and the attribute value of its access control policy inheritance attribute indicates that it should inherit the access control policy of the parent resource.

16. The apparatus of claim 14, wherein, The request takes the form of a resource creation message, and the attribute determination module is configured to extract the attribute value of the access control policy inherited attribute from the resource creation message, or extract the attribute value of the access control policy inherited attribute and the personalized access control policy identifier attribute value from the resource creation message.

17. The apparatus according to any one of claims 10-16, wherein, The policy setting unit is configured to configure the access control policy of the target resource based on the default policy configuration rules in response to the fact that no access control policy inheritance attribute is set for the target resource.

18. An apparatus for configuring access control policies, comprising: The determination module is designed to determine the inheritance relationship between the access control policies of the target resource and its parent resource. The sending module is configured to send a request to create the target resource, the request being set with an access control policy inheritance attribute indicating the inheritance relationship for configuring the access control policy of the target resource; as well as The receiving module is configured to receive a resource creation response in response to the request.

19. A computing device for configuring access control policies, comprising: The memory is configured to store executable instructions; as well as A processor coupled to the memory, the processor being configured to execute the executable instructions to implement the method as described in any one of claims 1 to 9.

20. A computer-readable storage medium having stored thereon computer program instructions that, when executed by one or more processors, cause the processors to perform the method of any one of claims 1 to 9.

21. A system for configuring access control policies, comprising: The first entity is used to send the request to create the target resource; and The second entity includes the apparatus as described in any one of claims 10 to 17.

22. The system of claim 21, wherein, The first entity includes an application entity, and the second entity includes a general service entity.

23. The system of claim 21, wherein, The first entity includes the apparatus as described in claim 18.