Data access control method and apparatus

Abstract

Disclosed in the embodiments of the present application are a data access control method and an apparatus, which are used for improving security for data access control. The method in the embodiments of the present application comprises: configuring authentication information for data access control, the authentication information comprising one or more of the following: an identity security classification level, a resource security classification level and an environment security classification level, the identity security classification level being used for indicating the access authority of a user, the resource security classification level being used for indicating the confidentiality level of a cloud resource, and the environment security classification level being used for indicating the confidentiality level of a cloud environment; receiving a data access request from the user, the data access request being used for requesting access to data in the cloud resource or cloud environment; and processing the data access request according to authentication logic, the authentication logic comprising control logic between the authentication information, the authentication logic being used for controlling the access authority of the user to the data in the cloud resource or cloud environment, or being used for controlling the flow direction of the data between the cloud resource or the cloud environment, and the flow direction being a direction from a low security classification level to a high security classification level.

Description

Data access control method and device

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office on July 17, 2023, with application number 202310876413.5 and invention name “A method, device and other equipment for access control”, the entire contents of which are incorporated by reference into this application.

[0002] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office on September 27, 2023, with application number 202311264762.8 and invention name “A Data Access Control Method and Device”, the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The embodiments of the present application relate to the field of cloud computing, and in particular to a data access control method and device. Background Art

[0004] After years of development, cloud computing has evolved from a form of computer resources providing services over the internet to a cloud-based microservices architecture model, supporting industrial upgrades and unleashing productivity. As cloud computing grows, various industries will further embrace it, and in this process, the importance of cloud data security will become increasingly prominent.

[0005] In current cloud data access control strategies, cloud data centers implement data access control based on the attributes of the accessing user and the accessed object. Specifically, cloud data centers control access to cloud resources based on the user's access rights. Once a user obtains access to the cloud data center, the cloud data center allows the user to access cloud resources. However, after obtaining access to cloud resources, the cloud service platform cannot prevent the user from transferring cloud resources to external environments, resulting in a high risk of data leakage and poor security for data access control in cloud data centers.

[0006] Summary of the Invention

[0007] Embodiments of the present application provide a data access control method that enables a cloud data center to configure the resource classification of cloud resources, thereby restricting the flow of data within the cloud resources based on the resource classification, thereby improving the security of data access control. Embodiments of the present application also provide a data access control apparatus, computing device, computing device cluster, computer-readable storage medium, and computer program product corresponding to the data access control method.

[0008] In the first aspect, an embodiment of the present application provides a data access control method, which can be executed by a data access system, or by a component of the data access system, such as a processor, chip or chip system of the data access system, or by a logic module or software that can implement all or part of the data access system functions. Taking a cloud data center as an example of a data access system, the method provided in the first aspect includes: the cloud data center configures authentication information for data access control, the authentication information includes one or more of the following: identity confidentiality level, resource confidentiality level and environment confidentiality level, the identity confidentiality level is used to indicate the user's access rights, the resource confidentiality level is used to indicate the confidentiality level of the cloud resource, the environment confidentiality level is used to indicate the confidentiality level of the cloud environment where the cloud resource is located, and the cloud resources include one or more of the following: computing resources, network resources and storage resources. The cloud data center receives a data access request from a user, the data access request is used to request access to data in the cloud resources, and the data access request carries authentication information. The cloud data center processes data access requests based on authentication logic, which includes control logic between authentication information. This authentication logic is used to control user access rights to data in cloud resources or cloud environments, as well as the flow of data within cloud resources or cloud environments, from low-security to high-security levels. The cloud data center then grants or denies the user's data access request based on the authentication logic's processing of the data access request.

[0009] In the embodiment of the present application, the cloud data center data can configure authentication information for users and cloud resources respectively, and control the flow of data between different cloud resources based on the authentication logic between the authentication information, so that the data in the cloud resources flows from cloud resources with low resource security levels to cloud resources with high resource security levels, thereby avoiding the leakage of data in cloud resources and improving the security of data access control.

[0010] In one possible implementation, during the process of configuring authentication information for data access control in a cloud data center, the cloud data center configures identity levels for different users based on the user's organizational structure hierarchy, and the highest configurable identity level for users in a lower-level organization is lower than the highest configurable identity level for users in a higher-level organization.

[0011] In the embodiment of the present application, the cloud data center can configure identity security levels for users, determine the user's highest configurable identity security level based on the user's level in its organizational structure, and control the user's access rights to cloud resources based on the user's identity security level, thereby improving the security of data access control.

[0012] In one possible implementation, the cloud data center sets an identity security level configuration method for newly added users. The configuration methods include inheriting the identity security level of the user in the upper layer in the organizational structure and configuring the identity security level according to the default method. The default method is not to inherit the identity security level of the user in the upper layer in the organizational structure, that is, to configure the user's identity security level according to the lowest identity security level.

[0013] In the implementation of this application, the cloud data center sets the identity security level configuration method for new users, and automatically configures the identity security level of new users according to the identity security level configuration method, thereby improving the configuration efficiency of the user's identity security level.

[0014] In one possible implementation, the cloud data center configures the resource security level of cloud resources based on the identity security level of the creating user. The creating user is the user who creates the cloud resource, and the resource security level of the cloud resource is positively correlated with the identity security level of the creating user. For example, if the identity security level of the creating user is Level 1, the resource security level of the cloud resource created by this user is Level 1.

[0015] In the process of configuring the resource level of cloud resources in the cloud data center in the implementation of this application, the resource level of cloud resources can be configured according to the identity level of the user who creates the cloud resources, thereby improving the configuration efficiency of resource levels and the security of cloud resources.

[0016] In one possible implementation, when the user's identity security level is greater than or equal to the resource security level of the cloud resource, the user is allowed to read data from the cloud resource. When the user's identity security level is less than or equal to the resource security level of the cloud resource, the user is allowed to write data to the cloud resource.

[0017] In the implementation of this application, the cloud data center can allow users whose identity security level is higher than the resource security level to read data in cloud resources, and prohibit users whose identity security level is higher than the resource security level from writing data in cloud resources, thereby preventing users with high identity security level from leaking data to cloud resources with low resource security level, and improving the security of data access control.

[0018] In one possible implementation, a data access request is used to request the transfer of data from a source cloud resource to a destination cloud resource. In the process of the cloud data center processing the data access request based on the authentication logic between the authentication information, when the resource confidentiality level of the source cloud resource is less than or equal to the resource confidentiality level of the destination cloud resource, the user is allowed to transfer the data in the source cloud resource to the destination cloud resource.

[0019] In the implementation of this application, the cloud data center controls the flow of data between different cloud resources based on resource security levels, so that data can only flow from cloud resources with low resource security levels to cloud resources with high resource security levels, thereby improving the security of data flow between different cloud resources.

[0020] In one possible implementation, the authentication information also includes the environmental confidentiality level of the cloud environment. The data access request is used to request the transfer of data from the source cloud environment to the destination cloud environment. In the process of the cloud data center processing the data access request according to the authentication logic between the authentication information, when the environmental confidentiality level of the source cloud environment is less than or equal to the environmental confidentiality level of the destination cloud environment, the user is allowed to transfer the data from the source cloud environment to the destination cloud environment.

[0021] In the implementation of this application, the cloud data center controls the flow of data between different cloud environments based on the environmental security level, so that data can only flow from a cloud environment with a low environmental security level to a cloud environment with a high environmental security level, thereby improving the security of data flow in different cloud environments.

[0022] In one possible implementation, the cloud data center needs to configure authentication logic between authentication information for data access control. The authentication logic between identity confidentiality and resource confidentiality includes: if the user's identity confidentiality is greater than or equal to the resource confidentiality of the cloud resource, the user is allowed to access the data in the cloud resource. The authentication logic between identity confidentiality and environment confidentiality includes: if the user's identity confidentiality is greater than or equal to the environment confidentiality, the user is allowed to access the data in the cloud environment. The authentication logic between different cloud resource confidentiality levels includes: data in cloud resources can only flow from low-confidential cloud resources to high-confidential cloud resources. The authentication logic between different environment confidentiality levels includes: data in the cloud platform can only flow from a low-confidential cloud environment to a high-confidential cloud environment.

[0023] In the embodiment of the present application, the cloud data center can pre-configure the authentication logic between the authentication information, thereby controlling the flow of data in different cloud resources or cloud environments based on the authentication logic, thereby improving the security of data access control.

[0024] In one possible implementation, the data access request also includes first temporary authorization information. In the process of the cloud data center processing the data access request according to the authentication logic between the authentication information, when the environmental confidentiality level of the source cloud environment is greater than the environmental confidentiality level of the destination cloud environment, the user is allowed to transfer the data in the source cloud environment to the destination cloud environment based on the first temporary authorization information. The first temporary authorization information is used to authorize data to flow from a high-confidence cloud environment to a low-confidence cloud environment.

[0025] In the implementation of this application, the cloud data center can control the flow of data from a cloud environment with a high environmental security level to a cloud environment with a low environmental security level based on temporary authorization information access, thereby improving the security of data flow in different cloud environments.

[0026] In one possible implementation, the data access request also includes second temporary authorization information. When the user's identity security level is lower than the resource security level of the cloud resource, the user is allowed to read the data in the cloud resource based on the second temporary authorization information. The second temporary authorization information is used to authorize the user to access cloud resources whose resource security level is higher than the identity security level.

[0027] In the embodiment of the present application, a user can access cloud resources whose resource security level is higher than the user's identity security level based on temporary authorization information, thereby improving the flexibility of data access control.

[0028] In one possible implementation, the data access request also includes third temporary authorization information. In the process of the cloud data center processing the data access request according to the authentication logic between the authentication information, when the resource confidentiality level of the source cloud resource is greater than the resource confidentiality level of the destination cloud resource, the user is allowed to transfer the data in the source cloud resource to the destination cloud resource based on the third temporary authorization information. The third temporary authorization information is used to authorize data to flow from high-confidentiality cloud resources to low-confidentiality cloud resources.

[0029] In the implementation of this application, the cloud data center can control the flow of data from cloud resources with high resource confidentiality to cloud resources with low resource confidentiality based on temporary authorization information access, thereby improving the security of data flowing between different cloud resources.

[0030] In one possible implementation, the temporary authorization information includes reviewer information and signature information. The reviewer information includes one or more designated reviewers who are allowed non-routine access, and the signature information includes the secret key that grants the temporary authorization. The user only obtains temporary authorization after all one or more reviewers in the reviewer information have approved the request.

[0031] In the embodiment of the present application, when a user obtains temporary authorization information, the user must obtain approval from all one or more reviewers of the instruction before the user can obtain temporary authorization rights, thereby improving the security of data access control.

[0032] In one possible implementation, a user's identity security level cannot be applied across organizations. That is, the identity security levels of users in different organizational structures are not interoperable. For example, even if the identity security level of a user in one organization is higher than the resource security level of the cloud resources corresponding to a second organization, the user in the first organization cannot access the cloud resources corresponding to the second organization.

[0033] In the embodiment of the present application, the identity levels of users in different organizational structures are not interoperable, thereby improving the security of data access control in the cloud data center.

[0034] In a second aspect, an embodiment of the present application provides a data access control device, which includes a configuration unit, a transceiver unit, and a processing unit. The configuration unit is used to configure authentication information for data access control, where the authentication information includes one or more of the following: identity security level, resource security level, and environment security level. The identity security level indicates the user's access rights, the resource security level indicates the confidentiality level of cloud resources, and the environment security level indicates the confidentiality level of the cloud environment in which the cloud resources are located. Cloud resources include one or more of the following: computing resources, network resources, and storage resources. The transceiver unit is used to receive data access requests from users, where the data access requests are used to request access to data in cloud resources. The processing unit is used to process data access requests based on authentication logic, where the authentication logic includes control logic between authentication information, and where the authentication logic controls the user's access rights to data in cloud resources or cloud environments, as well as the direction of data flow within cloud resources or cloud environments, with the flow direction being from low security level to high security level. The processing unit is also used to allow or deny the user's data access based on the authentication logic processing result of the data access request.

[0035] In one possible implementation, the configuration unit is specifically configured to configure identity levels of different users based on their organizational structure levels, where the highest configurable identity level of users in lower-level organizations is lower than the highest configurable identity level of users in higher-level organizations.

[0036] In a possible implementation, the configuration unit is further configured to set a configuration mode for the identity security level of the newly added user, the configuration modes including inheriting the identity security level of the organization and configuring according to a default mode, wherein the default mode is configuring according to the lowest identity security level.

[0037] In a possible implementation, the configuration unit is further configured to configure the resource security level of the cloud resource based on the identity security level of the creating user, the creating user being the user who creates the cloud resource, and the resource security level of the cloud resource is positively correlated with the identity security level of the creating user.

[0038] In one possible implementation, the processing unit is specifically used to allow the user to read data from the cloud resources when the user's identity security level is greater than or equal to the resource security level of the cloud resources; and to allow the user to write data in the cloud resources when the user's identity security level is less than or equal to the resource security level of the cloud resources.

[0039] In one possible implementation, a data access request is used to request the transfer of data from a source cloud resource to a destination cloud resource, and the processing unit is specifically used to allow a user to transfer data from a source cloud resource to a destination cloud resource when the resource confidentiality level of the source cloud resource is less than or equal to the resource confidentiality level of the destination cloud resource.

[0040] In one possible implementation, a data access request is used to request the transfer of data from a source cloud environment to a destination cloud environment, and the processing unit is used to allow a user to transfer data from the source cloud environment to the destination cloud environment when the environmental confidentiality level of the source cloud environment is less than or equal to the environmental confidentiality level of the destination cloud environment.

[0041] In one possible implementation, the data access request also includes first temporary authorization information, and the processing unit is also used to allow the user to transfer data from the source cloud environment to the destination cloud environment based on the first temporary authorization information when the environmental confidentiality level of the source cloud environment is greater than the environmental confidentiality level of the destination cloud environment. The first temporary authorization information is used to authorize data to flow from a high-confidentiality cloud environment to a low-confidentiality cloud environment.

[0042] In one possible implementation, the data access request also includes second temporary authorization information, and the processing unit is further used to allow the user to read data in the cloud resources based on the second temporary authorization information when the user's identity classification is lower than the resource classification of the cloud resources. The second temporary authorization information is used to authorize the user to access cloud resources whose resource classification is higher than the identity classification.

[0043] In one possible implementation, the data access request also includes third temporary authorization information, and the processing unit is also used to allow the user to transfer data from the source cloud resource to the destination cloud resource based on the third temporary authorization information when the environmental confidentiality level of the source cloud resource is greater than the environmental confidentiality level of the destination cloud resource. The third temporary authorization information is used to authorize data to flow from high-confidentiality cloud resources to low-confidentiality cloud resources.

[0044] In a third aspect, an embodiment of the present application provides a computing device, comprising a processor coupled to a memory, the processor being used to store instructions. When the instructions are executed by the processor, the computing device executes the method described in the first aspect or any possible implementation of the first aspect.

[0045] In a fourth aspect, an embodiment of the present application provides a computing device cluster, which includes one or more computing devices, each of which includes a processor coupled to a memory, and the processor is used to store instructions. When the instructions are executed by the processor, the computing device cluster executes the method described in the first aspect or any possible implementation method of the first aspect.

[0046] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium having instructions stored thereon. When the instructions are executed, the computer executes the method described in the first aspect or any possible implementation method of the first aspect.

[0047] In a sixth aspect, an embodiment of the present application provides a computer program product, which includes instructions. When the instructions are executed, the computer implements the method described in the first aspect or any possible implementation method of the first aspect.

[0048] It can be understood that the beneficial effects that can be achieved by any of the data access control devices, computing devices, computing device clusters, computer-readable media or computer program products provided above can refer to the beneficial effects in the corresponding methods and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] FIG1 is a schematic diagram of the system architecture of a data access control system provided by an embodiment of the present application;

[0050] FIG2 is a flow chart of a data access control method provided in an embodiment of the present application;

[0051] FIG3 is a schematic diagram of a user organization structure provided in an embodiment of the present application;

[0052] FIG4 is a flow chart of another data access control method provided in an embodiment of the present application;

[0053] FIG5 is a flow chart of another data access control method provided in an embodiment of the present application;

[0054] FIG6 is a flow chart of another data access control method provided in an embodiment of the present application;

[0055] FIG7 is a flow chart of another data access control method provided in an embodiment of the present application;

[0056] FIG8 is a schematic structural diagram of a data access control device provided in an embodiment of the present application;

[0057] FIG9 is a schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0058] FIG10 is a schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application;

[0059] FIG11 is a schematic diagram of the structure of another computing device cluster provided in an embodiment of the present application. DETAILED DESCRIPTION

[0060] The embodiments of the present application provide a data access control method and apparatus for improving the security of data access control in a cloud data center.

[0061] The terms "first," "second," "third," "fourth," and the like (if any) in the specification and claims of this application and in the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or sequential sequence. It should be understood that the terms used in this manner are interchangeable where appropriate so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having," and any variations thereof, are intended to cover non-exclusive inclusions, e.g., a process, method, system, product, or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0062] In the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be interpreted as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0063] First, some terms involved in the embodiments of the present application are introduced to facilitate those skilled in the art to understand the technical solutions.

[0064] A mandatory access control model restricts resource access based on predefined security policies. Security policies are typically defined by system administrators or security policy makers and determine the resources and actions a user can access based on their security level, role, or other attributes. Under the mandatory access control model, permissions are not determined by individuals but rather controlled by the system as a whole.

[0065] The Bell-LaPadula (BLP) model, proposed by David Elliott Bell and Leonard J. LaPadula in 1973, is a mandatory access control model designed to formalize a multi-level security policy for protecting data confidentiality. It describes a set of rules based on the subject's security clearance level and the object's classification level. If a subject's access to data complies with the security policy, the system is considered secure. The BLP model's access control features a no-read-up and no-write-down policy, meaning that subjects cannot read data with a classification level higher than their clearance level and cannot write objects with a classification level lower than their clearance level.

[0066] Attribute-based access control (ABAC) allows or denies a subject's requested operation on an object based on the subject's assigned attributes, the object's assigned attributes, environmental conditions, and a set of policies associated with these attributes and conditions. Attributes are characteristics of a subject, object, or environmental condition.

[0067] In order to make the technical solution of the present application clearer and easier to understand, the system architecture of the present application is introduced below with reference to the accompanying drawings.

[0068] Please refer to Figure 1, which is a schematic diagram of the system architecture of a data access control system provided in the examples of this application. In the example shown in Figure 1, data access control system 10 includes a user client 100 and a cloud data center 200. Cloud data center 200 includes a unified identity authentication service module 201, storage resources 202, computing resources 203, network resources 204, and a policy decision point 205. The functions of each component are described in detail below.

[0069] User client 100 is used to request cloud resources related to cloud services from cloud data center 200. Cloud resources include storage resources, computing resources, and network resources. For example, a user can send a data access request to cloud data center 200 through user client 100. The data access request is used to request to read data from a cloud resource or to request to write data to a cloud resource. For another example, a data access request can be used to request to copy data from a cloud resource to another cloud resource.

[0070] It can be understood that the user client 100 can be a client corresponding to one or more users in the cloud enterprise organizational structure. Each user in the cloud enterprise organizational structure has his or her own cloud account. The user logs in to the user client 100 based on the cloud account and accesses the cloud resources in the cloud data center 200 based on the application interface between the user client 100 and the cloud data center 200.

[0071] Cloud data center 200 centrally manages and controls various cloud resources. For example, upon receiving a data access request from a user client 100, cloud data center 200 processes the request based on the user's identity level and access requirements and returns a corresponding access response to the user client 100. The access response may include the execution result and the requested data. Cloud data center 200 includes a unified identity authentication service module 201, storage resources 202, computing resources 203, network resources 204, and a policy decision point 205. The functions of each component are described in detail below.

[0072] The unified identity authentication service module 201 is used to uniformly manage and authenticate user identities, including managing user authentication information, such as cloud account numbers and passwords. The unified identity authentication service module 201 is also used to configure the identity security level for each user's cloud account. For example, an enterprise security administrator can configure the identity security level for each user's cloud account through the unified identity authentication service module 201.

[0073] Storage resources 202 are used to provide devices or services for storing and managing data for the user client 100. Storage resources 202 include object storage, block storage, and file storage. Object storage stores data in the form of objects, and users can access and operate objects using unique identifiers. Block storage provides a storage model similar to a physical hard drive, allowing users to access and manage data in the form of blocks. File storage provides file system storage services, allowing users to access and share files using standard file protocols.

[0074] Computing resources 203 are used to provide user client 100 with resources such as servers or processors for processing and executing computing tasks. Computing resources 203 are, for example, Elastic Compute Service (ECS). Elastic Compute Service (ECS) provides users with elastically adjustable virtual server resources, enabling users to create, manage, and deploy computing resources on the cloud and execute user computing tasks based on these resources.

[0075] The network resources 204 are used to provide network devices and services for connection and data transmission for the user client 100. The network resources 204 are, for example, virtual private clouds (VPCs). A virtual private cloud (VPC) is a logically isolated virtual network that can provide users with customizable and scalable network services, enabling users to build and manage their own private networks on the cloud.

[0076] It should be noted that the storage resources 202, computing resources 203, and network resources 204 in the aforementioned cloud data center 200 can be located in different network environments. The cloud data center can configure resource security levels for different cloud resources and environment security levels for different network environments. Cloud data center 200 can control the flow of data between different cloud resources using resource security levels and control the flow of data between different cloud environments using environment security levels.

[0077] The policy decision point 205 is used to formulate and execute authentication logic in the cloud data center. The authentication logic includes the authentication logic between the user's identity classification and the resource classification of the cloud resources, the authentication logic between the user's identity classification and the environment classification of the cloud environment, the authentication logic of data flow between cloud resources, and the authentication logic of data flow between cloud environments.

[0078] Specifically, the policy decision point 205 can analyze the identity classification, environment classification, resource classification, and context information contained in the data access request, and perform matching and evaluation based on predefined authentication logic to determine whether to allow or deny the data access request. For example, the policy decision point 205 can allow a user to access cloud resources with a resource classification less than or equal to the identity classification, while denying the user access to cloud resources with a resource classification greater than the identity classification. For another example, the policy decision point 205 can allow data to flow from a cloud resource with a lower resource classification to a cloud resource with a higher resource classification. The policy decision point 205 can also allow data to flow from a cloud environment with a lower environment classification to a cloud environment with a higher environment classification.

[0079] Based on the data access control system 10 shown in Figure 1 , the present application further provides a data access control method. The data access control method provided by the present application embodiment will be described below in conjunction with an embodiment.

[0080] Please refer to Figure 2, which is a flow chart of a data access control method provided by an embodiment of the present application. In the example shown in Figure 2, the method includes the following steps:

[0081] Step 201: Configure authentication information for data access control, where the authentication information includes one or more of the following: identity confidentiality level, environment confidentiality level, and cloud resource confidentiality level.

[0082] Before performing data access control, the cloud data center 200 needs to configure authentication information for data access control. The authentication information includes one or more of the following: identity security level, environment security level, and resource security level. Specifically, the cloud data center 200 configures identity security levels for users in the cloud enterprise organizational structure, configures environment security levels for different cloud environments, and configures resource security levels for different cloud resources. Cloud resources include one or more of the following: computing resources, network resources, and storage resources. Cloud environments include those provided by different cloud service providers. The following details the configuration process of several authentication information:

[0083] When configuring the identity and security levels of users within an enterprise organization, cloud data center 200 arranges the cloud accounts of all users of the cloud enterprise according to the enterprise's organizational structure. The enterprise's security administrator then configures the identity and security levels (CL) for the cloud accounts of users within the organizational structure based on actual business needs. After configuring the user's identity and security levels, cloud data center 200 manages and verifies the user's identity and security levels based on a unified identity and access management (IAM) service.

[0084] It is understood that users within an enterprise organization include users at different levels of the organizational structure, such as high-level users, mid-level users, and low-level users. Users at different levels have different identity security levels, which can be represented by Arabic numerals, with larger numbers indicating higher identity security levels. For example, user identity security levels can be categorized from 0 to 10.

[0085] Please refer to Figure 3, which is a schematic diagram of a user organizational structure provided in an embodiment of the present application. In the example shown in Figure 3, the organizational structure of the enterprise includes a multi-layer organizational structure level, and each level of the organization in the organizational structure includes one or more users, and the highest configurable identity level of users in the organization at the same level is the identity level corresponding to the organizational level. For example, the second-level organizations 1 and 2 in the organizational structure of the enterprise shown in Figure 3 both include one or more users, and the highest configurable identity level of users in organizations 1 and 2 is the identity level corresponding to the organizational level. For example, the highest configurable identity level of users in organizations 1 and 2 is level 9.

[0086] When cloud data center 200 configures identity security levels for different users within the organizational structure, the highest configurable identity security level for users in lower-level organizations must not be higher than the highest configurable identity security level for users in higher-level organizations. For example, in the organizational structure shown in FIG3 , the highest configurable identity security level for users in second-level organizations 1 and 2 is 9, while the highest configurable identity security level for users in the first-level root organization is 10. This means that the highest configurable identity security level for users in the second-level organization is lower than the highest configurable identity security level for users in the first-level organization.

[0087] It should be noted that cloud data center 200 can also configure the identity security level configuration method for newly added users. The configuration method includes having newly added users inherit the identity security level corresponding to the newly added user's organization, or having newly added users be configured according to the default configuration method, which is to configure the user according to the lowest identity security level. For example, if cloud data center 200 sets the identity security level configuration method for newly added users to the default configuration method, when a new user is added to the organizational structure, cloud data center 200 will configure the new user's identity security level to 0 according to the default identity security level.

[0088] Please continue to refer to Figure 3. In the example shown in Figure 3, when a new user is added to Organization 7 in the organizational structure, since the identity security level of the new user is configured in the default configuration mode, when the cloud data center 200 configures the identity security level of the new user, it configures the identity security level of the new user in Organization 7 to level 0 according to the default configuration mode.

[0089] In the process of configuring environment security levels for different cloud environments, the cloud data center 200 can configure different environment security levels (SL) for different cloud environments according to business needs. Different cloud environments, for example, cloud service environments provided by different cloud service providers. The environment security level of a cloud environment can also be represented by Arabic numerals, with larger numbers indicating higher environment security levels. For example, different cloud environments are divided into edge clouds, public clouds, and private clouds according to their environment security levels, where the environment security level of an edge cloud is 1 and the environment security level of a private cloud is 10.

[0090] Please refer to Figure 4, which is a schematic diagram of different cloud environments provided by an embodiment of the present application. In the example shown in Figure 4, the cloud data center 200 can configure the environment security level for different cloud environments according to business needs. For example, different cloud environments can be divided into secret cloud, public cloud, and edge cloud based on the environment security level, where the environment security level corresponding to secret cloud is level 10, the environment security level corresponding to public cloud is level 4 to level 9, and the environment security level corresponding to edge cloud is level 1 to level 3.

[0091] When cloud data center 200 configures resource classifications for different cloud resources, it does so separately for computing resources, network resources, and storage resources. Different cloud resources can be classified as secret, confidential, top secret, and core secret based on their classification. Resource classifications can also be represented by Arabic numerals, with higher numbers indicating higher levels of security. For example, secret resources have classifications of 2 to 5, confidential resources have classifications of 4 to 7, top secret resources have classifications of 8 to 9, and core secret resources have classifications of 10.

[0092] In the embodiments of the present application, cloud resources with different resource security levels are located in cloud environments with different environmental security levels. The higher the environmental security level of a cloud environment, the more cloud resources with higher resource security levels it can accommodate. For example, a cloud environment with an environmental security level of 9 can accommodate cloud resources with a resource security level of 9 or lower.

[0093] Please refer to Figure 4. In the example shown in Figure 4, the resource classification levels of cloud resources are classified as Secret, Confidential, Top Secret, and Core Secret. Cloud environments with different classification levels can accommodate cloud resources of different resource classification levels. For example, the Secret Cloud environment can accommodate cloud resources with classification levels of Secret, Confidential, Top Secret, and Core Secret, while the Public Cloud environment can accommodate cloud resources with classification levels of Secret, Confidential, and Top Secret. Edge Cloud environments can only accommodate cloud resources with classification level 1.

[0094] In one possible implementation, when cloud data center 200 configures the resource security level of a cloud resource, the default resource security level of the cloud resource corresponds to the identity security level of the user who created the cloud resource. The higher the identity security level of the user who created the cloud resource, the higher the default resource security level of the cloud resource. For example, if the identity security level of the user who created the cloud resource is Level 1, the resource security level of the cloud resource created by that user is Level 1.

[0095] In the above-mentioned cloud resources, cloud resources can be various types of resources, including computing resources such as elastic compute service (ECS) resources, storage resources such as object storage service (OBS) resources, and network resources such as virtual private cloud (VPC) resources, without specific limitation.

[0096] In a possible implementation, the cloud data center 200 also needs to configure authentication logic between authentication information for data access control. The authentication logic between authentication information is described in detail below in conjunction with different authentication information.

[0097] The authentication logic between identity and resource security levels includes: if the user's identity security level is greater than or equal to the resource security level of the cloud resource, the user is allowed to access the data in the cloud resource. The authentication logic between identity and environment security levels includes: if the user's identity security level is greater than or equal to the environment security level, the user is allowed to access the data in the cloud environment. The authentication logic between different cloud resource security levels includes: data in cloud resources can only flow from low-security cloud resources to high-security cloud resources. The authentication logic between different environment security levels includes: data in the cloud platform can only flow from low-security cloud environments to high-security cloud environments.

[0098] Please refer to Figure 4. In the example shown in Figure 4, in a public cloud environment, a user whose identity classification corresponds to a Top Secret resource classification can access cloud resources with a Confidential resource classification. A user whose identity classification corresponds to a Confidential resource classification can access cloud resources with a Secret resource classification, but cannot access cloud resources with a Top Secret resource classification. A user whose identity classification corresponds to a Confidential resource classification cannot access cloud resources with a Secret resource classification, nor can they access cloud resources with a Top Secret resource classification.

[0099] Step 202: Receive a data access request from a user, where the data access request is used to request access to data in cloud resources.

[0100] In the embodiment of the present application, after cloud data center 200 configures authentication information and authentication logic between authentication information, cloud data center 200 performs a unified permission check at the policy decision point (PDP) for data access requests sent by users. The input of the PDP is the data access request, including information such as the user identifier, action, time, destination IP address, and source IP address contained in the data access request. The output of the PDP is permission or denial. The following example illustrates this:

[0101] Cloud data center 200 receives data access requests from users. When a data access request is used to access data in a cloud resource, the data access request carries the user's identity classification. When a data access request is used to transfer data from a source cloud resource to a destination cloud resource, the data access request carries the user's identity classification, the resource classification of the source cloud resource, and the resource classification of the destination cloud resource. When a data access request is used to transfer data from a source cloud environment to a destination cloud environment, the data access request carries the user's identity classification, the environment classification of the source cloud environment, and the environment classification of the destination cloud environment.

[0102] Step 203. Process the data access request according to the authentication logic between the authentication information. The authentication logic includes the control logic between the authentication information. The authentication logic is used to control the user's access rights to data in the cloud resources or cloud environment, and control the flow direction of data in the cloud resources or cloud environment. The flow direction is from low confidentiality level to high confidentiality level.

[0103] The cloud data center 200 processes the data access request according to the authentication logic between the authentication information. Specifically, the cloud data center 200 determines the authentication information carried in the data access request based on the authentication logic, thereby allowing or rejecting the data access request.

[0104] In one possible implementation, when a data access request is used to request reading data in a cloud resource, if the identity security level of the data access requesting user is greater than or equal to the resource security level of the cloud resource, the user is allowed to read data from the cloud resource.

[0105] Please refer to Figure 5, which is a schematic diagram of a user reading and writing data in cloud resources, according to an embodiment of the present application. In Figure (a) of the example shown in Figure 5, the user's identity security level is level 3, and the cloud resource's resource security level is level 2. When the user sends a data access request to cloud data center 200 to read data from the cloud resource, because the user's identity security level is greater than the cloud resource's resource security level, cloud data center 200 allows the user to read the data from the cloud resource.

[0106] In one possible implementation, the data access request is used to request writing data in the cloud resource. When the user's identity security level is less than or equal to the resource security level of the cloud resource, the user is allowed to write data in the cloud resource.

[0107] Please continue to refer to Figure 5. In Figure (b) of the example shown in Figure 5, the user's identity security level is level 3, and the resource security level of the cloud resources is level 2. When the user sends a data access request to the cloud data center 200, requesting to write data in the cloud resources, because the user's identity security level is greater than the resource security level of the cloud resources, the cloud data center 200 prohibits the user from writing data in the cloud resources.

[0108] Please refer to Table 1, which is a table of example code for implementing authentication logic provided in an embodiment of the present application. In the code shown in Table 1, "CL Larger Than Or Equal SL" is the condition under which cloud data center 200 allows a user to access cloud resources. That is, when the user's identity level is greater than or equal to the resource level of the cloud resource, the user is allowed to read data from the cloud resource.

[0109] Table 1

[0110] In one possible implementation, when a data access request is used to request the transfer of data from a source cloud resource to a destination cloud resource, if the resource security level of the source cloud resource in the first access request is less than or equal to the resource security level of the destination cloud resource, then data from the source cloud resource is permitted to flow to the destination cloud resource. It should be noted that during the process of data flowing from the source cloud resource to the destination cloud resource, if the user's identity security level is greater than or equal to the resource security level of the source cloud resource, then data from the source cloud resource is permitted to be read and written to the destination cloud resource.

[0111] Please refer to Figure 6, which is a schematic diagram of data transfer in a cloud resource provided by an embodiment of the present application. In the example shown in Figure 6, a user needs to read data from an object storage service OBS resource and transmit it through a first VPC and a second VPC, wherein the resource level of OBS is level 2, the resource level of the first VPC is level 1, and the resource level of the second VPC is level 3. Since the resource level of OBS is greater than the resource level of the first VPC but less than the resource level of the second VPC, the user can read the data from the OBS resource and transmit it through the second VPC, but cannot transmit it through the first VPC.

[0112] In the example shown in Figure 6, when a user reads data from an OBS resource, the user's identity security level must be greater than or equal to the resource security level of the OBS resource. When a user uses the first or second VPC to transfer data from the OBS resource, the user's identity security level must be greater than or equal to the resource security level of the first or second VPC. For example, if the user's identity security level is level 3 and the resource security level of the first VPC is level 1, the user can transfer data using the first VPC.

[0113] Please refer to Table 2, which is a schematic diagram of another implementation code of authentication logic provided in an embodiment of the present application. In the example shown in Table 2, the code "SL2Larger Than Or Equal SL1" is the condition under which cloud data center 200 allows data to flow from the source cloud resource to the destination cloud resource. That is, when the resource security level of the destination cloud resource is greater than or equal to the resource security level of the source cloud resource, data from the source cloud resource is allowed to flow to the destination cloud resource.

[0114] Table 2

[0115] In one possible implementation, the identity classification of a user cannot be effective across organizations, that is, the identity classifications of users in different organizational structures are not interoperable.

[0116] For example, in the example shown in Figure 6, the resource level of the first VPC is level 1, and the resource level of the second VPC is level 3. The identity security level of the user in the organizations corresponding to the first VPC and the second VPC is level 1, and the user can access the resources in the first VPC. Although the identity security level of the user in the other organization is level 3, since the user's identity security level cannot be effective across organizations, the user with an identity security level of level 3 in the other organization cannot access the second VPC.

[0117] In one possible implementation, when a data access request is used to request the transfer of data from a source cloud environment to a destination cloud environment, when the environmental confidentiality level of the source cloud environment in the first access request is less than or equal to the environmental confidentiality level of the destination cloud environment, data from the source cloud environment is allowed to flow to the destination cloud environment.

[0118] It should be noted that during the process of data flowing from the source cloud environment to the destination cloud environment, when the user's identity security level is greater than or equal to the environment security level of the source cloud environment and the environment security level of the destination cloud environment, the user is allowed to read data from the source cloud environment and write data to the destination cloud environment.

[0119] Please refer to Figure 7, which is a schematic diagram of data transfer in a cloud environment according to an embodiment of the present application. In the example shown in Figure 7, data in cloud environment A needs to be replicated to cloud environments B and C. The environmental security level of cloud environment A is Level 2, the environmental security level of cloud environment B is Level 3, and the environmental security level of cloud environment C is Level 1. Because the environmental security level of cloud environment A is greater than that of cloud environment C, but less than that of cloud environment B, data in cloud environment A can flow to cloud environment B, but cannot flow to cloud environment C.

[0120] In the example shown in Figure 7, when the data in the user's cloud environment A is copied to the cloud environment B, cloud environment A is the source cloud environment and cloud environment B is the destination cloud environment. Since the environmental confidentiality level of the source cloud environment is lower than that of the destination cloud environment, the user can copy the data in the source cloud environment to the destination cloud environment.

[0121] In the example shown in Figure 7, when the data in the user's cloud environment A is copied to the cloud environment C, cloud environment A is the source cloud environment and cloud environment C is the destination cloud environment. Since the environmental confidentiality level of the source cloud environment is greater than the environmental confidentiality level of the destination cloud environment, the user cannot copy the data in the source cloud environment to the destination cloud environment.

[0122] Please refer to Table 3, which is a schematic diagram of the implementation code of another authentication logic provided in an embodiment of the present application. In the example shown in Table 3, the code "Target Cloud SL Larger Or Equals Than Source Target Cloud SL" is the condition under which cloud data center 200 allows data to flow from the source cloud environment to the destination cloud environment. That is, when the environmental security level of the destination cloud environment is greater than or equal to the environmental security level of the source cloud environment, data from the source cloud environment is allowed to flow to the destination cloud environment.

[0123] Table 3

[0124] Step 204: Based on the result of the authentication logic processing of the data access request, allow or deny the user's data access request.

[0125] Cloud data center 200 processes the data access request based on the authentication logic and obtains the authentication logic processing result. Based on the authentication logic processing result, cloud data center 200 allows or denies the data access request. This includes allowing or denying user access to cloud resources or data in the cloud environment, allowing or denying data flow between different cloud resources, and allowing or denying data flow between different cloud environments.

[0126] In the embodiment of the present application, the cloud data center 200 can process data access requests based on temporary authorization information for non-routine access scenarios. Examples of non-routine access scenarios include users temporarily transferring data from a high-security cloud environment to a low-security cloud environment based on business needs, or transferring data from a high-security cloud resource to a low-security cloud resource, or users temporarily accessing data in a cloud environment or cloud resource with a security level higher than their own identity security level. The following describes the data access request processing process for non-routine access scenarios:

[0127] In one possible implementation, the data access request also includes first temporary authorization information. When the environmental confidentiality level of the source cloud environment is greater than the environmental confidentiality level of the destination cloud environment, the cloud data center 200 allows the user to transfer data from the source cloud environment to the destination cloud environment based on the first temporary authorization information during the process of processing the data access request. The first temporary authorization information is used to authorize data to flow from a high-confidence cloud environment to a low-confidence cloud environment.

[0128] In one possible implementation, the data access request also includes second temporary authorization information. When the user's identity classification is lower than the resource classification of the cloud resources, the cloud data center 200 allows the user to read the data in the cloud resources based on the second temporary authorization information during the process of processing the data access request. The second temporary authorization information is used to authorize the user to access cloud resources whose resource classification is higher than the identity classification.

[0129] In one possible implementation, the data access request also includes third temporary authorization information. When the resource confidentiality level of the source cloud resource is greater than the resource confidentiality level of the destination cloud resource, the cloud data center 200 allows the user to transfer data from the source cloud resource to the destination cloud resource based on the third temporary authorization information during the process of processing the data access request. The third temporary authorization information is used to authorize data to flow from high-confidentiality cloud resources to low-confidentiality cloud resources.

[0130] In one possible implementation, the temporary authorization information includes reviewer information and signature information. The reviewer information includes the permission for non-routine access to one or more designated reviewers, and the signature information includes the secret key for temporarily authorizing the user to access. Non-routine access to one or more designated reviewers and signature information are shown in the following code respectively:

[0131] ApprovedBy:[“approver1”, “approver2”, “approver3”…]

[0132] ApprovedSig:[“approver1’s Sig”, “approver2’s Sig”, “approver3’s Sig”…]

[0133] Please refer to Table 4, which is a schematic diagram of the implementation code of temporary authorization information provided in an embodiment of the present application. In the example shown in Table 4, the code "g:ApprovedBy": ["approver1", "approver2", "approver3",..."approverN"...] represents the reviewers allowed non-routine access by the cloud data center 200. That is, when the above reviewers "approver1", "approver2", "approver3",..."approverN" all pass the review, data is allowed to flow from the high-security cloud environment to the low-security cloud environment, or the user is allowed to access cloud resources with a resource security level higher than the identity security level.

[0134] Table 4

[0135] It can be seen from the above embodiments that the cloud data center in the embodiments of the present application combines the Bell-Lapadula model BLP and the attribute-based access control ABAC model to configure identity confidentiality levels for users, configure confidentiality levels for cloud resources such as networks, computing, and storage, and control the flow of data in different cloud resources based on identity confidentiality levels and confidentiality levels, so that data in cloud resources flows from cloud resources with low resource confidentiality levels to cloud resources with high resource confidentiality levels, thereby avoiding data leakage in cloud resources and improving the security of data access control.

[0136] The above describes the data access control method provided by the embodiment of the present application. The following specifically describes the data access control device provided by the embodiment of the present application.

[0137] Please refer to Figure 8, which is a schematic diagram of the structure of a data access control device provided in an embodiment of the present application. In the example shown in Figure 8, the data access control device is used to implement the various steps performed by the computing device in the above embodiments. The data access control device 800 includes a configuration unit 801, a transceiver unit 802, and a processing unit 803.

[0138] Among them, the configuration unit 801 is used to configure the authentication information of data access control. The authentication information includes one or more of the following: identity confidentiality level, resource confidentiality level and environment confidentiality level. The identity confidentiality level is used to indicate the user's access rights, the resource confidentiality level is used to indicate the confidentiality level of cloud resources, and the environment confidentiality level is used to indicate the confidentiality level of the cloud environment where the cloud resources are located. Cloud resources include one or more of the following: computing resources, network resources and storage resources. The transceiver unit 802 is used to receive data access requests from users. Data access requests are used to request access to data in cloud resources. The processing unit 803 is used to process data access requests according to the authentication logic. The authentication logic includes the control logic between the authentication information. The authentication logic is used to control the user's access rights to data in the cloud resources or cloud environment, and control the flow direction of data in the cloud resources or cloud environment. The flow direction is from low confidentiality level to high confidentiality level.

[0139] In one possible implementation, the configuration unit 801 is specifically configured to configure identity levels of different users based on their organizational structure levels, where the highest configurable identity level of users in lower-level organizations is lower than the highest configurable identity level of users in higher-level organizations.

[0140] In a possible implementation, the configuration unit 801 is further configured to set a configuration mode for the identity security level of the newly added user, including inheriting the identity security level of the organization and configuring according to a default mode, wherein the default mode is configuring according to the lowest identity security level.

[0141] In a possible implementation, the configuration unit 801 is further configured to configure the resource security level of the cloud resource based on the identity security level of the creating user. The creating user is the user who creates the cloud resource, and the resource security level of the cloud resource is positively correlated with the identity security level of the creating user.

[0142] In one possible implementation, the processing unit 803 is specifically used to allow the user to read data from the cloud resources when the user's identity security level is greater than or equal to the resource security level of the cloud resources; and to allow the user to write data in the cloud resources when the user's identity security level is less than or equal to the resource security level of the cloud resources.

[0143] In one possible implementation, the data access request is used to request the transfer of data from the source cloud resource to the destination cloud resource, and the processing unit 803 is specifically used to allow the user to transfer data from the source cloud resource to the destination cloud resource when the resource confidentiality level of the source cloud resource is less than or equal to the resource confidentiality level of the destination cloud resource.

[0144] In one possible implementation, the data access request is used to request the transfer of data from the source cloud environment to the destination cloud environment, and the processing unit 803 is used to allow the user to transfer data from the source cloud environment to the destination cloud environment when the environmental confidentiality level of the source cloud environment is less than or equal to the environmental confidentiality level of the destination cloud environment.

[0145] In one possible implementation, the data access request also includes first temporary authorization information, and the processing unit 803 is also used to allow the user to transfer data in the source cloud environment to the destination cloud environment based on the first temporary authorization information when the environmental confidentiality level of the source cloud environment is greater than the environmental confidentiality level of the destination cloud environment. The first temporary authorization information is used to authorize data to flow from a high-confidentiality cloud environment to a low-confidentiality cloud environment.

[0146] In one possible implementation, the data access request also includes second temporary authorization information, and the processing unit 803 is also used to allow the user to read data in the cloud resources based on the second temporary authorization information when the user's identity classification is lower than the resource classification of the cloud resources. The second temporary authorization information is used to authorize the user to access cloud resources whose resource classification is higher than the identity classification.

[0147] In one possible implementation, the data access request also includes third temporary authorization information, and the processing unit 803 is also used to allow the user to transfer data from the source cloud resource to the destination cloud resource based on the third temporary authorization information when the environmental confidentiality level of the source cloud resource is greater than the environmental confidentiality level of the destination cloud resource. The third temporary authorization information is used to authorize data to flow from high-confidentiality cloud resources to low-confidentiality cloud resources.

[0148] It should be understood that the division of units in the above device is merely a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. Moreover, the units in the device can all be implemented in the form of software called through processing elements; or they can all be implemented in the form of hardware; or some units can be implemented in the form of software called through processing elements, and some units can be implemented in the form of hardware. For example, each unit can be a separately established processing element, or it can be integrated into a certain chip of the device. In addition, it can also be stored in the memory in the form of a program, called by a certain processing element of the device and perform the function of the unit. In addition, all or part of these units can be integrated together, or they can be implemented independently. The processing element described here can also be a processor, which can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each unit above can be implemented by the integrated logic circuit of the hardware in the processor element or in the form of software called through the processing element.

[0149] It is worth noting that, for the sake of simplicity, the above method embodiments are expressed as a series of action combinations. However, those skilled in the art should know that the present invention is not limited to the order of the actions described. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required for the present invention.

[0150] Other reasonable step combinations that can be thought of by those skilled in the art based on the above description also fall within the scope of protection of the present invention. Secondly, those skilled in the art should also be familiar with that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the present invention.

[0151] Please refer to Figure 9, which is a schematic diagram of the structure of a computing device provided in an embodiment of the present application. As shown in Figure 9, the computing device 900 includes: a processor 901, a memory 902, a communication interface 903, and a bus 904. The processor 901, memory 902, and communication interface 903 are coupled via a bus (not labeled in the figure). The memory 902 stores instructions. When the execution instructions in the memory 902 are executed, the computing device 900 performs the method performed by the computing device in the above method embodiment.

[0152] The computing device 900 may be one or more integrated circuits configured to implement the above method, such as one or more application specific integrated circuits (ASICs), one or more digital signal processors (DSPs), one or more field programmable gate arrays (FPGAs), or a combination of at least two of these integrated circuit forms. For example, when a unit in the apparatus can be implemented in the form of a processing element scheduler, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call a program. For example, these units may be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0153] The processor 901 may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0154] The memory 902 may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. The non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0155] The memory 902 stores executable program code, and the processor 901 executes the executable program code to respectively implement the functions of the configuration unit, the transceiver unit, and the processing unit, thereby implementing the above-mentioned data access control method. In other words, the memory 902 stores instructions for executing the above-mentioned data access control method.

[0156] The communication interface 903 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 900 and other devices or a communication network.

[0157] In addition to the data bus, bus 904 may also include a power bus, a control bus, and a status signal bus. The bus may be a Peripheral Component Interconnect Express (PCIe) bus, an Extended Industry Standard Architecture (EISA) bus, a unified bus (Ubus or UB), a Compute Express Link (CXL), or a Cache Coherent Interconnect for Accelerators (CCIX). Buses can be categorized as address buses, data buses, and control buses.

[0158] Please refer to Figure 10 , which is a schematic diagram of a computing device cluster provided in an embodiment of the present application. As shown in Figure 10 , the computing device cluster 1000 includes at least one computing device 900 .

[0159] As shown in Figure 10, the computing device cluster 1000 includes at least one computing device 900. The memory 902 in one or more computing devices 900 in the computing device cluster 1000 may store the same instructions for executing the above-mentioned data access control method.

[0160] In some possible implementations, the memory 902 of one or more computing devices 900 in the computing device cluster 1000 may also store partial instructions for executing the above-mentioned data access control method. In other words, the combination of one or more computing devices 900 can jointly execute the instructions for executing the above-mentioned data access control method.

[0161] It should be noted that the memory 902 in different computing devices 900 in the computing device cluster 1000 may store different instructions, each for executing a portion of the functions of the aforementioned data access control apparatus. In other words, the instructions stored in the memory 902 in different computing devices 900 may implement the functions of one or more modules in the acquisition unit, the processing unit, and the creation unit.

[0162] In some possible implementations, one or more computing devices 900 in the computing device cluster 1000 may be connected via a network, which may be a wide area network or a local area network.

[0163] Please refer to Figure 11, which is a schematic diagram of computer devices in a computer cluster provided by an embodiment of the present application connected via a network. As shown in Figure 11, two computing devices 900A and 900B are connected via a network. Specifically, the connection to the network is through a communication interface in each computing device.

[0164] In one possible implementation, the memory of the computing device 900A stores instructions for executing the functions of the configuration unit, while the memory of the computing device 900B stores instructions for executing the functions of the transceiver unit and the processing unit.

[0165] It should be understood that the functions of the computing device 900A shown in Figure 11 may also be completed by multiple computing devices. Similarly, the functions of the computing device 900B may also be completed by multiple computing devices.

[0166] In another embodiment of the present application, a computer-readable storage medium is provided, in which computer-executable instructions are stored. When the processor of the device executes the computer-executable instructions, the device executes the method executed by the cloud data center in the above method embodiment.

[0167] In another embodiment of the present application, a computer program product is provided, including computer-executable instructions stored in a computer-readable storage medium. When a processor of a device executes the computer-executable instructions, the device executes the method performed by the cloud data center in the above method embodiment.

[0168] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0169] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0170] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0171] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0172] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

Claims

1. A data access control method, characterized in that: Said include: Authentication information for configuring data access control, the authentication information includes one or more of the following: identity level, resource level, and environment level. The identity level is used to indicate the user's access rights, the resource level is used to indicate the confidentiality level of cloud resources, and the environment level is used to indicate the confidentiality level of the cloud environment. receiving a data access request from a user, wherein the data access request is used to request access to the cloud resource or data in the cloud environment; Processing the data access request according to authentication logic, the authentication logic including control logic between the authentication information, the authentication logic being used to control the user's access rights to data in the cloud resource or the cloud environment, or being used to control the flow direction of data between the cloud resources or the cloud environment, the flow direction being from a low-security level to a high-security level; The data access request of the user is allowed or denied according to the authentication logic processing result of the data access request.

2. The method according to claim 1, characterized in that The authentication information for the configuration data access control includes: The identity levels of different users are configured based on their organizational structure levels. The configurable identity levels of users in low-level organizations are lower than those of users in high-level organizations. The configurable identity levels are used to indicate the highest identity levels that the users can configure in the organization.

3. The method according to claim 2, characterized in that The method further comprises: Set the identity classification configuration mode for newly added users. The configuration mode includes inheritance configuration and default configuration. The inheritance configuration is to inherit the identity classification of the organization for configuration, and the default configuration is to configure according to the lowest identity classification.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: The resource classification of the cloud resource is configured based on the identity classification of the creating user, the creating user is a user who creates the cloud resource, and the resource classification of the cloud resource is positively correlated with the identity classification of the creating user.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: When the identity security level of the user is greater than or equal to the resource security level of the cloud resource, the user is allowed to read data from the cloud resource; When the identity security level of the user is less than or equal to the resource security level of the cloud resource, the user is allowed to write data in the cloud resource.

6. The method according to any one of claims 1 to 5, characterized in that The data access request is used to request to transfer data of the source cloud resource to the destination cloud resource, and the processing of the data access request according to the authentication logic includes: When the resource security level of the source cloud resource is less than or equal to the resource security level of the destination cloud resource, the user is allowed to transfer data in the source cloud resource to the destination cloud resource.

7. The method according to any one of claims 1 to 6, characterized in that The data access request is used to request to transfer data from the source cloud environment to the destination cloud environment, and the processing of the data access request according to the authentication logic includes: When the environmental security level of the source cloud environment is less than or equal to the environmental security level of the destination cloud environment, the user is allowed to transfer data in the source cloud environment to the destination cloud environment.

8. The method according to any one of claim 7, characterized in that The data access request further includes first temporary authorization information, and the method further includes: When the environmental security level of the source cloud environment is greater than the environmental security level of the destination cloud environment, the user is allowed to transfer data from the source cloud environment to the destination cloud environment based on the first temporary authorization information, and the first temporary authorization information is used to authorize the data to flow from the high-security cloud environment to the low-security cloud environment.

9. The method according to any one of claims 1 to 8, characterized in that The data access request further includes second temporary authorization information, and the method further includes: When the identity classification of the user is lower than the resource classification of the cloud resources, the user is allowed to read the data in the cloud resources based on the second temporary authorization information, and the second temporary authorization information is used to authorize the user to access cloud resources whose resource classification is higher than the identity classification.

10. The method according to any one of claims 1 to 8, characterized in that The data access request further includes third temporary authorization information, and the method further includes: When the resource classification level of the source cloud resource is greater than the resource classification level of the destination cloud resource, the user is allowed to transfer the data in the source cloud resource to the destination cloud resource based on the third temporary authorization information, and the third temporary authorization information is used to authorize the data Flow from high-density cloud resources to low-density cloud resources.

11. The method according to any one of claims 1 to 10, characterized in that The cloud resources include one or more of the following: computing resources, network resources, and storage resources.

12. The method according to any one of claims 1 to 11, characterized in that The cloud environment includes one or more of the following: edge cloud, public cloud and dense cloud.

13. A data access control device, characterized in that: Said include: A configuration unit, configured to configure authentication information for data access control, wherein the authentication information includes one or more of the following: identity level, resource level, and environment level, wherein the identity level is used to indicate the user's access rights, the resource level is used to indicate the confidentiality level of the cloud resources, and the environment level is used to indicate the confidentiality level of the cloud environment; A transceiver unit, configured to receive a data access request from a user, wherein the data access request is used to request access to the cloud resource or data in the cloud environment; a processing unit, configured to process the data access request according to an authentication logic, wherein the authentication logic includes a control logic between the authentication information, wherein the authentication logic is configured to control the user's data access rights to the cloud resource or the cloud environment, and control a flow direction of data in the cloud resource or the cloud environment, wherein the flow direction is from a low-security level to a high-security level; The processing unit is further configured to allow or deny the user's data access request according to the authentication logic processing result of the data access request.

14. The device according to claim 13, characterized in that The configuration unit is specifically used for: The identity levels of different users are configured based on their organizational structure levels. The configurable identity levels of users in low-level organizations are lower than the configurable identity levels of users in high-level organizations. The configurable identity levels are used to indicate the highest identity levels that the users can configure in the organization.

15. The device according to claim 14, characterized in that The configuration unit is also used to: Set the identity classification configuration mode for newly added users. The configuration mode includes inheritance configuration and default configuration. The inheritance configuration is to inherit the identity classification of the organization for configuration, and the default configuration is to configure according to the lowest identity classification.

16. The device according to any one of claims 13 to 15, characterized in that The configuration unit is also used to: The resource classification of the cloud resource is configured based on the identity classification of the creating user, the creating user is a user who creates the cloud resource, and the resource classification of the cloud resource is positively correlated with the identity classification of the creating user.

17. The device according to any one of claims 13 to 16, characterized in that The processing unit is specifically used for: When the identity security level of the user is greater than or equal to the resource security level of the cloud resource, the user is allowed to read data from the cloud resource; When the identity security level of the user is less than or equal to the resource security level of the cloud resource, the user is allowed to write data in the cloud resource.

18. The device according to any one of claims 13 to 17, characterized in that The data access request is used to request to transfer data of the source cloud resource to the destination cloud resource, and the processing unit is specifically used to: When the resource security level of the source cloud resource is less than or equal to the resource security level of the destination cloud resource, the user is allowed to transfer data in the source cloud resource to the destination cloud resource.

19. The device according to any one of claims 13 to 18, characterized in that The data access request is used to request to transfer data from the source cloud environment to the target cloud environment, and the processing unit is used to: When the environmental security level of the source cloud environment is less than or equal to the environmental security level of the destination cloud environment, the user is allowed to transfer data in the source cloud environment to the destination cloud environment.

20. The device according to any one of claims 19, characterized in that The data access request further includes first temporary authorization information, and the processing unit is further configured to: When the environmental security level of the source cloud environment is greater than the environmental security level of the destination cloud environment, the user is allowed to transfer data from the source cloud environment to the destination cloud environment based on the first temporary authorization information, and the first temporary authorization information is used to authorize the data to flow from the high-security cloud environment to the low-security cloud environment.

21. The device according to any one of claims 13 to 18, characterized in that The data access request further includes second temporary authorization information, and the processing unit is further configured to: When the identity level of the user is lower than the resource level of the cloud resource, the user is allowed to read the resource based on the second temporary authorization information. The data in the cloud resource is obtained, and the second temporary authorization information is used to authorize the user to access the cloud resource whose resource security level is higher than the identity security level.

22. The device according to any one of claims 13 to 18, characterized in that The data access request further includes third temporary authorization information, and the processing unit is further configured to: When the resource confidentiality level of the source cloud resources is greater than the resource confidentiality level of the destination cloud resources, the user is allowed to transfer data in the source cloud resources to the destination cloud resources based on the third temporary authorization information, and the third temporary authorization information is used to authorize the data to flow from high-confidence cloud resources to low-confidence cloud resources.

23. The device according to any one of claims 13 to 22, characterized in that The cloud resources include one or more of the following: computing resources, network resources, and storage resources.

24. The device according to any one of claims 13 to 23, characterized in that The cloud environment includes one or more of the following: edge cloud, public cloud and dense cloud.

25. A computing device, characterized in that The method comprises a processor coupled to a memory, wherein the processor is used to store instructions. When the instructions are executed by the processor, the computing device performs the method according to any one of claims 1 to 12.

26. A computing device cluster, characterized in that: The method comprises at least one computing device, wherein the computing device comprises a processor, wherein the processor is coupled to a memory, and the processor is used to store instructions. When the instructions are executed by the processor, the computing device cluster performs the method according to any one of claims 1 to 12.

27. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instructions are executed, the computer is caused to perform the method according to any one of claims 1 to 12.

28. A computer program product, comprising instructions, characterized in that: When the instructions are executed, the computer implements the method according to any one of claims 1 to 12.

Images