A Dynamic Access Control Method Facing Internal Attacks

Abstract

The invention discloses a dynamic access control framework for internal attacks, belonging to the technical field of information security access control, including: submission of access requests, calculation of user enabled roles, calculation of role enabled permissions, selection of enabled roles, selection of candidate uses Reduction of functional roles, calculation of risk value, using the environment model to evaluate the satisfiability of the environment constraints in the access control strategy, realize the dynamic adjustment of user permissions, and prevent illegal users from accessing, and then, according to the policy constraints and risk analysis, Restrict the scope of authority of legitimate users to avoid internal attacks by malicious users. The present invention realizes triple control on access requests by analyzing environmental information, policy constraints, and access risks, can prevent illegal and malicious access behaviors in time, protect network resources more effectively, and ensure safe and efficient operation of the system.

Description

technical field [0001] The invention relates to a dynamic access control method, in particular to an internal attack-oriented dynamic access control method, and belongs to the technical field of information security access control. Background technique [0002] In order to correctly authorize all kinds of information resources on the network, at present, researchers mainly use access control mechanisms to block illegal users from accessing resources. But in real life, not all legitimate users are trusted users, and some legitimate users may abuse the obtained permissions and damage the use of enterprises. , 28% of respondents said they had suffered internal attacks, and 32% of respondents believed that internal attacks were more harmful than external attacks. [0003] The role-based access control model RBAC can effectively reduce the complexity of authorization management compared with other access control models, such as mandatory access control and autonomous access cont...

AI Technical Summary

Problems solved by technology

[0004] At present, the existing dynamic access control model dynamically adjusts the user's authority through context information to prevent external attacks brought by unauthorized users to the system. The existing risk-aware access control method analyzes the user's historical access behavior, Restricting users' access capabilities can solve internal attacks to a certain extent, but most of them only consider the risks brought by current access requests to the system, and do not consider the cumulative risks of users. At the same time, they do not consider strategic constraints.

Images