An ACL chain table-based fine-grained resource access control method

Abstract

The present application relates to the field of resource access control, and specifically relates to a fine-grained resource access control method based on ACL linked list, comprising the following steps: constructing an ACL linked list comprising a hierarchical structure, the ACL linked list comprising a main linked list storing core resource attributes and a sub-linked list defining subdivision dimension rules, and configuring permission inheritance and priority rules between the main linked list and the sub-linked list; processing a resource access request, extracting multi-dimensional attribute information by parsing the resource access request, performing hierarchical indexing and locating a target rule partition based on the multi-dimensional attribute information, dynamically loading the target rule partition in storage and performing matching; monitoring access frequency of each rule partition, and dynamically optimizing storage strategy and ACL linked list structure. The present application solves the defects of traditional ACL in control granularity, dynamic adaptability, execution efficiency and resource consumption, and provides a fine-grained resource access control method with high security, high performance and high maintainability.

Description

Technical Field

[0001] This invention relates to the field of resource access control, and more specifically to a fine-grained resource access control method based on ACL linked lists. Background Technology

[0002] Data access control is a core aspect of information security. It ensures, through a series of policies and mechanisms, that only entities (subjects) with the necessary permissions can access corresponding data or resources (objects) under specific conditions. Among numerous access control models, Access Control Lists (ACLs) are widely used due to their intuitiveness and ease of implementation. Traditional ACL models are typically built on a three-dimensional static mapping relationship of "resource-subject-operation," explicitly specifying which users or roles can perform which operations by maintaining a list for each resource. However, with the development of information technology and the increasing complexity of application scenarios, especially the widespread adoption of cloud computing, the Internet of Things, and mobile office environments, the access context of resources has become multi-dimensional and dynamic. Traditional coarse-grained ACL models have revealed many limitations and are no longer able to meet the security, efficiency, and flexibility requirements of modern systems, specifically in the following aspects:

[0003] Coarse-grained control and insufficient dimensional coverage: Traditional ACL models have fixed dimensions, typically only including core attributes such as users, resources, and operations, failing to effectively cover complex environmental dimensions such as time (e.g., allowing access only during working hours), device (e.g., allowing access only through company-issued devices), network status (e.g., intranet access only), and operation context. This results in permission policies failing to accurately describe fine-grained access needs in the real world, leading to security vulnerabilities or access inconvenience.

[0004] Traditional ACL rules are static and rigid, lacking dynamic adaptability: They are typically configured statically during system initialization, and once effective, they are difficult to dynamically adjust based on the subject's state (such as changes in user security levels), resource status, or environmental context. Furthermore, complex permission inheritance logic is difficult to define and manage clearly, easily leading to permission confusion or escalation, and failing to achieve "on-demand" intelligent access control.

[0005] Poor matching performance and high system latency: In large-scale distributed systems, the number of ACL rules can be extremely large. When faced with massive numbers of rules, using a linear traversal approach for matching has a time complexity of O(N), which leads to a sharp increase in decision latency for access requests, becoming a system performance bottleneck. Furthermore, static ACL structures struggle to support efficient fuzzy or range matching, further limiting their applicability.

[0006] Significant storage redundancy and high resource consumption: A large amount of repetitive principal information (such as user IDs and roles) and resource identifiers in ACL rules are stored separately in each rule node, resulting in significant memory waste. In addition, if all ACL rules are loaded into memory at system startup, it will lead to slow startup and high memory usage during runtime; while if they are all placed on disk, I / O operations are required for each match, which seriously sacrifices performance.

[0007] In summary, existing ACL-based access control technologies have significant shortcomings in terms of control dimensions, dynamic adaptability, execution efficiency, and resource consumption when dealing with the fine-grained, multi-dimensional, and dynamic permission management requirements of modern applications. Therefore, there is an urgent need for a new ACL implementation method that can achieve more granular permission control, more efficient rule matching, and better system resource utilization while maintaining the intuitiveness of the ACL model. Summary of the Invention

[0008] To address the problems existing in the prior art, this invention provides a fine-grained resource access control method based on ACL linked lists. The method forms a closed-loop processing mechanism including constructing ACL linked lists, processing resource access requests, and dynamic optimization. Specifically, it includes the following steps:

[0009] Construct an ACL linked list with a hierarchical structure, the ACL linked list including a main linked list storing core resource attributes and a sub-linked list defining detailed dimension rules, and configure permission inheritance and priority rules between the main linked list and the sub-linked list;

[0010] Process resource access requests, extract multi-dimensional attribute information by parsing resource access requests, perform hierarchical indexing based on the multi-dimensional attribute information and locate target rule partitions, dynamically load target rule partitions in storage and perform matching;

[0011] Monitor the access frequency of each rule partition and dynamically optimize the ACL list structure and storage strategy.

[0012] Furthermore, the main linked list is used to store core resource attributes, including user ID, role, and core mapping fields of resources; the sub-linked lists are attached to the main linked list nodes and are used to define detailed environmental dimension rules.

[0013] Furthermore, the environmental dimension rules include time, device, and network status, and support orthogonal matching of multiple dimension values.

[0014] Furthermore, priority identifiers are set for the nodes of the main linked list and the sub-linked list, so that high-priority rules override low-priority rules.

[0015] Furthermore, the step of processing the resource access request includes:

[0016] Receive and parse resource access requests, and extract multi-dimensional attribute information from the resource access requests;

[0017] A secondary index is constructed based on the parsed multidimensional attribute information to locate the partition where the target rule is located;

[0018] Dynamically load the target rule partition;

[0019] Match the main linked list nodes in memory to determine if the core mapping is successful.

[0020] Furthermore, the dynamically loaded target rule partition includes:

[0021] If the partition is a hot partition that resides in memory, then rule matching is performed directly;

[0022] If the partition is in the preload cache, it is loaded into memory and marked as a hot partition;

[0023] If the partition is located on a disk, it is read from the disk and stored sequentially in the preload cache and memory, and marked as a hot partition.

[0024] Furthermore, the determination of whether the core mapping passes includes:

[0025] If the request fails, the resource access request will be rejected and the process will be terminated.

[0026] If successful, the corresponding sub-list is loaded, and the subdivision rules in the sub-list are checked to complete the final match.

[0027] Furthermore, the dynamic optimization storage strategy includes:

[0028] Periodically analyze the access frequency of each ACL resource access partition, mark high-frequency access partitions as hot partitions and keep them resident in memory, and mark low-frequency access partitions as cold partitions and store them on disk;

[0029] Implement a preload caching strategy for cold partitions and reclaim infrequently used hot partitions in memory to free up resources.

[0030] Furthermore, the dynamic optimization of the ACL linked list structure includes automatic ACL linked list reorganization: defining event triggering conditions for ACL linked list reorganization, automatically reorganizing the ACL linked list when the event triggering conditions are met, and updating the mapping relationship between the main linked list and the child linked list.

[0031] Furthermore, the dynamically optimized ACL linked list structure also includes a lightweight design for ACL linked list nodes, reducing node memory usage through a combination of field compression, shared storage, and bitmap encoding.

[0032] Furthermore, the lightweight design includes:

[0033] Binary compression encoding is used for non-repeating fields;

[0034] A global dictionary is created for duplicate main information, and nodes reference duplicate dictionary entries through mapping IDs to avoid duplicate storage;

[0035] Convert permission operations from text descriptions to bitmap encoding.

[0036] Compared with the prior art, the present invention has the following beneficial effects:

[0037] 1. Achieving Multi-dimensional and Fine-grained Access Control: This invention breaks through the traditional fixed three-dimensional ACL model of "resource-subject-operation". By constructing a hierarchical structure containing a main linked list and sub-linked lists, the control granularity is successfully devolved from the "resource level" to the "field level" and "environment level". The main linked list handles core resource attributes, while the sub-linked lists define multi-dimensional environment rules such as time, device, and network status, and support orthogonal matching of these dimensions. This design enables the system to achieve precise control, and is particularly suitable for complex scenarios such as the Internet of Things where security context requirements are stringent.

[0038] 2. Significantly Improved Rule Matching and System Performance: Through a "hierarchical indexing" and "dynamic loading" mechanism, this invention completely changes the inefficient matching mode of traditional ACL linear traversal. When processing access requests, the system can quickly locate the target rule partition and dynamically optimize the storage strategy according to the access frequency, achieving low-latency matching of millions of rule sets. This design greatly reduces the latency caused by access control decisions and ensures the system's response efficiency under high load.

[0039] 3. Enhanced System Adaptability and Maintainability: This invention introduces an "event-triggered automatic linked list reorganization" mechanism. The system can automatically reorganize the ACL linked list structure and update the mapping relationships based on predefined event triggering conditions, enabling permission rules to dynamically adjust according to subject status, resource status, or environmental context. This feature not only solves the problem of static and rigid traditional ACL rules but also significantly reduces the maintenance complexity of the permission model, facilitating unified rule management and cross-domain synchronization.

[0040] 4. Significantly Optimized Storage Efficiency and Resource Consumption: A lightweight design for ACL linked list nodes effectively reduces node memory usage. Combined with an on-demand dynamic loading strategy, the system does not need to load all rules at startup, avoiding slow startup and high resource consumption. This design significantly reduces system memory overhead and storage redundancy, improving overall resource utilization. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 This is a flowchart of a fine-grained resource access control method based on ACL linked lists according to the present invention.

[0043] Figure 2 This is a diagram illustrating the implementation steps of the resource access control request processing of the present invention.

[0044] Figure 3 This is a flowchart of the automatic ACL linked list reorganization process of the present invention.

[0045] Figure 4 This diagram illustrates the lightweight design and dynamic loading process of the ACL linked list nodes in this invention. Detailed Implementation

[0046] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0047] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0048] like Figure 1 As shown, this invention discloses a fine-grained resource access control method based on ACL linked lists, which mainly includes the following steps:

[0049] S1: Construct an ACL linked list with a hierarchical structure. The ACL linked list includes a main linked list that stores core resource attributes and a sub-linked list that defines detailed dimension rules. Configure permission inheritance and priority rules between the main linked list and the sub-linked lists.

[0050] S2: Process resource access requests, extract multi-dimensional attribute information by parsing resource access requests, perform hierarchical indexing based on the multi-dimensional attribute information and locate the target rule partition, dynamically load the target rule partition in storage and perform matching.

[0051] S3: Monitors the access frequency of each rule partition and dynamically optimizes the ACL list structure and storage strategy.

[0052] In a preferred embodiment of this application, the main linked list is used to store core resource attributes, including user ID, role, and core mapping fields of resources; the sub-linked lists are attached to the main linked list nodes and are used to define rules for subdivided environment dimensions.

[0053] As a preferred implementation of this application, the environment dimension rules include time, device and network status, and support orthogonal matching of multiple dimension values.

[0054] As a preferred implementation of this application, priority identifiers are set for nodes in the main linked list and sub-linked lists, so that high-priority rules override low-priority rules.

[0055] In a preferred embodiment of this application, the steps for processing resource access requests include: receiving and parsing the resource access request, extracting multi-dimensional attribute information from the resource access request; constructing a secondary index based on the parsed multi-dimensional attribute information to locate the partition where the target rule is located; dynamically loading the target rule partition; and matching the main linked list nodes in memory to determine whether the core mapping is successful.

[0056] As a preferred embodiment of this application, dynamically loading the target rule partition includes: if the partition is a hot partition resident in memory, then rule matching is performed directly; if the partition is located in the preload cache, then it is loaded into memory and marked as a hot partition; if the partition is located on the disk, then it is read from the disk and stored sequentially into the preload cache and memory, and marked as a hot partition.

[0057] In a preferred embodiment of this application, the step of determining whether the core mapping passes includes: if it fails, rejecting the resource access request and terminating the process; if it passes, loading the corresponding sub-list and checking the sub-list's subdivision rules to complete the final matching.

[0058] As a preferred embodiment of this application, the dynamic optimization storage strategy includes: periodically analyzing the access frequency of each ACL resource access partition, marking high-frequency access partitions as hot partitions and keeping them resident in memory, marking low-frequency access partitions as cold partitions and storing them on disk; performing a preloading caching strategy on cold partitions, and reclaiming low-frequency hot partitions in memory to release resources.

[0059] As a preferred embodiment of this application, dynamic optimization of the ACL linked list structure includes automatic ACL linked list reorganization: defining event triggering conditions for ACL linked list reorganization, automatically reorganizing the ACL linked list when the event triggering conditions are met, and updating the mapping relationship between the main linked list and the child linked list.

[0060] As a preferred implementation of this application, dynamically optimizing the ACL linked list structure also includes lightweight design of ACL linked list nodes, reducing node memory usage through a combination of field compression, shared storage, and bitmap encoding.

[0061] As a preferred implementation of this application, the lightweight design includes: using binary compression encoding for non-repeating fields; establishing a global dictionary for repetitive subject information, with nodes referencing repetitive dictionary entries through mapping IDs to avoid duplicate storage; and converting permission operations from text descriptions to bitmap encoding.

[0062] The specific technical embodiments of the core inventive points of this invention are described in detail with reference to the accompanying drawings:

[0063] S1: Construct an ACL linked list with a hierarchical structure. The ACL linked list includes a main linked list that stores core resource attributes and a sub-linked list that defines detailed dimension rules. Configure permission inheritance and priority rules between the main linked list and the sub-linked lists.

[0064] like Figure 2 As shown, the multi-dimensional attribute extension of the linked list nodes expands each node of the traditional ACL linked list from three elements (subject + resource + permission) to a four-dimensional structure of "subject dimension + resource dimension + operation dimension + environment dimension". Each dimension supports multi-value matching, such as IP supporting network segments and time supporting time periods. The subject dimension covers multiple identity identifiers such as user, role, and user, and supports combination matching of multiple subject types, such as user A or user B with the role of administrator. The resource dimension is refined from resource ID to resource attributes and field levels. The operation dimension is refined from macro-level operations such as CRUD operations to more precise operation types, such as modifying a specific attribute of field X in database table A. The environment dimension introduces dimensions such as time (time period, date), IP (single IP, network segment), device (device type, device ID), and network status, and each dimension supports multi-value matching.

[0065] A main linked list + sub-linked list structure is adopted. The main linked list stores the core subject-resource-basic permission mapping, ensuring clear core permission logic, such as user A having write permission to resource X. Sub-linked lists are attached to nodes of the main linked list and are used to define rules at more granular levels. For example, if the main linked list defines that user A has write permission to resource X, the sub-linked list defines that modification of fields A and B of resource X is only allowed, and operations are only permitted during working hours (9:00-18:00), achieving ultra-fine-grained permission control at the field, operation, and environment binding levels. This flexible design through the linked list structure allows for more precise permission control and better meets the needs of complex business scenarios.

[0066] S2: Process resource access requests, extract multi-dimensional attribute information by parsing resource access requests, perform hierarchical indexing based on the multi-dimensional attribute information and locate the target rule partition, dynamically load the target rule partition in storage and perform matching.

[0067] S21: Process resource access requests, specifically including: receiving and parsing resource access requests, extracting multi-dimensional attribute information from resource access requests; constructing a secondary index based on the parsed multi-dimensional attribute information to locate the partition where the target rule is located; dynamically loading the target rule partition; and matching the main linked list nodes in memory to determine whether the core mapping is successful.

[0068] S22: Hierarchical indexed linked list. The specific steps include: from linear traversal to indexed binary search, building a two-level index system based on resource dimension + subject dimension, and upgrading large-scale ACL rules from unstructured linear linked lists to hierarchical partitioned index structures.

[0069] First-level index (resource type partition): ACL rules are divided into different partitions according to resource type. For example, permission rules for all interface-type resources are grouped into the interface partition, and permission rules for file-type resources are grouped into the file partition.

[0070] Secondary Index (Subject ID Hash Sharding): Within each resource partition, sharding is performed based on the hash value of the subject ID (user / role / user group ID). When processing permission requests, the primary partition is first located by resource type, then the secondary shard is located by subject ID hash, and finally a binary search is performed in the ordered linked list within the shard. The time complexity is reduced from the traditional O(n) to O(logn), significantly improving matching efficiency.

[0071] S23: Dynamically load the target rule partition. The specific steps include: if the partition is a hot partition that resides in memory, then directly perform rule matching; if the partition is located in the preload cache, then load it into memory and mark it as a hot partition; if the partition is located on the disk, then read it from the disk and store it in the preload cache and memory in sequence, and mark it as a hot partition.

[0072] S3: Monitors the access frequency of each rule partition and dynamically optimizes the ACL list structure and storage strategy.

[0073] S31: Automatic ACL Reorganization. Defines the event triggering conditions for ACL reorganization. When the event triggering conditions are met, the ACL list is automatically reorganized, and the mapping relationship between the main list and the child list is updated.

[0074] By combining event-triggered conditions with automatic reorganization logic, the ACL linked list can be dynamically adjusted to adapt to business changes. Scenarios that trigger linked list reorganization can be pre-defined, such as "user role change" or "system time switch (e.g., from working hours to non-working hours)". Figure 3 As shown. When the triggering conditions are met, the system automatically adjusts the structure of the ACL linked list, eliminating the need for manual rule modification. A multi-level permission inheritance system is constructed, consisting of users → user groups → roles → global rules, and conflicts are resolved using a "precedence identifier." Permission rules form a hierarchical inheritance relationship, from global rules to role rules, then to user group rules, and finally to individual user rules. In case of conflicts, each linked list node carries a priority identifier from 0 to 100. When rules at different levels conflict, the system automatically handles the conflict by following the rule that higher priority rules override lower priority rules and child nodes override parent nodes. Through dynamic reorganization and permission inheritance, ACL is upgraded from a static permission management tool to a dynamically adaptable, automatically conflict-resolving intelligent permission system.

[0075] S32: Lightweight design of ACL linked list nodes, reducing node memory footprint through a combination of field compression, shared storage, and bitmap encoding. The lightweight design includes: using binary compression encoding for non-repeating fields; establishing a global dictionary for duplicate main information, with nodes referencing duplicate dictionary entries via mapping IDs to avoid duplicate storage; and converting permission operations from text descriptions to bitmap encoding.

[0076] like Figure 4 As shown, the lightweight node design utilizes field compression, shared storage, and bitmap encoding to significantly reduce the memory footprint of ACL linked list nodes. Shared storage employs a dictionary mapping method, creating a global dictionary for duplicate main information, storing each duplicate item only once, and subsequent nodes reference it via the mapped ID, avoiding duplicate string storage. Field compression uses binary compression encoding for non-duplicate fields such as resource IDs and operation conditions, reducing the memory footprint of a single field. Read, write, delete, and modify permission operations are converted from text descriptions to bitmap encoding. This improves efficiency several times compared to traditional text description storage. Through these methods, the size of a single ACL node can be compressed to 1 / 5 of a traditional ACL, and the memory footprint of millions of rules can be controlled within 500MB.

[0077] Based on access frequency and pre-loading caching, dynamic loading and resource optimization of ACL rules are achieved. Hot and cold partition management divides the ACL linked list into hot and cold partitions according to the access frequency of the resource-subject relationship. The ACL linked lists corresponding to frequently accessed resources and subjects reside in memory; partitions with low-frequency access are stored on disk. Pre-loading caching predicts potential access demands based on historical access data and pre-loads rules that may be accessed in low-frequency partitions into the cache, reducing I / O overhead. Simultaneously, at system startup, only the core index structure, such as the first-level partitions of the hierarchical index and the dictionary mapping table, is loaded, rather than the full set of rules. This measure reduces system startup time by 80%.

[0078] This invention proposes a fine-grained resource access control method based on ACL linked lists, which solves the problem of the single dimension of traditional ACLs, greatly improves the matching efficiency under massive rules, enhances the system's adaptability, significantly reduces memory consumption and storage redundancy, and achieves improved system performance and resource utilization while maintaining precise access control.

[0079] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A fine-grained resource access control method based on ACL linked list, characterized in that, The method comprises the following steps: constructing an ACL chain table including a hierarchy, the ACL chain table including a main chain table storing core resource attributes and a sub-chain table defining sub-environment dimension rules, and configuring permission inheritance and priority rules between the main chain table and the sub-chain table; processing a resource access request, extracting multi-dimensional attribute information by parsing the resource access request, performing hierarchical indexing based on the multi-dimensional attribute information and locating a target rule partition, dynamically loading the target rule partition stored in the memory and performing matching; monitoring access frequencies of each rule partition, and dynamically optimizing the ACL chain table structure and the storage strategy; the step of processing the resource access request comprises: receiving and parsing the resource access request, extracting multi-dimensional attribute information in the resource access request, constructing a secondary index according to the parsed multi-dimensional attribute information, locating a partition where a target rule is located, dynamically loading the target rule partition, and matching main chain table nodes in the memory to determine whether a core mapping is passed; the step of dynamically loading the target rule partition comprises: if the partition is a hot partition in the resident memory, directly performing rule matching; if the partition is located in a preloading cache, loading it into the memory and marking it as a hot partition; and if the partition is located in a disk, reading it from the disk and sequentially storing it in the preloading cache and the memory, and marking it as a hot partition; the step of determining whether the core mapping is passed comprises: if not, rejecting the resource access request and terminating the process; and if yes, loading a corresponding sub-chain table and checking sub-environment dimension rules in the sub-chain table to complete final matching.

2. The fine-grained resource access control method based on ACL linked list according to claim 1, characterized in that, the main chain table is used for storing core resource attributes, including user ID, role, and core mapping fields of resources; the sub-chain table is hung under a main chain table node and is used for defining sub-environment dimension rules; the environment dimension rules include time, device and network state, and support orthogonal matching of multiple dimension values.

3. The method of claim 1, wherein the ACL chain table is a list of access control entries (ACEs). priority identifiers are set for nodes of the main chain table and the sub-chain table, so that high-priority rules cover low-priority rules.

4. The method of claim 1, wherein the ACL chain table is used to control access to a resource. the dynamic optimization of the storage strategy comprises: timely analyzing access frequencies of each ACL resource access partition, marking high-frequency access partitions as hot partitions and resident in the memory, and marking low-frequency access partitions as cold partitions and storing them in a disk; performing a preloading cache strategy on the cold partitions, and recycling low-frequency hot partitions in the memory to release resources.

5. The method of claim 1, wherein the ACL chain table is used to control access to a resource. the dynamic optimization of the ACL chain table structure comprises automatic recombination of the ACL chain table: defining event trigger conditions for recombination of the ACL chain table, automatically recombining the ACL chain table when the event trigger conditions are met, and updating mapping relationships of the main chain table and the sub-chain table.

6. The method of claim 1, wherein the ACL chain table is used to control access to a resource. the dynamic optimization of the ACL chain table structure further comprises lightweight design of ACL chain table nodes, which reduces node memory occupation by combining field compression, shared storage and bitmap coding.

7. The fine-grained resource access control method based on ACL linked list according to claim 6, characterized in that, the lightweight design comprises: adopting binary compression coding for non-repeated fields; establishing a global dictionary for repeated main information, and nodes referencing repeated dictionary items through mapping IDs to avoid repeated storage; converting permission operations from text description to bitmap coding.

Images