WO2019052328A1 - 一种匿名账户的鉴权方法及服务器 - Google Patents

一种匿名账户的鉴权方法及服务器 Download PDF

Info

Publication number
WO2019052328A1
WO2019052328A1 PCT/CN2018/102189 CN2018102189W WO2019052328A1 WO 2019052328 A1 WO2019052328 A1 WO 2019052328A1 CN 2018102189 W CN2018102189 W CN 2018102189W WO 2019052328 A1 WO2019052328 A1 WO 2019052328A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
resource
anonymous account
version number
policy
Prior art date
Application number
PCT/CN2018/102189
Other languages
English (en)
French (fr)
Inventor
袁哲
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2019052328A1 publication Critical patent/WO2019052328A1/zh
Priority to US16/601,693 priority Critical patent/US11394748B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
    • H04L63/0421—Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general

Definitions

  • the application relates to the field of computer technology, and in particular to an account authentication technology.
  • the user needs to authenticate the account used by the user before the user operates the resource to prevent the user from illegally accessing and illegally operating the resource.
  • the anonymous account is used as a special account form for anonymous access to resources on the cloud platform.
  • the authentication policy of the anonymous account and the authentication policy of the ordinary account can be stored in a unified manner.
  • the authentication corresponding to the anonymous account can be found by traversing the stored authentication policy. Strategy and use this strategy for authentication.
  • the server needs to traverse the authentication policies of all resource owners, and in addition, due to the access volume of the anonymous accounts. Generally, it is relatively large. Therefore, the authentication operation of the anonymous account needs to consume a large amount of time and system resources, which increases the load of the overall authentication operation of the cloud platform, and reduces the efficiency of the authentication operation and system performance.
  • the embodiment of the present application provides an authentication method and a server for an anonymous account, which can reduce the time and system resources consumed by the authentication operation, reduce the load of the overall authentication operation of the cloud platform, improve the efficiency of the authentication operation, and improve the efficiency of the authentication operation and the cloud platform system. performance.
  • the first aspect of the present application provides an authentication method for an anonymous account, including:
  • the server receives an anonymous account authentication request; the anonymous account authentication request is used to request that the resource owner authenticates the use right of the resource through the anonymous account;
  • the first version number matches the second version number, obtaining a linear policy table, where the second version number is used to represent an identification number of a current version of the linear policy table, and the linear policy table includes the a correspondence between each resource content in the resource set and each rights information in the permission set;
  • the authentication policy set is used for authentication, where the authentication policy set includes at least one authentication policy, where the authentication policy is a correspondence between resource content and rights information.
  • a second aspect of the embodiments of the present application provides a server, including a memory and a processor
  • the memory is used to store a program
  • the processor is configured to invoke a program in the memory, and perform the following steps:
  • the anonymous account authentication request is used to request that the resource owner authenticates the use right of the resource through the anonymous account;
  • the table contains the correspondence between the resource collection and the permission collection;
  • the linear policy table includes a correspondence between each resource content in the resource set and each rights information in the permission set;
  • the authentication policy set includes at least one authentication policy, where the authentication policy is a correspondence between resource content and rights information. relationship.
  • a third aspect of embodiments of the present application provides a computer readable storage medium having instructions stored therein that, when executed on a computer, cause the computer to perform the methods described in the above aspects.
  • a fourth aspect of the present application provides a computer program product comprising instructions which, when run on a computer, cause the computer to perform the methods described in the various aspects above.
  • the embodiments of the present application have the following advantages:
  • an authentication method for an anonymous account where the server first receives an anonymous account authentication request, and the anonymous account authentication request is used to request the resource owner to use the anonymous account to check the use rights of the resource. And then obtaining the first version number of the resource owner according to the anonymous account authentication request, where the first version number is used to indicate the identification number of the current version of the authentication policy table, and the authentication policy table includes the resource set and the permission set. If the first version number matches the second version number, the linear policy table is obtained, the second version number is used to represent the identification number of the current version of the linear policy table, and the linear policy table includes each resource in the resource set. The correspondence between each authority in the permission set.
  • the server may obtain the resource association authentication policy set from the linear policy table to use the authentication policy set for authentication.
  • the authentication result can be determined by traversing the authentication policy associated with the resource owner and the anonymous account, and the traversed content does not include the authentication policies of other resource owners, thereby reducing the authentication policy.
  • the time consumed by the authentication operation and the system resources reduce the load of the overall authentication operation of the cloud platform, and improve the efficiency of the authentication operation and the performance of the cloud platform system.
  • 1 is a schematic diagram of authentication logic in an embodiment of the present application.
  • FIG. 2 is a schematic diagram of an anonymous account authentication policy in an embodiment of the present application.
  • FIG. 3 is a schematic diagram of an embodiment of an authentication method for an anonymous account in an embodiment of the present application
  • FIG. 4 is a schematic diagram of an embodiment of an update authentication policy table in an embodiment of the present application.
  • FIG. 5 is a schematic diagram of an embodiment of updating a linear policy table in an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a server in an embodiment of the present application.
  • the embodiment of the present application provides an authentication method and a server for an anonymous account, which can reduce the time and system resources consumed by the authentication operation, reduce the load of the overall authentication operation of the cloud platform, improve the efficiency of the authentication operation, and improve the efficiency of the authentication operation and the cloud platform system. performance.
  • FIG. 1 is a schematic diagram of the authentication logic in the embodiment of the present application, for an anonymous account authentication policy and a general account authentication policy. Independent storage, in the authentication, it is necessary to simultaneously read the anonymous account authentication policy and the traditional ordinary account authentication policy related to the current operation context, and finally determine whether the authentication is passed.
  • the current operation context generally refers to the time when the cloud service is started and the usage scenario of the cloud service.
  • FIG. 2 is a schematic diagram of an anonymous account authentication policy according to an embodiment of the present application, as shown in FIG. 2
  • the entire authentication system includes an anonymous user authentication logic service, an anonymous user policy storage layer, and an anonymous user-related policy version control.
  • the authentication logic layer includes an anonymous policy authentication module, which is used to complete the actual authentication operation, and receives the authentication request, obtains the user, resource, and operation information in the authentication request, and obtains an authorization policy database corresponding to the service.
  • the policy related to reading and requesting is analyzed and calculated, and finally the user is notified of the authentication result, wherein the policy here refers to the policy of the anonymous account.
  • the anonymous user policy storage layer mainly includes an anonymous user cache table, an anonymous user linear table, an anonymous user policy table and a version, and the anonymous user cache table is used to directly cache the final authentication result.
  • the anonymous user linear table is used to record the relationship table between the resource collection and the permission collection.
  • the anonymous user policy table is used to store traditional authentication policies.
  • the version is the version management table related to linear table update and authentication.
  • the keyword of the version is the identifier of the resource owner, and the version content is the timestamp of the last change of the related policy of the anonymous user and a resource owner.
  • Version control is the core and master of the entire system. It expands the linear strategy in terms of account granularity and records the version of the policy set. When the policy information under any account is updated, the policy table version number of the account is updated. When the version number changes, the version control system needs to re-update the linear table.
  • an embodiment of the method for authenticating an anonymous account in the embodiment of the present application includes:
  • the server receives an anonymous account authentication request sent by the user, where the anonymous account authentication request is usually initiated by the cloud service platform, and the anonymous account authentication request is used to request an anonymous account for the resource owner.
  • the right to use the resource is authenticated.
  • An anonymous account is a special account on the cloud service platform, and cloud service users can have access to anonymous accounts.
  • the resource owner can grant the user permission to use one or some resources, thereby controlling the user's access rights to the resources, including which users can access the resources, and how they access the resources.
  • the server first obtains the first version number of the resource owner according to the anonymous account authentication request.
  • the first version number is an identification number used to represent the current version of the authentication policy table, and the authentication policy table.
  • Table 1 is an illustration of the authentication policy table.
  • Table 1 is only a schematic diagram. In actual applications, there are other association manners between the resource collection and the permission set, which is not limited herein.
  • the authentication policy table corresponding to each resource owner has a first version number.
  • the first version number matches the second version number, obtain a linear policy table, where the second version number is used to represent an identification number of a current version of the linear policy table, and the linear policy table includes each resource content in the resource set.
  • the resource owner further corresponds to a linear policy table, where the linear policy table has a second version number, and the linear policy table includes each resource content in the resource set and each permission information in the permission set.
  • the correspondence between the linear strategy table is mainly used to record the resource content, the authority information, and the root account to which the resource belongs. See Table 2, which is an illustration of the linear strategy table.
  • Table 2 is only a schematic diagram. In actual applications, there are other association manners between the resource content and the authority information, which is not limited herein.
  • the linear policy table corresponding to each resource owner has a second version number.
  • the correspondence relationship included in the linear policy table may be a one-to-one correspondence between a resource content and a rights information, or may be a correspondence between multiple resource contents and multiple rights information.
  • the linear strategy table has the same content as the authentication policy table, but the expression form is different.
  • the linear strategy table is the expanded content of the authentication policy table, that is, the linear strategy represents a one-dimensional linear strategy in which the resource owner is expanded.
  • the anonymous account authentication request is a d resource
  • the authority information related to the d resource is directly extracted from the linear policy table to form an authentication.
  • a set of policies, and these permission information are related to an anonymous account that initiates an anonymous account authentication request. See Table 3, which is an illustration of the linear strategy table.
  • the table 3 is only a schematic diagram.
  • the authentication policy set is generated according to the linear policy table, which is not limited herein.
  • the authentication policy set includes at least one authentication policy.
  • the weight policy is the correspondence between resource content and authority information.
  • the 105 Perform authentication by using an authentication policy set, where the authentication policy set includes at least one authentication policy, where the authentication policy is a correspondence between the resource content and the rights information.
  • the server uses the authentication policy set similar to Table 3 to perform authentication. For example, if the anonymous account request reads the resource content d of the resource owner A, the server obtains the authentication policy corresponding to the resource content d. After the collection, the permission information of the resource content d of the resource owner A is determined to be allowed to be read and allowed to be written, thereby authenticating the usage right of the read operation of the anonymous account request, and determining that the anonymous account can read the resource ownership Party A's resource content d.
  • the authentication policy set includes at least one authentication policy, where the authentication policy is used to indicate the correspondence between the resource content and the rights information. It can be understood that the authentication policy may be part of the information in the linear policy table.
  • the linear strategy table can contain 100 authentication policies.
  • an authentication method for an anonymous account where the server first receives an anonymous account authentication request, and the anonymous account authentication request is used to request the resource owner to use the resource through the anonymous account. Authentication, and then obtaining a first version number of the resource owner according to the anonymous account authentication request, where the first version number is used to indicate an identification number of a current version of the authentication policy table, and the authentication policy table includes a resource set and a permission set. Corresponding relationship, if the first version number matches the second version number, the linear strategy table is obtained, the second version number is used to represent the identification number of the current version of the linear policy table, and the linear policy table includes each resource in the resource set.
  • the server may obtain the resource association authentication policy set from the linear policy table to use the authentication policy set for authentication.
  • the authentication result can be determined by traversing the authentication policy associated with the resource owner and the anonymous account, and the traversed content does not include the authentication policies of other resource owners, thereby reducing the authentication policy.
  • the time consumed by the authentication operation and the system resources reduce the load of the overall authentication operation of the cloud platform, and improve the efficiency of the authentication operation and the performance of the cloud platform system.
  • the method for authenticating an anonymous account provided by the embodiment of the present application may further include: after obtaining the first version number of the resource owner according to the anonymous account authentication request, :
  • the authentication policy table is used for authentication.
  • the server uses the authentication policy table to authenticate the anonymous account.
  • the matching between the first version number and the second version number may mean that the version numbers of the two versions are the same, or the version numbers of the two versions may satisfy the preset association relationship. If the first version number and the second version number do not match, the authentication policy table is used for authentication.
  • the server first finds the resource set related to the resource owner A from the authentication policy table, and takes the table 1 as an example to obtain the resource set a, b, c and d, then parsing the resource content d from the resource collection, and then parsing the permission set, and obtaining the permission content of the resource content d is “allow reading and allowing writing”, thereby determining the resource of the resource owner A by the anonymous account request. Whether the operation performed by the content conforms to the content of the permission corresponding to the resource d, and thus the authentication is implemented.
  • the authentication policy table needs to be obtained to authenticate the anonymous account by using the authentication policy table.
  • the traditional authentication policy table may be preferentially used for authentication.
  • the policy table may be filtered according to actual conditions, thereby improving the flexibility of authentication.
  • the authentication policy table is usually a policy table that is updated preferentially, and the linear policy table is a policy table that is updated according to the authentication policy table. Therefore, if the version numbers of the two are not matched, the update is selected first. After the authentication policy table, to improve the practicality of the program.
  • the method for authenticating an anonymous account may further include:
  • the authentication policy table is updated.
  • the authentication policy table may be updated.
  • FIG. 4 is a schematic diagram of an embodiment of an update authentication policy table according to an embodiment of the present application.
  • a resource owner is assumed to be a resource owner A.
  • the server first detects whether the resource set and/or the permission set change, that is, whether the content of the authentication policy related to the resource owner A and the anonymous account is changed.
  • the server needs to detect whether the permission set is changed, as long as it has As soon as the change occurs, the corresponding authentication policy needs to be updated, and the updated version also includes the identification number of the current version of the authentication policy table, that is, the first version number is updated.
  • the process of updating the authentication policy table is introduced, that is, the server needs to detect whether the resource set and/or the permission set change, and if the resource set and/or the permission set change, the update is updated. Rights policy table.
  • the server can obtain the information related to the authentication policy in time to update the authentication policy in real time, thereby improving the practicability and feasibility of the solution, and improving the reliability of the anonymous account authentication.
  • detecting whether the resource set and/or the permission set change may include:
  • the server may use three types of rules to determine whether the resource set and/or the permission set have changed.
  • the first type is for the server to detect whether the content of the resource in the resource set changes, wherein the resource content is used to represent the resource provided by the resource owner. Assuming that the resource owner a corresponds to the resource content a, and then the resource content a is changed to "resource content x", it can be considered that the resource collection has changed.
  • the second type is that the server detects whether the permission information in the permission set changes, wherein the permission information is used to indicate the usage rights of the resource content. Assume that the resource content a corresponding to the resource owner A has the permission information "Allow read and allow write”, and then the permission information is changed to "Allow read and write not allowed", which can be considered as a permission set. Change.
  • the third type is whether the server detects whether the correspondence between each resource content in the resource set and each rights information in the permission set changes. For example, the resource content a corresponding to the resource owner A, the permission information is “allow read and allow writing”, and the subsequent change is the resource content b corresponding to the resource owner A, and the permission information is “not allowed to read and allowed Write”, this can be considered as the correspondence between the resource collection and the permission set has changed.
  • three conditions for determining the need to update the authentication policy table are respectively introduced, that is, whether the resource content in the resource set is changed, whether the permission information in the permission set changes, and detection is detected. Whether the correspondence between each resource content in the resource set and each of the rights information in the permission set changes.
  • the method may further include:
  • the linear policy table is updated according to the updated authentication policy table.
  • the linear policy table needs to be updated according to the updated authentication policy table.
  • Policy management includes two parts: the update of the authentication policy table and the update of the linear policy table. Since all the policies here are related to anonymous accounts, for fine-grained version management, all policies are subdivided by resource owners, and a version is defined for each resource owner's policy related to anonymous accounts, as long as Any policy related to the owner of the resource changes and the corresponding version is updated.
  • FIG. 5 is a schematic diagram of an embodiment of updating a linear policy table according to an embodiment of the present application.
  • the organization structure of the linear table is (sub-account, account, application programming interface, resources, and permissions).
  • the authentication will be very intuitive.
  • For the authentication request of the anonymous account first check the version number corresponding to the resource owner in the authentication request. If the identification number of the current version of the authentication policy table does not match the identification number of the current version of the linear policy table, it indicates that the authentication policy of the recent anonymous account of the resource owner is updated. For services with very high timeliness requirements, look in the traditional authentication policy table. Otherwise, search for the linear strategy table directly.
  • the server can further optimize the version number check, and the authentication service registers the version change message. If the version changes, all the authentication services are notified, and the authentication service reads the original policy table for authentication before the policy completes the linear table update.
  • the version control process verifies the consistency of the linear policy table and the authentication policy table version at very short intervals. If they are inconsistent, the linear table is updated. After the update is completed, the linear policy table and authentication of the same anonymous account are performed. The identification number of the current version of the policy table is consistent.
  • the linear policy table may be updated according to the updated authentication policy table.
  • the authentication policy table and the linear policy table do not match, it indicates that the resource owner's recent anonymous user policy has been updated, so the authentication policy table needs to be updated first, and then the linear policy table is updated to ensure The synchronization of the two policy tables improves the reliability of the authentication, and for the services with very high timeliness, the traditional authentication policy table is searched to ensure the real-time authentication.
  • the obtaining the first version number of the resource owner according to the anonymous account authentication request may include:
  • the first version number is obtained from the version management table based on the anonymous account and the resource owner of the anonymous account request.
  • the obtaining, by the server, the first version number of the resource owner may include the following steps. First, the server determines the corresponding anonymous account according to the received anonymous account authentication request, and then requests the anonymous account and the anonymous account. The resource owner reads the first version number of the authentication policy table from the version management table already stored in the server.
  • the version management table stored in the server includes a first version number corresponding to the authentication policy table and a second version number corresponding to the linear policy table.
  • the policy table is updated, the corresponding version number is also updated, and the version management table is updated. You can erase the version number of the original version, or you can keep the version number of the original version, which is not limited here.
  • the process of obtaining the first version number of the resource owner by the server may be: first determining an anonymous account according to the anonymous account authentication request, and then requesting the resource owner according to the anonymous account and the anonymous account, from the version Get the first version number in the management table.
  • the server accurately obtains the first version number corresponding to the resource owner is described, thereby improving the feasibility and operability of the solution.
  • the authentication policy set associated with the anonymous account is obtained from the linear policy table to adopt the authentication.
  • the policy set may also include:
  • the target authentication result is stored in a cache table, wherein the cache table is used to store a plurality of authentication results.
  • the target authentication result corresponding to the anonymous account may be further obtained, and then the target authentication result is stored in the cache table, and the cache table is stored.
  • the resource content d of the resource owner A is allowed to read and is allowed to be written.
  • the resource content of resource owner A is allowed to read and is not allowed to be written.
  • the resource content a of the resource owner D is allowed to be read and not allowed to be written.
  • the resource content a of the resource owner C is not allowed to read and is allowed to be written.
  • the resource content d of the resource owner B is allowed to be read and allowed to be written
  • the table 4 is only a schematic diagram. In the actual application, the cache table cache table stores multiple authentication results, which is not limited herein.
  • the server obtains the resource association authentication policy set from the linear policy table, and uses the authentication policy set to authenticate the use rights of the resource requested by the anonymous account, and further obtains the anonymous account.
  • Corresponding target authentication results the target authentication result is stored in the cache table, and the cache table can store multiple authentication results.
  • the server does not need to perform the same operation again, but directly retrieves the corresponding target authentication result from the cache table, thereby improving the authentication. Speed and help improve authentication performance.
  • User A logs in to the cloud service platform and hopes to download the learning materials he needs on the platform.
  • User A first logs in to the cloud service platform with an anonymous account.
  • the cloud service platform obtains the identification number of the current version of the authentication policy table from the background according to the anonymous account authentication request of user A, that is, version v1.0.11, and then the cloud service platform continues to search.
  • the identification number of the current version of the linear policy table is also version v1.0.11. Therefore, the identification number of the current version of the authentication policy table is matched with the identification number of the current version of the linear policy table. Extract information from a linear strategy table.
  • the resource owner requested by user A is first found. If the resource owner is X, the resource provided by resource owner X is found in the linear policy table, including resource 1, resource 2, and resource 3. User A The actual learning data required is resource 2. Therefore, the resource owner is X, and the resource is the resource information of resource 2, and if the permission information is "readable and unwritable", the permission information is Corresponding to the download (ie, read) operation permission requested by user A, user A can download the data from the cloud service platform.
  • FIG. 6 is a schematic structural diagram of a server according to an embodiment of the present application.
  • the server 300 may generate a large difference due to different configurations or performances, and may include one or More than one central processing unit (CPU) 322 (eg, one or more processors) and memory 332, one or more storage media 330 storing application 342 or data 344 (eg, one or one storage in Shanghai) device).
  • the memory 332 and the storage medium 330 may be short-term storage or persistent storage.
  • the program stored on storage medium 330 may include one or more modules (not shown), each of which may include a series of instruction operations in the server.
  • the central processor 322 can be configured to communicate with the storage medium 330 to perform a series of instruction operations in the storage medium 330 on the server 300.
  • the memory 332 and the CPU 322 can be connected and communicated through a bus system.
  • Server 300 may also include one or more power sources 326, one or more wired or wireless network interfaces 350, one or more input and output interfaces 358, and/or one or more operating systems 341, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM and more.
  • the steps performed by the server in the above embodiment may be implemented based on the server structure shown in FIG. 6.
  • the CPU 322 is configured to perform the following steps:
  • the anonymous account authentication request is used to request that the resource owner authenticates the use right of the resource through the anonymous account;
  • the first version number matches the second version number, obtaining a linear policy table, where the second version number is used to represent an identification number of a current version of the linear policy table, and the linear policy table includes the a correspondence between each resource content in the resource set and each rights information in the permission set;
  • the authentication policy set is used for authentication, where the authentication policy set includes at least one authentication policy, where the authentication policy is a correspondence between resource content and rights information.
  • the CPU 322 is further configured to perform the following steps:
  • the authentication policy table is used for authentication.
  • the CPU 322 is further configured to perform the following steps:
  • the authentication policy table is updated.
  • the CPU 322 when performing the step of detecting whether the resource set and/or the permission set change, is specifically configured to perform the following steps:
  • the CPU 322 is further configured to perform the following steps:
  • the CPU 322 is configured to perform the following steps when performing the step of acquiring the first version number of the resource owner according to the anonymous account authentication request:
  • the CPU 322 is configured to perform the following steps after performing the step of obtaining the authentication policy set associated with the anonymous account from the linear policy table to perform authentication by using the authentication policy set. :
  • the target authentication result is stored in a cache table, wherein the cache table is used to store a plurality of authentication results.
  • the embodiment of the present application further provides a storage medium for storing program code, which is used to execute any one of the authentication methods of an anonymous account described in each of the foregoing embodiments.
  • the embodiment of the present application further provides a computer program product comprising instructions, when executed on a computer, causing the computer to perform any one of the authentication methods of an anonymous account described in the foregoing various embodiments.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • a computer readable storage medium A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. .

Abstract

本申请实施例公开了一种匿名账户鉴权方法，应用于服务器，包括：接收匿名账户鉴权请求；根据匿名账户鉴权请求获取资源拥有方的第一版本号，第一版本号表示鉴权策略表当前版本的标识号，鉴权策略表包含资源集合与权限集合之间的对应关系；若第一版本号与第二版本号匹配，则获取线性策略表，第二版本号表示线性策略表当前版本的标识号，线性策略表包含资源集合中每个资源内容与权限集合中每个权限信息之间的对应关系；从线性策略表中获取资源关联的鉴权策略集合；采用鉴权策略集合进行鉴权。本申请在进行匿名账户鉴权时，通过遍历资源拥有方与匿名账户相关的鉴权策略即可实现鉴权，减少了鉴权操作消耗的时间和系统资源。

Description

一种匿名账户的鉴权方法及服务器
本申请要求于2017年9月13日提交中国专利局、申请号2017108234932、发明名称为“一种匿名账户的鉴权方法及服务器”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，尤其涉及账户鉴权技术。
背景技术
现如今，云服务正在快速的发展且被广泛的应用。为了保护云平台上存储的资源，用户在对资源进行操作之前，服务器需要先对用户使用的账户进行鉴权，以防止用户对该资源进行非法访问和非法操作。其中，匿名账户作为一种特殊的账户形式，可用于匿名访问云平台上的资源。
通常情况下，可以将匿名账户的鉴权策略与普通账户的鉴权策略进行统一存储，当用户采用匿名账户进行访问时，通过遍历已存储的鉴权策略可以找出匿名账户所对应的鉴权策略，并采用该策略进行鉴权。
然而，云平台上存储有大量资源，根据匿名账户的不同将生成大量不同的鉴权策略，在进行鉴权操作时服务器需要遍历所有资源拥有方的鉴权策略，此外，由于匿名账户的访问量通常较大，因此，将导致匿名账户的鉴权操作需要消耗大量的时间和系统资源，增加了云平台整体鉴权操作的负载，降低了鉴权操作的效率和系统性能。
发明内容
本申请实施例提供了一种匿名账户的鉴权方法及服务器，可以减少鉴权操作消耗的时间和系统资源，降低云平台整体鉴权操作的负载，提升鉴权操作的效率和云平台系统的性能。
有鉴于此，本申请第一方面提供了一种匿名账户的鉴权方法，包括：
服务器接收匿名账户鉴权请求；所述匿名账户鉴权请求用于请求针对资源拥有方通过匿名账户对资源的使用权限进行鉴权；
根据所述匿名账户鉴权请求获取资源拥有方的第一版本号，其中，所述第一版本号用于表示鉴权策略表当前版本的标识号，所述鉴权策略表包含资源集合与权限集合之间的对应关系；
若所述第一版本号与第二版本号匹配，则获取线性策略表，其中，所述第二版本号用于表示所述线性策略表当前版本的标识号，所述线性策略表包含所述资源集合中每个资源内容与所述权限集合中每个权限信息之间的对应关系；
从所述线性策略表中获取所述资源关联的鉴权策略集合；
采用所述鉴权策略集合进行鉴权，其中，所述鉴权策略集合中包含至少一条鉴权策略，所述鉴权策略为资源内容与权限信息之间的对应关系。
本申请实施例第二方面提供了一种服务器，包括存储器和处理器；
其中，所述存储器用于存储程序；
所述处理器用于调用所述存储器中的程序，执行以下步骤：
接收匿名账户鉴权请求；所述匿名账户鉴权请求用于请求针对资源拥有方通过匿名账户对资源的使用权限进行鉴权；
根据所述接收模块接收的所述匿名账户鉴权请求获取资源拥有方的第一版本号，其中，所述第一版本号用于表示鉴权策略表当前版本的标识号，所述鉴权策略表包含资源集合与权限集合之间的对应关系；
若所述第一获取模块获取的所述第一版本号与第二版本号匹配，则获取线性策略表，其中，所述第二版本号用于表示所述线性策略表当前版本的标识号，所述线性策略表包含所述资源集合中每个资源内容与所述权限集合中每个权限信息之间的对应关系；
从所述第二获取模块获取的所述线性策略表中获取所述资源关联的鉴权策略集合；
采用所述第三获取模块获取的所述鉴权策略集合进行鉴权，其中，所述鉴权策略集合中包含至少一条鉴权策略，所述鉴权策略为资源内容与权限信息之间的对应关系。
本申请实施例第三方面提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
本申请第四方面提供了一种包括指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
从以上技术方案可以看出，本申请实施例具有以下优点：
本申请实施例中，提供了一种匿名账户的鉴权方法，主要为服务器先接收匿名账户鉴权请求，该匿名账户鉴权请求用于请求资源拥有方通过匿名账户对资源的使用权限进行鉴权，然后根据该匿名账户鉴权请求获取资源拥有方的第一版本号，其中，第一版本号用于表示鉴权策略表当前版本的标识号，鉴权策略表包含资源集合与权限集合之间的对应关系，若第一版本号与第二版本号匹配，则获取线性策略表，第二版本号用于表示线性策略表当前版本的标识号，线性策略表包含资源集合中每个资源与权限集合中每个权限之间的对应关系，最后服务器可以从线性策略表中获取资源关联的鉴权策略集合，以采用鉴权策略集合进行鉴权。通过上述方式，在进行匿名账户鉴权操作时，通过遍历资源拥有方与匿名账户相关的鉴权策略即可确定鉴权结果，遍历的内容不包括其他资源拥有方的鉴权策略，从而减少了鉴权操作消耗的时间和系统资源，降低了云平台整体鉴权操作的负载，提升了鉴权操作的效率和云 平台系统的性能。
附图说明
图1为本申请实施例中鉴权逻辑的一个示意图；
图2为本申请实施例中匿名账户鉴权策略的一个示意图；
图3为本申请实施例中匿名账户的鉴权方法一个实施例示意图；
图4为本申请实施例中更新鉴权策略表的一个实施例示意图；
图5为本申请实施例中更新线性策略表的一个实施例示意图；
图6为本申请实施例中服务器一个结构示意图。
具体实施方式
本申请实施例提供了一种匿名账户的鉴权方法及服务器，可以减少鉴权操作消耗的时间和系统资源，降低云平台整体鉴权操作的负载，提升鉴权操作的效率和云平台系统的性能。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本申请的实施例例如能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
应理解，本申请主要用于支持匿名账号云服务的鉴权，请参阅图1，图1为本申请实施例中鉴权逻辑的一个示意图，对于匿名账号鉴权策略和普通账号鉴权策略进行独立存储，在鉴权时，需要同时读取和当前操作上下文相关的匿名账号鉴权策略和传统的普通账号鉴权策略，最后决定鉴权是否通过。其中，当前操作上下文通常是指开启云服务的时间和云服务的使用场景等。
在对匿名账户所请求的资源的使用权限进行鉴权时，需要采用与匿名账户相关的框架，请参阅图2，图2为本申请实施例中匿名账户鉴权策略的一个示意图，如图2所示，整个鉴权系统包括匿名用户鉴权逻辑服务、匿名用户策略存储层以及匿名用户相关策略版本控制三部分组成。
鉴权逻辑层包括了匿名策略鉴权模块，该模块用于完成实际的鉴权操作，它接收鉴权请求，获取鉴权请求中的用户、资源和操作信息，并从业务对应的授权策略数据库中读取和请求相关的策略，再进行分析和计算，最后通知用户鉴权结果，其中，这里的策略是指匿名账户的策略。
匿名用户策略存储层主要包括匿名用户缓存表、匿名用户线性表、匿名用户策略表和版本，匿名用户缓存表用于直接缓存最终的鉴权结果。匿名用 户线性表用于记录资源集合与权限集合展开后的关系表。匿名用户策略表用于存储传统的鉴权策略。版本即为线性表更新和鉴权相关的版本管理表，版本的关键字为资源拥有者的标识，版本内容是匿名用户和某个资源拥有者相关策略的最后一次变更的时间戳。
版本控制是整个系统的核心和主控，它以账户粒度为单位去展开线性策略，并记录该策略集合的版本。当任何账户下的策略信息更新，都会更新该账户的策略表版本号，当版本号发生变化时，版本控制系统就需要重新去更新线性表。
下面将从服务器的角度，对本申请中匿名账户的鉴权方法进行介绍，请参阅图3，本申请实施例中匿名账户的鉴权方法一个实施例包括：
101、接收匿名账户鉴权请求；
本实施例中，服务器接收用户发送的匿名账户鉴权请求，其中，该匿名账户鉴权请求通常用户是通过云服务平台发起的，该匿名账户鉴权请求用于请求针对资源拥有方通过匿名账户对资源的使用权限进行鉴权。
匿名账户是云服务平台上的一种特殊的账户，云服务用户可拥有使用匿名账户的权限。鉴权通过后，资源拥有方可以授予用户对某个或某些资源的使用权限，以此控制用户对资源的使用权限，包括哪些用户可以访问资源，以及他们访问资源的方式等。
102、根据匿名账户鉴权请求获取资源拥有方的第一版本号，其中，第一版本号用于表示鉴权策略表当前版本的标识号，鉴权策略表包含资源集合与权限集合之间的对应关系；
本实施例中，服务器根据匿名账户鉴权请求，先获取资源拥有方的第一版本号，具体地，该第一版本号是用于表示鉴权策略表当前版本的标识号，鉴权策略表包含资源集合与权限集合之间的对应关系，请参阅表1，表1为鉴权策略表的一个示意。
表1
资源拥有方 资源集合 权限集合
A a、b、c和d 允许读取且允许写入
B a、c和d 允许读取且不允许写入
C c和d 允许读取且允许写入
D b、c和d 允许读取且不允许写入
需要说明的是，表1仅为一个示意，在实际应用中，资源集合与权限集合之间还存在其他的关联方式，此处不做限定。对于每个资源拥有方所对应的鉴权策略表都具有一个第一版本号。
103、若第一版本号与第二版本号匹配，则获取线性策略表，其中，第二版本号用于表示线性策略表当前版本的标识号，线性策略表包含资源集合中每个资源内容与权限集合中每个权限信息之间的对应关系；
本实施例中，相应地，资源拥有方还对应于一张线性策略表，该线性策略表具有第二版本号，线性策略表包含资源集合中每个资源内容与权限集合中每个权限信息之间的对应关系，线性策略表主要用于记录资源内容、权限信息以及资源所属的根账户等。请参阅表2，表2为线性策略表的一个示意。
表2
资源拥有方 资源内容 权限信息
A a 允许读取且允许写入
A b 允许读取且允许写入
A c 允许读取且允许写入
A d 允许读取且允许写入
B a 允许读取且不允许写入
B c 允许读取且不允许写入
B d 允许读取且不允许写入
C c 允许读取且允许写入
C d 允许读取且允许写入
D b 允许读取且不允许写入
D c 允许读取且不允许写入
D d 允许读取且不允许写入
需要说明的是，表2仅为一个示意，在实际应用中，资源内容与权限信息之间还存在其他的关联方式，此处不做限定。对于每个资源拥有方所对应的线性策略表都具有一个第二版本号。
线性策略表所包含的对应关系可以是，一个资源内容与一个权限信息之间一一对应的关系，也可以是多个资源内容与多个权限信息之间的对应关系。
线性策略表与鉴权策略表中具有相同的内容，但是表达形式不同，线性策略表是鉴权策略表展开后的内容，即线性策略表示意资源拥有方为单位展开的一维线性策略。
104、从线性策略表中获取所述资源关联的鉴权策略集合；
本实施例中，在第一版本号与第二版本号匹配的前提下，假设匿名账户鉴权请求的是d资源，则直接从线性策略表中提取与d资源相关的权限信息，组成鉴权策略集合，且这些权限信息均与发起匿名账户鉴权请求的匿名账户相关。请参阅表3，表3为线性策略表的一个示意。
表3
资源拥有方 资源内容 权限信息
A d 允许读取且允许写入
B d 允许读取且不允许写入
C d 允许读取且允许写入
D d 允许读取且不允许写入
需要说明的是，表3仅为一个示意，在实际应用中，鉴权策略集合是根据线性策略表生成的，此处不做限定，其中，鉴权策略集合中包含至少一条鉴权策略，鉴权策略为资源内容与权限信息之间的对应关系。
105、采用鉴权策略集合进行鉴权，其中，鉴权策略集合中包含至少一条鉴权策略，鉴权策略为资源内容与权限信息之间的对应关系。
本实施例中，服务器采用类似表3的鉴权策略集合进行鉴权，比如，匿名账户请求对资源拥有方A的资源内容d进行读取操作，则服务器获取到资源内容d对应的鉴权策略集合后，确定资源拥有方A的资源内容d的权限信息为允许读取且允许写入，据此对匿名账户请求的读取操作的使用权限进行鉴权，确定该匿名账户可以读取资源拥有方A的资源内容d。
其中，鉴权策略集合中包含了至少一条鉴权策略，该鉴权策略用于指示资源内容与权限信息之间的对应关系，可以理解的是，鉴权策略可以是线性策略表中的一部分信息，比如，线性策略表可以中包含100条鉴权策略。
本申请实施例中，提供了一种匿名账户的鉴权方法，主要为服务器先接收匿名账户鉴权请求，该匿名账户鉴权请求用于请求针对资源拥有方通过匿名账户对资源的使用权限进行鉴权，然后根据该匿名账户鉴权请求获取资源拥有方的第一版本号，其中，第一版本号用于表示鉴权策略表当前版本的标识号，鉴权策略表包含资源集合与权限集合之间的对应关系，若第一版本号与第二版本号匹配，则获取线性策略表，第二版本号用于表示线性策略表当前版本的标识号，线性策略表包含资源集合中每个资源与权限集合中每个权限之间的对应关系，最后服务器可以从线性策略表中获取资源关联的鉴权策略集合，以采用鉴权策略集合进行鉴权。通过上述方式，在进行匿名账户鉴权操作时，通过遍历资源拥有方与匿名账户相关的鉴权策略即可确定鉴权结果，遍历的内容不包括其他资源拥有方的鉴权策略，从而减少了鉴权操作消耗的时间和系统资源，降低了云平台整体鉴权操作的负载，提升了鉴权操作的效率和云平台系统的性能。
可选地，在上述图3对应的实施例的基础上，本申请实施例提供的匿名账户的鉴权方法中，根据匿名账户鉴权请求获取资源拥有方的第一版本号之后，还可以包括：
若第一版本号与第二版本号不匹配，则采用鉴权策略表进行鉴权。
本实施例中，如果鉴权策略表的第一版本号与线性策略表的第二版本号不匹配，那么服务器将采用鉴权策略表对匿名账户进行鉴权，
具体地，第一版本号与第二版本号匹配可以是指两者版本号相同，也可以是两者版本号满足预设的关联关系。若第一版本号和第二版本号不匹配，则采用鉴权策略表进行鉴权。假设匿名账户请求对资源拥有方A的资源内容d进行某些操作，则服务器从鉴权策略表中先找到资源拥有方A相关的资源集合，以表1为例，得到资源集合a、b、c和d，然后从资源集合中出解析资 源内容d，再解析权限集合，得到资源内容d的权限内容是“允许读取且允许写入”，进而判断匿名账户请求对资源拥有方A的资源内容进行的操作，是否符合资源d对应的权限内容，如此实现鉴权。
其次，本申请实施例中，如果第一版本号与第二版本号不匹配，那么需要获取鉴权策略表，以采用鉴权策略表对匿名账户进行鉴权。通过上述方式，可以在第一版本号和第二版本号不匹配的情况，优先采用传统的鉴权策略表进行鉴权，一方面可以根据实际情况进行策略表的筛选，从而提升鉴权的灵活性，另一方面，鉴权策略表通常是优先进行更新的策略表，而线性策略表是根据鉴权策略表进行更新的策略表，因此，如果发现两者版本号不匹配，则先选择更新后的鉴权策略表，以此提升方案的实用性。
可选地，在上述图3对应的实施例的基础上，本申请实施例提供的匿名账户的鉴权方法中，还可以包括：
检测资源集合和/或权限集合是否发生变化；
若资源集合和/或权限集合发生变化，则更新鉴权策略表。
本实施例中，在服务器对匿名账户进行鉴权之前，或者对匿名账户进行鉴权之后，可以对鉴权策略表进行更新。
具体地，请参阅图4，图4为本申请实施例中更新鉴权策略表的一个实施例示意图，如图4所示，以单个资源拥有者为单位，假设资源拥有者为资源拥有方A，服务器先检测资源集合和/或权限集合是否发生变化，也就是检测资源拥有方A和匿名账户相关的鉴权策略内容是否发生变更，此外，服务器还需要检测权限集合是否发生变更，只要有其一发生变化，那么对应的鉴权策略就需要进行更新，同时需要更新的还包括鉴权策略表当前版本的标识号，即更新第一版本号。
其次，本申请实施例中，介绍了更新鉴权策略表的过程，即服务器需要检测资源集合和/或权限集合是否发生变化，在资源集合和/或权限集合发生变化的情况下，再更新鉴权策略表。通过上述方式，可以使得服务器及时地获取与鉴权策略相关的信息，以对鉴权策略进行实时更新，从而提升方案的实用性和可行性，并且能够提升匿名账户鉴权的可靠性。
可选地，在上述图3对应的实施例的基础上，本申请实施例提供的匿名账户的鉴权方法中，检测资源集合和/或权限集合是否发生变化，可以包括：
检测资源集合中的资源内容是否发生变化，其中，资源内容用于表示资源拥有方所提供的资源；或，
检测权限集合中的权限信息是否发生变化，其中，权限信息用于表示资源内容的使用权限；或，
检测资源集合中每个资源内容与权限集合中每个权限信息之间的对应关系是否发生变化。
本实施例中，服务器可以采用三类规则来判断资源集合和/或权限集合是 否发生变化。
第一种为服务器检测资源集合中的资源内容是否发生变化，其中，资源内容用于表示资源拥有方所提供的资源。假设资源拥有方A对应的资源内容a，而后来资源内容a更改为“资源内容x”，这就可以认为是资源集合发生了变化。
第二种为服务器检测权限集合中的权限信息是否发生变化，其中，权限信息用于表示资源内容的使用权限。假设资源拥有方A对应的资源内容a，其权限信息为“允许读取且允许写入”，而后来权限信息更改为“允许读取且不允许写入”，这就可以认为是权限集合发生了变化。
第三种为服务器检测资源集合中每个资源内容与权限集合中每个权限信息之间的对应关系是否发生变化。例如，资源拥有方A对应的资源内容a，其权限信息为“允许读取且允许写入”，后续更改为资源拥有方A对应的资源内容b，其权限信息为“不允许读取且允许写入”，这就可以认为是资源集合与权限集合的对应关系发生了变化。
再次，本申请实施例中，分别介绍了三种判定需要对鉴权策略表进行更新的条件，即检测资源集合中的资源内容是否发生变化，检测权限集合中的权限信息是否发生变化，以及检测资源集合中每个资源内容与所述权限集合中每个权限信息之间的对应关系是否发生变化。通过上述方式，利用三个条件中的至少一个条件，即可确定是需要对鉴权策略表更新，从而提升方案的灵活性和多样性，并且通过限定这些条件来维护鉴权的可靠性。
可选地，在上述图3对应的实施例的基础上，本申请实施例提供的匿名账户的鉴权方法中，更新鉴权策略表之后，还可以包括：
根据更新后的鉴权策略表，对线性策略表进行更新。
本实施例中，在服务器对鉴权策略表进行更新操作后，还需要根据更新了的鉴权策略表对线性策略表进行更新。
策略管理包括鉴权策略表的更新以及线性策略表的更新两部分。由于这里的所有策略都是和匿名账户相关的，为了进行细粒度的版本管理，把所有策略按资源拥有方进行细分，针对每个资源拥有方的和匿名账户相关的策略定义一个版本，只要该资源拥有方相关的任何策略发生变更，对应的版本便会进行更新。
请参阅图5，图5为本申请实施例中更新线性策略表的一个实施例示意图，如图5所示，线性表的组织结构就是(子账户、账户、应用程序编程接口、资源和权限)这样的一维关系，所以鉴权的时候会非常直观。对于匿名账号的鉴权请求，先去查看该鉴权请求中资源拥有方对应的版本号。如果鉴权策略表当前版本的标识号和线性策略表当前版本的标识号不一致，则说明该资源拥有方近期的匿名账号的鉴权策略发生更新。对于时效性要求非常高的业务而言，就去传统的鉴权策略表里进行查找，否则，直接查找线性策略 表。
可以理解的是，服务器可以对版本号检查进行进一步优化，由鉴权服务注册版本变化的消息。如果版本一旦变更，则通知所有的鉴权服务，鉴权服务在策略完成线性表更新前读取原始的策略表进行鉴权。
版本控制流程会以非常短的时间间隔去校验线性策略表和鉴权策略表版本的一致性，如果不一致，则进行线性表更新，更新完成后，同一个匿名账户的线性策略表和鉴权策略表当前版本的标识号就保持一致了。
再次，本申请实施例中，服务器更新鉴权策略表之后，还可以根据更新后的鉴权策略表，对线性策略表进行更新。通过上述方式，如果鉴权策略表和线性策略表不匹配，则说明该资源拥有方近期的匿名用户策略发生过更新，于是需要先更新鉴权策略表，然后对线性策略表进行更新，从而保证两个策略表的同步，提升鉴权的可靠性，而对于时效性要求非常高的业务而言，就去传统的鉴权策略表里进行查找，以此保证鉴权的实时性。
可选地，在上述图3对应的实施例的基础上，本申请实施例提供的匿名账户的鉴权方法中，根据匿名账户鉴权请求获取资源拥有方的第一版本号，可以包括：
根据匿名账户鉴权请求确定匿名账户；
根据匿名账户以及匿名账户请求的资源拥有方，从版本管理表中获取第一版本号。
本实施例中，服务器获取资源拥有方的第一版本号具体可以包括如下步骤，首先，服务器根据接收到的匿名账户鉴权请求，确定对应的匿名账户，然后通过匿名账户以及该匿名账户请求的资源拥有方，从服务器中已经存储的版本管理表中读取鉴权策略表的第一版本号。
在服务器存储的版本管理表中包含鉴权策略表对应的第一版本号，以及线性策略表对应的第二版本号，一旦发生策略表更新，则相应的版本号也会进行更新，版本管理表可以擦除原版本的版本号，也可以保留原版本的版本号，此处不做限定。
进一步地，本申请实施例中，服务器获取资源拥有方的第一版本号的过程可以为，首先根据匿名账户鉴权请求确定匿名账户，然后根据匿名账户以及匿名账户请求的资源拥有方，从版本管理表中获取第一版本号。通过上述方式，说明了服务器如何准确地获取资源拥有方所对应的第一版本号，以此提升方案的可行性和可操作性。
可选地，在上述图3对应的实施例的基础上，本申请实施例提供的匿名账户的鉴权方法中，从线性策略表中获取与匿名账户关联的鉴权策略集合，以采用鉴权策略集合进行鉴权之后，还可以包括：
获取目标鉴权结果；
将目标鉴权结果存储在缓存表中，其中，缓存表用于存储多个鉴权结果。
本实施例中，在服务器采用鉴权策略集合对匿名账户进行鉴权之后，还可以进一步得到匿名账户所对应的目标鉴权结果，然后将目标鉴权结果存储在缓存表中，缓存表中存储有多个鉴权结果。请参阅表4，表4为缓存表的一个示意。
表4
匿名账户 鉴权结果
X 对资源拥有方A的资源内容d允许读取且允许写入
X 对资源拥有方A的资源内容c允许读取且不允许写入
X 对资源拥有方D的资源内容a允许不读取且不允许写入
X 对资源拥有方C的资源内容a不允许读取且允许写入
X 对资源拥有方B的资源内容d允许读取且允许写入
需要说明的是，表4仅为一个示意，在实际应用中，缓存表缓存表存储多个鉴权结果的，此处不做限定。
其次，本申请实施例中，在服务器从线性策略表中获取资源关联的鉴权策略集合，以采用鉴权策略集合对匿名账户请求的资源的使用权限进行鉴权之后，还可以进一步获取匿名账户对应的目标鉴权结果，再将目标鉴权结果存储在缓存表中，而且缓存表能够存储多个鉴权结果。通过上述方式，可以使得已经做过鉴权的匿名账户再次进行鉴权时，服务器无需重新执行一遍相同的操作，而是直接从缓存表中调取对应目标鉴权结果即可，从而提升了鉴权的速度，并有利于提升鉴权性能。
为便于理解，下面可以以一个具体应用场景对本申请中匿名账户的鉴权方法进行详细描述，具体为：
用户甲登录云服务平台，希望在该平台上下载自己需要的学习资料。用户甲先用匿名账号登录云服务平台，云服务平台根据用户甲的匿名账户鉴权请求，从后台获取鉴权策略表当前版本的标识号，即版本v1.0.11，接下来云服务平台继续查找线性策略表当前版本的标识号，其中，线性策略表当前版本的标识号也为版本v1.0.11，于是认为鉴权策略表当前版本的标识号与线性策略表当前版本的标识号匹配，从而优先从线性策略表中提取信息。
线性策略表中先找到用户甲请求的资源拥有方，假设资源拥有方为X，则从该线性策略表中找到资源拥有方X所提供的资源，包括资源1、资源2和资源3，用户甲实际需要的学习资料是资源2，因此，将从线性策略表中查找资源拥有方为X，且资源为资源2的权限信息，若该权限信息为“可读取不可写入”，该权限信息与用户甲请求的下载(即读取)操作权限对应，则用户甲可以从云服务平台上下载该资料。
下面对本申请中的服务器进行详细描述，请参阅图6，图6是本申请实施例提供的一种服务器结构示意图，该服务器300可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上中央处理器(central processing  units，CPU)322(例如，一个或一个以上处理器)和存储器332，一个或一个以上存储应用程序342或数据344的存储介质330(例如一个或一个以上海量存储设备)。其中，存储器332和存储介质330可以是短暂存储或持久存储。存储在存储介质330的程序可以包括一个或一个以上模块(图示没标出)，每个模块可以包括对服务器中的一系列指令操作。更进一步地，中央处理器322可以设置为与存储介质330通信，在服务器300上执行存储介质330中的一系列指令操作。存储器332与CPU322之间可以通过总线系统连接并通信。
服务器300还可以包括一个或一个以上电源326，一个或一个以上有线或无线网络接口350，一个或一个以上输入输出接口358，和/或，一个或一个以上操作系统341，例如Windows ServerTM，Mac OS XTM，UnixTM,LinuxTM，FreeBSDTM等等。
上述实施例中由服务器所执行的步骤可以基于该图6所示的服务器结构实现。
其中，CPU 322用于执行如下步骤：
接收匿名账户鉴权请求；所述匿名账户鉴权请求用于请求针对资源拥有方通过匿名账户对资源的使用权限进行鉴权；
根据所述匿名账户鉴权请求获取资源拥有方的第一版本号，其中，所述第一版本号用于表示鉴权策略表当前版本的标识号，所述鉴权策略表包含资源集合与权限集合之间的对应关系；
若所述第一版本号与第二版本号匹配，则获取线性策略表，其中，所述第二版本号用于表示所述线性策略表当前版本的标识号，所述线性策略表包含所述资源集合中每个资源内容与所述权限集合中每个权限信息之间的对应关系；
从所述线性策略表中获取所述资源关联的鉴权策略集合；
采用所述鉴权策略集合进行鉴权，其中，所述鉴权策略集合中包含至少一条鉴权策略，所述鉴权策略为资源内容与权限信息之间的对应关系。
可选地，CPU 322还用于执行如下步骤：
若所述第一版本号与第二版本号不匹配，则采用所述鉴权策略表进行鉴权。
可选地，CPU 322还用于执行如下步骤：
检测所述资源集合和/或所述权限集合是否发生变化；
若所述资源集合和/或所述权限集合发生变化，则更新所述鉴权策略表。
可选地，CPU 322在执行所述检测所述资源集合和/或所述权限集合是否发生变化的步骤时，具体用于执行如下步骤：
检测所述资源集合中的所述资源内容是否发生变化，其中，所述资源内容用于表示所述资源拥有方所提供的资源；或，
检测所述权限集合中的所述权限信息是否发生变化，其中，所述权限信息用于表示所述资源内容的使用权限；或，
检测所述资源集合中每个所述资源内容与所述权限集合中每个所述权限信息之间的对应关系是否发生变化。
可选地，CPU 322在执行完所述更新所述鉴权策略表之后，还用于执行如下步骤：
根据更新后的所述鉴权策略表，对所述线性策略表进行更新。
可选地，CPU 322在执行根据所述匿名账户鉴权请求获取资源拥有方的第一版本号的步骤时，具体用于执行如下步骤：
根据所述匿名账户鉴权请求确定所述匿名账户；
根据所述匿名账户以及所述匿名账户请求的所述资源拥有方，从版本管理表中获取所述第一版本号。
可选地，CPU 322在执行完从所述线性策略表中获取与所述匿名账户关联的鉴权策略集合，以采用所述鉴权策略集合进行鉴权的步骤之后，还用于执行如下步骤：
获取目标鉴权结果；
将所述目标鉴权结果存储在缓存表中，其中，所述缓存表用于存储多个鉴权结果。
本申请实施例还提供一种存储介质，用于存储程序代码，该程序代码用于执行前述各个实施例所述的一种匿名账户的鉴权方法中的任意一种实施方式。
本申请实施例还提供一种包括指令的计算机程序产品，当其在计算机上运行时，使得计算机执行前述各个实施例所述的一种匿名账户的鉴权方法中的任意一种实施方式。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方， 或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (16)

  1. 一种匿名账户的鉴权方法，包括：
    服务器接收匿名账户鉴权请求；所述匿名账户鉴权请求用于请求针对资源拥有方通过匿名账户对资源的使用权限进行鉴权；
    根据所述匿名账户鉴权请求获取资源拥有方的第一版本号，其中，所述第一版本号用于表示鉴权策略表当前版本的标识号，所述鉴权策略表包含资源集合与权限集合之间的对应关系；
    若所述第一版本号与第二版本号匹配，则获取线性策略表，其中，所述第二版本号用于表示所述线性策略表当前版本的标识号，所述线性策略表包含所述资源集合中每个资源内容与所述权限集合中每个权限信息之间的对应关系；
    从所述线性策略表中获取所述资源关联的鉴权策略集合；
    采用所述鉴权策略集合进行鉴权，其中，所述鉴权策略集合中包含至少一条鉴权策略，所述鉴权策略为资源内容与权限信息之间的对应关系。
  2. 根据权利要求1所述的方法，所述根据所述匿名账户鉴权请求获取资源拥有方的第一版本号之后，所述方法还包括：
    若所述第一版本号与第二版本号不匹配，则采用所述鉴权策略表进行鉴权。
  3. 根据权利要求1所述的方法，所述方法还包括：
    检测所述资源集合和/或所述权限集合是否发生变化；
    若所述资源集合和/或所述权限集合发生变化，则更新所述鉴权策略表。
  4. 根据权利要求3所述的方法，所述检测所述资源集合和/或所述权限集合是否发生变化，包括：
    检测所述资源集合中的所述资源内容是否发生变化，其中，所述资源内容用于表示所述资源拥有方所提供的资源；或，
    检测所述权限集合中的所述权限信息是否发生变化，其中，所述权限信息用于表示所述资源内容的使用权限；或，
    检测所述资源集合中每个所述资源内容与所述权限集合中每个所述权限信息之间的对应关系是否发生变化。
  5. 根据权利要求3所述的方法，所述更新所述鉴权策略表之后，所述方法还包括：
    根据更新后的所述鉴权策略表，对所述线性策略表进行更新。
  6. 根据权利要求1至5中任一项所述的方法，所述根据所述匿名账户鉴权请求获取资源拥有方的第一版本号，包括：
    根据所述匿名账户鉴权请求确定所述匿名账户；
    根据所述匿名账户以及所述匿名账户请求的所述资源拥有方，从版本管理表中获取所述第一版本号。
  7. 根据权利要求1所述的方法，所述从所述线性策略表中获取与所述匿名账户关联的鉴权策略集合，以采用所述鉴权策略集合进行鉴权之后，所述方法还包括：
    获取目标鉴权结果；
    将所述目标鉴权结果存储在缓存表中，其中，所述缓存表用于存储多个鉴权结果。
  8. 一种服务器，包括：
    存储器和处理器；
    其中，所述存储器用于存储程序代码；
    所述处理器用于调用所述存储器中的程序代码，执行以下步骤：
    接收匿名账户鉴权请求；所述匿名账户鉴权请求用于请求针对资源拥有方通过匿名账户对资源的使用权限进行鉴权；
    根据所述接收模块接收的所述匿名账户鉴权请求获取资源拥有方的第一版本号，其中，所述第一版本号用于表示鉴权策略表当前版本的标识号，所述鉴权策略表包含资源集合与权限集合之间的对应关系；
    若所述第一获取模块获取的所述第一版本号与第二版本号匹配，则获取线性策略表，其中，所述第二版本号用于表示所述线性策略表当前版本的标识号，所述线性策略表包含所述资源集合中每个资源内容与所述权限集合中每个权限信息之间的对应关系；
    从所述第二获取模块获取的所述线性策略表中所述资源关联的鉴权策略集合；
    采用所述第三获取模块获取的所述鉴权策略集合进行鉴权，其中，所述鉴权策略集合中包含至少一条鉴权策略，所述鉴权策略为资源内容与权限信息之间的对应关系。
  9. 根据权利要求8所述的服务器，所述处理器还用于执行以下步骤：
    在所述第一获取模块根据所述匿名账户鉴权请求获取资源拥有方的第一版本号之后，若所述第一版本号与第二版本号不匹配，则采用所述鉴权策略表进行鉴权。
  10. 根据权利要求8所述的服务器，所述处理器还用于执行以下步骤：
    检测所述资源集合和/或所述权限集合是否发生变化；
    若所述检测模块检测得到所述资源集合和/或所述权限集合发生变化，则更新所述鉴权策略表。
  11. 根据权利要求10所述的服务器，所述处理器在执行所述检测所述资源集合和/或所述权限集合是否发生变化的步骤时，具体用于执行以下步骤：
    检测所述资源集合中的所述资源内容是否发生变化，其中，所述资源内容用于表示所述资源拥有方所提供的资源；或，
    用于检测所述权限集合中的所述权限信息是否发生变化，其中，所述权 限信息用于表示所述资源内容的使用权限；或，
    用于检测所述资源集合中每个所述资源内容与所述权限集合中每个所述权限信息之间的对应关系是否发生变化。
  12. 根据权利要求10所述的服务器，所述处理器在执行完所述更新所述鉴权策略表的步骤之后，还用于执行以下步骤：
    根据更新后的所述鉴权策略表，对所述线性策略表进行更新。
  13. 根据权利要求8至12中任一项所述的服务器，所述处理器在执行根据所述匿名账户鉴权请求获取资源拥有方的第一版本号的步骤时，具体用于执行以下步骤：
    根据所述匿名账户鉴权请求确定所述匿名账户；
    根据所述匿名账户以及所述匿名账户请求的所述资源拥有方，从版本管理表中获取所述第一版本号。
  14. 根据权利要求8所述的服务器，所述处理器还用于执行以下步骤：
    获取目标鉴权结果；
    将所述目标鉴权结果存储在缓存表中，其中，所述缓存表用于存储多个鉴权结果。
  15. 一种计算机可读存储介质，所述存储介质用于存储程序代码，所述程序代码用于执行如权利要求1-7所述的方法。
  16. 一种包括指令的计算机程序产品，当其在计算机上运行时，使得所述计算机执行权利要求1-7所述的方法。
PCT/CN2018/102189 2017-09-13 2018-08-24 一种匿名账户的鉴权方法及服务器 WO2019052328A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/601,693 US11394748B2 (en) 2017-09-13 2019-10-15 Authentication method for anonymous account and server

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710823493.2A CN109495432B (zh) 2017-09-13 2017-09-13 一种匿名账户的鉴权方法及服务器
CN201710823493.2 2017-09-13

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/601,693 Continuation US11394748B2 (en) 2017-09-13 2019-10-15 Authentication method for anonymous account and server

Publications (1)

Publication Number Publication Date
WO2019052328A1 true WO2019052328A1 (zh) 2019-03-21

Family

ID=65687851

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/102189 WO2019052328A1 (zh) 2017-09-13 2018-08-24 一种匿名账户的鉴权方法及服务器

Country Status (3)

Country Link
US (1) US11394748B2 (zh)
CN (1) CN109495432B (zh)
WO (1) WO2019052328A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111737279B (zh) * 2020-08-24 2020-12-18 支付宝(杭州)信息技术有限公司 基于区块链的业务处理方法、装置、设备及存储介质
CN115242417B (zh) * 2021-06-03 2023-07-25 广州汽车集团股份有限公司 车载功能控制方法、系统、装置和车辆

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101448002A (zh) * 2008-12-12 2009-06-03 北京大学 一种数字资源的访问方法及设备
WO2010072158A1 (zh) * 2008-12-24 2010-07-01 华为技术有限公司 一种业务链中的用户身份验证方法、设备及系统
CN102843366A (zh) * 2012-08-13 2012-12-26 北京百度网讯科技有限公司 一种网络资源访问权限控制方法及装置
CN106790262A (zh) * 2017-02-07 2017-05-31 腾讯科技（深圳）有限公司 一种鉴权方法及装置

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8688991B1 (en) * 2007-06-01 2014-04-01 Adobe Systems Incorporated Media player embodiments and secure playlist packaging

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101448002A (zh) * 2008-12-12 2009-06-03 北京大学 一种数字资源的访问方法及设备
WO2010072158A1 (zh) * 2008-12-24 2010-07-01 华为技术有限公司 一种业务链中的用户身份验证方法、设备及系统
CN102843366A (zh) * 2012-08-13 2012-12-26 北京百度网讯科技有限公司 一种网络资源访问权限控制方法及装置
CN106790262A (zh) * 2017-02-07 2017-05-31 腾讯科技（深圳）有限公司 一种鉴权方法及装置

Also Published As

Publication number Publication date
CN109495432A (zh) 2019-03-19
US20200045085A1 (en) 2020-02-06
CN109495432B (zh) 2021-05-25
US11394748B2 (en) 2022-07-19

Similar Documents

Publication Publication Date Title
US10757106B2 (en) Resource access control method and device
US9961053B2 (en) Detecting compromised credentials
US9774586B1 (en) Dynamic authorization of users in a multi-tenant environment using tenant authorization profiles
US10878218B2 (en) Device fingerprinting, tracking, and management
WO2015043420A1 (zh) 权限控制方法和装置
US9652511B2 (en) Secure matching supporting fuzzy data
US10484383B2 (en) Pre-authorizing a client application to access a user account on a content management system
US11562812B2 (en) Computer implemented method for secure management of data generated in an EHR during an episode of care and a system therefor
JP6074514B2 (ja) 特徴情報の取得方法、装置、ネットワーク装置、プログラム及び記録媒体
JP2020504395A (ja) マルチテナントデータベースシステムにおけるデータ共有
US20130086065A1 (en) Privileged account manager, dynamic policy engine
US9177129B2 (en) Devices, systems, and methods for monitoring and asserting trust level using persistent trust log
KR20160083930A (ko) 웹사이트에 로그인하는 단말기가 모바일 단말기인지를 결정하기 위한 방법 및 시스템
KR20130133028A (ko) 문서들의 디지털 사용 권한들을 관리하기 위한 방법 및 디바이스
WO2018233051A1 (zh) 数据发布方法、装置、服务器和存储介质
US11695559B2 (en) Nested tenancy that permits a hierarchy having a plurality of levels
US8898318B2 (en) Distributed services authorization management
JP2011521307A (ja) オンラインアカウントへのアクセスを委任するシステムおよび方法
CN108073823B (zh) 数据处理方法、装置及系统
WO2018145546A1 (zh) 一种鉴权方法、装置及存储介质
WO2016206414A1 (zh) 多个虚拟桌面架构的融合方法及装置
US11636184B2 (en) Method for providing cloud-based service
WO2019052328A1 (zh) 一种匿名账户的鉴权方法及服务器
US8065281B2 (en) Method and apparatus for facilitating distributed processing of database operations
WO2024021417A1 (zh) 数据账户创建方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18857040

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18857040

Country of ref document: EP

Kind code of ref document: A1