Data access control method and system based on attribute encryption and zero-trust architecture

Abstract

The invention provides a data access control method and system based on attribute encryption and a zero-trust architecture, and relates to the technical field of information security. User identity registration is carried out, an SM2 signature key pair is generated, and an SM2 public key, identity information and attributes are sent to a server; the server generates a user private key based on the identity information and the attribute, encrypts the user private key and sends a CP-ABE private key of the user; the method comprises the following steps: acquiring user access login information and an identity label, verifying the user identity, encrypting a challenge message by using a preset access strategy and sending the challenge message to a user side, and the user side decrypting by using the attribute of a ciphertext strategy and a CP-ABE private key to acquire a challenge message plaintext and sending the challenge message plaintext to a server side to realize signature verification; and when the user logs in next time, the state and the context information of the user side are obtained in real time, the access strategy is dynamically adjusted based on the real-time state and the context information of the user side, the adjusted access strategy is applied to the user identity verification and signature process, and continuous monitoring and evaluation are carried out.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and in particular to a data access control method and system based on attribute encryption and zero-trust architecture. Background Art

[0002] The statements in this section merely provide background information related to the present disclosure and do not necessarily constitute prior art.

[0003] As system data becomes increasingly digital, it becomes increasingly important to access and store data securely. Traditional security models, such as those based on network perimeters, often rely on physical or network layer security, such as firewalls, VPNs, etc., to authenticate users logging into the system. Access control methods such as access control lists (ACLs) and role-based access control (RBAC) become difficult to manage and scale in dynamic and distributed environments.

[0004] However, with the rise of mobile computing cloud services, boundaries are blurred, and data access patterns have become more complex and diverse. Current access control methods have the following problems:

[0005] 1. Traditional access control mechanisms are not able to handle dynamic and distributed access requests well. Moreover, as the organization changes and business needs evolve, policies may need to be updated frequently, which requires continuous management and monitoring.

[0006] 2. Fine-grained data access control methods increase the complexity of configuration and management. Implementing and maintaining a zero-trust, fine-grained access control system may require additional resources such as hardware, software, and manpower, thereby increasing costs.

[0007] 3. Data access control relies on fixed, pre-defined roles and access control lists, and lacks fine-grained and dynamic data access control.

[0008] 4. In the traditional security model, users can access the system after passing identity authentication, but data may be at risk of leakage during transmission and storage. Summary of the invention

[0009] In order to solve the above problems, the present disclosure provides a data access control method and system based on attribute encryption and zero trust architecture, which uses a ciphertext policy-based attribute encryption (CP-ABE) identity authentication mechanism to complete login, generates dynamic access policies based on zero trust architecture and CP-ABE algorithm, and dynamically adjusts access rights in combination with the user's real-time status and context information.

[0010] According to some embodiments, the present disclosure adopts the following technical solutions:

[0011] Data access control methods based on attribute encryption and zero trust architecture include:

[0012] System initialization;

[0013] Perform user identity registration, generate SM2 signature key pair, and send SM2 public key, identity information and attributes to the server; the server generates user private key based on identity information and attributes, encrypts and sends user CP-ABE private key;

[0014] Obtain user access login information and identity, the server verifies the user identity, encrypts the challenge message using the pre-set access policy and sends the challenge message to the client. The client uses the attributes of the ciphertext policy and the CP-ABE private key to decrypt the challenge message plaintext and sends it to the server for signature verification.

[0015] The next time you log in, the user-side status and context information are obtained in real time, the access policy is dynamically adjusted based on the real-time user-side status and context information, and the adjusted access policy is applied to the user authentication and signing process, and continuous monitoring and evaluation are performed.

[0016] According to some embodiments, the present disclosure adopts the following technical solutions:

[0017] Data access control system based on attribute encryption and zero trust architecture, including:

[0018] Initialization module, used for system initialization;

[0019] The registration and login module is used to register the user identity, generate the SM2 signature key pair, and send the SM2 public key, identity information and attributes to the server; the server generates the user private key based on the identity information and attributes, and sends the user CP-ABE private key after encryption;

[0020] The signature verification module is used to obtain the user's access login information and identity. The server verifies the user's identity, encrypts the challenge message using the pre-set access policy, and sends the challenge message to the user. The user uses the attributes of the ciphertext policy and the CP-ABE private key to decrypt the challenge message plaintext and send it to the server for signature verification.

[0021] The dynamic adjustment module is used to obtain the user-side status and context information in real time during the next login, dynamically adjust the access policy based on the real-time user-side status and context information, apply the adjusted access policy to the user identity authentication and signature process, and conduct continuous monitoring and evaluation.

[0022] According to some embodiments, the present disclosure adopts the following technical solutions:

[0023] A non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, the data access control method based on attribute encryption and zero trust architecture is implemented.

[0024] According to some embodiments, the present disclosure adopts the following technical solutions:

[0025] An electronic device comprises: a processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory so that the electronic device executes the data access control method based on attribute encryption and zero trust architecture.

[0026] Compared with the prior art, the present invention has the following beneficial effects:

[0027] The data access control method based on attribute encryption and zero trust architecture disclosed in the present invention, when ciphertext policy-based attribute encryption (CP-ABE) is combined with zero trust architecture, can create a powerful, dynamic, context-related data access control system. In a zero trust architecture, contextual factors are evaluated, such as the user's device status, current location, access time, etc. According to the results of the context evaluation, the user's policy is dynamically adjusted or changed. For example, if a user accesses from an unknown geographical location, their ability to access "data type: sensitive" will be restricted. When the user's attributes have not changed, only the policy has changed: Policy tightening (stricter): If the access policy becomes stricter, that is, more attributes are required to decrypt the data, the user's existing private key may no longer meet the requirements of the new policy. The user will not be able to decrypt the data, but there is no need to regenerate the private key. Policy relaxation (more relaxed): If the access policy becomes more relaxed, that is, the required attributes are reduced, the user can continue to use the existing private key to decrypt the data.

[0028] The data access control method based on attribute encryption and zero trust architecture disclosed in the present invention proposes attribute-based encryption, where only users who meet specific attributes can decrypt messages, which greatly improves the security of data. The policy is adjusted in real time according to the user's status and context information to ensure that only users who meet the current security conditions can access the data. By generating random challenge messages and combining mechanisms such as timestamps, replay attacks can be effectively prevented, thereby enhancing security.

[0029] The data access control method based on attribute encryption and zero trust architecture disclosed in this disclosure can dynamically generate access policies based on real-time collected information to meet the needs of different environments and scenarios. The access rights are dynamically adjusted based on contextual information such as geographic location, device type, time, network status, etc., which improves the intelligence of the system and improves flexibility and adaptability.

[0030] The data access control method based on attribute encryption and zero-trust architecture disclosed in this disclosure allows users to seamlessly access system resources without repeatedly verifying their identities when they comply with the policy. It generates personalized security policies based on the user's behavior patterns and device conditions to improve the user experience.

[0031] The data access control method based on attribute encryption and zero trust architecture disclosed in this disclosure re-evaluates the user's status and context information for each access to ensure continuous verification and dynamic authorization. Only the minimum permissions currently required by the user are given to reduce potential security risks. The access policy template can be flexibly configured and adjusted according to business needs to adapt to different application scenarios. The system can dynamically adjust the policy as the user's attributes and behaviors change to ensure the scalability and adaptability of the system.

[0032] The disclosed data access control method based on attribute encryption and zero trust architecture can verify attribute-based encryption in a distributed environment, reducing the risk of single point failure; it combines multiple context information for policy verification, and provides a multi-level security protection mechanism. The user's private key is generated based on its attributes, and there is no need to manage keys for each user separately, which simplifies the key management process. User attributes can be flexibly updated and revoked, thereby dynamically adjusting the user's access rights. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The accompanying drawings constituting a part of the present disclosure are used to provide a further understanding of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure.

[0034] Figure 1 This is a flowchart of system initialization and user registration in an embodiment of the present disclosure;

[0035] Figure 2 A flowchart of user login verification according to an embodiment of the present disclosure;

[0036] Figure 3 The following is a basic flow chart of the dynamic access strategy of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0037] The present disclosure is further described below in conjunction with the accompanying drawings and embodiments.

[0038] It should be noted that the following detailed descriptions are all illustrative and are intended to provide further explanation of the present disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present disclosure belongs.

[0039] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0040] Example 1

[0041] In one embodiment of the present disclosure, a data access control method based on attribute encryption and zero trust architecture is provided, including:

[0042] System initialization;

[0043] Perform user identity registration, generate SM2 signature key pair, and send SM2 public key, identity information and attributes to the server; the server generates user private key based on identity information and attributes, encrypts and sends user CP-ABE private key;

[0044] Obtain user access login information and identity, the server verifies the user identity, encrypts the challenge message using the pre-set access policy and sends the challenge message to the client. The client uses the attributes of the ciphertext policy and the CP-ABE private key to decrypt the challenge message plaintext and sends it to the server for signature verification.

[0045] The next time you log in, the user-side status and context information are obtained in real time, the access policy is dynamically adjusted based on the real-time user-side status and context information, and the adjusted access policy is applied to the user authentication and signing process, and continuous monitoring and evaluation are performed.

[0046] As an embodiment, the present invention discloses a data access control method based on attribute encryption and zero trust architecture, and implements the identity authentication function of the logged-in user based on attribute encryption (CP-ABE) technology based on ciphertext policy (CP-ABE) technology and zero trust architecture, implements a dynamic and context-related data access control method, solves how to ensure the confidentiality and integrity of data in an untrusted environment, and how to simplify the management and implementation of access control. The specific process is as follows:

[0047] Step 1. System initialization

[0048] 1) Choose an elliptic curve over a finite field and define two cyclic groups G0, G1 and G T , they all have the same large prime order P. Then, establish a bilinear mapping: e:G0×G1→G T, the generators of G0 and G1 are P1 and P2 respectively, which are global variables. P and Z P The set S of elements in defines the Lagrange coefficients:

[0049]

[0050] 2) Choose a hash function: Choose or define several hash functions that map the input to a suitable domain, {0,1} * →G0

[0051] 3) Generate system parameters and master key. Select a bilinear group G0 with a prime order p of generator g. Next, select two random exponents α, β∈Z P , the public key is published as follows:

[0052]

[0053] The master key MK is: (β,g β ).

[0054] Step 2: User registration and key distribution

[0055] 1) When a user registers, an SM2 signature key pair is generated, and the public key and necessary identity information (such as work number, identity ID, email address, etc.), as well as related attributes (such as department, role, location, etc.) are sent to the identity and access management module (IAM) on the server. The main function of the IAM module is to manage user identities, control user access rights to resources, and ensure that only authorized users can access specific resources.

[0056] 2) The Identity and Access Management module (IAM) verifies the user's identity. After the identity verification is passed, the identity attributes are distributed according to the user's identity and the attribute policy customized by the system, such as: "(Administrator AND Weekly Work Hours) OR (Technician AND Device Type = Mobile Device)"

[0057] 3) Based on the user's attributes, the master key, and the previously selected random number, PAC calculates the user's private key. The key generation algorithm takes a set of attributes S as input and outputs a key represented by this set. For each attribute of the user, PAC selects a random number r∈Z P , for each attribute j∈S, select r j ∈Z P , calculate the user's private key:

[0058]

[0059] 4) After the private key is generated, the public key of the user's SM2 signature key is used to encrypt the private key, necessary identity information and attributes, and the encrypted ciphertext and CP-ABE private key are sent to the user. The user uses his own decryption to obtain the corresponding information and save it.

[0060] Step 3: User authentication for logging into the platform, including, Figure 2 As shown:

[0061] 1) User provides an identity: When a user attempts to log into a system, they first need to provide their identity (such as a user name or user ID). This identity is used to determine the user's identity and find the user information and attributes associated with it.

[0062] 2) The system searches for user information: Based on the identity provided by the user, the system searches for the corresponding user information in the stored user database. User information usually includes a set of user attributes and information related to the private key.

[0063] 3) User identity verification, including:

[0064] a. Generate challenge message: As the challenger, the system randomly generates a 256-bit random number each time it initiates a challenge to prevent replay attacks. It collects information such as the user's geographic location, device type, time, network status, and user behavior in real time. Together with the random number, it forms a 512-bit challenge message.

[0065] b. Encrypted challenge message: The system uses a pre-set access policy (user attributes and other information) to encrypt the challenge message. This access policy is designed based on the user attribute set to ensure that only the user can decrypt the message.

[0066] c. Send encrypted message: The system sends the encrypted challenge message to the user. After receiving the encrypted message, the user uses the private key to decrypt the message.

[0067] d. User decrypts the message: The user uses his private key to decrypt the challenge message. If the user's private key is generated based on the correct attribute set and satisfies the encryption policy, the decryption is successful and the user obtains the original challenge message.

[0068] e. Return decryption result: The user signs the decrypted challenge message with his own SM2 private key and returns the signed message to the system. The system verifies the signed message with the user's SM2 public key. If the verification is successful, the user can continue to log in to the system and complete the operation.

[0069] Step 4: Dynamic and contextual data access control method. When ciphertext policy-based attribute encryption (CP-ABE) is combined with a zero trust architecture, a powerful, dynamic, and contextual data access control system can be created.

[0070] In a zero trust architecture, contextual factors are evaluated, such as the user's device status, current location, access time, etc. Based on the results of the contextual evaluation, the user's policy is dynamically adjusted or changed. For example, if a user accesses from an unknown geographic location, their ability to access "Data Type: Sensitive" is restricted.

[0071] When the user attributes have not changed and only the policy has changed, it includes:

[0072] Policy tightening (stricter): If the access policy becomes stricter, that is, more attributes are required to decrypt data, the user's existing private key may no longer meet the requirements of the new policy. The user will not be able to decrypt the data, but will not need to regenerate the private key.

[0073] Policy relaxation (more permissive): If the access policy becomes more permissive, i.e., reduces the required attributes, users can continue to decrypt data using existing private keys.

[0074] As an embodiment, the generation of dynamic access policies based on zero trust architecture and CP-ABE algorithm dynamically adjusts access rights in combination with the user's real-time status and context information. The following is a specific operation method:

[0075] 1) Collect the user’s real-time status and context information, such as:

[0076] Geolocation: Determine the user's current location through GPS or IP address.

[0077] Device type: Detect the type of device used by the user (such as PC, mobile phone, tablet, etc.).

[0078] Time: The time period of the current visit.

[0079] Network status: The type and security of the network the user is connected to (e.g., Wi-Fi, cellular data, VPN, etc.).

[0080] User behavior: historical access records and behavior patterns.

[0081] 2) Define access policy template

[0082] A set of attribute-based access policy templates are predefined, and these policies can be dynamically adjusted based on different context information. For example:

[0083] Geographical location: location=="office"OR location=="home"

[0084] Device type: device == "trusted_device"

[0085] Time: time>="09:00"AND time<="18:00"

[0086] Network status: network == "secure"

[0087] User behavior: behavior == "normal"

[0088] 3) Dynamically generate access policies

[0089] Dynamically generate access policies based on the real-time status and context information collected. For example:

[0090] If users are in the office using trusted devices and connected to a secure network, you can create a more relaxed access policy.

[0091] If the user is outside of work hours or using an untrusted device, you can generate a more restrictive access policy.

[0092] 4) Encrypt the challenge message using dynamic policy

[0093] When a user logs in, the dynamically generated access policy is used as the encryption policy to encrypt the challenge message.

[0094] 5) Real-time evaluation and adjustment

[0095] Every time a user attempts to access the system, the current state and context information is evaluated in real time, and the loose or strict access policy is dynamically adjusted. For example:

[0096] When users are in different geographical locations, the system automatically switches to the corresponding access policy.

[0097] Based on changes in user behavior patterns, the system will dynamically adjust policies to respond to potential security threats.

[0098] 6) Strategy execution and monitoring

[0099] Apply dynamically generated access policies to the system's authentication and authorization process, and conduct continuous monitoring and evaluation to ensure the effectiveness and security of the policies. For example:

[0100] When abnormal behavior is detected, the system can instantly adjust access policies to limit user access rights.

[0101] Continuously optimize access policy templates and dynamic adjustment mechanisms through log recording and analysis.

[0102] Step 5: Logging and Monitoring

[0103] Apply dynamically generated access policies to the system's authentication and authorization process, and conduct continuous monitoring and evaluation to ensure the effectiveness and security of the policies. For example:

[0104] When abnormal behavior is detected, the system can instantly adjust access policies to limit user access rights.

[0105] Continuously optimize access policy templates and dynamic adjustment mechanisms through log recording and analysis.

[0106] Example 2

[0107] In one embodiment of the present disclosure, a data access control system based on attribute encryption and zero trust architecture is provided, including:

[0108] Initialization module, used for system initialization;

[0109] The registration and login module is used to register the user identity, generate the SM2 signature key pair, and send the SM2 public key, identity information and attributes to the server; the server generates the user private key based on the identity information and attributes, and sends the user CP-ABE private key after encryption;

[0110] The signature verification module is used to obtain the user's access login information and identity. The server verifies the user's identity, encrypts the challenge message using the pre-set access policy, and sends the challenge message to the user. The user uses the attributes of the ciphertext policy and the CP-ABE private key to decrypt the challenge message plaintext and send it to the server for signature verification.

[0111] The dynamic adjustment module is used to obtain the user-side status and context information in real time during the next login, dynamically adjust the access policy based on the real-time user-side status and context information, apply the adjusted access policy to the user identity authentication and signature process, and conduct continuous monitoring and evaluation.

[0112] Example 3

[0113] In one embodiment of the present disclosure, a non-transitory computer-readable storage medium is provided, wherein the non-transitory computer-readable storage medium is used to store computer instructions, and when the computer instructions are executed by a processor, the data access control method based on attribute encryption and zero trust architecture is implemented.

[0114] Example 4

[0115] In one embodiment of the present disclosure, an electronic device is provided, including: a processor, a memory, and a computer program; wherein the processor is connected to the memory, and the computer program is stored in the memory. When the electronic device is running, the processor executes the computer program stored in the memory, so that the electronic device executes the data access control method based on attribute encryption and zero trust architecture.

[0116] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0117] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0118] Although the above describes the specific implementation methods of the present disclosure in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present disclosure. Technical personnel in the relevant field should understand that on the basis of the technical solution of the present disclosure, various modifications or variations that can be made by those skilled in the art without creative work are still within the scope of protection of the present disclosure.

Claims

1. A data access control method based on attribute encryption and zero trust architecture, characterized in that: include: System initialization; Register the user identity, generate the SM2 signature key pair, and send the SM2 public key, identity information and attributes to the server; The server generates a user private key based on the identity information and attributes, and sends the user's CP-ABE private key after encryption; Obtain user access login information and identity, the server verifies the user identity, encrypts the challenge message using the pre-set access policy and sends the challenge message to the client. The client uses the attributes of the ciphertext policy and the CP-ABE private key to decrypt the challenge message plaintext and sends it to the server for signature verification. The next time you log in, the user-side status and context information are obtained in real time, the access policy is dynamically adjusted based on the real-time user-side status and context information, and the adjusted access policy is applied to the user authentication and signing process, and continuous monitoring and evaluation are performed.

2. The data access control method based on attribute encryption and zero trust architecture as claimed in claim 1, characterized in that: System initialization includes: selecting an elliptic curve on a finite field, defining two cyclic groups, and establishing a bilinear mapping: e:G0×G1→G T , the generators of G0 and G1 are P1 and P2 respectively, as global variables, and the Lagrange coefficients are defined at the same time; a hash function is selected and the input is mapped to a suitable domain; system parameters and master keys are generated.

3. The data access control method based on attribute encryption and zero trust architecture as claimed in claim 1, characterized in that: When a user registers, an SM2 signature key pair is generated, and the public key, identity information, and related attributes are sent to the server. After identity authentication is passed, identity attributes are distributed according to the user identity and the system-customized attribute policy. Based on the user attributes, the master key, and the previously selected random number, PAC calculates the user's private key, taking a set of attributes S as input and outputting a key represented by the set. For each attribute of the user, PAC selects a random number, selects a random number for each attribute, and calculates the user's private key.

4. The data access control method based on attribute encryption and zero trust architecture as claimed in claim 3, characterized in that: After the private key is generated, the private key, identity information and attributes are encrypted using the public key of the user's SM2 signature key pair, and the encrypted ciphertext is sent to the user. The user uses his own decryption to obtain the corresponding information and save it.

5. The data access control method based on attribute encryption and zero trust architecture as claimed in claim 1, characterized in that: When performing user identity authentication, the server acts as the challenger and randomly generates a 256-bit random number each time a challenge is initiated. It collects the user's geographic location, device type, time, network status, and user behavior information in real time to form a 512-bit challenge information with the random number.

6. The data access control method based on attribute encryption and zero trust architecture as claimed in claim 5, characterized in that: The server encrypts the challenge message using a preset access policy and sends the encrypted challenge message to the user. After receiving the encrypted message, the user uses the private key to decrypt the message.

7. The data access control method based on attribute encryption and zero trust architecture as claimed in claim 5, characterized in that: The user uses his private key to decrypt the challenge message. If the user's private key is generated according to the correct attribute set and meets the encryption policy, the decryption is successful and the user obtains the original challenge message. The user signs the decrypted challenge message with his own SM2 private key and returns the signed message to the server. The server uses the user's SM2 public key to verify the signed message. If the verification is successful, the user can continue to log in and complete the operation.

8. Data access control system based on attribute encryption and zero trust architecture, characterized in that: include: Initialization module, used for system initialization; The registration and login module is used to register the user identity, generate the SM2 signature key pair, and send the SM2 public key, identity information and attributes to the server; the server generates the user private key based on the identity information and attributes, and sends the user CP-ABE private key after encryption; The signature verification module is used to obtain the user's access login information and identity. The server verifies the user's identity, encrypts the challenge message using the pre-set access policy, and sends the challenge message to the user. The user uses the attributes of the ciphertext policy and the CP-ABE private key to decrypt the challenge message plaintext and send it to the server for signature verification. The dynamic adjustment module is used to obtain the user-side status and context information in real time during the next login, dynamically adjust the access policy based on the real-time user-side status and context information, apply the adjusted access policy to the user identity authentication and signature process, and conduct continuous monitoring and evaluation.

9. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by the processor, the data access control method based on attribute encryption and zero trust architecture as described in any one of claims 1-7 is implemented.

10. An electronic device, characterized in that: include: A processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory so that the electronic device executes the data access control method based on attribute encryption and zero trust architecture as described in any one of claims 1-7.

Images