System, method, and apparatus for data access in a cloud computing environment

• US 10,372,928 B2
• Filed: 08/24/2016
• Issued: 08/06/2019
• Est. Priority Date: 08/24/2015
• Status: Active Grant

• Current Assignee: Alibaba Group Holding Ltd.
• Original Assignee: Alibaba Group Holding Ltd.
• Inventors: Yuan, Panfeng, Guo, Dong, Zhang, Wei, Pan, Zihua, Chen, Tingliang
• Primary Examiner(s): Getachew, Abiy
• Application Number:
  US15/246,303
• Publication Number:
  US 20170061149A1
• Time in Patent Office: 1,077 Days
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A data access method in a cloud computing environment is disclosed. The method may comprise, in a service object space of the cloud computing environment, receiving a request of a user for accessing a data package, the request including a user identification, determining a service object space of the data package corresponding to the request, and providing the data package to the user according to the service object space of the data package and the user identification.

Claims

1. A data access method in a cloud computing environment including one or more service object spaces, comprising:

receiving a request of a user for accessing a data package, wherein the request includes a user identification;

determining, among the one or more service object spaces, a service object space of the data package corresponding to the request; and

providing the data package to the user according to the service object space of the data package and the user identification, wherein;

the data package comprises an internal data package of the service object space and an external data package of the service object space, and the external data package is used among the one or more service object spaces, and

providing the data package to the user according to the service object space of the data package and the user identification comprises;

using the user identification to determine that the user has a designated access authorization configured based on the user identification, and

using the designated access authorization to provide the external data package of the service object space to the user.

2. The method according to claim 1, wherein:

determining the service object space of the data package corresponding to the request further comprises;

determining whether the data package corresponding to the request is a data package of a current service object space,

in response to the data package corresponding to the request being the data package of the current service object space, determining that the data package corresponding to the request is the internal data package of the service object space, and

in response to the data package corresponding to the request being not the data package of the current service object space, determining that the data package corresponding to the request is the external data package of the service object space.

3. The method according to claim 2, wherein:

the service object space comprises one or more service object types corresponding to the data package;

a first access authorization is determined based on the user identification and the service object types; and

providing the data package to the user according to the service object space of the data package and the user identification comprises;

in response to the data package being the internal data package of the service object space, using the user identification to determine that the user has the first access authorization;

determining a service object type corresponding to the internal data package of the service object space; and

under the service object type, using the first access authorization to provide the internal data package of the service object space to the user.

4. The method according to claim 3, wherein:

the service object type comprises a development type service object and a production type service object;

a first access authorization in the development type service object comprises;

a shared-type authorization and an isolated-type authorization;

the first access authorization comprises;

reading, writing, and management; and

under the service object type, using the first access authorization to provide the internal data package of the service object space to the user comprises;

under the development type service object, in response to the user'"'"'s access authorization being a shared-type authorization, permitting the user to read/write the internal data package of the development type service object;

under the development type service object, in response to the user'"'"'s access authorization being an isolated-type authorization, permitting the user to read/write a designated internal data package of the development type service object; and

under the production type service object, permitting the user to read/write the internal data package of the development type service object, but prohibiting the user from managing the internal data package of the development type service object.

5. The method according to claim 1, wherein:

the external data package of the service object space comprises a designated field;

the external data package of the service object space is provided by a data provider; and

using the designated access authorization to provide the external data package of the service object space to the user comprises;

receiving a field access request for the external data package of the service object space;

using the access authorization to send an approval request, based on the field access request, to the data provider;

in response to receiving an approval to the approval request from the data provider, permitting the user to access the external data package; and

in response to receiving a rejection to the approval request from the data provider, prohibiting the user from accessing the external data package.

6. An apparatus for accessing data in a cloud computing environment including one or more service object spaces, comprising:

a memory storing instructions; and

one or more processors configured to execute the set of instructions to cause the apparatus to perform;

receiving a request of a user for accessing a data package, wherein the request includes a user identification;

determining, among the one or more service object spaces, a service object space of the data package corresponding to the request; and

providing the data package to the user according to the service object space of the data package and the user identification, wherein;

the data package comprises an internal data package of the service object space and an external data package of the service object space, and the external data package is used among the one or more service object spaces, and

in providing the data package to the user, the one or more processors are further configured to execute the set of instructions to cause the apparatus to perform;

using the user identification to determine that the user has a designated access authorization configured based on the user identification, and

using the designated access authorization to provide the external data package of the service object space to the user.

7. The apparatus according to claim 6, wherein the one or more processors are further configured to execute the set of instructions to cause the apparatus to perform:

if the data package corresponding to the request is determined to be the data package of the current service object space, determining that the data package corresponding to the request is the internal data package of the service object space, and

if the data package corresponding to the request is determined to not be the data package of the current service object space, determining that the data package corresponding to the request is the external data package of the service object space.

8. The apparatus according to claim 7, wherein:

the service object space comprises one or more service object types corresponding to the data package;

a first access authorization is determined based on the user identification and the service object types; and

the one or more processors are further configured to execute the set of instructions to cause the apparatus to perform;

if the data package is the internal data package of the service object space, using the user identification to determine that the user has the first access authorization;

determining a service object type corresponding to the internal data package of the service object space; and

under the service object type, using the first access authorization to provide the internal data package of the service object space to the user.

9. The apparatus to claim 8, wherein:

the service object type comprises a development type service object and a production type service object;

a first access authorization in the development type service object comprises;

a shared-type authorization and an isolated-type authorization;

the first access authorization comprises;

reading, writing, and management; and

the one or more processors are further configured to execute the set of instructions to cause the apparatus to perform;

under the development type service object, if the user'"'"'s access authorization is a shared-type authorization, permitting the user to read/write the internal data package of the development type service object;

under the development type service object, if the user'"'"'s access authorization is an isolated-type authorization, permitting the user to read/write a designated internal data package of the development type service object; and

under the production type service object, permitting the user to read/write the internal data package of the development type service object, but prohibiting the user from managing the internal data package of the development type service object.

10. The apparatus according to claim 6, wherein:

the external data package of the service object space comprises a designated field;

the external data package of the service object space is provided by a data provider; and

the one or more processors are further configured to execute the set of instructions to cause the apparatus to perform;

receiving a field access request for the external data package of the service object space;

using the access authorization to send an approval request, based on the field access request, to the data provider;

if an approval to the approval request is received from the data provider, permitting the user to access the external data package; and

if receiving a rejection to the approval request is received from the data provider, prohibiting the user from accessing the external data package.

11. The apparatus according to claim 6, wherein:

a subject is configured for an external data package of the service object space;

a second access authorization is configured based on at least one of the user identification, the subject, or a preset authorization relation table; and

the one or more processors are further configured to execute the set of instructions to cause the apparatus to perform;

if the data package is the external data package of the service object space, using the user identification to determine that the user has the second access authorization; and

using the second access authorization to provide the external data package of the service object space to the user.

12. A non-transitory computer readable medium that stores a set of instructions that are executable by at least one processor of a computer system to cause the computer system to perform a method for accessing data in a cloud computing environment including one or more service object spaces, the method comprising:

receiving a request of a user for accessing a data package, wherein the request includes a user identification;

determining, among the one or more service object spaces, a service object space of the data package corresponding to the request; and

providing the data package to the user according to the service object space of the data package and the user identification, wherein;

the data package comprises an internal data package of the service object space and an external data package of the service object space, and the external data package is used among the one or more service object spaces, and

providing the data package to the user according to the service object space of the data package and the user identification comprises;

using the user identification to determine that the user has a designated access authorization configured based on the user identification, and

using the designated access authorization to provide the external data package of the service object space to the user.

13. The non-transitory computer readable medium according to claim 12, wherein:

determining the service object space of the data package corresponding to the request further comprises;

determining whether the data package corresponding to the request is a data package of a current service object space,

in response to the data package corresponding to the request being the data package of the current service object space, determining that the data package corresponding to the request is the internal data package of the service object space, and

in response to the data package corresponding to the request being not the data package of the current service object space, determining that the data package corresponding to the request is the external data package of the service object space.

14. The non-transitory computer readable medium according to claim 13, wherein:

the service object space comprises one or more service object types corresponding to the data package;

a first access authorization is determined based on the user identification and the service object types; and

providing the data package to the user according to the service object space of the data package and the user identification comprises;

in response to the data package being the internal data package of the service object space, using the user identification to determine that the user has the first access authorization;

determining a service object type corresponding to the internal data package of the service object space; and

under the service object type, using the first access authorization to provide the internal data package of the service object space to the user.

15. The non-transitory computer readable medium according to claim 14, wherein:

the service object type comprises a development type service object and a production type service object;

a first access authorization in the development type service object comprises;

a shared-type authorization and an isolated-type authorization;

the first access authorization comprises;

reading, writing, and management; and

under the service object type, using the first access authorization to provide the internal data package of the service object space to the user comprises;

under the development type service object, in response to the user'"'"'s access authorization being a shared-type authorization, permitting the user to read/write the internal data package of the development type service object;

under the development type service object, in response to the user'"'"'s access authorization being an isolated-type authorization, permitting the user to read/write a designated internal data package of the development type service object; and

under the production type service object, permitting the user to read/write the internal data package of the development type service object, but prohibiting the user from managing the internal data package of the development type service object.

16. The non-transitory computer readable medium according to claim 12, wherein:

the external data package of the service object space comprises a designated field;

the external data package of the service object space is provided by a data provider; and

using the designated access authorization to provide the external data package of the service object space to the user comprises;

receiving a field access request for the external data package of the service object space;

using the access authorization to send an approval request, based on the field access request, to the data provider;

in response to receiving an approval to the approval request from the data provider, permitting the user to access the external data package; and

in response to receiving a rejection to the approval request from the data provider, prohibiting the user from accessing the external data package.

17. The non-transitory computer readable medium according to claim 12, wherein:

a subject is configured for an external data package of the service object space;

a second access authorization is configured based on at least one of the user identification, the subject, or a preset authorization relation table; and

providing the data package to the user according to the service object space of the data package and the user identification comprises;

in response to the data package being the external data package of the service object space, using the user identification to determine that the user has the second access authorization; and

using the second access authorization to provide the external data package of the service object space to the user.