Access control method, device, apparatus and readable storage medium
View Patent ↗The present application provides an access control method, device, apparatus, and readable storage medium. The method comprises: receiving and parsing an access request, and determining a subject and an object corresponding to the access request; by using a security access strategy, obtaining a first result of whether the subject has permission to access the object, and determining whether a match access control linked list exists; when the access control linked list exists, by using the access control linked list, obtaining a second result whether the subject has permission to access the object; when the second result is obtained, by using the second result, performing control processing on the access request; or when the second result is not obtained, by using the first result, performing control processing on the access request.
1. An electronic device, comprising:
a processor; and
a memory, configured for storing computer-readable instructions, wherein the computer-readable instructions, when executed by the processor, cause the processor to perform operations of:
receiving and parsing an access request, and determining a subject and an object corresponding to the access request;
by using a security access strategy, obtaining a first result whether the subject has a permission to access the object, and determining whether a match access control linked list exists;
when the access control linked list exists, by using the access control linked list, obtaining a second result whether the subject has a permission to access the object; and
when the second result is obtained, by using the second result, performing control processing on the access request, or when the second result is not obtained, by using the first result, performing control processing on the access request.
2. The electronic device according to claim 1 , wherein when the access control linked list is an attribute access control linked list, the step of, by using the access control linked list, obtaining the second result whether the subject has the permission to access the object, comprising:
obtaining an attribute of the subject and the object; and
querying the second result matching the attribute from the attribute access control linked list.
3. The electronic device according to claim 1 , wherein when the access control linked list is a scenario access control linked list, the step of, by using the access control linked list, obtaining the second result whether the subject has the permission to access the object, comprising:
acquiring scenario information corresponding to the access request; and
querying the second result matching the scenario information from the scenario access control linked list.
4. The electronic device according to claim 1 , wherein the processor is further configured to perform operations of:
receiving a modification request of the access control linked list to obtain modification content; and
by using the modification content, modifying the access control linked list.
5. The electronic device according to claim 1 , wherein the processor is further configured to perform operations of:
receiving a viewing request of the access control linked list; and
outputting the access control linked list.
6. The electronic device according to claim 1 , wherein when the security access strategy is a discretionary access strategy, the step of, by using the security access strategy, obtaining the first result whether the subject has the permission to access the object, comprising:
obtaining an authorization list corresponding to the object; and
searching the subject in the authorization list to obtain the first result whether the subject has the permission to access the object.
7. The electronic device according to claim 1 , wherein when the security access strategy is a mandatory access strategy, the step of, by using the security access strategy, obtaining a first result whether the subject has the permission to access the object, comprises:
obtaining a security tag of the subject and a security tag of the object; and
comparing the security tag of the subject with the security tag of the object to obtain the first result whether the subject has the permission to access the object.
8. The electronic device according to claim 7 , wherein the security tag of the subject is a security level label tag having a partial order relationship.
9. The access control method according to claim 7 , wherein the security tag of the object is a non-level classification tag.
10. The electronic device according to claim 7 , wherein the attributes of the subject are the features of the subject, and the attributes of the object are the features of the object.
11. The electronic device according to claim 1 , wherein the subject is a process or a thread.
12. The electronic device according to claim 1 , wherein the object may be a file, a directory, a Transmission Control Protocol (TCP)/User Datagram Protocol (UDP) port, a shared memory segment, an input/output (I/O) device, a table, a view or a process.
13. A non-transitory computer-readable storage medium storing computer-readable instructions, wherein when the computer-readable instruction is executed by one or more processors, making the one or more processors perform operations of:
receiving and parsing an access request, and determining a subject and an object corresponding to the access request;
by using a security access strategy, obtaining a first result whether the subject has a permission to access the object, and determining whether a match access control linked list exists;
when the access control linked list exists, by using the access control linked list, obtaining a second result whether the subject has a permission to access the object; and
when the second result is obtained, by using the second result, performing control processing on the access request, or when the second result is not obtained, by using the first result, performing control processing on the access request.