CN106411857B - A kind of private clound GIS service access control method based on virtual isolation mech isolation test - Google Patents
A kind of private clound GIS service access control method based on virtual isolation mech isolation test Download PDFInfo
- Publication number
- CN106411857B CN106411857B CN201610807010.5A CN201610807010A CN106411857B CN 106411857 B CN106411857 B CN 106411857B CN 201610807010 A CN201610807010 A CN 201610807010A CN 106411857 B CN106411857 B CN 106411857B
- Authority
- CN
- China
- Prior art keywords
- service
- gis
- tenant
- data
- access
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/46—Interconnection of networks
- H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/50—Network services
- H04L67/52—Network services specially adapted for the location of the user terminal
Landscapes
- Engineering & Computer Science (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- Theoretical Computer Science (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Storage Device Security (AREA)
Abstract
本发明公开一种基于虚拟隔离机制的私有云GIS服务访问控制方法，依次包括以下步骤：（1）网络控制：（2）数据隔离与访问控制：（3）云GIS服务接口策略。本发明在私有云平台环境中为多租户GIS服务的使用设计一套安全隔离、访问控制和通信机制，使得私有云平台能具有多租户处理地理空间数据的能力，能提高GIS服务处理的安全性，达到变地理空间数据为资产的目的。
The invention discloses a private cloud GIS service access control method based on a virtual isolation mechanism, which sequentially includes the following steps: (1) network control: (2) data isolation and access control: (3) cloud GIS service interface strategy. The present invention designs a set of security isolation, access control and communication mechanisms for the use of multi-tenant GIS services in the private cloud platform environment, so that the private cloud platform can have the ability of multi-tenant processing of geospatial data, and can improve the security of GIS service processing , to achieve the purpose of turning geospatial data into assets.
Description
Technical field
The present invention relates to the privately owned cloud computing technologies of GIS, and in particular to a kind of private clound GIS clothes based on virtual isolation mech isolation test
Business access control method.
Background technique
In recent years, with the fast development of cloud computing technology, the application of cloud computing has penetrated into all trades and professions.Sub- horse
The scientific & technical corporation such as inferior, Microsoft constantly release enterprise-level cloud computing service, to meet the business demand of users.GIS industry
It is unexceptional.Well-known GIS company has launched cloud GIS products & services both at home and abroad for ESRI, hypergraph etc..
Currently, traditional file system, the exclusive tightly coupled Web Application Server trunking mode of formula be unable to satisfy it is privately owned
The requirement of cloud GIS service elastic load equilibrium, it is necessary to which a kind of new cloud GIS calculating access control method and communication mechanism are provided.
Cloud storage technology is the basis of cloud computing application, it can be by heterogeneous storage devices in network by software system integration, jointly
Data storage and business access function (Bao Aihua etc., 2014) are externally provided.It is mainly public affairs for GIS data service
Crowd provides spatial analysis and geographical information sharing service, it requires that the delay of data positioning, inquiry or modification is smaller.Furthermore
In view of geographic information data concerning security matters, domestic many enterprises can only use private clound numerical procedure.
Summary of the invention
Goal of the invention: it is an object of the invention to solve the deficiencies in the prior art, provide it is a kind of based on virtually every
The private clound GIS service access control method for system of disembarking is a kind of virtual isolation scheme of private clound GIS platform multi-tenant resource with
And service-oriented role access (Workflow-based and Service-oriented Role Based Access
Control, WSRBAC) as access control module GIS data with service-oriented (Service Oriented
Architecture, SOA) the method shared of mode, wherein GIS resource isolation includes Network Isolation and software isolation, is passed through
The combination of above two method, first data safety of the guarantee GIS data under isomery private clound GIS platform, secondly user with
Role accesses public GIS data as permission, and manages and share privately owned GIS data.
Technical solution: a kind of private clound GIS service access control method based on virtual isolation mech isolation test of the invention, successively
The following steps are included:
(1) network-control: in private clound platform environment dispose hardware virtualization environment when establish three it is mutually independent
Virtual network segment is that data storage network segment VLANIF16, Service Source network segment VLANIF18 and user use network segment respectively
VLANIF20；
(2) data isolation and access control:
(21) forced quarantine not data between commensurate；
(22) simultaneously shared data is moderately isolated in the data in same units between different tissues；
(23) private data between stringent separating tissues and between tenant；
(24) tenant must be requested by interface predetermined using GIS service, the service access control of VLANIF18
System verifying authorization processed, after being verified, which licenses to the tenant for GIS service use, and the tenant is according to authorization message
Using corresponding GIS service, after the completion of GIS service processing, processing result is returned to tenant, tenant by VLANIF18 by system
The IasS layer of privately owned cloud platform can not directly be accessed；
(25) tenant is applied obtaining GIS data service by the role of itself, and applies for obtaining the use of GIS application service
Power, when GIS application service per treatment, system is service distribution temporary authority automatically；After service processing, system is automatic
Recycle temporary authority；
(3) cloud GIS service interface strategies: hardware resource, Internet resources, GIS data resource and GIS application resource is complete
Portion is supplied to user in service-oriented mode and uses.
Further, in the step (1), the building of VLANIF16, VLANIF18 and VLANIF20 tri- work network segments
It is realized by three layers of physical switches or virtual switch, wherein VLANIF16 distributes to one group of distributed file server collection
Group uses, this group of cluster can only be accessed by VLANIF18, if it is desired that with the GIS data service on VLANIF16, it is necessary to
GIS data, file can be read and write after obtaining file access permission by the service access control system being deployed on VLANIF18
Access authority is by distributed file server master control configuration file core-site.xml IP address predetermined in VLANIF16
Distributed file server control can be obtained with both access rights field access-key combinations.
Further, in the step (2), based on access control based roles strategy；
In step (21), in conjunction with host and guest's body tissue Organization label, to share number between private data, multi-tenant
According to the mode of four class access control right of shared data and other users shared data in, platform, for different tenant's logics point
With resource pool space, data in the privately owned cloud platform of forced quarantine between different tenants can not to reach the tenant of a certain tissue
Its hetero-organization of unauthorized access is not allowed to the purpose of the data of access；
In step (22), the condition accessed using the logical combination of a variety of security attributes as resource accesses item by resource
The data of private clound platform internal memory storage are isolated in the screening of part, appropriateness, and tenant can customize resource according to the demand of inherently safe and visit
Control strategy is asked, the private data from different tenants is isolated；
In step (23), shared data is divided into two class of full shared data and partial sharing data, introduces the general of Virtual Organization
It reads, in conjunction with the formulation of sharing policy, realizes between tenant that data are shared and partial sharing entirely；By the definition of conflict of interest class,
Data sharing between stringent limitation conflict tenant between tissue；
In step (24), the concept of service Service is introduced, service-oriented role-based access control model is proposed, by angle
Color access control is promoted to service dynamic authorization protection from the protection of resource Static authorization, when tenant request uses GIS service,
The verifying system of VLANIF18 authorizes the GIS service right to use of corresponding role according to its legitimacy of tenant's Information Authentication；
In step (25), system can dynamically manage role and distribute role hierarchy automatically, and the role of each grade assigns
The access authority of one group of GIS service is given, tenant can apply being upgraded to high-grade role from inferior grade role, remove mutual role help
Except strategy, dynamic authorization policy control GIS application service access, this GIS application service access right is also can be used in system
Policy independence is in tenant's role-security strategy, the former controls GIS application service access, and the latter controls hardware resource and GIS number
According to the access of service.
Further, the specific method of the step (3) is:
(31) VLANIF18 disposes the service access control system of independent development, which is that each GIS service uses definition
The interface rules of REST style access GIS service for tenant, and tenant is requested by the use that interface rules send GIS service, asked
Asking must be verified by service access control system, and after system is verified, tenant can use corresponding GIS service；
(32) VLANIF18 dispose independent development hardware resource operation control system, the system can by physical memory,
The hardware resources such as virtual cpu and storage are supplied to tenant's use in a manner of servicing.The web client that tenant passes through control system
End application hardware resource service；System manager responds and verifies this application service in the management end of control system, is verified
It is afterwards hardware resource needed for its distribution in hardware resource pool, then the description information of its hardware resource is returned into web client
End is supplied to tenant's use；
(33) VLANIF18 disposes the GIS application service system of independent development, what which can service GIS business
Mode is supplied to tenant's use.Tenant can use in two ways GIS application service: one is directly answered using single GIS
With service, another kind is that several single GIS application service groups are combined into a business, is supplied to tenant's use.
Further, the detailed process that dynamic authorization policy control GIS application service accesses in the step (25) is: renting
The corresponding GIS data service of authority application of oneself affiliated role is pressed at family, then applies for the right to use of GIS application service, system
Workflow is merged into GIS data service and GIS application service, and are the automatic allocation processing permission of the workflow, when having handled
Bi Hou, system will automatically retract the permission of the workflow.
The utility model has the advantages that the present invention in private clound platform environment for the use of multi-tenant GIS service design a set of safety every
From, access control and communication mechanism, enables privately owned cloud platform that there is the ability of multi-tenant processing geographical spatial data, can improve
The safety of GIS service processing achievees the purpose that become geographical spatial data into assets.
Detailed description of the invention
Fig. 1 is the Method of Data Organization schematic diagram in embodiment in file server.
Fig. 2 is the schematic diagram of REST service interface message in embodiment.
Specific embodiment
Technical solution of the present invention is described in detail below, but protection scope of the present invention is not limited to the implementation
Example.
Embodiment 1:
The realization of Network Control Segment:
Network configuration in the present embodiment is by taking Huawei's S5700 interchanger as an example, and default opens a work after interchanger is powered
Make network segment.Three work network segments are established in this example, so reconfiguring interchanger.Specific step is as follows:
First, interchanger is connected by Serial Port Line with computer, and computer opens corresponding com serial ports, and configures interchanger
Com serial ports parameter, configuration information are as follows: frequency: 9600；Data bit: 8；Even-odd check: nothing；Stop bit: 1；Data flow control:
Nothing.
Second, serial communication program is opened in a computer and presses keyboard any key activation serial communication, is received interchanger and is rung
Switch pin is inputted again after answering information.After password authentification passes through, occur on computer display "<Quidway>", explanation
Interchanger is ready for ready.At this point, being inputted on computers to issue orders and create three required work network segments on switches:
<Quidway>
<Quidway>system-view
[Quidway]interface vlanif 1016
[Quidway-Vlanif1016]ip address 192.168.16.254 255.255.255.0
[Quidway-Vlanif1016]quit
<Quidway>
<Quidway>system-view
[Quidway]interface vlanif 1018
[Quidway-Vlanif1018]ip address 192.168.18.254 255.255.255.0
[Quidway-Vlanif1018]quit
<Quidway>
<Quidway>system-view
[Quidway]interface vlanif 1020
[Quidway-Vlanif1020]ip address 192.168.20.254 255.255.255.0
[Quidway-Vlanif1020]quit
1016,1018,1,020 3 work network segments are established by the above Management Information Base.
Third distributes to the physical internet ports of interchanger on newly created three work network segment, and configuration mode is as follows:
(1) order system-view is executed, into system view；
(2) order interface vlanif vlan-id is executed, into VLANIF interface view；
(3) order ip address ip-address { mask | mask-length } is executed, the main address ip is configured.
Concrete operations are exemplified below.If number 0/0/1 is the address ip of first network interface, configuration operation is:
<Quidway>system-view
[Quidway]vlan 1016
[Quidway-Vlan1016]quit
[Quidway]interface gigabitethernet 0/0/1
[Quidway-Gigabitethernet0/0/1]port hybrid pvid vlan 1016
[Quidway-Gigabitethernet0/0/1]port htbrid untagged vlan 1016
[Quidway-Gigabitethernet0/0/1]quit
Corresponding work network segment is distributed to each physical internet ports of interchanger by ordering above.
The realization of data isolation part:
Data isolation is divided into two parts: first, the isolation of initial data.Point in initial data trustship to privately owned cloud platform
Cloth file server passes through the file access control module in distributed file server and hardware resource operation control system
Realize the operation of initial data；Second, the access control of GIS service.GIS service in privately owned cloud platform is in trust to GIS
The access control of Server server, service is visited by the service in GIS Server server and hardware resource operation control system
Ask that control module is implemented in combination with.
Distributed file server isolation: distributed file server is deployed in 1016 network segments, according to network-control every
From design, 1016 network segments can only by the file access control module accesses of the hardware resource operation control system of 1018 network segments,
The user client of 1020 network segments can not directly access the distributed file server of 1016 network segments.In distributed file server
Method of Data Organization it is as shown in Figure 1.
The isolation of file access control module: file access control module is 1018 network segment hardware resource operation control systems
One of component is responsible for the response of user file request and the request of other program files.User file request refers to when 1020 nets
When user's request of section is to initial data read-write operation in privately owned cloud platform, user is requested first by 1018 network segment service access
Subscriber authentication module in control system is intercepted and is verified, if user requests while meeting identity legitimacy and operation validity two
Kind verifying, then user's request can just be distributed to service access control system, and then service access control system issues instruction and allows
1016 network segment distributed file systems respond user's request.In above-mentioned steps implementation procedure, user is to be unable to direct read/write
The distributed file server of 1016 network segments, it is even more impossible to obtain the physical address of file storage, so the client of 1020 network segments
Required GIS resource can not be directly accessed, client must be sent to the REST service interface of the subscriber authentication module of 1018 network segments
User's checking request, as shown in Fig. 2, REST service interface message is as follows:
URL:http://{host}/user/generatetoken
Method:POST
Data:{username:user0606,password:ab123456}
Specific example is as follows:
(1) user is logged in by username and password.Client where user obtains one and takes from 1018 network segments after login
The token that access control system of being engaged in is sent, token information are transmitted by JSON format, as follows:
This is the token information for logining successfully rear user and receiving.Wherein, Status indicates logging state, if logining successfully
Success is then returned, error is otherwise returned；Tokenstring is a string of encryption information, using user name, two random characters
String and token generate ageing and encrypt in strange land.After user obtains token, when retransmiting other requests just not
With input username and password, system automatically decrypts user token to verify the legitimacy of user identity；Exparetime is
Refer to that token generates the time；Timelong is service effective time, and expired time is in seconds.1200000 indicate current
Token effective time is 20 minutes.
(2) after logging in, if user uploads a private data, following request is sent:
URL:http://{host}/user/{username}/zone/{filefolder}Token=
{tokenstring}
Method:POST
Data:{file:filedata,type:[number,default 0]
Wherein, URL is the api interface of upload service；Host is the address ip of service access control system；Username is
User name；Filefolder is the privately owned directory address of user；Tokenstring is the token of user；Data is that user will send
Post parameter；File is user's file to be uploaded；Type is the access authority of file, and 0 indicates that file is privately owned, 1 table
Show that file is shared in organization department, 2 indicate that file is shared to full platform, either 1 or 2, other users can only obtain text
The right to use of part, is deleted and the permission of change is owned by file distribution person always.
If obtaining the GIS resource in privately owned cloud platform, http get request equally is sent to corresponding REST service interface,
The information of offer is as follows:
Uri:http://{host}/user/{username}/getfile/{fileoid}Token=
{tokenstring}
Method:GET
Wherein, fileoid is the unique identifier of GIS resource in privately owned cloud platform, and file is given birth to when uploading by system automatically
At, and save in the database.After user sends the above request, system verifies user token information, after being verified, system
The reading the permission whether user has fileoid file is verified again, and concrete operations are as follows:
(1) if this document is that active user uploads, there is reading permission；
(2) if what this document was uploaded by other users, if access authority is set as sharing in organization department, and currently use
Family and upload user then have reading permission in the same organization department；
(3) if what this document was uploaded by other users, if to be set as full platform shared for access authority, active user has
Read permission.
GIS Server isolation: GIS Server provides the clothes that the services such as map, image, geographical processing have GIS function
Business device.User obtains GIS by the username and password of oneself and the role distributed in privately owned cloud platform
The right to use of Server.If role hierarchy is low, only has and use oneself affiliated GIS Server and public GIS organized
The permission of Server；If role hierarchy is high, in addition to this it is possible to the permission for thering is application to create privately owned GIS Server.
(1) use public GIS Server: after login, user obtains the GIS that oneself can be used by following API
Server list:
URL:Http: // { host }/user/ { username }/gisserver? token={ tokenstring }
Method:GET
If requested successfully, user receives the available GIS Server list of system return:
Wherein, type 1 indicates that the server is privately owned GIS Server, and type 2 indicates that the server is public GIS
Server.User has absolute control to privately owned GIS Server, there was only access right to public GIS Server, without more
Change permission.
The isolation of service access control module: service access control module is one of the component of 1018 network section control systems, is used
The access request of GIS service is every time all verified in family by the component, user can also by the component obtain service list,
And the parameter of service.The GIS service range that user uses includes the public GIS clothes that the public GIS website of privately owned cloud platform provides
It is engaged in, the GIS clothes in the privately owned GIS website of GIS service and user oneself creation is shared in the department that user affiliated function provides
Business.
User calls the process of privately owned cloud platform REST interface service as follows:
(1) user sends the call request of special services according to REST interface format:
(2) user's request is intercepted by 1018 network segments, verifies token information.If token information is not met, JSON is returned
Information illustrates to refuse the secondary user service call request；
If token information meets, it is verified, user's request goes to GIS service business module, takes from user's request
Then special services oid out inquires database and obtains the corresponding service of oid, then from the GIS Server where the service, allows use
Family Connection inquiring to service in.
Claims (4)
1. a kind of private clound GIS service access control method based on virtual isolation mech isolation test, it is characterised in that: successively include following
Step:
(1) network-control: established when disposing hardware virtualization environment in private clound platform environment three it is mutually independent virtual
Network segment is that data storage network segment VLANIF16, Service Source network segment VLANIF18 and user use network segment respectively
VLANIF20；
(2) data isolation and access control:
(21) forced quarantine not data between commensurate；
(22) simultaneously shared data is moderately isolated in the data in same units between different tissues；
(23) private data between stringent separating tissues and between tenant；
(24) tenant must be requested by interface predetermined using GIS service, and the service access of VLANIF18 controls system
System verifying authorization, after being verified, which licenses to the tenant for GIS service use, which uses according to authorization message
Corresponding GIS service, after the completion of GIS service processing, processing result is returned to tenant by VLANIF18 by system, and tenant can not
Directly access the IaaS layer of privately owned cloud platform；
(25) tenant is applied obtaining GIS data service by the role of itself, and applies for obtaining the right to use of GIS application service, often
When secondary processing GIS application service, system is service distribution temporary authority automatically；After service processing, system recycles automatically
Temporary authority；
(3) cloud GIS service interface strategies: by hardware resource, Internet resources, GIS data resource and GIS application resource all with
Service-oriented mode is supplied to user's use, and specific method is:
(31) VLANIF18 disposes the service access control system of independent development, which is that each GIS service uses definition REST
The interface rules of style access GIS service for tenant, and tenant is requested by the use that interface rules send GIS service, and request must
It must be verified by service access control system, after system is verified, tenant can use corresponding GIS service；
(32) VLANIF18 disposes the hardware resource operation control system of independent development, which can be by physical memory, virtual
The hardware resources such as CPU and storage are supplied to tenant's use in a manner of servicing, and tenant passes through the Web client Shen of control system
It please hardware resource service；System manager responds in the management end of control system and verifies this application service, after being verified
It is hardware resource needed for its distribution in hardware resource pool, then the description information of its hardware resource is returned into Web client, mentions
Tenant is supplied to use；
(33) VLANIF18 disposes the GIS application service system of independent development, which can be by GIS business in a manner of servicing
It is supplied to tenant's use, tenant uses GIS application service in two ways: one is single GIS application service is directly used, separately
One is several single GIS application service groups are combined into a business, it is supplied to tenant's use.
2. the private clound GIS service access control method according to claim 1 based on virtual isolation mech isolation test, feature exist
In: in the step (1), the three layers of physics that are constructed by of VLANIF16, VLANIF18 and VLANIF20 tri- work network segments are handed over
It changes planes or virtual switch is realized, wherein the cluster that VLANIF16 distributes to one group of distributed file server uses, this group
Cluster can only be accessed by VLANIF18, if it is desired that with the GIS data service on VLANIF16, it is necessary to by being deployed in
Service access control system on VLANIF18, which obtains, can read and write GIS data after file access permission, file access permission by
Distributed file server master control configuration file core-site.xml IP address predetermined and access authority in VLANIF16
Both field access-key combination can obtain distributed file server control.
3. the private clound GIS service access control method according to claim 1 based on virtual isolation mech isolation test, feature exist
In: in the step (2), based on access control based roles strategy；
In step (21), in conjunction with host and guest's body tissue Organization label, with private data, multi-tenant data sharing, put down
The mode of four class access control right of shared data and other users shared data in platform is different tenant's assignment of logical resources
Pool space, the data in the privately owned cloud platform of forced quarantine between different tenants can not be gone beyond one's commission visit with reaching the tenant of a certain tissue
Ask the purpose that its hetero-organization is not allowed to the data of access；
In step (22), the condition accessed using the logical combination of a variety of security attributes as resource passes through resource access conditions
The data of private clound platform internal memory storage are isolated in screening, appropriateness, and tenant can customize resource access control according to the demand of inherently safe
System strategy, the private data from different tenants is isolated；
In step (23), shared data is divided into two class of full shared data and partial sharing data, introduces the concept of Virtual Organization, knot
Close sharing policy formulation, realize tenant between data entirely share and partial sharing；It is stringent to limit by the definition of conflict of interest class
Data sharing between system conflict tenant between tissue；
In step (24), the concept of service Service is introduced, service-oriented role-based access control model is proposed, role is visited
Ask that control is promoted to service dynamic authorization protection from the protection of resource Static authorization, when tenant request uses GIS service,
The verifying system of VLANIF18 authorizes the GIS service right to use of corresponding role according to its legitimacy of tenant's Information Authentication；
In step (25), system can dynamically manage role and distribute role hierarchy automatically, and the role of each grade assigns one
The access authority of group GIS service, tenant can apply being upgraded to high-grade role from inferior grade role, except mutual role help strategy
Except, dynamic authorization policy control GIS application service access, this GIS application service access right strategy also can be used in system
Independently of tenant's role-security strategy, the former controls GIS application service access, and the latter controls hardware resource and GIS data clothes
The access of business.
4. the private clound GIS service access control method according to claim 3 based on virtual isolation mech isolation test, feature exist
In: the detailed process that dynamic authorization policy control GIS application service accesses in the step (25) is: tenant is by oneself affiliated angle
The corresponding GIS data service of the authority application of color, then applies for the right to use of GIS application service, system by GIS data service and
Workflow is merged into GIS application service, and is the automatic allocation processing permission of the workflow, and after being disposed, system will be automatic
Withdraw the permission of the workflow.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610807010.5A CN106411857B (en) | 2016-09-07 | 2016-09-07 | A kind of private clound GIS service access control method based on virtual isolation mech isolation test |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610807010.5A CN106411857B (en) | 2016-09-07 | 2016-09-07 | A kind of private clound GIS service access control method based on virtual isolation mech isolation test |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106411857A CN106411857A (en) | 2017-02-15 |
| CN106411857B true CN106411857B (en) | 2019-03-29 |
Family
ID=57999565
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610807010.5A Active CN106411857B (en) | 2016-09-07 | 2016-09-07 | A kind of private clound GIS service access control method based on virtual isolation mech isolation test |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106411857B (en) |
Families Citing this family (16)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106685994A (en) * | 2017-02-22 | 2017-05-17 | 河海大学 | A cloud GIS resource access control method based on GIS role level authority |
| CN109787938B (en) * | 2017-11-14 | 2021-04-30 | 中国电信股份有限公司 | Method and device for realizing access to virtual private cloud and computer readable storage medium |
| CN107819875B (en) * | 2017-11-27 | 2021-04-09 | 深信服科技股份有限公司 | Method and device for sharing service exclusively by user under cloud platform |
| CN108270858A (en) * | 2018-01-15 | 2018-07-10 | 郑州云海信息技术有限公司 | A kind of private cloud framework and its data processing method based on API gateway |
| CN108846634B (en) * | 2018-05-30 | 2022-08-12 | 北京尚易德科技有限公司 | A kind of case automatic authorization method and system |
| CN108810024A (en) * | 2018-07-19 | 2018-11-13 | 广东浪潮大数据研究有限公司 | A kind of isolation network data transmission method, device, medium, management platform |
| CN110109731B (en) * | 2019-04-19 | 2021-02-09 | 苏州浪潮智能科技有限公司 | A management method and system for a virtual root of trust in a cloud environment |
| CN110417863B (en) * | 2019-06-27 | 2021-01-29 | 华为技术有限公司 | Method and device for generating identity identification code and method and device for authenticating identity |
| CN110827167A (en) * | 2019-09-29 | 2020-02-21 | 武汉开目信息技术股份有限公司 | Product design manufacturability knowledge sharing method and device for collaborative manufacturing |
| CN110826101B (en) * | 2019-11-05 | 2021-01-05 | 安徽数据堂科技有限公司 | Privatization deployment data processing method for enterprise |
| CN111432024B (en) * | 2020-04-09 | 2022-11-04 | 兰州聚源信息科技有限公司 | Construction method of composite cloud training platform based on SCORM technology |
| CN112532474B (en) * | 2020-11-19 | 2022-08-19 | 用友网络科技股份有限公司 | Control method and device of data management system and readable storage medium |
| CN112637232B (en) * | 2020-12-29 | 2022-09-27 | 国云科技股份有限公司 | Cloud platform resource isolation framework implementation method and device supporting multiple strategies |
| CN114398457A (en) * | 2021-12-31 | 2022-04-26 | 核工业北京地质研究院 | A method for accessing, displaying and managing MapGIS and ArcGIS services based on OGC standards |
| CN115604028A (en) * | 2022-11-28 | 2023-01-13 | 北京鸿迪鑫业科技有限公司（Cn） | Cloud server data security protection system |
| CN116910015B (en) * | 2023-09-12 | 2024-01-19 | 苏州浪潮智能科技有限公司 | Storage platform service method, device, equipment and storage medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102708316A (en) * | 2012-04-19 | 2012-10-03 | 北京华胜天成科技股份有限公司 | Method for isolating data in multi-tenant architecture |
| CN102307185B (en) * | 2011-06-27 | 2015-02-25 | 北京大学 | Data isolation method used in storage cloud |
| CN103067406B (en) * | 2013-01-14 | 2015-07-22 | 暨南大学 | Access control system and access control method between public cloud and private cloud |
| CN105591863A (en) * | 2014-10-20 | 2016-05-18 | 中兴通讯股份有限公司 | Method and device for realizing interworking between virtual private cloud network and external network |
-
2016
- 2016-09-07 CN CN201610807010.5A patent/CN106411857B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102307185B (en) * | 2011-06-27 | 2015-02-25 | 北京大学 | Data isolation method used in storage cloud |
| CN102708316A (en) * | 2012-04-19 | 2012-10-03 | 北京华胜天成科技股份有限公司 | Method for isolating data in multi-tenant architecture |
| CN103067406B (en) * | 2013-01-14 | 2015-07-22 | 暨南大学 | Access control system and access control method between public cloud and private cloud |
| CN105591863A (en) * | 2014-10-20 | 2016-05-18 | 中兴通讯股份有限公司 | Method and device for realizing interworking between virtual private cloud network and external network |
Non-Patent Citations (3)
| Title |
|---|
| 一种基于虚拟隔离机制的安全私有云存储系统;鲍爱华等;《计算机科学》;20140115(第1期);第202-207页 |
| 云GIS平台构建的关键技术研究;唐权等;《测绘与空间地理信息》;20160325(第3期);第32-36页 |
| 基于ArcGIS的云GIS平台设计方案研究;曹全龙等;《测绘与空间地理信息》;20141025;第37卷(第10期);第36-38页 |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106411857A (en) | 2017-02-15 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106411857B (en) | A kind of private clound GIS service access control method based on virtual isolation mech isolation test | |
| CN108293045B (en) | Single sign-on identity management between local and remote systems | |
| US10623406B2 (en) | Access authentication for cloud-based shared content | |
| US9047462B2 (en) | Computer account management system and realizing method thereof | |
| US9787659B2 (en) | Techniques for secure access management in virtual environments | |
| US10148637B2 (en) | Secure authentication to provide mobile access to shared network resources | |
| US8978122B1 (en) | Secure cross-tenancy federation in software-as-a-service system | |
| US9998446B2 (en) | Accessing a cloud-based service platform using enterprise application authentication | |
| RU2598324C2 (en) | Means of controlling access to online service using conventional catalogue features | |
| CN105247830B (en) | Provides mobile device management capabilities | |
| CN105991734B (en) | A kind of cloud platform management method and system | |
| US9215225B2 (en) | Mobile device locking with context | |
| CN105247531A (en) | Providing managed browser | |
| CN106375323A (en) | Kerberos identity authentication method in multi-tenant mode | |
| JP2015537269A (en) | LDAP-based multi-tenant in-cloud identity management system | |
| CN105074713A (en) | Systems and methods for identifying a secure application when connecting to a network | |
| US9130904B2 (en) | Externally and internally accessing local NAS data through NSFV3 and 4 interfaces | |
| US10911299B2 (en) | Multiuser device staging | |
| CN110636057A (en) | Application access method and device and computer readable storage medium | |
| RU2415466C1 (en) | Method of controlling identification of users of information resources of heterogeneous computer network | |
| CN106375334A (en) | An Authentication Method for Distributed System | |
| KR20060062319A (en) | Home network gateway that manages authority assignment and access for each user and control method | |
| US11411813B2 (en) | Single user device staging | |
| Wei et al. | A VDI system based on cloud stack and active directory | |
| CN107608768A (en) | Resource access method, electronic equipment and storage medium based on command mode |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CB03 | Change of inventor or designer information | ||
| CB03 | Change of inventor or designer information |
Inventor after: Ge Ying Inventor before: Ge Ying Inventor before: AISIKAER.ABULIMITI Inventor before: Chen Gangrui |
|
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20211227 Address after: 200241 330, floor 3, building 2, No. 588, Zixing Road, Minhang District, Shanghai Patentee after: Shanghai Nongsheng Intelligent Technology Co.,Ltd. Address before: No.8, Fucheng West Road, Jiangning Development Zone, Nanjing, Jiangsu Province Patentee before: HOHAI University |
|
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20240329 Address after: Room 05, 12th Floor, Building D2, No. 32 Dazhou Road, Yuhuatai District, Nanjing City, Jiangsu Province, 210000 Patentee after: Nanjing Pintu Surveying and Mapping Technology Co.,Ltd. Country or region after: China Address before: 200241 330, floor 3, building 2, No. 588, Zixing Road, Minhang District, Shanghai Patentee before: Shanghai Nongsheng Intelligent Technology Co.,Ltd. Country or region before: China |