Two-level policy decision-based access control method and system

Abstract

The invention discloses a two-level policy decision-based access control method and a two-level policy decision-based access control system, and belongs to the field of access control in information safety. In the method, a local policy decision point (PDP) is deployed at a policy enforcement point (PEP) end, and the local PDP makes a decision for an access request according to a local policy cache, and if the local PDP cannot determine that the decision is a deterministic decision, a central PDP finally finishes the decision according to a system policy library. The system comprises a policydecision server, an attribute publishing point and a plurality of resource servers, wherein a policy enforcement point (PEP) and a local policy decision point (PDP) are deployed on each resource server; and a central policy decision point (PDP) is deployed on the policy decision server. The invention has a good dynamically adjusted elastic system framework, fully utilizes the computing resources of the PEP end, lightens the burden of the central PDP, reduces the network transmission overhead and effectively improves the access control efficiency at extremely low policy update cost.

Description

technical field [0001] The invention belongs to the field of access control in information security, and particularly relates to an access control method and system based on two-level policy decision-making. Background technique [0002] As a security facility to protect resources from illegal access, the efficiency of access control system directly affects the efficiency of the entire system. Most of the current access control systems use the access control architecture in ISO / IEC 10181-3, that is, the policy enforcement point (Policy Enforcement Point, PEP) intercepts the access request initiated by the user, and then submits the access request to the policy decision point (PEP). Policy Decision Point, PDP) to make decisions, and finally the PEP executes the PDP decision. In practical applications, the PEP and the PDP are usually physically separated, so the communication channel between the PEP and the PDP needs to be protected. When the PEP side has a certain computing...

AI Technical Summary

Problems solved by technology

In the SAAM model, PEP does not base its decision-making on access control policies, so the decision-making logic is different from that of PDP. This results in different decision-making logics for SAAM at the PEP side for different access control models, which is harmful to SAAM. The versatility of the

Images