Zero-trust access control strategy generation method and system based on extensible attributes

Abstract

The invention discloses a zero-trust access control strategy generation method and system based on extensible attributes, and the method comprises the steps: constructing an empty dynamic attribute space which comprises subject attributes, object attributes, environment attributes and permission attributes, collecting network security elements of subjects, objects, environments and permissions in a current zero-trust system, and storing the network security elements in the current zero-trust system; extracting basic attributes of each network security element according to user requirements, and adding the basic attributes into a dynamic attribute space; mapping subject attributes, object attributes, environment attributes and authority attributes in the dynamic attribute space with subject information, object information, environment information and authority information collected by the current zero-trust system; and selecting subject attributes, environment attributes, object attributes and permission attributes from the dynamic attribute space according to actual requirements, and configuring an attribute constraint range for each attribute, thereby generating an access control strategy. The problem that the access control strategy is difficult to generate due to the change of the network environment or the change of the user demand is effectively solved.

Description

Technical Field

[0001] The present invention belongs to the field of network security applications, and more specifically, relates to a method and system for generating zero-trust access control policies based on extensible attributes. Background Art

[0002] With the rapid development of cloud computing and big data, the network security boundary has gradually disintegrated, and internal and external threats have become increasingly severe. The traditional boundary security architecture is difficult to cope with, and the zero-trust security architecture has emerged. The core problem of the zero-trust architecture is how to generate access control policies.

[0003] Traditional attribute-based access control policies are difficult to meet the requirements of policy dynamic expansion. When network security elements change and new access control policies need to be configured, product iteration is often required, consuming a large amount of manpower, material resources, and time costs. Summary of the Invention

[0004] In order to overcome the deficiencies in the prior art, the present invention proposes a method and system for generating zero-trust access control policies based on extensible attributes by constructing an extensible attribute space and attribute mapping technology. This method constructs an extensible dynamic attribute space for subjects, objects, environments, and permissions in the zero-trust system according to the security elements of the network environment, and generates access control policies based on the attributes in the attribute space, thereby realizing the dynamic expansion of access control policies and effectively solving the problem of difficulty in generating access control policies due to changes in the network environment or user requirements.

[0005] The object of the present invention can be achieved by the following technical solutions.

[0006] A method for generating zero-trust access control policies based on extensible attributes, comprising the following steps:

[0007] S1 Dynamic Attribute Space Construction

[0008] Classify attributes into four categories: subject attributes, object attributes, environment attributes, and permission attributes. Construct an empty dynamic attribute space according to these four categories of attributes, collect the network security elements of subjects, objects, environments, and permissions in the current zero-trust system, extract the basic attributes of each network security element according to user requirements, and add them to the constructed empty dynamic attribute space; when the network environment changes or user requirements change during the operation of the zero-trust system, the dynamic attribute space can be dynamically increased or updated to achieve the dynamic expansion of the attribute space;

[0009] S2 Extended Attribute Mapping

[0010] Map the subject attributes, object attributes, environment attributes, and permission attributes in the dynamic attribute space to the subject information, object information, environment information, and permission information collected by the current zero-trust system;

[0011] S3 Access Control Policy Generation

[0012] Select subject attributes, environmental attributes, object attributes, and permission attributes from the dynamic attribute space according to actual requirements, and configure the attribute constraint scope for each attribute, so as to generate an access control policy.

[0013] Further, the specific process of step S2 for extended attribute mapping: reserve certain slots for subject information, object information, environmental information, and permission information respectively at the storage determined according to requirements, establish a mapping relationship between the subject attributes, object attributes, environmental attributes, and permission attributes in the dynamic attribute space and the reserved slots of the corresponding subject information, object information, environmental information, and permission information, and configure the corresponding actual values in the mapped slots; when an attribute in the dynamic attribute space is not needed, remove the attribute, and the mapped slot is released at the same time. If new attributes are added, reuse them.

[0014] Further, in step S3, if the current dynamic attribute space cannot meet the requirements, expand the attributes of the dynamic attribute space as needed, map them to the corresponding entity information, and then generate an access control policy; the access control policy is composed of a subject constraint set, an environmental constraint set, an object constraint set, and a permission constraint set.

[0015] The object of the present invention can also be achieved by the following technical solutions.

[0016] A zero-trust access control policy generation system based on extensible attributes, which is composed of a dynamic attribute space construction unit, an extended attribute mapping unit, and an access control policy generation unit;

[0017] The dynamic attribute space construction unit classifies attributes into four categories: subject attributes, object attributes, environmental attributes, and permission attributes, constructs an empty dynamic attribute space according to these four categories of attributes, collects the network security elements of subjects, objects, environments, and permissions in the current zero-trust system, extracts the basic attributes of each network security element according to user requirements, and adds them to the constructed empty dynamic attribute space; when the network environment changes or the user requirements change during the operation of the zero-trust system, the dynamic attribute space can be dynamically increased or updated to achieve the dynamic expansion of the attribute space.

[0018] The extended attribute mapping unit maps the subject attributes, object attributes, environmental attributes, and permission attributes in the dynamic attribute space to the subject information, object information, environmental information, and permission information collected by the current zero-trust system;

[0019] The access control policy generation unit selects subject attributes, environmental attributes, object attributes, and permission attributes from the dynamic attribute space according to actual requirements, and configures an attribute constraint range for each attribute, thereby generating an access control policy. The access control policy consists of a subject constraint set, an environmental constraint set, an object constraint set, and a permission constraint set; if the current dynamic attribute space cannot meet the requirements, the dynamic attribute space is expanded as needed, mapped to the corresponding entity information, and then the access control policy is generated.

[0020] The object of the present invention can be achieved by the following technical solutions.

[0021] A zero-trust system includes a subject, an object, and a zero-trust access control policy generation system. The zero-trust access control policy generation system adopts the above-mentioned zero-trust access control policy generation system based on extensible attributes; when the zero-trust system is running, when a certain subject wants to access a certain object, the real-time data of the current subject, environment, and object are first obtained. These real-time data have been bound to the respective attributes in the generated access control policy during the attribute mapping process in the zero-trust access control policy generation system. Use these real-time data to match the generated access control policy. If an exact match can be made, it means that the current subject can access the object resource through the method in the permission constraint set in this environment.

[0022] The object of the present invention can also be achieved by the following technical solutions.

[0023] An electronic device includes a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the above-mentioned zero-trust access control policy generation method based on extensible attributes or the zero-trust access control policy generation system based on extensible attributes is implemented.

[0024] The object of the present invention can also be achieved by the following technical solutions.

[0025] A computer-readable storage medium stores a computer program thereon. When the computer program is executed by a processor, the above-mentioned zero-trust access control policy generation method based on extensible attributes or the zero-trust access control policy generation system based on extensible attributes is implemented.

[0026] Compared with the prior art, the beneficial effects brought by the technical solution of the present invention are:

[0027] The present invention constructs an extensible dynamic attribute space for the subject, object, environment, and permission in the zero-trust system according to the security elements of the network environment, and generates an access control policy based on the attributes in the attribute space, thereby realizing the dynamic expansion of the access control policy, and effectively solving the problem that it is difficult to generate an access control policy due to changes in the network environment or user requirements.

[0028] The present invention can provide a method for generating fine-grained and scalable access control policies for a zero-trust system. The principle of this method is simple and easy to implement. It can be implemented through software or encapsulated as a component of the zero-trust system and provided for various systems that require access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a schematic diagram of the method for generating zero-trust access control policies based on extensible attributes according to the present invention;

[0030] Figure 2 It is a structural diagram of the dynamic attribute space in the present invention;

[0031] Figure 3 It is a schematic diagram of the extended attribute mapping principle in the present invention;

[0032] Figure 4 It is an example diagram of the access control policy generated by the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0033] The present invention will be further described below with reference to the accompanying drawings.

[0034] As Figure 1 shown, the present invention proposes a method for generating zero-trust access control policies based on extensible attributes, including the following steps:

[0035] S1 Construction of the dynamic attribute space

[0036] The subjects in the network space include users, devices or applications, the objects include resources or applications, the environment includes devices and the software information of the device operation, and the permissions include policy validity period, transmission method, encryption algorithm, etc. The attributes are divided into four categories: subject attributes, object attributes, environmental attributes, and permission attributes. An empty dynamic attribute space is constructed according to these four categories of attributes. The network security elements of the subjects, objects, environment, and permissions in the current zero-trust system are collected, and the basic attributes of each network security element are extracted according to user requirements and added to the constructed empty dynamic attribute space. When the network environment changes or the user requirements change during the operation of the zero-trust system, the dynamic attribute space can be dynamically increased or updated to realize the dynamic expansion of the attribute space.

[0037] For example: subject attributes = {name, role, department, authentication method, user group,...}; object attributes = {resource name, resource type, resource grouping, resource classification level, associated gateway type,...}; environmental attributes = {device location, device type, device source, device operating system, degree of localization,...}; permission attributes = {policy validity period, number of connections, terminal security level, transmission method,...}. The dynamic attribute space is as Figure 2 shown.

[0038] S2 Extended Attribute Mapping

[0039] Mapping the subject attributes, object attributes, environment attributes, and permission attributes in the dynamic attribute space with the subject information, object information, environment information, and permission information collected by the current zero-trust system is equivalent to assigning new attributes to the subject information, object information, environment information, permission information, etc., which are used to match the subject information, object information, environment information, permission information, and access control policies during the operation of the zero-trust system, thereby determining whether the subject can access the object under certain conditions.

[0040] The specific process of extended attribute mapping: reserve certain slots for subject information, object information, environment information, and permission information in the storage location determined according to the needs. After the dynamic attribute space is constructed, establish a mapping relationship between the subject attributes, object attributes, environment attributes, and permission attributes in the dynamic attribute space and the reserved slots of the corresponding subject information, object information, environment information, and permission information, and configure the corresponding actual values ​​in the mapped slots. For example, when the access subject is a user, add an "identity type" attribute to the subject attribute in the attribute space, establish a mapping between the "identity type" of the subject attribute in the attribute space and the unused slot reserved for user information, and configure the corresponding actual value of the "identity type" in the slot (foreign, entity, formal employee, etc.). When an attribute in the dynamic attribute space is not needed, the attribute can be removed, and the mapped slot needs to be released at the same time. If new attributes are added, they can be reused. The principle of extended attribute mapping is as follows: Figure 3 shown.

[0041] S3 access control policy generation

[0042] According to actual needs (i.e., requirements for actual access rights), subject attributes, environment attributes, object attributes, and permission attributes are selected from the dynamic attribute space, and the attribute constraint range is configured for each attribute, thereby generating an access control policy. The access control policy is composed of a subject constraint set, an environment constraint set, an object constraint set, and a permission constraint set. If the current dynamic attribute space cannot meet the needs, the attributes of the dynamic attribute space are expanded as needed and mapped to the corresponding entity information (i.e., subject, object, environment, and permission information), and then the access control policy is generated.

[0043] For example, configure a policy like this: Regular employees of the R&D department can access the database protected by the IPSEC gateway on the company-issued internal security device by logging in through ukey. The number of accesses does not exceed 100, and the data transmission method is tunnel. According to the above method, configure the attributes mentioned in the requirements to the dynamic attribute space, perform attribute mapping, and then generate the corresponding access control policy. Figure 4 shown.

[0044] Based on the above zero-trust access control policy generation method, the present invention also proposes a zero-trust access control policy generation system based on extensible attributes, which consists of a dynamic attribute space construction unit, an extended attribute mapping unit, and an access control policy generation unit.

[0045] The dynamic attribute space construction unit classifies attributes into four categories: subject attributes, object attributes, environmental attributes, and permission attributes. It constructs an empty dynamic attribute space according to these four categories of attributes, collects the network security elements of subjects, objects, environments, and permissions in the current zero-trust system, extracts the basic attributes of each network security element according to user requirements, and adds them to the constructed empty dynamic attribute space. When the network environment changes or user requirements change during the operation of the zero-trust system, the dynamic attribute space can be dynamically increased or updated to achieve the dynamic expansion of the attribute space.

[0046] The extended attribute mapping unit maps the subject attributes, object attributes, environmental attributes, and permission attributes in the dynamic attribute space to the subject information, object information, environmental information, and permission information collected by the current zero-trust system.

[0047] The access control policy generation unit selects subject attributes, environmental attributes, object attributes, and permission attributes from the dynamic attribute space according to actual needs, and configures an attribute constraint range for each attribute, thereby generating an access control policy. The access control policy consists of a subject constraint set, an environmental constraint set, an object constraint set, and a permission constraint set. If the current dynamic attribute space cannot meet the requirements, the dynamic attribute space is expanded according to the needs, mapped to the corresponding entity information, and then the access control policy is generated.

[0048] Based on the above principle process, the present invention also proposes a zero-trust system, including a subject, an object, and a zero-trust access control policy generation system. The zero-trust access control policy generation system adopts the above zero-trust access control policy generation system based on extensible attributes. When the zero-trust system is running, when a certain subject wants to access a certain object, it first obtains the real-time data of the current subject, environment, and object. These real-time data have been bound to each attribute in the generated access control policy during the attribute mapping process of the zero-trust access control policy generation system. Use these real-time data to match the generated access control policy. If an exact match can be made, it means that the current subject can access the object resource through the method in the permission constraint set in this environment.

[0049] In addition, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the above-described method for generating a zero-trust access control policy based on extensible attributes or the system for generating a zero-trust access control policy based on extensible attributes is implemented.

[0050] In addition, the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the above-described method for generating a zero-trust access control policy based on extensible attributes or the system for generating a zero-trust access control policy based on extensible attributes is implemented.

[0051] Although the functions and working processes of the present invention are described above in conjunction with the accompanying drawings, the present invention is not limited to the above specific functions and working processes. The above specific embodiments are merely illustrative rather than restrictive. Under the inspiration of the present invention, those of ordinary skill in the art can also make many forms without departing from the spirit of the present invention and the scope protected by the claims. All of these fall within the protection scope of the present invention.

Claims

1. A method for generating a zero-trust access control policy based on extensible attributes, characterized in that: The following steps are involved: S1 Dynamic Attribute Space Construction Attributes are divided into four categories: subject attributes, object attributes, environment attributes, and permission attributes. An empty dynamic attribute space is constructed based on these four attributes. The network security elements of subject, object, environment, and permission in the current zero-trust system are collected. The basic attributes of each network security element are extracted according to user needs and added to the constructed empty dynamic attribute space. When the network environment changes or user needs change during the operation of the zero-trust system, the dynamic attribute space can be dynamically increased or updated to achieve dynamic expansion of the attribute space; S2 Extended Attribute Mapping Map the subject attributes, object attributes, environment attributes, and permission attributes in the dynamic attribute space with the subject information, object information, environment information, and permission information collected by the current zero-trust system; S3 access control policy generation According to actual needs, subject attributes, environment attributes, object attributes, and permission attributes are selected from the dynamic attribute space, and attribute constraint ranges are configured for each attribute to generate access control policies.

2. The method for generating a zero-trust access control policy based on scalable attributes according to claim 1, characterized in that: The specific process of step S2 extended attribute mapping is as follows: certain slots are reserved for subject information, object information, environment information, and permission information in the storage location determined according to the needs, and mapping relationships are established between the subject attributes, object attributes, environment attributes, and permission attributes in the dynamic attribute space and the reserved slots of the corresponding subject information, object information, environment information, and permission information, and the corresponding actual values ​​are configured in the mapped slots; when an attribute in the dynamic attribute space is not needed, the attribute is removed and the mapped slot is released at the same time. If a new attribute is added, it is reused.

3. The method for generating a zero-trust access control policy based on scalable attributes according to claim 1, characterized in that: In step S3, if the current dynamic attribute space cannot meet the demand, the attributes of the dynamic attribute space are expanded as needed and mapped to the corresponding entity information, and then the access control policy is generated; the access control policy consists of a subject constraint set, an environment constraint set, an object constraint set, and a permission constraint set.

4. A zero-trust access control policy generation system based on the zero-trust access control policy generation method based on scalable attributes as described in claim 1, 2 or 3, characterized in that: It is composed of a dynamic attribute space construction unit, an extended attribute mapping unit, and an access control policy generation unit; The dynamic attribute space construction unit divides attributes into four categories: subject attributes, object attributes, environment attributes, and permission attributes. An empty dynamic attribute space is constructed based on these four attributes. The network security elements of the subject, object, environment, and permission in the current zero-trust system are collected. The basic attributes of each network security element are extracted according to user needs and added to the constructed empty dynamic attribute space. When the network environment changes or user needs change during the operation of the zero-trust system, the dynamic attribute space can be dynamically increased or updated to achieve dynamic expansion of the attribute space. The extended attribute mapping unit maps the subject attributes, object attributes, environment attributes, and permission attributes in the dynamic attribute space with the subject information, object information, environment information, and permission information collected by the current zero trust system; The access control policy generation unit selects subject attributes, environment attributes, object attributes, and permission attributes from the dynamic attribute space according to actual needs, and configures the attribute constraint range for each attribute, thereby generating an access control policy, and the access control policy is composed of a subject constraint set, an environment constraint set, an object constraint set, and a permission constraint set; if the current dynamic attribute space cannot meet the needs, the attributes of the dynamic attribute space are expanded as needed and mapped to the corresponding entity information, and then the access control policy is generated.

5. A zero-trust system, comprising a subject, an object, and a zero-trust access control policy generation system, characterized in that: The zero-trust access control policy generation system adopts the zero-trust access control policy generation system based on extensible attributes as described in claim 4 above; when the zero-trust system is running, a subject wants to access an object, firstly, the real-time data of the current subject, environment and object are obtained, and these real-time data have been bound to each attribute in the generated access control policy during the attribute mapping process of the zero-trust access control policy generation system, and these real-time data are used to match the generated access control policy. If they can be accurately matched, it means that the current subject can access the object resources in the environment through the methods in the permission constraint set.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, it implements the zero-trust access control policy generation method based on extensible attributes or the zero-trust access control policy generation system based on extensible attributes as described in any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for generating a zero-trust access control policy based on extensible attributes or the system for generating a zero-trust access control policy based on extensible attributes described in any one of claims 1 to 4 is implemented.

Images