CN109976914A - Method and apparatus for controlling resource access - Google Patents

Abstract

The embodiments of the present application disclose a method and an apparatus for controlling resource access. A specific implementation of the method includes: acquiring an access request sent by a user, where the access request includes user identification information and resource identification information; and determining the resource identification information included in the access request according to a preset association relationship between the resource identification information and the label information associated tag information; acquire access control information including the determined tag information in at least one set of preset access control information associated with the user identification information; determine whether to deny the access request according to the acquired access control information. This embodiment provides an access control mechanism based on tag information, which improves the efficiency of resource access control.

Description

Method and apparatus for controlling resource access

technical field

The embodiments of the present application relate to the field of computer technologies, and in particular, to a method and apparatus for controlling resource access.

Background technique

With the huge number of user groups such as large and medium-sized enterprises and their complex services, their demand for Internet host applications is increasing. When users use traditional servers, due to many factors such as cost and operator selection, they have to face various Tough question. Due to its centralized remote management platform, multi-level business backup, fast business deployment and configuration, and elastic scalability of scale, cloud servers can effectively solve the shortcomings of traditional servers.

There are two tenant models in a private cloud environment: single-tenancy and multi-tenancy. In a single-tenant scenario, all employees of the company are sub-users under the tenant, and the use of resources by sub-users is controlled by assigning different roles and permissions to each sub-user. Since the resources of the entire private cloud are in one tenant, the number of resources is large.

SUMMARY OF THE INVENTION

The embodiments of the present application propose a method and apparatus for controlling resource access.

In a first aspect, some embodiments of the present application provide a method for controlling resource access, the method comprising: acquiring an access request sent by a user, where the access request includes user identification information and resource identification information; The association relationship between the information and the label information, determine the label information associated with the resource identification information included in the access request; obtain the access control information that includes the determined label information in at least one set of access control information associated with the user identification information that is preset; Determine whether to deny the access request according to the obtained access control information.

In some embodiments, the access control information further includes first operation identification information; and determining whether to deny the access request according to the obtained access control information includes: obtaining second operation identification information included in the access request; according to the second operation identification Whether the information matches the first operation identification information included in the acquired access control information determines whether to deny the access request.

In some embodiments, the access control information includes indication information indicating whether to deny the access request; and determining whether to deny the access request according to the acquired access control information includes: determining whether to deny the access according to the indication information included in the acquired access control information ask.

In some embodiments, the resource identification information includes at least one of the following: a resource identifier, information about a product to which the resource belongs, and information about a region where the resource is located.

In some embodiments, acquiring at least one set of preset access control information associated with the user identification information includes the determined tag information in the access control information, comprising: acquiring at least one preset set of access control information associated with the user identification information The control information includes the determined tag information or the access control information of the resource identification information included in the access request.

In some embodiments, acquiring the access request sent by the user includes: intercepting the access request sent by the user through a predefined aspect in the method for authorization verification and/or the method for processing request address mapping; acquiring the access request through a reflection mechanism in the aspect Predefined fields in the request.

In some embodiments, the predefined fields include an operation identification information field and a resource identifier field; and obtaining the predefined fields in the access request through a reflection mechanism in the aspect includes: in response to obtaining the operation identification information field indicating the request The operation type is a create class operation, and the value of the resource identifier field is set to a preset character.

In a second aspect, some embodiments of the present application provide an apparatus for controlling resource access, the apparatus includes: a first obtaining unit configured to obtain an access request sent by a user, where the access request includes user identification information, resource identification information; the first determining unit is configured to determine the label information associated with the resource identification information included in the access request according to the preset association relationship between the resource identification information and the label information; the second obtaining unit is configured to obtain the preset resource identification information. The at least one group of access control information associated with the user identification information includes the determined access control information of the tag information; the second determining unit is configured to determine whether to deny the access request according to the acquired access control information.

In some embodiments, the access control information further includes first operation identification information; and a second determination unit, including: a first acquisition subunit configured to acquire the second operation identification information included in the access request; the first determination subunit The unit is configured to determine whether to reject the access request according to whether the second operation identification information matches with the first operation identification information included in the obtained access control information.

In some embodiments, the access control information includes indication information indicating whether to deny the access request; and the second determination unit includes: a second determination subunit configured to determine according to the indication information included in the acquired access control information Whether to deny access requests.

In some embodiments, the resource identification information includes at least one of the following: a resource identifier, information about a product to which the resource belongs, and information about a region where the resource is located.

In some embodiments, the second obtaining unit includes: a second obtaining subunit, configured to obtain at least one set of preset access control information associated with the user identification information, including the determined tag information or the information included in the access request. Access control information for resource identification information.

In some embodiments, the first obtaining unit includes: an intercepting subunit, configured to intercept the access request sent by the user through a predefined aspect in the permission verification apparatus and/or the method for processing request address mapping; the third obtaining The subunit is configured to obtain the predefined fields in the access request through the reflection mechanism in the aspect.

In some embodiments, the predefined fields include an operation identification information field and a resource identifier field; and a third obtaining subunit is further configured to: in response to obtaining the operation identification information field, indicating that the requested operation type is a create class operation , set the value of the resource identifier field to the default character.

In a third aspect, some embodiments of the present application provide a device, including: one or more processors; a storage device on which one or more programs are stored, when the one or more programs are stored by the one or more programs described above Execution by the plurality of processors causes the above-mentioned one or more processors to implement the method as described above in the first aspect.

In a fourth aspect, some embodiments of the present application provide a computer-readable medium on which a computer program is stored, and when the program is executed by a processor, implements the method as described in the first aspect.

The method and device for controlling resource access provided by the embodiments of the present application determine the resource identification information associated with the resource identification information included in the access request by acquiring the access request sent by the user, and according to the preset association relationship between the resource identification information and the label information. Label information, then obtain the access control information including the determined label information in at least one set of access control information that is preset and associated with the user identification information, and finally determine whether to reject the access request according to the obtained access control information. The access control mechanism based on tag information improves the efficiency of controlling resource access.

Description of drawings

Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

Fig. 1 is some exemplary system architecture diagrams in which the present application can be applied;

FIG. 2 is a flowchart of one embodiment of a method for controlling resource access according to the present application;

3 is a schematic diagram of an application scenario of the method for controlling resource access according to the present application;

FIG. 4 is a flowchart of yet another embodiment of a method for controlling resource access according to the present application;

5 is a schematic structural diagram of an embodiment of an apparatus for controlling resource access according to the present application;

FIG. 6 is a schematic structural diagram of a computer system suitable for implementing a server or terminal of some embodiments of the present application.

Detailed ways

The present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the related invention, but not to limit the invention. In addition, it should be noted that, for the convenience of description, only the parts related to the related invention are shown in the drawings.

It should be noted that the embodiments in the present application and the features of the embodiments may be combined with each other in the case of no conflict. The present application will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

FIG. 1 illustrates an exemplary system architecture 100 to which embodiments of the method or apparatus for controlling resource access of the present application may be applied.

As shown in FIG. 1 , the system architecture 100 may include terminal devices 101 , 102 , and 103 , a network 104 and a server 105 . The network 104 is a medium used to provide a communication link between the terminal devices 101 , 102 , 103 and the server 105 . The network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.

The user can use the terminal devices 101, 102, 103 to interact with the server 105 through the network 104 to receive or send messages and the like. Various client applications may be installed on the terminal devices 101 , 102 and 103 , such as cloud service applications, data management applications, image processing applications, e-commerce applications, and search applications.

The terminal devices 101, 102, and 103 may be hardware or software. When the terminal devices 101, 102, and 103 are hardware, they can be various electronic devices with display screens, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like. When the terminal devices 101, 102, and 103 are software, they can be installed in the electronic devices listed above. It can be implemented as a plurality of software or software modules, and can also be implemented as a single software or software module. There is no specific limitation here. The terminal devices 101, 102, and 103 can obtain the access request sent by the user through other devices, and the access request includes the user identification information and the resource identification information; according to the preset association relationship between the resource identification information and the label information, determine the resources included in the access request. label information associated with the identification information; obtain access control information including the determined label information in at least one set of access control information associated with the user identification information preset; determine whether to deny the access request according to the obtained access control information.

The server 105 can be a server that provides various services, such as a background server that provides support for applications installed on the terminal devices 101, 102, and 103. The server 105 can obtain the access requests sent by the users through the terminal devices 101, 102, and 103. Including user identification information and resource identification information; according to the preset association relationship between the resource identification information and the label information, determine the label information associated with the resource identification information included in the access request; obtain at least one preset set associated with the user identification information. The access control information includes the determined access control information of the label information; whether to deny the access request is determined according to the acquired access control information.

It should be noted that the method for controlling resource access provided by the embodiments of the present application may be executed by the server 105, or may be executed by the terminal devices 101, 102, and 103. Correspondingly, the means for controlling resource access may be set in The server 105 may also be installed in the terminal devices 101 , 102 and 103 .

It should be noted that the server may be hardware or software. When the server is hardware, it can be implemented as a distributed server cluster composed of multiple servers, or can be implemented as a single server. When the server is software, it can be implemented as a plurality of software or software modules (for example, for providing distributed services), or it can be implemented as a single software or software module. There is no specific limitation here.

It should be understood that the numbers of terminal devices, networks and servers in FIG. 1 are merely illustrative. There can be any number of terminal devices, networks and servers according to implementation needs.

Continuing to refer to FIG. 2, a flow 200 of one embodiment of a method for controlling resource access according to the present application is shown. The method for controlling resource access includes the following steps:

Step 201: Obtain an access request sent by a user.

In this embodiment, the method execution body for controlling resource access (for example, the server or terminal shown in FIG. 1 ) may first obtain an access request sent by a user, where the access request includes user identification information and resource identification information. The user identification information may include any information that can identify the user, such as a user ID, and the generation rule of the user ID may be set according to actual needs. The resource identification information can include any information that can identify a resource, such as a resource ID, and the resource ID generation rule can be set according to actual needs.

In some optional implementations of this embodiment, the resource identification information includes at least one of the following: a resource identifier, information about a product to which the resource belongs, and information about a region where the resource is located. The resource identifier may be used to identify a specific resource, the information of the product to which the resource belongs may include information indicating which cloud product the resource is in, and the information of the region where the resource is located may include the name or address of the region where the resource is located.

In some optional implementations of this embodiment, acquiring the access request sent by the user includes: intercepting the access request sent by the user through a pre-defined aspect in the method for authorization verification and/or the method for processing request address mapping; Obtain the predefined fields in the access request through the reflection mechanism. The above execution body can perform method interception on all @RequestMapping and @PermissionVertify annotated methods by defining method-level annotations, such as @RequestMapping (permission verification), @PermissionVertify (processing request address mapping), and an aspect. The reflection mechanism refers to the fact that the program can obtain its own information at runtime. For example, in java, as long as the name of the class is given, all the information of the class can be obtained through the reflection mechanism. A parameter annotation configured to identify the method can be added to the method parameter of the above intercepted operation interface. If the parameter is an object, the field name of the resource ID can be specified. In this way, when the user accesses the corresponding business module through the console or API (Application Programming Interface), after the request reaches the interface, there will be an aspect to intercept the user's access request and obtain relevant information from the access request.

In some optional implementations of this embodiment, the predefined fields include an operation identification information field and a resource identifier field; and obtaining the predefined fields in the access request through a reflection mechanism in the aspect includes: in response to obtaining the operation The identification information field indicates that the requested operation type is a create class operation, and the value of the resource identifier field is set to a preset character. Characters can be set according to actual needs, for example, "*" can be used.

Step 202: Determine the tag information associated with the resource identification information included in the access request according to the preset association relationship between the resource identification information and the tag information.

In this embodiment, the above-mentioned execution body may determine the tag information associated with the resource identification information included in the access request obtained in step 201 according to the preset association relationship between the resource identification information and the tag information, and the tag information may be a global information , a global concept regardless of region or project, which can be a unique identifier represented by a key/value pair, and a resource can be associated with multiple tag information. The relationship between resource identification information and tag information can be established by the user through the console. Permission management is performed through the tag information. Compared with authorizing a resource alone, it can achieve the effect of batch authorization and greatly reduce the operating pressure of the user. ; In the scenario based on project authorization, permission management through tag information can achieve flexibility that cannot be achieved by simple project management, such as cross-project resource access permission control, and for ordinary role-based access control, it can be more refined. Implement access control for resources.

Step 203: Acquire access control information including the determined tag information in at least one set of preset access control information associated with the user identification information.

In this embodiment, the above-mentioned execution subject may acquire the access control information including the tag information determined in step 202 in at least one set of preset access control information associated with the user identification information. Users can create sub-users through IAM (Identity and Access Management), create an access control policy based on tag information, and then associate one or more access control policies for users. An access control policy can include an access control policy. Group access control information.

In some optional implementation manners of this embodiment, acquiring the access control information including the determined tag information in at least one set of access control information that is preset and associated with the user identification information includes: acquiring preset information related to the user identification information. The associated at least one set of access control information includes the determined tag information or the access control information of the resource identification information included in the access request. In this implementation manner, the rights management is performed through the label information and the resource identification information at the same time, which further enriches the resource access control method.

Step 204: Determine whether to deny the access request according to the acquired access control information.

In this embodiment, the above-mentioned execution subject may determine whether to deny the access request according to the access control information obtained in step 203 . The above-mentioned execution body may deny or allow the access request in response to acquiring at least one set of preset access control information associated with the user identification information that includes the determined tag information. The set at least one set of access control information associated with the user identification information includes the determined access control information of the label information is empty, the access request is denied or allowed, and specific rules can be set according to user needs. The IAM can return the authentication result of whether to deny the access request to the service end.

In some optional implementation manners of this embodiment, the access control information includes indication information indicating whether to deny the access request; and determining whether to deny the access request according to the obtained access control information includes: according to the obtained access control information, including: Indicates whether to deny the access request. For example, the access control information can include Allow (allow) or Deny (deny), which is used to specify whether the resources that meet this policy control are allowed to access or not allowed to access.

Continue to refer to FIG. 3 , which is a schematic diagram of an application scenario of the method for controlling resource access according to this embodiment. In the application scenario of FIG. 3, the server 301 obtains the access request 303 sent by the user through the device 302, and the access request 303 includes the user identification information and the resource identification information. The tag information 304 associated with the resource identification information included in the access request 303, and then the server 301 acquires the access control information 305 that includes the determined tag information in at least one set of access control information preset and associated with the user identification information, and finally according to the The obtained access control information 305 determines the result 306 of denying the access request.

The method provided by the above-mentioned embodiments of the present application obtains the access request sent by the user, and the access request includes the user identification information and the resource identification information; according to the preset association relationship between the resource identification information and the label information, the resource identification included in the access request is determined. tag information associated with the information; obtain access control information that includes the determined tag information in at least one set of access control information that is preset and associated with the user identification information; determine whether to deny the access request according to the acquired access control information, and provide a An access control mechanism based on tag information improves the efficiency of controlling resource access.

With further reference to Figure 4, a flow 400 of yet another embodiment of a method for controlling resource access is shown. The process 400 of the method for controlling resource access includes the following steps:

Step 401: Obtain an access request sent by a user.

In this embodiment, the method execution body for controlling resource access (for example, the server or terminal shown in FIG. 1 ) may first obtain an access request sent by a user, where the access request includes user identification information and resource identification information.

Step 402 , according to the preset association relationship between the resource identification information and the label information, determine the label information associated with the resource identification information included in the access request.

In this embodiment, the above-mentioned execution subject may determine the tag information associated with the resource identification information included in the access request obtained in step 401 according to the preset association relationship between the resource identification information and the tag information.

Step 403: Acquire access control information including the determined tag information in at least one set of preset access control information associated with the user identification information.

In this embodiment, the above-mentioned execution subject may acquire the access control information including the tag information determined in step 402 in at least one set of preset access control information associated with the user identification information.

Step 404: Obtain the second operation identification information included in the access request.

In this embodiment, the above-mentioned execution subject may acquire the second operation identification information included in the access request. The operation identification information may indicate an operation type, and as examples, may include restarting a virtual machine (RebootVM), creating a virtual machine (CreateVM), and obtaining a list of virtual machines (ListVM).

Step 405: Determine whether to reject the access request according to whether the second operation identification information matches the first operation identification information included in the obtained access control information.

In this embodiment, the above-mentioned execution subject may determine whether to reject the access request according to whether the second operation identification information obtained in step 404 matches the first operation identification information included in the obtained access control information. Whether the second operation identification information matches the first operation identification information may include whether the second operation identification information matches the operation type indicated by the first operation identification information, for example, if the indicated operation type is restarting the virtual machine, it matches.

In this embodiment, the operations of step 401 , step 402 , and step 403 are basically the same as those of step 201 , step 202 , and step 203 , which will not be repeated here.

As can be seen from FIG. 4 , compared with the embodiment corresponding to FIG. 2 , in the process 400 of the method for controlling resource access in this embodiment, when determining whether to deny the access request, the operations included in the access request are further processed. The identification information is matched with the operation identification information included in the access control information, so that the resource access control in the solution described in this embodiment is more precise.

Further referring to FIG. 5 , as an implementation of the methods shown in the above figures, the present application provides an embodiment of an apparatus for controlling resource access, and the apparatus embodiment corresponds to the method embodiment shown in FIG. 2 , Specifically, the device can be applied to various electronic devices.

As shown in FIG. 5 , the apparatus 500 for controlling resource access in this embodiment includes: a first obtaining unit 501 , a first determining unit 502 , a second obtaining unit 503 and a second determining unit 504 . Wherein, the first obtaining unit is configured to obtain the access request sent by the user, and the access request includes user identification information and resource identification information; determining the tag information associated with the resource identification information included in the access request; the second acquiring unit is configured to acquire the access control information that includes the determined tag information in at least one set of preset access control information associated with the user identification information; The second determination unit is configured to determine whether to deny the access request according to the acquired access control information.

In this embodiment, for specific processing of the first obtaining unit 501 , the first determining unit 502 , the second obtaining unit 503 and the second determining unit 504 of the apparatus 500 for controlling resource access, reference may be made to the corresponding embodiments in FIG. 2 . Step 201 , Step 202 , Step 203 and Step 204 .

In some optional implementations of this embodiment, the access control information further includes first operation identification information; and a second determining unit includes: a first obtaining subunit configured to obtain the second operation identification included in the access request information; a first determination subunit configured to determine whether to reject the access request according to whether the second operation identification information matches the first operation identification information included in the obtained access control information.

In some optional implementation manners of this embodiment, the access control information includes indication information indicating whether to deny the access request; and the second determination unit includes: a second determination subunit configured to be configured according to the acquired access control The information includes indication information to determine whether to deny the access request.

In some optional implementations of this embodiment, the resource identification information includes at least one of the following: a resource identifier, information about a product to which the resource belongs, and information about a region where the resource is located.

In some optional implementations of this embodiment, the second obtaining unit includes: a second obtaining subunit, configured to obtain a preset at least one set of access control information associated with the user identification information including the determined tag Information or access control information for resource identification information included in an access request.

In some optional implementations of this embodiment, the first obtaining unit includes: an intercepting subunit, configured to intercept the data sent by the user through a predefined aspect in the permission verification apparatus and/or the method for processing request address mapping. The access request; the third obtaining subunit is configured to obtain the pre-defined fields in the access request through the reflection mechanism in the aspect.

In some optional implementations of this embodiment, the predefined fields include an operation identification information field and a resource identifier field; and a third obtaining subunit is further configured to: in response to obtaining the operation identification information field indicating that the requested The operation type is a create class operation, and the value of the resource identifier field is set to a preset character.

The device provided by the above-mentioned embodiments of the present application acquires the access request sent by the user, where the access request includes the user identification information and the resource identification information; according to the preset association relationship between the resource identification information and the label information, the resources included in the access request are determined. Label information associated with identification information; obtain access control information that includes the determined label information in at least one set of access control information that is preset and associated with the user identification information; determine whether to deny the access request according to the obtained access control information, and provide An access control mechanism based on tag information improves the efficiency of controlling resource access.

Referring to FIG. 6 below, it shows a schematic structural diagram of a computer system 600 suitable for implementing the server or terminal of the embodiment of the present application. The server or terminal shown in FIG. 6 is only an example, and should not impose any limitations on the functions and scope of use of the embodiments of the present application.

As shown in FIG. 6, a computer system 600 includes a central processing unit (CPU) 601, which can be loaded into a random access memory (RAM) 603 according to a program stored in a read only memory (ROM) 602 or a program from a storage section 608 Instead, various appropriate actions and processes are performed. In the RAM 603, various programs and data necessary for the operation of the system 600 are also stored. The CPU 601 , the ROM 602 , and the RAM 603 are connected to each other through a bus 604 . An input/output (I/O) interface 605 is also connected to bus 604 .

The following components can be connected to the I/O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; storage including a hard disk, etc. part 608; and a communication part 609 including a network interface card such as a LAN card, a modem, and the like. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I/O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is mounted on the drive 610 as needed so that a computer program read therefrom is installed into the storage section 608 as needed.

In particular, according to embodiments of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the method illustrated in the flowchart. In such an embodiment, the computer program may be downloaded and installed from the network via the communication portion 609 and/or installed from the removable medium 611 . When the computer program is executed by the central processing unit (CPU) 601, the above-described functions defined in the method of the present application are performed. It should be noted that the computer-readable medium described in this application may be a computer-readable signal medium or a computer-readable medium, or any combination of the above two. The computer readable medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or a combination of any of the above. More specific examples of computer readable media may include, but are not limited to, electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable Read only memory (EPROM or flash memory), fiber optics, portable compact disk read only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing. In this application, a computer-readable medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, however, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code therein. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable medium that can transmit, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any suitable medium including, but not limited to, wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

Computer program code for performing the operations of the present application may be written in one or more programming languages, including object-oriented programming languages—such as Java, Smalltalk, C++, but also conventional procedural programming language—such as C or a similar programming language. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (eg, using an Internet service provider through Internet connection).

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code that contains one or more logical functions for implementing the specified functions executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It is also noted that each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, can be implemented in dedicated hardware-based systems that perform the specified functions or operations , or can be implemented in a combination of dedicated hardware and computer instructions.

The units involved in the embodiments of the present application may be implemented in a software manner, and may also be implemented in a hardware manner. The described unit may also be provided in the processor, for example, it may be described as: a processor includes a first obtaining unit, a first determining unit, a second obtaining unit and a second determining unit. Wherein, the names of these units do not constitute a limitation on the unit itself in some cases, for example, the first obtaining unit may also be described as "a unit configured to obtain an access request sent by a user".

As another aspect, the present application also provides a computer-readable medium, which may be included in the apparatus described in the above-mentioned embodiments, or may exist independently without being assembled into the apparatus. The above-mentioned computer-readable medium carries one or more programs, and when the above-mentioned one or more programs are executed by the device, the device is made to: obtain an access request sent by a user, and the access request includes user identification information and resource identification information; The association relationship between the set resource identification information and the label information, determine the label information associated with the resource identification information included in the access request; obtain at least one set of preset access control information associated with the user identification information that includes the determined label information. Access control information; determine whether to deny the access request according to the obtained access control information.

The above description is only a preferred embodiment of the present application and an illustration of the applied technical principles. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to the technical solution formed by the specific combination of the above technical features, and should also cover the above technical features or Other technical solutions formed by any combination of its equivalent features. For example, a technical solution is formed by replacing the above-mentioned features with the technical features disclosed in this application (but not limited to) with similar functions.

Claims (16)

1. a kind of method for controlling resource access, comprising:

The access request that user sends is obtained, the access request includes user identity information, resource identification information；

According to the incidence relation of pre-set resource identification information and label information, the determining money for including with the access request The associated label information of source identification information；

Obtaining in the associated at least one set of access control information of the pre-set and user identity information includes determining The access control information of label information；

Determine whether to refuse the access request according to acquired access control information.

2. according to the method described in claim 1, wherein, the access control information further includes the first operation identification information；With And

The access control information according to acquired in determines whether to refuse the access request, comprising:

Obtain the second operation identification information for including in the access request；

Whether the first operation identification information for including according to second operation identification information and acquired access control information Matching determines whether to refuse the access request.

3. according to the method described in claim 1, wherein, the access control information includes indicating whether that refusing the access asks The instruction information asked；And

The access control information according to acquired in determines whether to refuse the access request, comprising:

Determine whether to refuse the access request according to the instruction information that acquired access control information includes.

4. according to the method described in claim 1, wherein, the resource identification information includes at least one of the following:

Information, the information of resource region of the affiliated product of resource identifier, resource.

5. according to the method described in claim 1, wherein, the acquisition is pre-set associated with the user identity information It include the access control information for the label information determined at least one set of access control information, comprising:

Obtaining in the associated at least one set of access control information of the pre-set and user identity information includes determining The access control information for the resource identification information that label information or the access request include.

6. method according to any one of claims 1-5, wherein the access request for obtaining user and sending, comprising:

User's hair is intercepted by section predetermined in the method for Authority Verification and/or the method for processing request address mapping The access request sent；

Field predetermined in the access request is obtained by reflection mechanism in the section.

7. according to the method described in claim 6, wherein, the field predetermined includes operation identification information field and money Source identifier field；And

It is described that field predetermined in the access request is obtained by reflection mechanism in the section, comprising:

In response to getting the action type of the operation identification information field instruction request for creation generic operation, by the resource The value of identifier field is set as preset characters.

8. a kind of for controlling the device of resource access, comprising:

First acquisition unit, be configured to obtain user transmission access request, the access request include user identity information, Resource identification information；

First determination unit is configured to the incidence relation according to pre-set resource identification information and label information, determines The associated label information of resource identification information for including with the access request；

Second acquisition unit is configured to obtain pre-set access with the associated at least one set of the user identity information and controls It include the access control information for the label information determined in information processed；

Second determination unit is configured to determine whether to refuse the access request according to acquired access control information.

9. device according to claim 8, wherein the access control information further includes the first operation identification information；With And

Second determination unit, comprising:

First obtains subelement, is configured to obtain the second operation identification information in the access request included；

First determine subelement, be configured to include according to second operation identification information and acquired access control information The first operation identification information whether match and determine whether to refuse the access request.

10. device according to claim 8, wherein the access control information includes indicating whether to refuse the access The instruction information of request；And

Second determination unit, comprising:

Second determines subelement, is configured to determine whether to refuse according to the instruction information that acquired access control information includes The access request.

11. device according to claim 8, wherein the resource identification information includes at least one of the following:

Information, the information of resource region of the affiliated product of resource identifier, resource.

12. device according to claim 8, wherein the second acquisition unit, comprising:

Second obtains subelement, is configured to obtain the associated at least one set of access of the pre-set and user identity information The access control information for the resource identification information that in control information include the label information determined or the access request includes.

13. the device according to any one of claim 8-12, wherein the first acquisition unit, comprising:

Subelement is intercepted, is configured in the device of Authority Verification and/or the method for processing request address mapping by preparatory The section of definition intercepts the access request that user sends；

Third obtains subelement, is configured in the section obtain by reflection mechanism in the access request pre-defined Field.

14. device according to claim 13, wherein the field predetermined include operation identification information field and Resource identifier field；And

The third obtains subelement, is further configured to:

In response to getting the action type of the operation identification information field instruction request for creation generic operation, by the resource The value of identifier field is set as preset characters.

15. a kind of electronic equipment, comprising:

One or more processors；

Storage device is stored thereon with one or more programs；

When one or more of programs are executed by one or more of processors, so that one or more of processors Realize the method as described in any in claim 1-7.

16. a kind of computer-readable medium, is stored thereon with computer program, such as right is realized when which is executed by processor It is required that any method in 1-7.