WO2016169324A1

WO2016169324A1 - Access management method for cloud computing data centre and cloud computing data centre

Info

Publication number: WO2016169324A1
Application number: PCT/CN2016/073822
Authority: WO
Inventors: 童遥; 彭亦辉
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-04-24
Filing date: 2016-02-15
Publication date: 2016-10-27
Also published as: CN106161566A

Abstract

Provided are an access management method for a cloud computing data centre, and a cloud computing data centre, which are applied to the field of communications. The method comprises: a data centre receiving an access request of a terminal and performing identity verification on the terminal; after the identity verification is passed, determining whether a target resource corresponding to the access request exists locally in the data centre; and if so, authorizing, according to a pre-set access strategy of the data centre, the terminal to perform an access. Compared with the prior art, the limitation is not applied by setting complicated access control conditions for access; instead, identity recognition is performed on the access control, and after the identity recognition, it is judged whether authorization for access is necessary by means of the access strategy preset by the cloud computing data centre, so that the access to the cloud computing data centre is guaranteed by means of the simple identity recognition combined with the access strategy preset by the cloud computing data centre without affecting the processing capability of the cloud computing data centre, thereby, improving the core competitiveness of a product.

Description

Cloud computing data center access management method and cloud computing data center

Technical field

The present invention relates to the field of communications, and in particular, to a cloud computing data center access management method and a cloud computing data center.

Background technique

Access control technology realizes the need for shared data management of the system by defining the access rights of the main body of the system to the object, and better prevents the theft and destruction of information, especially confidential information. For different security application environment requirements, researchers have proposed many different access control technologies, such as DAC, MAC, RBAC, TRBAC, TBAC and so on. However, there are still many areas for existing access control technologies to be applied to the data center that need further improvement and improvement. The first is that flexibility needs to be further improved. Existing access control technologies implement session control by configuring constraints on the principal. Since the type of constraint configured by the access control application system is fixed at the time of design and coding; at the same time, in order to simplify configuration management, the number of access control constraints configured by the system during actual operation is not likely to be large, and if it is too much, it will be limited. The flexibility of access control. The application environment of the existing access control technology is described by the constraints and corresponding policies of the session entity configuration, and does not consider factors such as the application environment of the system, resulting in poor adaptability.

Currently, the deployment of cloud computing data centers is based on regional units, and the same level of data centers are established at the same level. The logical complexity of the access control mechanism will affect the security performance of the system. However, for cloud computing data centers with average access times higher than the average system, the excessively complex access control will affect the access rate and weaken the cloud computing data center. Operation processing capability. How to ensure the security of cloud computing data center access becomes an urgent problem to be solved without affecting the processing power of the cloud computing data center.

Summary of the invention

The main technical problem to be solved by the present invention is to provide a cloud computing data center access management method and a cloud computing data center to solve the security problem of the existing cloud computing data center access.

To solve the above problem, the present invention provides a cloud computing data center access management method, including:

Receiving, by the data center, an access request of the terminal, and performing identity verification on the terminal;

After the authentication, determining whether the target resource corresponding to the access request exists locally in the data center;

If the target resource exists, the terminal is authorized to access according to a preset access policy of the data center.

In an embodiment of the present invention, the data center performing identity verification on the terminal includes: calling attribute information in the data center attribute library, where the attribute information includes identity identification information that allows access; Align with the identification information of the terminal, and if they are the same, pass the authentication.

In an embodiment of the present invention, the access policy includes performing an authorized access when the current running environment satisfies the preset condition, and/or the current access number meets the preset number of conditions.

In an embodiment of the present invention, the method further includes: when the data center does not have the target resource corresponding to the access request, establishing a session with the target data center where the target resource is located through the central data center to perform authorized access. .

In an embodiment of the present invention, the establishing a session by the central data center and the target data center where the target resource is located for authorized access includes: searching, by the central data center, a target data center where the target resource is located, Establishing a session with the target data center, and the pre-set access policy of the target data center performs authorized access to the terminal.

In an embodiment of the present invention, after authorizing access to the terminal, the method further includes: performing security auditing on the access.

In an embodiment of the present invention, the security auditing of the access includes: generating an access log in a data center where the target resource is located, performing tracking according to the access information recorded in the access log, and determining whether the access information is A security audit policy that meets the preset settings to handle non-compliant access.

To solve the above problem, the present invention further provides a cloud computing data center, which includes an identity verification module, a resource search module, and a policy verification module:

The identity verification module is configured to receive an access request of the terminal, and perform identity verification on the terminal;

The resource searching module is configured to determine, by the identity verification, whether the target resource corresponding to the access request exists locally in the data center;

The policy verification module is configured to perform authorized access to the terminal according to a preset access policy of the data center if the target resource exists.

In an embodiment of the present invention, the external access module is further configured to: when the data center does not locally have the target resource corresponding to the access request, pass the central data center and the target resource. The target data center in which it is located establishes a session for authorized access.

In an embodiment of the present invention, the security audit module is further configured to perform security auditing on the access after authorizing access to the terminal.

The beneficial effects of the invention are:

In the cloud computing data center access management method and the cloud computing data center provided by the present invention, the data center receives the access request of the terminal, and performs identity verification on the terminal; after the identity verification, determines whether the target resource corresponding to the access request exists locally in the data center. If there is a target resource, the terminal is authorized to access according to the data center's pre-set access policy. Compared with the prior art, the access control condition is not limited by the access setting, as long as the access control is identified, and the access policy preset by the cloud computing data center is used to determine whether to perform authorized access after the identification, so that The simple access identification combined with the cloud computing data center pre-set access policy ensures cloud computing data center access without affecting the processing power of the cloud computing data center, and improves the core competitiveness of the product.

DRAWINGS

1 is a schematic flowchart of a cloud computing data center access management method according to Embodiment 1 of the present invention;

2 is a schematic flowchart of a cloud computing data center access management method according to Embodiment 2 of the present invention;

3 is a schematic structural diagram 1 of a packet data gateway according to Embodiment 3 of the present invention;

4 is a schematic structural diagram 2 of a packet data gateway according to Embodiment 3 of the present invention;

FIG. 5 is a schematic structural diagram 3 of a packet data gateway according to Embodiment 3 of the present invention; FIG.

FIG. 6 is a schematic structural diagram 4 of a packet data gateway according to Embodiment 3 of the present invention.

detailed description

The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

Embodiment 1

The cloud computing data center access management method of this embodiment, as shown in FIG. 1 , includes the following steps:

Step S101: The data center receives an access request of the terminal, and performs identity verification on the terminal.

In this step, the data center here refers to the cloud computing system, which is deployed in units of areas, and the same level of areas establishes the same level of data centers. In order to facilitate management, the same level of data center is established in the same level of area, and a central data center is also established to manage the following level of data center. The authentication of the terminal here should be understood as determining whether the subject and/or resource of the access request of the terminal has rights. The identity verification here should be understood as the overall identity verification of the entire cloud computing system, that is, once After authentication, access can be made in different levels of the entire cloud computing system, that is, in different domains, without multiple identifications, and the system is cumbersome to operate. That is to say, the authentication is a federation federation established between domains (data centers) in the entire cloud computing system. Specifically, the data center can authenticate the terminal by calling the attribute information in the data center attribute library, and the attribute information includes the identification information that is allowed to be accessed; comparing the attribute information with the identification information of the terminal, and if the same, the identity is verified. . That is, the data center queries whether the identity information is in the attribute library in the established attribute library. If it is verified, the attribute library should be understood as storing a large amount of identity information that allows access and data that allows access to the identity information. The attribute information sets different access data for people with different identity information. Of course, the attribute information in the attribute library can be specifically set in a specific situation. In this way, a simple identity information comparison can be used to determine whether the verification is passed, and the verification processing speed is accelerated. Of course, it is not limited to this method for identification, and other ways of being able to identify it can be achieved.

Step S102: After the identity verification, determine whether there is a target resource corresponding to the access request locally in the data center;

In this step, the target resource here refers to the subject or/and resource that the access request wants to access, where the subject refers to the specific location, and the resource here refers to the specifically accessed data. The data here includes data The center uses the external or internal application database as the data source. After the business data in the application database is processed through standardization and data cleaning, it is collected and updated into the data stored in the data center.

Step S103: If the target resource exists, the terminal performs authorized access according to the preset access policy of the data center.

In this step, the access policy refers to some access control conditions set by the data center according to itself. It should be understood that the access policy here is some access restriction conditions that the data center flexibly sets according to its specific situation, so that the terminal access is performed. After simple authentication, it is not allowed to directly access, and authorized access according to the access policy established in advance by the data center, so as to ensure the access security of the data center. Specifically, the access policy includes performing authorization access when the current running environment meets the preset condition and/or when the current access number meets the preset number of conditions. The operating environment here includes the physical environment of the data center itself, such as the temperature of the data center, etc., for example, when the temperature exceeds a certain threshold, access is not allowed, or the number of corresponding accesses is set according to different temperatures. The operating environment here also includes the data center's own attributes, such as the usage of the data center CPU. When the usage rate is high, the access can be denied, or the number of allowed accesses can be set according to the CPU usage rate. Of course, the access policy here may be a corresponding restriction condition set by the administrator according to specific management requirements, such as not allowing external access to certain specific data or requiring specific authorization to access. It should be understood that not only the above-mentioned access policy settings, but also other settings that ensure the access security of the data center should be included.

Specifically, in the foregoing step S102, when the target resource corresponding to the access request does not exist locally in the data center, the central data center establishes a session with the target data center where the target resource is located to perform authorized access. Specifically, the central data center establishes a session with the target data center where the target resource is located for authorized access, and the central data center can find the target data center where the target resource is located, establish a session with the target data center, and set a preset access policy of the target data center. Authorized access to the terminal. It is worth noting that the target data center here refers to the data center where the target resource corresponding to the storage access request is located. The central data center application here is understood to be information in which data center is stored for all resources in the cloud computing system.

Further, considering the logical complexity of the access control mechanism will affect the security performance of the cloud computing system, but for a data center whose average access volume is several times higher than that of the ordinary system, too complex access control will affect the access rate and weaken the data. The central processing power. In addition to ensuring the data processing capability of the data center, the security control of the data center is enhanced, and after the terminal is authorized to access, the security audit is also performed on the access. The security audit of the access security can generate an access log in the data center where the target resource is located, track the access information recorded by the access log, determine whether the access information meets the preset security audit policy, and process the non-compliant access. It should be understood that in which data center the resource corresponding to the access request is located, a log is generated in the data center, and a security audit is performed.

Embodiment 2

The cloud computing data center access management method according to the embodiment, in this example, in order to facilitate specific access Manage and pre-establish a data center architecture for hierarchical deployment and multi-level sharing. By deploying data center nodes in the unified authentication framework of hierarchical organizations, a cross-platform access control and audit policy model is established based on the analysis of different granularity and type operations of the data center, which has high security defense and intrusion identification capabilities. Specifically, the corresponding multi-level access control model (PBAC) consists of seven basic elements: domain, subject, resource, environment, operation, attribute and strategy, and strategy evaluation mechanism. The formal definition of PBAC is as follows: The policy-based multi-level access control model PBAC is a seven-tuple M={D, S, R, E, O, A, P}, where D is the set of domains, and S is the subject A collection, R is a collection of resources, E is a collection of environments, O is a collection of operations, A is a collection of attributes, and P is a collection of policies. On the basis of the formal model description of PBAC, a unified authentication framework with access control and resource access control as the main content is constructed. The method in this example is shown in Figure 2, including the following steps. :

Step S201: hierarchically establish an attribute library of each data center;

In this step, LDAP (Lightweight Directory Access Protocol) can be used to store attribute information in the PBAC model, using hierarchical cloud computing data consisting of a central data center and several local data centers. Center, where the local data center stores local attribute information, and the central data center stores all local attribute information, and implements dynamic update of the stored attribute information;

Step S202: Establish a unified identity trust;

In this step, the identity trust federation can be constructed based on the domain structure tree to form a cross-domain unified authentication system, and attributes are defined for the domain, the subject, the resource, the environment, and the operation in the domain, so that the terminal can be based on any one. The policy defined by the domain accesses the resources in the domain; that is, the access to the resources in the entire system can be accessed by one authentication;

Step S203: Perform an access authorization;

In this step, the distributed attribute authority centered on the establishment of the cross-domain trust federation and the attribute library and the policy library includes authentication for the authentication and the access policy, and the identity information is exchanged based on the attribute certificate CA. The user completes the single-point login between domains by means of intra-domain identity authentication, thereby implementing access control. By establishing an authorization framework based on the SAML standard and the XACML model, a certain intra-domain and inter-domain access policy evaluation mechanism is used to implement resources. Access control; that is, after passing the authentication, the access policy of the data center where the resource is located can be authenticated before authorized access can be performed to improve the security of the data center; specifically, under the hierarchical authentication and authorization system, the terminal The local attribute authority is used to complete the identity authentication. If the target resource is also local, the local access policy is used to complete the access authorization. If the target resource is not local, the domain where the resource is located can be obtained by querying the central data center to establish a session connection with the local Attribute access policy implementation visit Authorization;

Step S204: Perform security audit on authorized access.

In this step, the security audit trail not only helps the administrator to ensure that the data resources are protected from illegal authorization operations, but also helps with data recovery. Some audit systems can use the system's protective response to achieve more timely. Safe response. Specifically, security audits can be divided into audit trails, audit analysis, and response offices. In several stages, in the audit tracking phase, the audit system keeps track of the access behavior; the violation events are identified in the audit analysis stage, and the combination of manual analysis and automatic analysis can achieve the best results, while the automatic analysis requires pre-defined security audits. Policy; response processing is a system's protective measures, including invalidation of usage rights, invalidation of accounts, interruption of network connections, interruption of processes, etc. That is, the security audit determines whether the access information recorded in the log conforms to the access policy according to certain rules. Therefore, sufficient access information must be recorded in the access log. The audit policy needs to describe the access information items and the audit method. Specifically, in order to facilitate execution, a corresponding security audit model may be established, for example, an audit policy item is set, which is a triplet r=(I, p, C), where I is a set of access information items, and p is The access policy corresponding to the described operation, C is a collection of audit methods. The security audit policy model is a nine-tuple, M={D, S, R, E, O, A, P, L, R}, where D is a collection of domains, S is a collection of subjects, and R is a collection of resources. E is a collection of environments, O is a collection of operations, A is a collection of attributes, P is a collection of access policies, L is a collection of events to be audited, and R is a collection of audit policy items. The security audit is a triple, N=(l,R,Res), where l represents an event to be audited, R is a collection of audit rules, and Res is an audit decision, which is the result of determining whether the operation conforms to the access policy. Res∈{CONFORM,VIOLATE,NOTAPPLICATION}, where CONFORM indicates auditing, VIOLATE indicates non-compliant access, and NOTAPPLICATION indicates uncertainty. The process and results of the security audit are generated and stored in the audit log in the form of audit records. For the event whose audit result is VIOLATE, the detailed information of the violation access can be further restored, the nature of the violation is determined and processed in time; The NOTAPPLICATION event can be comprehensively analyzed by other means to obtain the final judgment result.

The target resource of the access request is not exemplified locally, and the terminal completes the identity authentication in the domain of the terminal access request; the session between the domain where the subject is located and the policy decision point of the domain where the target resource is located is established through the central data center node, according to the trust The federation trusts the principal credentials in the resource authority of the resource location authority; the entity accesses the resources and generates an access log in the domain where the target resource is located; and the security audit is performed by the audit authority of the domain where the target resource is located. By applying the access control and security audit functions provided by the system, the security and confidentiality of the entire system are greatly enhanced, and good economic benefits are created.

Embodiment 3

The embodiment provides a cloud computing data center. As shown in FIG. 3, the cloud computing data center includes an identity verification module, a resource searching module, and a policy verification module. The identity verification module is configured to receive an access request of the terminal, and perform identity on the terminal. The resource search module is configured to determine whether there is a target resource corresponding to the access request in the data center, and the policy verification module is configured to perform authorized access to the terminal according to the preset access policy of the data center if the target resource exists.

The embodiment provides a cloud computing data center. As shown in FIG. 4, the cloud computing data center further includes an external access module: the external access module is configured to use the central data when there is no target resource corresponding to the access request locally in the data center. The center establishes a session with the target data center where the target resource is located for authorized access.

This embodiment provides a cloud computing data center. As shown in FIG. 5, the cloud computing data center further includes a security auditing module. The security auditing module is configured to perform security auditing on the access after authorizing access to the terminal.

In order to facilitate management, the data center in this example can specifically establish a corresponding model, as shown in FIG. 6, including a resource directory system, a meta-database, a shared information base, an exchange information base, a statistical analysis database, an application server, and a data sharing exchange. platform. A large amount of data needs to establish a data warehouse, and a security audit library with audit function. The data center uses the external or internal application database as the data source. After the business data in the application database is processed through standardization and data cleaning, it is collected and updated into the data center storage. Resource Directory System: The data resources collected in the data center are classified according to the characteristics and types. Depending on the storage format, data resources can be divided into structured data, semi-structured data, and unstructured data. Structured data can be extracted from data centers by data centers, while semi-structured data and unstructured data are generally Stored locally, the stored information is recorded in the resource catalog of the data center. Metabase: Consists of metadata and data dictionaries. Metadata is data that describes the characteristics of data itself and transformation rules, including data structure definitions, dimension definitions, data extraction, and mapping rule definitions. It can support data center system management and maintenance of data. The data dictionary includes definitions and descriptions of data items, data streams, processing logic, external entities, classification codes, indicator systems, and the like. Shared information base: It stores the standardized data collected, extracted, cleaned and converted by the business application database and the lower-level shared information database in real time, and provides the data source for data exchange and sharing. The data of the shared database needs to be maintained regularly to ensure data consistency. Exchange information base: The user temporarily stores the exchange data of the heterogeneous database between the data centers and the data that is shared and exchanged between the internal and external databases for the security of the business database. Statistical analysis database: Analyze and analyze data according to a certain dimension, and provide support for statistical analysis and report production. The statistical analysis library is generally collected and updated periodically. Data Warehouse: Compared with operational databases, data warehouse provides online analysis and processing, data mining, decision support systems, online analysis, and intelligent query for processed data to support application decision analysis. The data warehouse is organized according to certain themes, and the storage capacity is generally large. Security Audit Library: The user stores the audit data of the database system. Data sharing exchange platform: used to provide data exchange services between different databases and different data formats. It consolidates separate data resources into a shared database. It mainly includes data exchange sharing function and ETL (Extraction Transformation Loading). The ETL system performs collection, cleaning, conversion, and comparison to solve the problem that information data between different information bases cannot be freely converted. Data exchange is the core of data integration in data centers. Data sharing is the data access and distribution based on data exchange. The data transfer between the shared information base and the business integration system is assisted by the shared exchange platform.

The cloud computing data center is configured to perform the cloud computing data center access management method described above. The cloud computing data center can be a cloud computer, a cloud server, or the like. The cloud computing data center can include at least one of a processing component, a memory, a power component, an input and output interface, and a communication component.

The processing component can perform all operations of implementing a cloud computing data center, such as data communications, logging operations, and the like. Processing components may include one or more processors for executing instructions to implement all or a portion of the steps above. Moreover, the processing component can include one or more modules that facilitate interaction between the processing component and other components.

The memory is configured to store various types of data to support operation of the cloud computing data center. Examples of such data include instructions, messages, etc. of any application or method running in a cloud computing data center. The memory can be implemented using any type of volatile or non-volatile memory device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Magnetic Memory, Flash Memory, Disk or Optical Disk.

Power components provide power to various components of the cloud computing data center.

The input/output interface provides an interface between the processing component and the peripheral interface module, and the peripheral interface module may be a keyboard, a click wheel, a button, or the like.

The communication component is configured to facilitate wired or wireless communication between the cloud computing data center and other devices.

One of ordinary skill in the art will appreciate that all or a portion of the above steps may be accomplished by a program that instructs the associated hardware, such as a read-only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the foregoing embodiment may be implemented in the form of hardware or in the form of a software function module. The invention is not limited to any specific form of combination of hardware and software.

The above embodiments are only intended to illustrate the technical solutions of the present invention and are not to be construed as limiting the invention. It should be understood by those skilled in the art that the present invention may be modified or equivalently substituted without departing from the spirit and scope of the invention.

Industrial applicability

The invention is applicable to the field of communication and is used for realizing secure access of a cloud computing data center.

Claims

A cloud computing data center access management method includes:

Receiving, by the data center, an access request of the terminal, and performing identity verification on the terminal;

After the authentication, determining whether the target resource corresponding to the access request exists locally in the data center;

If the target resource exists, the terminal is authorized to access according to a preset access policy of the data center.
The cloud computing data center access management method according to claim 1, wherein the data center authenticating the terminal comprises: invoking attribute information in the data center attribute library, the attribute information including allowing access The identification information is compared with the identification information of the terminal by the attribute information, and if the same, the identity is verified.
The cloud computing data center access management method according to claim 1, wherein the access policy comprises performing an authorized access when the current running environment satisfies a preset condition and the authorized access is performed when the current access number satisfies a preset number of conditions.
The cloud computing data center access management method according to claim 1, further comprising: when the data center does not have a target resource corresponding to the access request locally, through the central data center and the target data center where the target resource is located Establish a session for authorized access.
The cloud computing data center access management method according to claim 4, wherein the establishing a session by the central data center and the target data center where the target resource is located for authorizing access comprises: searching for the target through the central data center The target data center where the resource is located establishes a session with the target data center, and the pre-set access policy of the target data center performs authorized access to the terminal.
The cloud computing data center access management method according to any one of claims 1 to 5, further comprising: performing security auditing on the access after authorizing access to the terminal.
The cloud computing data center access management method according to claim 6, wherein the performing security auditing on the access comprises: generating an access log in a data center where the target resource is located, and tracking according to the access information recorded by the access log And determining whether the access information meets a preset security auditing policy, and processing the non-compliant access.
A cloud computing data center includes an authentication module, a resource finding module, and a policy verification module:

The identity verification module is configured to receive an access request of the terminal, and perform identity verification on the terminal;

The resource search module is configured to determine, by the identity verification, whether the target resource corresponding to the access request exists locally in the data center;

The policy verification module is configured to authorize access to the terminal according to a preset access policy of the data center if the target resource exists.
The cloud computing data center of claim 8, further comprising an external access module, wherein the external access module is configured to pass through the central area when the data center does not locally have the target resource corresponding to the access request The data center establishes a session with the target data center where the target resource is located for authorized access.
A cloud computing data center according to claim 8 or 9, further comprising a security auditing module, said security auditing module being arranged to perform a security audit of said access after authorizing access to said terminal.
[Correct according to Rule 26 29.03.2016]

A non-transitory computer readable storage medium comprising instructions executable by a processor in a cloud computing data center to perform a cloud computing data center access management method, comprising:

Receiving, by the data center, an access request of the terminal, and performing identity verification on the terminal;

After the authentication, determining whether the target resource corresponding to the access request exists locally in the data center;

If the target resource exists, the terminal is authorized to access according to a preset access policy of the data center.