Authority management method and device in distributed environment, and server

1. An authority management method in a distributed environment, comprising:

obtaining usage information of a user when the user uses an object storage product, the usage information comprising the user's behavior, status and feature;

determining a matching degree between the usage information of the user and usage information predicted by a portrait model of the user; and

applying a preset early warning mechanism to the user's access authorities according to the matching degree, including performing a locking operation on an access control list of the user according to the matching degree.

2. The method of claim 1 , wherein before said determining the matching degree between the usage information of the user and usage information predicted by a portrait model of the user, the method further comprises:

constructing the portrait model of the user using a machine learning method according to historical usage information samples of the user about the object storage product.

3. The method of claim 1 , wherein said performing the locking operation on the access control list of the user according to the matching degree comprises selectively performing locking operations classified into two types: an immediate locking operation and a restricted locking operation.

4. The method of claim 3 , wherein said performing the locking operation on the access control list of the user according to the matching degree comprises:

performing the immediate locking operation on the access control list of the user when the matching degree is less than a first preset threshold, to lock all access requests to the access control list; and

recording all the access requests so as to continue processing the access requests after the locking operation is released.

5. The method of claim 4 , wherein said performing the locking operation on the access control list of the user according to the matching degree comprises:

performing the restricted locking operation on the access control list of the user when the matching degree is greater than or equal to the first preset threshold and less than a second preset threshold, to restrict the access requests to the access control list.

6. The method of claim 5 , wherein said performing the locking operation on the access control list of the user according to the matching degree comprises:

verifying the identity of the user by a preset authentication mechanism when the matching degree is greater than or equal to the second preset threshold, and releasing the locking operation in response to the user passing the identity verification.

7. The method of claim 1 , wherein before said obtaining usage information of the user when the user uses an object storage product, the method further comprises:

monitoring a network traffic used by the user in a unit time; and

performing a locking operation on an access control list of the user according to the network traffic.

8. The method of claim 1 , wherein before said obtaining usage information of the user when the user uses an object storage product, the method further comprises:

monitoring an object to which the user sends an access request;

directly blocking access to the object of the access request in response to determining that the object of the access request is in a black list; and

skipping the preset early warning mechanism to normally access the object of the access request in response to determining that the object of the access request is in a white list.

9. An authority management device in a distributed environment, comprising:

one or more processors; and

a storage device configured to store one or more programs,

wherein the one or more programs, when executed by the one or more processors, enable the one or more processors to:

obtain usage information of a user when the user uses an object storage product, the usage information comprising the user's behavior, status and feature;

determine a matching degree between the usage information of the user and usage information predicted by a portrait model of the user; and

apply a preset early warning mechanism to the user's access authorities according to the matching degree;

monitor a network traffic used by the user in a unit time; and

perform a locking operation on an access control list of the user according to the network traffic.

10. The device of claim 9 , wherein the one or more programs, when executed by the one or more processors, further enable the one or more processors to:

monitor an object to which the user sends an access request, directly block access to the object of the access request in response to determining that the object of the access request is in a black list, and skip the preset early warning mechanism to normally access the object of the access request in response to determining that the object of the access request is in a white list.

11. A computer readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method of claim 1 .