Access control method and apparatus, and device and storage medium

Abstract

On the basis of the embodiments of the present disclosure, provided are an access control method and apparatus, and a device and a storage medium. The method comprises: receiving an access request for a target resource in a platform; verifying the access request by means of an access control system, and determining a verification result of the access request, wherein the access control system comprises a plurality of verification units, the plurality of verification units comprise a platform verification unit and a resource verification unit, the platform verification unit is configured to verify the access request on the basis of a first group of verification policies, the resource verification unit is configured to verify the access request on the basis of a second group of verification policies, the first group of verification policies is configured by a manager of the platform, and the second group of verification policies is configured by a manager of the target resource; and on the basis of the verification result, processing the access request. Thus, the embodiments of the present disclosure can improve the efficiency of access control.

Description

Access control method, apparatus, device, and storage medium TECHNICAL FIELD

[0001] Example embodiments of the present disclosure generally relate to the field of computers, and in particular, to an access control method, apparatus, device, and computer-readable storage medium. BACKGROUND

[0002] Access control is a core component of information security and data protection, which is used to restrict access to systems and data, and to ensure the security of information and resources. With the development and popularization of Internet technology, more and more complex access control mechanisms are needed to cope with the growing security challenges.

[0003] SUMMARY

[0004] In a first aspect of the present disclosure, an access control method is provided. The method comprises: receiving an access request for a target resource in a platform; determining a verification result of the access request by verifying the access request using an access control system, the access control system comprising a plurality of verification units, the plurality of verification units comprising a platform verification unit and a resource verification unit, the platform verification unit being configured to verify the access request based on a first set of verification policies, the resource verification unit being configured to verify the access request based on a second set of verification policies, the first set of verification policies being configured by a management party of the platform, the second set of verification policies being configured by a management party of the target resource; and processing the access request based on the verification result.

[0005] In a second aspect of the present disclosure, an apparatus for access control is provided. The apparatus comprises: a receiving module configured to receive an access request for a target resource in a platform; a determining module configured to determine a verification result of the access request by verifying the access request using an access control system, the access control system comprising a plurality of verification units, the plurality of verification units comprising a platform verification unit and a resource verification unit, the platform verification unit being configured to verify the access request based on a first set of verification policies, the resource verification unit being configured to verify the access request based on a second set of verification policies, the first set of verification policies being configured by a management party of the platform, the second set of verification policies being configured by a management party of the target resource; and a processing module configured to process the access request based on the verification result.

[0006] In a third aspect of the present disclosure, an electronic device is provided. The device comprises at least one processing unit; and at least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit. The instructions, when executed by the at least one processing unit, cause the device to perform the method of the first aspect.

[0007] In a fourth aspect of the present disclosure, a computer-readable storage medium is provided. The computer-readable storage medium has stored thereon a computer program, the computer program being executable by a processor to implement the method of the first aspect.

[0008] In a fifth aspect of the present disclosure, a computer program product is provided. The computer program product comprises computer executable instructions that, when executed by a processor, implement the method according to the first aspect of the present disclosure.

[0009] It should be understood that nothing in this Summary is intended to limit the scope of the embodiments of the present disclosure or the accompanying claims in any way. BRIEF DESCRIPTION OF DRAWINGS

[0010] The above and other features, aspects and advantages of embodiments of the present disclosure will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings. In the drawings, like reference numerals refer to like elements, in which:

[0011] FIG. 1 shows a schematic diagram of an example environment in which embodiments of the present disclosure can be implemented;

[0012] FIG. 2 shows a flowchart of an example process of access control according to some embodiments of the present disclosure;

[0013] FIG. 3 shows a schematic diagram of an example access control system according to some embodiments of the present disclosure;

[0014] FIG. 4 shows a schematic structural block diagram of an apparatus for an access control system according to certain embodiments of the present disclosure;

[0015] FIG. 5 shows a block diagram of an electronic device that can implement a number of embodiments of the present disclosure. DETAILED DESCRIPTION

[0016] Embodiments of the present disclosure will be described in more detail with reference to the drawings. While certain embodiments of the present disclosure will be shown and described, it is to be understood that the present disclosure is not limited to the embodiments to be described, but is applicable to any other embodiments that fall within the scope of the present disclosure. Therefore, the scope of the present disclosure should be decided by the technical spirit of the present disclosure.

[0017] It should be noted that the headings provided in any section / subsection herein are not limitations. Various embodiments are described throughout this document and any type of embodiment can be included under any section / subsection. Moreover, embodiments described in any section / subsection can be combined with any other embodiments described in the same section / subsection and / or different section / subsection in any manner.

[0018] In the description of embodiments of the disclosure, the term "includes" and its conjugates are open-ended, meaning "including but not limited to". The term "based on" is intended to mean "based, at least in part, on" The term "one embodiment" or "an embodiment" means "at least one embodiment". The term "some embodiments" means "at least some embodiments". Other explicit or implicit definitions can also be included below. The terms "first", "second", etc. can refer to different or the same objects. Other explicit and implicit definitions can also be included below.

[0019] Data of users, acquisition and / or use of data, etc. can be involved in embodiments of the disclosure. These aspects all comply with corresponding laws and regulations and relevant provisions. In embodiments of the disclosure, all data collection, acquisition, processing, processing, forwarding, use, etc. are carried out on the premise that the user is aware of and confirms. Accordingly, when implementing embodiments of the disclosure, the type of data or information that can be involved, the use range, the use scenario, etc. should be notified to the user and the authorization of the user should be obtained according to relevant laws and regulations through appropriate means. The specific notification and / or authorization mode can vary according to the actual situation and application scenario, and the scope of the disclosure is not limited in this respect.

[0020] In the specification and embodiments of the present disclosure, if personal information processing is involved, it will be processed on the premise of legality (for example, obtaining the consent of the subject of personal information, or being necessary for the performance of a contract, etc.), and only within the prescribed or agreed range. Users refuse to process personal information other than the necessary information required for basic functions, which will not affect the user's use of basic functions.

[0021] As mentioned above, the permission control policy is becoming more and more complex, which makes the maintenance of permission logic difficult. Generally, as the product function iterates, the access control logic in the permission system will become more and more complex.

[0022] Embodiments of the present disclosure propose an access control scheme. According to the scheme, an access request for a target resource in a platform can be received. Further, the access request can be verified by utilizing an access control system, a verification result of the access request can be determined, the access control system comprising a plurality of verification units, the plurality of verification units comprising a platform verification unit and a resource verification unit, the platform verification unit being configured to verify the access request based on a first set of verification policies, the resource verification unit being configured to verify the access request based on a second set of verification policies, the first set of verification policies being configured by a management party of the platform, the second set of verification policies being configured by a management party of the target resource. Accordingly, the access request can be processed based on the verification result.

[0023] Thus, embodiments of the present disclosure can hierarchically control the permission control policies, thereby reducing the difficulty of maintaining the permission control policies and improving the efficiency of access control.

[0024] Example Environment

[0025] FIG. 1 illustrates a schematic diagram of an example environment 100 in which embodiments of the present disclosure can be implemented. As shown in FIG. 1, the example environment 100 can include an electronic device 110.

[0026] In this example environment 100, the electronic device 110 can receive an access request 130. For example, the electronic device 110 can receive the access request 130 from a terminal device 120. The access request 130 may, for example, be initiated by an application in the terminal device 120.

[0027] In some embodiments, the access request 130 can be for a resource 150 in a platform 140. As an example, such a platform 140 may, for example, comprise an application development platform, and the resource 150 can comprise an application developed or published in the application development platform.

[0028] As an example, such an application can be a bot or an agent based on a machine learning model. A third-party application installed in the terminal device 120 can invoke such a bot or agent to perform a corresponding task based on authorization.

[0029] The electronic device 110 can be any type of mobile terminal, fixed terminal, or portable terminal including a mobile handset, a tablet computer, a laptop computer, a notebook computer, a netbook computer, a smartbook, a media tablet, a palmtop computer, a portable gaming terminal, a VR / AR device, a Personal Communication System (PCS) terminal, a personal navigation device, a Personal Digital Assistant (PDA), an audio / video player, a digital camera / camcorder, a positioning device, a television receiver, a radio broadcast receiver, an electronic book device, a game device, or any combinations of these, including accessories and peripherals of these devices, or any combinations thereof. In some embodiments, the electronic device 110 can also support any type of interface to the user (such as “wearable” circuitry, etc.).

[0030] The electronic device 110 can also be a standalone physical server, a server cluster or distributed system of multiple physical servers, a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, web services, cloud communications, middleware services, domain name services, security services, content distribution networks, and basic cloud computing services of big data and artificial intelligence platforms, etc. The electronic device 110 may, for example, include a computing system / server, such as a mainframe, an edge computing node, a computing device in a cloud environment, etc.

[0031] It should be understood that the structure and functionality of the various elements in the environment 100 are described for illustrative purposes only and do not imply any limitation on the scope of the present disclosure.

[0032] Various example implementations of the present disclosure will be described in detail below.

[0033] Example process

[0034] FIG. 2 illustrates a flowchart of a process 200 of access control, according to some embodiments of the present disclosure. The process 200 can be implemented at the electronic device 110. The process 200 is described below with reference to FIG. 1.

[0035] At block 210, the electronic device 110 receives an access request 130 for a target resource 150 in the platform 140.

[0036] As introduced above, the electronic device 110 can receive the access request 130 from the terminal device 120, and can perform a corresponding access control process to determine whether to allow the terminal device 120 to correspondingly access the target resource 150 in the platform 140.

[0037] At block 220, the electronic device 110 determines a verification result of the access request by verifying the access request using an access control system. In some embodiments, the access control system includes a plurality of verification units. The plurality of verification units includes a platform verification unit configured to verify the access request based on a first set of verification policies configured by a management party of the platform, and a resource verification unit configured to verify the access request based on a second set of verification policies configured by a management party of the target resource.

[0038] In some embodiments, the access control system can hierarchically process the access control policies to reduce the difficulty of managing and maintaining the access control policies.

[0039] In some embodiments, such access control policies can be divided into a first set of verification policies configured by a management party of the platform, also referred to as mandatory access control policies. Accordingly, the platform verification unit can verify the access request 130 according to the mandatory access control policies.

[0040] For example, the mandatory access control policies can be used to check whether the access request 130 satisfies the constraints set by an administrator of the platform 140. In some embodiments, the mandatory access control policies can include a set of conditions for denying access.

[0041] As an example, the mandatory access control policies can indicate that an application in the terminal device 110 will only be allowed to access resources in the platform 140 by a specific account when the application accesses the platform 140 through the specific account.

[0042] Accordingly, the platform verification unit can determine whether the resource accessed by the access request 130 is a resource owned by the account corresponding to the access request 130 in the platform 140. If so, the platform verification unit can pass the access request. Conversely, the platform verification unit can deny the access request.

[0043] In some embodiments, such access control policies can also be divided into a second set of verification policies configured by a management party of the resource 150, also referred to as discretionary access control policies. Accordingly, the resource verification unit can verify the access request 130 according to the discretionary access control policies.

[0044] As an example, the discretionary access control policies can be used to check whether the access request 130 satisfies the authorization of the owner of the resource 140. In some embodiments, the discretionary access control policies can include a set of conditions for allowing access.

[0045] As an example, the autonomous access control policy can indicate that the owner or publisher of a resource will allow access to the resource. Accordingly, the autonomous validation unit can determine whether the resource accessed by the access request 130 is the owner or publisher of the resource corresponding to the access request 130. If so, the autonomous validation unit can pass the access request. Conversely, the autonomous validation unit can reject the access request.

[0046] In some embodiments, the second set of validation policies or the third set of validation policies can define both pass policies and reject policies. Accordingly, the reject policies can have a higher priority, for example. That is, if the access request 130 matches any of the reject policies, the access request can be rejected by the platform validation unit or the autonomous validation unit.

[0047] FIG. 3 illustrates a schematic diagram of an example access control system 300, according to some embodiments of the present disclosure. As shown in FIG. 3, the access control system 300 can include the platform validation unit 320 and the resource validation unit 330 as described above.

[0048] In some embodiments, the access control system 300 can further include a session validation unit 310. The session validation unit 310 can be configured to validate the access request 130 based on a third set of validation policies.

[0049] In some embodiments, the third set of validation policies is associated with an authorization scope for a sender of the access request. As an example, the third set of validation policies can also be referred to as a session access control policy, which can check whether the access request satisfies the authorization scope for the third-party application.

[0050] As an example, the third set of validation policies can define the identification of one or more bots, e.g., botl, bot2, and bot3, that the third-party application will allow to access one or more bots published in the application development platform.

[0051] In some embodiments, the session validation unit 310 can validate the access request 130 based on a predetermined protocol. For example, the session validation unit 310 can check whether the access request 130 satisfies the granted permissions based on the OAuth protocol.

[0052] As an example, if the identification of the bot (e.g., botl) requested to be accessed by the access request 130 matches the identification (e.g., botl, bot2, and bot3) allowed to be accessed by the third set of policies, the session validation unit 310 can pass the access request 130. Conversely, the session validation unit 310 can reject the access request 130.

[0053] In some embodiments, as shown in FIG. 3, the plurality of verification units can be configured to sequentially verify the access request 130 in a predetermined order. Further, if any of the units rejects the access request 130, the access control system can determine that the access request 130 corresponds to a first verification result 350, i.e., the access request 130 fails the verification.

[0054] If all of the plurality of verification units pass the access request 130, the access control system can determine that the access request 130 corresponds to a second verification result 340, i.e., the access request 130 passes the verification.

[0055] In some embodiments, to improve the efficiency of the verification, the plurality of verification units processes the access request 130 in the following order: first, the first stage verification is performed by the session verification unit 310; then, the second stage verification is performed by the platform verification unit 320; and finally, the third stage verification is performed by the resource verification unit 330.

[0056] Based on such a manner, embodiments of the present disclosure can further improve the efficiency of the verification of the access request.

[0057] In some embodiments, the access control policies corresponding to the plurality of verification units can be defined independently. As an example, such access control policies can be maintained by code files independent of each other, thereby further improving the flexibility of the maintenance of the access control policies.

[0058] As an example, the owner of botl can initiate an access request for botl in the platform, e.g., through a third-party application. Accordingly, the session verification unit 310 can determine that the botl targeted by the access request matches the bot identification allowed to be accessed, and can accordingly pass the access request. Further, the platform verification unit 320 can further process the access request, and can accordingly pass the access request according to that the access request does not match any rejection policy. Further, the autonomous verification unit 330 can further process the access request, and can accordingly pass the access request according to that the botl targeted by the access request is a resource owned by the account.

[0059] Thus, the session verification unit 310, the platform verification unit 320, and the autonomous verification unit 330 all pass the access request, the access control system can accordingly determine that the access request 130 passes the verification.

[0060] Continuing to refer to FIG. 2, at block 230, the electronic device 110 processes the access request 130 based on the verification result.

[0061] Specifically, if the access request 130 passes the verification by the access control system, the electronic device 110 will allow the access request 130 to access the target resource in the platform 140. In contrast, the electronic device 110 can reject the access request 130.

[0062] In this way, by layering the permission control policy, on the one hand, embodiments of the present disclosure can reduce the difficulty of maintaining the permission control policy, and on the other hand, embodiments of the present disclosure can also improve the efficiency of access control.

[0063] Example apparatuses and devices

[0064] Embodiments of the present disclosure also provide a corresponding apparatus for implementing the above method or process. FIG. 4 shows a schematic structural block diagram of an apparatus 400 for access control according to certain embodiments of the present disclosure. The apparatus 400 can be implemented as or included in the electronic device 110 as discussed above. Various modules / components in the apparatus 400 can be implemented by hardware, software, firmware, or any combination thereof.

[0065] As shown in FIG. 4, the apparatus 400 includes a receiving module 410 configured to receive an access request for a target resource in a platform; a determining module 420 configured to determine a verification result of the access request by verifying the access request by utilizing an access control system, the access control system including a plurality of verification units, the plurality of verification units including a platform verification unit and a resource verification unit, the platform verification unit being configured to verify the access request based on a first set of verification policies, the resource verification unit being configured to verify the access request based on a second set of verification policies, the first set of verification policies being configured by a management party of the platform, the second set of verification policies being configured by a management party of the target resource; and a processing module 430 configured to process the access request based on the verification result.

[0066] In some embodiments, the plurality of verification units further includes a session verification unit, the session verification unit being configured to verify the access request based on a third set of verification policies, the third set of verification policies being associated with an authorized scope for a sender of the access request.

[0067] In some embodiments, the session verification unit verifies the access request based on a predetermined protocol.

[0068] In some embodiments, the determining module 420 is further configured to determine that the access request fails the verification in response to any verification unit in the plurality of verification units rejecting the access request.

[0069] In some embodiments, the determining module 420 is further configured to sequentially verify the access request by the plurality of verification units in a predetermined order.

[0070] In some embodiments, the predetermined order indicates that the platform verification unit verifies the access request prior to the resource verification unit.

[0071] In some embodiments, the first set of verification policies indicates a first set of conditions for denying access, and / or the second set of verification indicates a second set of conditions for allowing access.

[0072] In some embodiments, the platform is an application development platform, and the target resource includes an application in the application development platform.

[0073] The units included in the apparatus 400 can be implemented by various means, including software, hardware, firmware, or any combination of these. In some embodiments, one or more units can be implemented using software and / or firmware, e.g., machine-executable instructions stored on a storage medium. In addition or as an alternative, some or all of the units of the apparatus 400 can be implemented at least partially by one or more hardware logic components. As an example and not by way of limitation, example types of hardware logic components that can be used include Field- programmable Gate Arrays (FPGAs), Application-specific Integrated Circuits (ASICs), Application-specific Standard Products (ASSPs), System-on-a-Chip (SOCs), Complex Programmable Logic Devices (CPLDs), etc.

[0074] FIG. 5 shows a block diagram of an electronic device 500 in which one or more embodiments of the disclosure can be implemented. It should be understood that the electronic device 500 illustrated in FIG. 5 is merely an example and should not be construed to limit the functionality and scope of the embodiments described herein. The electronic device 500 illustrated in FIG. 5 can be used to implement the electronic device 110 illustrated in FIG. 1.

[0075] As shown in FIG. 5, the electronic device 500 is in the form of a general electronic device. Components of the electronic device 500 can include, but are not limited to, one or more processors or processing units 510, a memory 520, a storage device 530, one or more communication units 540, one or more input devices 550, and one or more output devices 560. The processing unit 510 can be a real or virtual processor and is capable of performing various processing according to programs stored in the memory 520. In a multi-processor system, multiple processing units perform computer-executable instructions in parallel to improve the parallel processing capability of the electronic device 500.

[0076] The electronic device 500 typically includes a plurality of computer storage media. Such media can be any available media that is accessible by the electronic device 500 and includes both volatile and nonvolatile media, removable and non-removable media. The memory 520 can be volatile (such as register, cache, RAM), non-volatile (such as ROM, EEPROM, flash memory), or some combination of the two. The storage device 530 can be a removable or non-removable media, and can include machine-readable media, such as flash drives, disk drives, or any other media that can be used to store information and / or data (e.g., training data for training) and can be accessed within the electronic device 500.

[0077] The electronic device 500 can further include additional removable / non-removable, volatile / non-volatile storage media. Although not shown in FIG. 5, a disk drive for reading from or writing to a removable, non- volatile magnetic disk (e.g., a "floppy disk"), and an optical disk drive for reading from or writing to a removable, non-volatile optical disk (e.g., a CD-ROM) can be provided. In such instances, each drive can be connected to the bus (not shown) by one or more data media interfaces. The memory 520 can include a computer program product 525 having one or more program modules configured to carry out the various methods or actions of the various embodiments of the present disclosure.

[0078] The communication unit 540 enables communication with other electronic devices over communication media. Additionally, the functionality of the components of the electronic device 500 can be implemented in a single computing cluster or a plurality of computer machines capable of communication over a communication connection. As such, the electronic device 500 can operate in a networked environment using logical connections to one or more other servers, network personal computers (PCs), or another network nodes in the networking environment.

[0079] The input device 550 can be one or more input devices, such as a mouse, a keyboard, a trackball, etc. The output device 560 can be one or more output devices, such as a display, a speaker, a printer, etc. The electronic device 500 can also communicate with one or more external devices (not shown) such as a storage device, a display device, etc. through the communication unit 540, as needed, one or more devices that enable a user to interact with the electronic device 500, or any devices (e.g., a network card, a modem, etc.) that enable the electronic device 500 to communicate with one or more other electronic devices. Such communication can be carried out via an input / output (I / O) interface (not shown).

[0080] According to an example implementation of the present disclosure, a computer readable storage medium is provided having computer executable instructions stored thereon, where the computer executable instructions are executed by a processor to implement the method described above. According to an example implementation of the present disclosure, a computer program product is also provided that is tangibly stored on a non-transitory computer readable medium and includes computer executable instructions, where the computer executable instructions are executed by a processor to implement the method described above.

[0081] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0082] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0083] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0084] The computer program product of the present disclosure can have a signal including said computer program. This signal can be electronic, electromagnetic, optical, or any other suitable type of signal. Such a signal can be provided through a communication connection, such as electrical wiring, optical fiber, cellular phone infrastructure, or computer bus or network. Such a signal can also be provided as a computer readable (storage) medium, for example a compact disk, a DVD, a Blu-ray disk, a memory stick, a memory card, or a USB stick. The computer program product of the present disclosure can have a signal including said computer program. This signal can be electronic, electromagnetic, optical, or any other suitable type of signal. Such a signal can be provided through a communication connection, such as electrical wiring, optical fiber, cellular phone infrastructure, or computer bus or network. Such a signal can also be provided as a computer readable (storage) medium, for example a compact disk, a DVD, a Blu-ray disk, a memory stick, a memory card, or a USB stick.

[0085] Having described several implementations of the present disclosure, it will be clear to those of ordinary skill in the art that many modifications can be made to the described implementations without departing from the scope and spirit of the described implementations. In some instances, well-known steps have not been described in detail in order to avoid obscuring the present disclosure. No limitation is intended to the details of the described implementations, which can also include techniques other than those explicitly described to provide the features and benefits described in this disclosure. Further, each of the implementations discussed above can be used independently or in combination with other implementations discussed above.

Claims

1. A method for access control, comprising: receiving an access request for a target resource in a platform; determining a verification result of the access request by verifying the access request with an access control system, the access control system comprising a plurality of verification units, the plurality of verification units comprising a platform verification unit and a resource verification unit, the platform verification unit configured to verify the access request based on a first set of verification policies, the resource verification unit configured to verify the access request based on a second set of verification policies, the first set of verification policies configured by a party managing the platform, the second set of verification policies configured by a party managing the target resource; and processing the access request based on the verification result.

2. The method of claim 1, wherein the plurality of verification units further comprises a session verification unit, the session verification unit configured to verify the access request based on a third set of verification policies, the third set of verification policies associated with an authorized scope for a sender of the access request.

3. The method of claim 2, wherein the session verification unit verifies the access request based on a predetermined protocol.

4. The method of claim 1, wherein determining the verification result of the access request by verifying the access request with the access control system comprises: determining that the access request fails verification in response to any of the plurality of verification units rejecting the access request.

5. The method of claim 1, wherein determining the verification result of the access request by verifying the access request with the access control system comprises: verifying the access request with the plurality of verification units in a predetermined order.

6. The method of claim 5, wherein the predetermined order indicates that the platform verification unit verifies the access request before the resource verification unit.

7. The method of claim 1, wherein the first set of verification policies indicates a first set of conditions for denying access, and / or, the second set of verification indicates a second set of conditions for allowing access.

8. The method of claim 1, wherein the platform is an application development platform, and the target resource comprises an application in the application development platform.

9. An apparatus for access control, comprising: a receiving module configured to receive an access request for a target resource in a platform; a determining module configured to determine a verification result of the access request by verifying the access request with an access control system, the access control system comprising a plurality of verification units, the plurality of verification units comprising a platform verification unit and a resource verification unit, the platform verification unit configured to verify the access request based on a first set of verification policies, the resource verification unit configured to verify the access request based on a second set of verification policies, the first set of verification policies configured by a party managing the platform, the second set of verification policies configured by a party managing the target resource; and a processing module configured to process the access request based on the verification result.

10. An electronic device, comprising: at least one processing unit; ​ and at least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions when executed by the at least one processing unit cause the electronic device to perform the method according to any one of claims 1 to 8.

11. A computer readable storage medium having stored thereon a computer program, the computer program being executed by a processor to implement the method according to any one of claims 1 to 8.

12. A computer program product comprising computer-executable instructions, wherein the computer-executable instructions, when executed by a processor, implement the method according to any one of claims 1 to 8.

Images