A fine-grained access control method and system of dynamic policy decision mechanism

Abstract

The application provides a fine-grained access control method and system of a dynamic policy decision mechanism, comprising: receiving a data access request sent by an access subject; calculating an access risk value according to a risk identification vector; generating a dynamic authentication requirement corresponding to the current access request through risk level mapping of the access risk value, and generating zero-knowledge authentication challenge information; the client generates a zero-knowledge proof response based on the zero-knowledge authentication challenge information; performing dynamic zero-knowledge authentication based on the authentication result of the zero-knowledge proof response and the identity state of the access subject; and generating a fine-grained access authorization and an access token according to the authentication result; performing validity verification on the access token, and returning restricted data to the access subject according to the fine-grained access authorization when the verification is passed, so that trusted authentication and dynamic risk control of data resource access behavior can be realized without leaking sensitive identity information and authentication factors of the access subject, and the security of data access is improved.

Description

Technical Field

[0001] This application relates to the fields of data security and access control technology, and more specifically, to a fine-grained access control method and system with a dynamic policy decision-making mechanism. Background Technology

[0002] With the rapid development of the data element market, trusted data space has gradually become an important infrastructure for cross-organizational data sharing and collaboration. In the trusted data space environment, data providers, data users and data operators need to exchange data and control access under conditions of incomplete trust, which puts forward higher requirements for access control mechanisms.

[0003] Existing data access control technologies mainly include role-based access control, attribute-based access control, and policy-based access control. However, these traditional access control methods mostly rely on static policy rules, which are difficult to adapt to the real-time changing access risk environment in dynamic data sharing environments. For example, in cross-organizational data sharing scenarios, the device status, access behavior patterns, and network environment of the access subjects may change in real time, and traditional static policies are difficult to adjust authentication requirements in real time according to these dynamic factors. Therefore, how to achieve dynamic risk monitoring and policy adjustment during the access process without disclosing the sensitive identity information and authentication factors of the access subjects, so as to ensure the adaptability of cross-domain data access control scenarios in trusted data spaces, has become an urgent problem to be solved. Summary of the Invention

[0004] This application provides a fine-grained access control method and system with a dynamic policy decision-making mechanism, which can achieve trusted authentication and dynamic risk control of data resource access behavior without disclosing the sensitive identity information and authentication factors of the access subject.

[0005] In a first aspect, this application provides a fine-grained access control method with a dynamic policy decision-making mechanism. This method can be executed by a network device, or it can be executed by a chip configured in the network device. This application does not limit the execution of this method.

[0006] Specifically, the method includes: Receive data access requests sent by the accessing entity; A risk identification vector is constructed based on the access context information corresponding to the data access request, and an access risk value is calculated based on a preset risk function and the risk identification vector. The access risk value is input into the dynamic access control policy engine, and dynamic authentication requirements corresponding to this access request are generated through risk level mapping; zero-knowledge authentication challenge information is generated based on the dynamic authentication requirements. The client generates a zero-knowledge proof response based on the zero-knowledge authentication challenge information; performs dynamic zero-knowledge authentication based on the authentication result of the zero-knowledge proof response and the identity status of the access subject; and generates fine-grained access authorization and access token according to the authentication result. The access token is validated, and if the validation passes, restricted data is returned to the access subject based on the fine-grained access authorization.

[0007] In conjunction with the first aspect, in some implementations of the first aspect, the process of receiving a data access request sent by the accessing subject further includes: Generate long-term secret materials and device-bound secret materials for the accessing subject; Based on the long-term secret material and the secret material bound to the device, identity public key verification parameters and identity status records are generated.

[0008] In conjunction with the first aspect, in some implementations of the first aspect, after receiving the data access request sent by the accessing subject, the method further includes: generating a session identifier bound to the data access request, specifically including: Obtain the data access request and perform normalization preprocessing on the data access request; Based on the request information in the normalized data access request, an anti-collision hash algorithm is used to generate an access request digest; A one-time random number is generated and combined with the access request digest, and a session identifier is generated through a hash operation.

[0009] In conjunction with the first aspect, in some implementations of the first aspect, constructing a risk identification vector based on the access context information corresponding to the data access request specifically includes: collecting context information from the corresponding device side, network side, behavior side, and data resource side based on the data access request, performing vectorization encoding processing, and concatenating the context information based on a preset field order to construct a risk identification vector corresponding to the data access request.

[0010] In conjunction with the first aspect, in certain implementations of the first aspect, generating zero-knowledge authentication challenge information based on the dynamic authentication requirements specifically includes: Read the session state information corresponding to the current access request; Extract authentication strength parameters, authentication rounds, challenge length, and authentication factor combination information from dynamic authentication requirements, and construct challenge generation parameters based on the current session state; Generate a one-time random number, combine the session identifier, access request digest, policy version digest, authentication round identifier and the one-time random number in a preset order, and use a collision-resistant hash algorithm to generate a zero-knowledge authentication challenge value; Based on the authentication information in the dynamic authentication requirements and the zero-knowledge authentication challenge value, zero-knowledge authentication challenge information is generated.

[0011] In conjunction with the first aspect, in certain implementations of the first aspect, validating the access token specifically includes: The access token is parsed to extract the token payload information and digital signature information; The digital signature information is verified based on the public key pre-configured by the access control gateway. If the signature verification fails, the access token is deemed invalid and the access request is rejected. When the signature verification is successful, the access token is checked for access behavior based on the token payload information. If the behavior check fails, the access token is determined to be invalid and the access request is rejected. If the behavior verification passes, the validity verification of the access token is deemed successful.

[0012] In conjunction with the first aspect, in some implementations of the first aspect, after returning restricted data to the access subject based on the fine-grained access authorization when the verification passes, the method further includes: monitoring the data access behavior of the access subject for risks, and resetting permissions when the access risk value changes in real time.

[0013] Secondly, this application provides a fine-grained access control system with a dynamic policy decision-making mechanism, which includes a dynamic verification unit, the dynamic verification unit comprising: The access request unit is used to receive data access requests sent by the access subject; The risk identification unit is used to construct a risk identification vector based on the access context information corresponding to the data access request, and to calculate the access risk value based on a preset risk function and the risk identification vector. The challenge information generation unit is used to input the access risk value into the dynamic access control policy engine, generate dynamic authentication requirements corresponding to the current access request through risk level mapping, and generate zero-knowledge authentication challenge information based on the dynamic authentication requirements. The zero-knowledge authentication unit is used by the client to generate a zero-knowledge proof response based on the zero-knowledge authentication challenge information; to perform dynamic zero-knowledge authentication based on the authentication result of the zero-knowledge proof response and the identity status of the access subject; and to generate fine-grained access authorization and access token according to the authentication result. The token verification unit is used to verify the validity of the access token, and when the verification passes, it returns restricted data to the access subject based on the fine-grained access authorization.

[0014] Thirdly, this application provides a computer terminal device, the computer terminal device including a memory and a processor, the memory storing code, the processor being configured to acquire the code and execute the fine-grained access control method of the dynamic policy decision mechanism described above.

[0015] Fourthly, this application provides a computer-readable storage medium storing at least one computer program, which is loaded and executed by a processor to implement the operations performed by the fine-grained access control method of the aforementioned dynamic policy decision-making mechanism.

[0016] The technical solutions provided by the embodiments disclosed in this application have the following beneficial effects: This application provides a fine-grained access control method and system with a dynamic policy decision-making mechanism. First, it receives a data access request from the accessing subject. Then, it constructs a risk identification vector based on the access context information corresponding to the data access request, and calculates the access risk value based on a preset risk function and the risk identification vector. The access risk value is input into a dynamic access control policy engine, which generates dynamic authentication requirements corresponding to the current access request through risk level mapping. Zero-knowledge authentication challenge information is generated based on the dynamic authentication requirements. The client generates a zero-knowledge proof response based on the zero-knowledge proof response and the accessing subject's identity status. Dynamic zero-knowledge authentication is performed based on the authentication result of the zero-knowledge proof response and the accessing subject's identity status. Fine-grained access authorization and an access token are generated based on the authentication result. The access token's validity is verified, and if the verification passes, restricted data is returned to the accessing subject based on the fine-grained access authorization.

[0017] Therefore, this application demonstrates that by having the access subject client generate a zero-knowledge proof response solely based on the zero-knowledge authentication challenge information, the proof process only outputs verifiable proof results without directly transmitting or exposing user authentication factors, thus protecting sensitive authentication information. During the risk assessment phase, the system constructs a risk identification vector based on access context information and obtains access risk values, using only non-sensitive statistical features such as device status, behavioral characteristics, and environmental information, without involving plaintext identity data, achieving privacy isolation. In the dynamic access control policy engine, the system maps risk levels to dynamic authentication requirements, enabling adaptive adjustment of authentication strength according to risk, allowing the authentication process to change dynamically with risk. The system changes state, but does not rely on the plaintext acquisition of authentication factors. The access subject generates a zero-knowledge proof response within a secure execution environment, and the access control gateway performs joint verification with the identity state information. The identity state is managed statefully through the trusted identity service module, which only returns the validity result without exposing specific identity-sensitive information, thus decoupling identity verification from privacy information. The fine-grained access authorization and access token generated during the authorization phase only carry access scope, operation type, and constraint information to control access permission boundaries, without including the authentication factor itself. This ensures that subsequent data access is only executed within the authorized constraints, thereby achieving minimum access control over access behavior.

[0018] In summary, this application can achieve trusted authentication and dynamic risk control of data resource access behavior without disclosing the sensitive identity information and authentication factors of the accessing subject, thereby improving the security of data access. Attached Figure Description

[0019] Figure 1 This is an exemplary flowchart of a fine-grained access control method with a dynamic policy decision-making mechanism according to some embodiments of this application; Figure 2 This is a fine-grained licensing flowchart shown in some embodiments of this application; Figure 3 This is a hardware system overall architecture diagram shown in some embodiments of this application; Figure 4 This is an access control flowchart shown in some embodiments of this application; Figure 5 This is a schematic diagram of the structure of a dynamic verification unit according to some embodiments of this application; Figure 6 This is a schematic diagram of the structure of a computer terminal device that implements a fine-grained access control method with a dynamic policy decision-making mechanism, according to some embodiments of this application. Detailed Implementation

[0020] This application achieves trusted authentication and dynamic risk control of data resource access behavior without disclosing the sensitive identity information and authentication factors of the accessing subject. It receives data access requests from the accessing subject; constructs a risk identification vector based on the access context information corresponding to the data access request; calculates an access risk value based on a preset risk function and the risk identification vector; inputs the access risk value into a dynamic access control policy engine; generates dynamic authentication requirements corresponding to the current access request through risk level mapping; generates zero-knowledge authentication challenge information based on the dynamic authentication requirements; the client generates a zero-knowledge proof response based on the zero-knowledge authentication challenge information; performs dynamic zero-knowledge authentication based on the authentication result of the zero-knowledge proof response and the identity status of the accessing subject; generates fine-grained access authorization and access tokens based on the authentication results; verifies the validity of the access token; and returns restricted data to the accessing subject based on the fine-grained access authorization when the verification passes. This improves the security of data access by enabling trusted authentication and dynamic risk control of data resource access behavior without disclosing the sensitive identity information and authentication factors of the accessing subject.

[0021] To better understand the above technical solutions, a detailed description of the solutions will be provided below in conjunction with the accompanying drawings and specific implementation methods. (Reference) Figure 1 The figure is an exemplary flowchart of a fine-grained access control method with a dynamic policy decision mechanism according to some embodiments of this application. The fine-grained access control method 100 with the dynamic policy decision mechanism mainly includes the following steps: In step S101, a data access request sent by the accessing subject is received.

[0022] In some embodiments, the method further includes the following steps before receiving a data access request from the accessing subject: Generate long-term secret materials and device-bound secret materials for the accessing subject; Based on the long-term secret material and the secret material bound to the device, identity public key verification parameters and identity status records are generated.

[0023] It should be noted that the identity public key verification parameters and identity status records described in this application are used to establish a trust relationship between the access control gateway and the identity service module.

[0024] In practical implementation, the system is deployed in a computing environment that supports trusted execution or equivalent security isolation capabilities, covering the data provider side, data user side, and consortium trust service side. The system internally includes the following core modules: a unified verifiable identity service module, responsible for the registration of access subjects' identities, generation of basic authentication materials, and management of revocation status; a zero-knowledge and dynamic access control gateway module, serving as the unified control entry point for all data access requests; a dynamic access control policy engine module, generating dynamic authentication requirements based on the access context; and a data resource service module, providing restricted data access services to access subjects based on authorization results. To ensure the overall trustworthiness of the system, the system adopts the following security model: the system is defined as a five-tuple: Where U: set of access subjects; C: set of contracts; P: set of policies; G: zero-knowledge access control gateway; R: set of controlled data resources. Secure communication between modules within the system is established via a TLS 1.3 channel based on two-way authentication. The communication process employs the following security mechanisms: session keys are negotiated and generated using the ECDHE algorithm; communication data is symmetrically encrypted using AES-GCM mode; all messages are accompanied by an HMAC checksum to prevent tampering.

[0025] In some embodiments, the unified verifiable identity service module generates long-term secret material and device-binding secret material for the access subject; wherein, the long-term secret material is used as a long-term identity credential of the access subject, and the device-binding secret material is used to establish a unique binding relationship with the access device; both the long-term secret material and the device-binding secret material are generated in a trusted execution environment by a random number generator, and are only allowed to be stored and accessed within a secure isolation environment, and are prohibited from being exported in plaintext form.

[0026] In some embodiments, the system collects hardware feature information of the access device to form a device hardware fingerprint as a secret binding material for the device. The device hardware fingerprint may include one or more of the following: processor serial identifier, trusted platform module identifier, network card hardware address, security chip identifier, and trusted boot measurement value. The unified verifiable identity service module concatenates the long-term secret material, the device binding secret material, and the device hardware fingerprint, and calculates them using an anti-collision hash algorithm to generate an identity binding commitment value, so that an inseparable binding relationship is formed between the access subject's identity and the access device, preventing identity credentials from being copied to other devices for use.

[0027] In specific implementation, the unified verifiable identity service module generates identity public key verification parameters based on long-term secret materials; when the system adopts a discrete logarithmic cryptosystem, it generates an identity public key based on the generator and the modular arithmetic of large prime numbers; when the system adopts an elliptic curve cryptosystem, it generates a corresponding elliptic curve public key based on the elliptic curve base points and long-term secret materials; the generated identity public key verification parameters are used for zero-knowledge proof verification and access identity verification.

[0028] In some embodiments, this application establishes an identity status record corresponding to the access subject through the unified verifiable identity service module; the identity status record includes at least the following: identity validity status, used to indicate whether the current identity is in an available state; revocation time information, used to indicate the effective time of identity invalidation or revocation; session count information, used to record the number of access sessions and prevent replay attacks.

[0029] During the access process, the system determines whether the identity has expired based on the current time and the revocation time. If the current time exceeds the revocation time, the identity is determined to be unusable. After identity initialization is completed, the access control gateway and the unified verifiable identity service module establish a trusted communication relationship. Specifically, the two parties first establish an encrypted communication channel through two-way identity authentication and generate a session key using a temporary key negotiation mechanism. Then, a symmetric encryption mechanism is used to encrypt and protect the communication data, and a message integrity verification mechanism is used to prevent the communication data from being tampered with.

[0030] In some embodiments, the unified verifiable identity service module synchronizes identity public key verification parameters, current dynamic access control policy version digest, and identity revocation list digest to the access control gateway. The access control gateway generates a system trust digest based on the above information and saves the trust digest as trusted anchoring information. During the execution of dynamic access control and zero-knowledge authentication, the access control gateway verifies the access subject's identity public key, policy consistency, and revocation status based on the trust digest, establishing a trusted relationship between the access control gateway and the identity service module.

[0031] In some embodiments, the data access request includes verifiable identity reference information of the accessing subject, target data resource identifier, type of operation to be performed, and current request time information; wherein, the verifiable identity reference information is used to identify the decentralized identity corresponding to the accessing subject; the target data resource identifier is used to uniquely identify the data object to be accessed; the operation type is used to indicate access behavior categories such as reading, downloading, writing, sharing, or calling; and the request time information is used for subsequent timeliness verification and replay attack detection.

[0032] In some embodiments, after receiving a data access request sent by the accessing subject, the method further includes: generating a session identifier bound to the data access request, specifically including: Obtain the data access request and perform normalization preprocessing on the data access request; Based on the request information in the normalized data access request, an anti-collision hash algorithm is used to generate an access request digest; A one-time random number is generated and combined with the access request digest, and a session identifier is generated through a hash operation.

[0033] In specific implementation, for example, the data access request is preprocessed in a standardized manner, including: standardizing the format of identity reference information; standardizing the encoding of resource identifiers; enumerating and mapping operation types; and performing time synchronization verification on time information. Then, by combining the access subject's identity reference information, the target data resource identifier, the operation type, and the time information in a preset order, and using an anti-collision hash algorithm to generate an access request digest, the access request digest is used to uniquely represent this access request and is used for request binding in the subsequent dynamic authentication process. Since the access request digest of this application is generated by multiple key request fields, the possibility of the access request content being tampered with and reused is greatly reduced, thus improving data security during the access process.

[0034] In some embodiments, the zero-knowledge and dynamic access control gateway module generates a one-time random number by calling the secure random number generation module, and combines the random number with the access request digest to generate a session identifier through hash operation; wherein, the session identifier uniquely corresponds to the current access request and serves as an associated identifier for dynamic authentication and access authorization.

[0035] In some embodiments, a pending access session cache is established through an access control gateway, and the access request digest, access subject identity reference information, target resource identifier, current authentication status, session creation time, session timeout time, and risk assessment status are bound and stored with the session identifier. Before dynamic authentication is completed, all data access requests associated with the session identifier are marked as pending and are prohibited from directly accessing data resources. This application achieves a strong binding relationship between the authentication process and access requests by requiring all authentication challenge information, zero-knowledge proof data, dynamic authentication requirements, and access authorization information to carry the corresponding session identifier. This prevents attackers from migrating authenticated proof results to other access requests for reuse, and also prevents session hijacking, request replacement, and replay attacks, thereby improving the security and traceability of the dynamic access control process.

[0036] In step S102, a risk identification vector is constructed based on the access context information corresponding to the data access request, and an access risk value is calculated based on a preset risk function and the risk identification vector.

[0037] In some embodiments, constructing a risk identification vector based on the access context information corresponding to the data access request specifically includes: collecting context information from the device side, network side, behavior side, and data resource side corresponding to the data access request and performing vectorized encoding processing, and concatenating the context information based on a preset field order to construct a risk identification vector corresponding to the data access request.

[0038] In specific implementation, for example, after the zero-knowledge and dynamic access control gateway receives a data access request, the system initiates an access context collection process to extract and analyze dynamic environment information related to this access request. Specifically, the device-side context information includes: the hardware fingerprint of the currently accessing device, the device's trusted startup state, the secure execution environment state, the operating system version information, the device's patch update status, the device's abnormal operation status, and the device's historical trust level. It can be seen that this application can determine whether the currently accessing device is a trusted device by comparing the consistency between the current device's hardware fingerprint and the registered device's fingerprint; at the same time, it can generate corresponding device risk characteristics by combining the device's security status information.

[0039] The network-side context information specifically includes: the current access IP address, the network region, network operator information, network proxy status, VPN usage status, network link stability, and historical network risk level. It can be seen that this application can generate network environment risk characteristics by analyzing whether there are anonymous proxies, abnormal cross-regional access, high-frequency address switching, or abnormal link fluctuations in the current network environment.

[0040] The behavioral context information specifically includes: historical access frequency, historical access time distribution, historical resource access habits, historical operation type characteristics, user behavior trajectory, and the degree of deviation of current access behavior. This application can analyze whether the current access behavior deviates from the normal behavior pattern by comparing the current access behavior with the historical behavior profile; if the degree of deviation exceeds the preset threshold, the behavioral risk level is increased.

[0041] The specific contextual information on the data resource side includes: data resource sensitivity level, data sharing scope, data usage constraints, the business domain to which the data belongs, data access frequency restrictions, and data cross-domain transfer restrictions. The system generates data sensitivity features based on the importance of the data resources and sharing constraint rules, and then performs vectorized encoding processing on the aforementioned contextual features from the device side, network side, behavior side, and data resource side.

[0042] Specifically, the system first performs one-hot encoding on discrete context information and normalization on continuous context information. Statistical feature extraction is performed on time-series behavioral data to obtain context feature data of a unified dimension. The various context features are then concatenated according to a preset field order to construct the risk identification vector corresponding to this access request.

[0043] The risk identification vector includes the following feature dimensions: device risk dimension, behavioral risk dimension, network environment risk dimension, data sensitivity dimension, and sharing constraint dimension. Then, based on a preset risk assessment model, the contextual features of each dimension are weighted and analyzed. Specifically, corresponding risk scores can be generated for device risk, behavioral risk, and environmental risk, and a comprehensive risk value can be calculated based on preset weights. Specifically, the device risk score represents the trustworthiness of the currently accessing device; the behavioral risk score represents the deviation between the current access behavior and historical behavior; and the environmental risk score represents the security level of the current network and access environment. In some embodiments, this application can also dynamically adjust the weights corresponding to each risk dimension according to different business scenarios, thereby adapting to the security requirements of different data resources.

[0044] The following is a specific embodiment of this application for calculating access risk values ​​based on a preset risk function and the risk identification vector: The features of each dimension in the risk identification vector are classified and processed to form a device risk feature set, a behavioral risk feature set, an environmental risk feature set, and a data sensitivity feature set. The device risk feature set includes: device hardware fingerprint matching degree, device trusted startup state, integrity of secure execution environment, device patch update state, device abnormal operation state, and historical device trust score. By determining whether the current device has fingerprint drift, trusted startup failure, security isolation environment failure, and abnormal debugging state, etc., the verification result corresponding to each device behavior is preset with a corresponding risk weight. The device risk score is generated based on the verification results corresponding to all device behaviors, so that the lower the device trust level, the higher the corresponding device risk score.

[0045] The behavioral risk feature set specifically includes: the deviation between the current access time and historical access time, the deviation between the current access frequency and historical access frequency, the degree of change in the type of resource accessed, the degree of abnormality of the current operation behavior, and the degree of deviation of the current behavior trajectory. The system establishes a normal behavior distribution model based on historical behavior profiles and generates a behavioral risk score by calculating the degree of deviation between the current behavioral features and historical behavioral features. The greater the difference between the current behavior and historical behavior, the higher the behavioral risk score.

[0046] The environmental risk feature set specifically includes: the current access network region, network proxy status, VPN usage status, IP address switching frequency, network link stability, and current network historical risk level. For any environmental risk feature, there is a corresponding risk weight and risk mapping value. By identifying the risk weights corresponding to abnormal cross-regional access, anonymous proxy access, high-frequency network switching, and abnormal link behavior, a corresponding environmental risk score is generated.

[0047] The data sensitivity feature set specifically includes: data resource sensitivity level, data sharing scope restrictions, cross-domain data transfer restrictions, data access frequency restrictions, and data business importance level. A multi-dimensional feature vector is generated based on these data sensitivity features. A K-means clustering model is used to train the mapping relationship between multiple historical sensitivity feature samples and their corresponding manual risk score mean labels. Based on the classification results of the multi-dimensional feature vector, corresponding mean label values ​​are set. By learning historical risk mapping patterns, the higher the data resource sensitivity level, the higher the corresponding risk gain coefficient. Subsequently, the dynamic access control policy engine normalizes various risk scores.

[0048] Specifically, the system maps each risk score to a unified risk range and performs weighted fusion of risks across different dimensions based on preset weights. Furthermore, the system calculates a comprehensive access risk value based on a preset risk function.

[0049] In specific implementation, the preset risk function can adopt a linear weighting method, summing the device risk score, behavioral risk score, environmental risk score, and data sensitivity score according to their respective weights to obtain the comprehensive access risk value corresponding to the current access request. In some embodiments, the system can also perform dynamic risk prediction on the risk identification vector based on a machine learning risk assessment model. Specifically, a decision tree model, random forest model, support vector machine model, or neural network model can be used to train historical access behavior samples and output the risk prediction value corresponding to the current access request. This application does not limit the specific type of machine learning risk assessment model.

[0050] In some embodiments, the system performs an average weighted fusion of the predicted risk value and the comprehensive access risk value calculated by the rules to obtain the final access risk value.

[0051] In step S103, the access risk value is input into the dynamic access control policy engine, and dynamic authentication requirements corresponding to the current access request are generated through risk level mapping; zero-knowledge authentication challenge information is generated based on the dynamic authentication requirements. In some embodiments, the dynamic access control policy engine is manifested as a risk level mapping function based on a threshold range, used to map the risk level according to the threshold range where the access risk value is located, and generate dynamic authentication requirements corresponding to the current access request based on the mapping result.

[0052] In practice, the system pre-establishes risk level classification rules and divides access risks into multiple authentication levels based on risk ranges. Different authentication levels correspond to different authentication strengths, authentication factor combinations, and access authorization ranges. The dynamic access control policy engine compares the current access risk value with preset risk thresholds. For example, when the access risk value is lower than the first risk threshold, the current access request is determined to be low-risk access; when the access risk value is between the first and second risk thresholds, the current access request is determined to be medium-risk access; and when the access risk value is higher than the second risk threshold, the current access request is determined to be high-risk access.

[0053] In some embodiments, the authentication policy template corresponding to the risk level is matched to generate dynamic authentication requirements corresponding to the current access request. For example, in a specific implementation, a low-risk level corresponds to a single-device trusted authentication policy, which only requires verification of the trusted device status; a medium-risk level corresponds to a two-factor authentication policy, which requires verification of both the trusted device status and the user password; and a high-risk level corresponds to a multi-factor authentication policy, which requires verification of both the trusted device, biometrics, and dynamic identity credentials.

[0054] In some embodiments, generating zero-knowledge authentication challenge information based on the dynamic authentication requirements specifically includes: Read the session state information corresponding to the current access request; Extract authentication strength parameters, authentication rounds, challenge length, and authentication factor combination information from dynamic authentication requirements, and construct challenge generation parameters based on the current session state; Generate a one-time random number, combine the session identifier, access request digest, policy version digest, authentication round identifier and the one-time random number in a preset order, and use a collision-resistant hash algorithm to generate a zero-knowledge authentication challenge value; Based on the authentication information in the dynamic authentication requirements and the zero-knowledge authentication challenge value, zero-knowledge authentication challenge information is generated.

[0055] In specific implementation, the zero-knowledge and dynamic access control gateway first reads the session state information corresponding to the current access request. The session state information specifically includes: session identifier, access request digest, current dynamic authentication requirement, current policy version identifier, current authentication status, and session creation time. Then, it extracts authentication strength parameters, authentication rounds, challenge length, and authentication factor combination information from the dynamic authentication requirement, and constructs challenge generation parameters based on the current session state.

[0056] The challenge generation parameters specifically include: session identifier, access request digest, current policy version digest, current authentication round identifier, challenge generation time, and one-time random number. The zero-knowledge and dynamic access control gateway calls the secure random number generation module to generate the one-time random number. The one-time random number is only valid in the current authentication session and expires immediately after authentication to prevent the reuse of historical challenge information. Furthermore, the session identifier, access request digest, policy version digest, authentication round identifier, and one-time random number are combined in a preset order, and a collision-resistant hash algorithm is used to generate the zero-knowledge authentication challenge value.

[0057] It should be noted that in this application, the zero-knowledge authentication challenge value is uniquely bound to the current access request, the current dynamic authentication policy, and the current authentication session. Therefore, even if an attacker obtains historical authentication data, they cannot reuse the corresponding zero-knowledge proof result in other access requests or other sessions.

[0058] In some embodiments, during the process of constructing challenge description information based on dynamic authentication requirements, the zero-knowledge and dynamic access control gateway includes at least the following: the type of authentication factor required, the zero-knowledge proof algorithm identifier, the zero-knowledge circuit version identifier, the challenge value, the current authentication round, the authentication timeout, and the policy version identifier corresponding to this round of authentication, wherein: the authentication factor type is used to indicate the authentication factor that the client needs to collect, the zero-knowledge proof algorithm identifier is used to indicate that the client uses the corresponding zero-knowledge proof algorithm to generate the proof, the zero-knowledge circuit version identifier is used to ensure that the client and the server use the same authentication circuit, and the authentication timeout is used to limit the effective time window of the challenge information.

[0059] In some embodiments, the challenge description information is bound and stored with the current session identifier, and the current session state is updated. Specifically, this includes updating the session state to "authentication in progress", recording the challenge generation time, recording the challenge expiration time, recording the current authentication round, and recording the challenge identifier that has been issued. The zero-knowledge and dynamic access control gateway sends the zero-knowledge authentication challenge information to the access subject client through a secure communication channel.

[0060] In some embodiments, challenge data is sent through an encrypted communication channel established by two-way authentication, and a message integrity verification mechanism is used to prevent the challenge information from being tampered with during transmission. After receiving the zero-knowledge authentication challenge information, the accessing principal client first verifies the integrity, time validity, and policy version consistency of the challenge information. If the verification passes, the authentication factor collection process is started in the local secure execution environment, and the corresponding zero-knowledge proof circuit is called to generate a zero-knowledge proof response based on the challenge information.

[0061] Furthermore, in some implementations, the system can also generate multiple rounds of challenges based on dynamic authentication requirements. Specifically, the first round of challenges is used to verify the trusted status of the device, the second round of challenges is used to verify the user password, the third round of challenges is used to verify biometrics, and subsequent challenges are used to perform dynamic behavior verification. Each round of challenges is bound to the current session identifier and the authentication result of the previous round, forming a chain authentication structure to improve the credibility of data security verification.

[0062] In step S104, the client generates a zero-knowledge proof response based on the zero-knowledge authentication challenge information; performs dynamic zero-knowledge authentication based on the authentication result of the zero-knowledge proof response and the identity status of the access subject; and generates fine-grained access authorization and access token according to the authentication result.

[0063] In some embodiments, the zero-knowledge authentication challenge information is sent to the access subject client through an encrypted communication channel. After receiving the zero-knowledge authentication challenge information, the access subject client initiates an authentication factor collection process in a secure execution environment according to dynamic authentication requirements. The authentication factors include one or more of the following: device binding secret information, user password, and biometric information. The client constructs a zero-knowledge proof circuit by combining the contract identifier, resource identifier, operation type, and random challenge value corresponding to the current access request. Specifically, firstly, the contract identifier, resource identifier, and operation type are hashed to generate a first intermediate state value. Then, the first intermediate state value is combined with a random challenge value and a user password for hashing to generate a second intermediate state value. Next, the second intermediate state value is combined with biometric information and device binding secret information for hashing to generate a final authentication claim value. The client constructs a proof target to prove that the accessing entity meets the current dynamic authentication requirements without disclosing device secrets, user passwords, and plaintext biometrics. The client uses device binding secrets, user passwords, and biometrics as private inputs, and access request digests, random challenge values, and authentication claim values ​​as public inputs. It then calls the Groth16 zero-knowledge proof algorithm to generate corresponding zero-knowledge proof data. The generated zero-knowledge proof response includes at least the proof data, the current session identifier, and the authentication claim value. Subsequently, the client sends the zero-knowledge proof response to the zero-knowledge and dynamic access control gateway through a secure communication channel. The access control gateway verifies the zero-knowledge proof based on the public inputs and verification key. If the verification passes, the accessing entity is deemed to have passed this dynamic zero-knowledge authentication.

[0064] In some embodiments, after receiving a zero-knowledge proof response submitted by the access subject client, the zero-knowledge and dynamic access control gateway first performs a verification operation on the zero-knowledge proof response based on a preset verification key and public input parameters. The verification function is represented as Verify(Proof, PublicInputs). When the verification result is true, the zero-knowledge proof is determined to be valid; otherwise, the authentication is determined to fail and the current access request is directly rejected.

[0065] Based on the successful verification of the zero-knowledge proof, the access control gateway further initiates an identity status query request to the unified verifiable identity service module to obtain the identity status information and revocation status information corresponding to the access subject. The identity status information includes at least the identity validity flag `valid_flag` and the revocation control information `revoke_epoch` or a revocation flag. The system performs status verification based on the query results. When it detects that `valid_flag` is 0 or the identity is in a revoked state, it directly determines that the current access subject is invalid and rejects the access request, thereby realizing a joint authentication mechanism based on identity status and the zero-knowledge proof result.

[0066] It should be noted that the fine-grained access authorization described in this application refers to a dynamic authorization control mechanism that precisely limits the scope of data resource access, access operation types, access frequency, access time window, and access constraints based on the access subject's identity status, zero-knowledge authentication results, and access risk assessment results. This mechanism is used to achieve minimum access control over data resources. When the zero-knowledge proof verification passes and the identity status verification meets the valid conditions, the system determines that the access subject has passed this dynamic zero-knowledge authentication and enters the authorization generation stage. During the authorization generation process, the access control gateway generates fine-grained access authorization information based on the policy parameters defined in the current dynamic authentication requirements, such as the access scope, access frequency limits, and authorization validity period. The fine-grained access authorization includes at least the allowed scope of data resources, the allowed types of operations, access frequency limits, and authorization validity time window.

[0067] In some embodiments, the access control gateway synchronously generates an access token and binds and encodes the contract identifier (contract_id), authorization scope (scope), access quota (quota), validity period (exp), and zero-knowledge proof output result (statement) in the access request to form a token payload structure. Then, the token payload is digitally signed using the signature key corresponding to the access control gateway to generate a corresponding anti-counterfeiting access token.

[0068] The zero-knowledge proof output result, `statement`, is the output binding value of the zero-knowledge proof response, used to characterize the correlation between this authentication result and the dynamic authentication process. The access token must be bound and verified with the zero-knowledge proof output result during use and cannot be used independently of it. The generated access token is sent to the data resource service module and the access subject client for subsequent data access control verification. When the data resource service module receives an access request, it jointly verifies the signature validity, authorization scope, access count, and validity period of the access token. Only when all verifications pass is the access subject allowed to perform restricted data access operations within the authorized scope.

[0069] In step S105, the access token is validated, and if the validation passes, restricted data is returned to the access subject based on the fine-grained access authorization.

[0070] In some embodiments, validating the access token specifically includes: The access token is parsed to extract the token payload information and digital signature information; The digital signature information is verified based on the public key pre-configured by the access control gateway. If the signature verification fails, the access token is deemed invalid and the access request is rejected. When the signature verification is successful, the access token is checked for access behavior based on the token payload information. If the behavior check fails, the access token is determined to be invalid and the access request is rejected. If the behavior verification fails, the validity verification of the access token is deemed to have passed.

[0071] In specific implementation, the token payload information includes at least the contract identifier (contract_id), access scope, access quota, authorization validity period (exp), and zero-knowledge proof binding code (statement). The data resource service module verifies the digital signature of the access token based on the public key pre-configured by the access control gateway to confirm whether the token was issued by a legitimate access control gateway. If signature verification fails, the access token is directly deemed invalid, and the access request is rejected.

[0072] The access behavior verification based on the token payload information specifically includes: verifying the validity period, access quota, and access scope of the access token according to the token payload information. Specifically, verifying the validity period of the access token includes: determining whether the current system time is within the authorized validity period (exp); if the current time exceeds the validity period, the access token is deemed invalid and access is denied. Verifying the access quota includes: determining whether the number of accesses by the access subject within the current session or authorization period has exceeded a preset limit; if the access quota has been exceeded, subsequent access requests are denied. Verifying the access scope includes: matching the data resource identifier requested by the access subject with the accessible resource scope defined in the token, allowing continued access only if the requested resource is within the authorized scope.

[0073] In some embodiments, reference Figure 2 As shown, Figure 2 This is a flowchart of fine-grained authorization shown in some embodiments of this application. The fine-grained authorization process includes: after the access subject is successfully authenticated, a fine-grained access authorization is generated, and an access token is generated based on the authorization; the access subject sends an authorization access request to the data service to verify the access token with the access token; after the verification is successful, restricted data is returned according to the fine-grained access authorization, and the access control process is completed.

[0074] After verifying the validity of the access token, this application constrains and controls the access behavior of the access subject based on the fine-grained access authorization information carried in the access token. Specifically, the system filters the target data according to the authorization scope, extracting only the authorized subset of data; it restricts the access subject to perform only preset allowed operations based on the operation type, such as read, query, or limited write operations; at the same time, it dynamically updates the remaining available attempts according to the access quota and records the access behavior in real time. The data resource service module extracts data content that meets the authorization conditions from the controlled data resource set and returns the filtered restricted data to the access subject's client.

[0075] In some implementations, the system can also synchronously update the access log during the data return process and record the access behavior, access time, access resources and access results to the audit module, thereby supporting data traceability analysis and anomaly detection.

[0076] In some embodiments, after returning restricted data to the access subject based on the fine-grained access authorization upon successful verification, the method further includes: monitoring the data access behavior of the access subject for risks, and resetting permissions when the access risk value changes in real time.

[0077] In practice, after an access session is established, the system collects the access behavior of the accessing entity in real time. This access behavior includes at least information such as access frequency, access time interval, access resource switching path, changes in access operation type, and changes in data access volume. Then, based on a sliding time window, the system performs serialization modeling of the access behavior, constructs a real-time behavioral feature sequence, and compares it with the behavioral baseline model generated during the initial authentication phase to calculate the deviation of the current access behavior. This deviation is used to characterize the degree of abnormality of the accessing entity's current behavior relative to historical normal behavior patterns.

[0078] In some implementations, the system further combines information on changes in device status, network environment, and data resource access sensitivity to comprehensively assess real-time access risks and generate a real-time access risk value. When the real-time access risk value changes and exceeds a preset risk threshold, the system determines that the access risk status has dynamically transitioned and triggers a permission reset mechanism.

[0079] Specifically, permission reset includes: invalidating access tokens by marking them as unusable; narrowing the access scope by reducing the original scope to a subset; lowering the access operation permission level to allow only low-risk operation types; reducing the access quota by re-limiting the remaining access attempts; shortening the authorization validity period (exp) to trigger an early expiration mechanism; and triggering a secondary zero-knowledge authentication process, requiring the access subject to re-authenticate dynamically.

[0080] In practice, fine-grained access authorization is regenerated based on the updated risk assessment results, and access tokens are updated or new access tokens are generated to replace the original access credentials. After the permission reset is performed, the data resource service module will re-verify subsequent access requests according to the new authorization policy, and only allow the access subject to continue to access data resources within the updated permission boundaries, thereby realizing a dynamic permission contraction and access control adjustment mechanism based on real-time risk changes.

[0081] In some embodiments, risk monitoring of a subject's data access behavior specifically includes: Based on the authorization information of fine-grained access authorization, a multi-level permission pooling index is constructed, wherein the multi-level permission pooling index contains multiple permission pool areas. For any permission pool region, set a pooling time window for that permission pool scale and perform permission collision feature identification to extract permission collision behavior features for that permission pool region. Collision correlation monitoring is performed based on the permission collision behavior characteristics corresponding to each permission pool area, and abnormal risk monitoring is performed based on the collision correlation degree to obtain the risk correction factor corresponding to the data access behavior.

[0082] It should be noted that this application uses a fine-grained access control strategy based on multi-level permission pooling. It extracts the correlation of permission collision behaviors between different permission pool areas as a basis for correcting real-time access risks. When there is a high correlation and synchronization of permission collision behaviors between different permission pool areas, the access behavior is not independently and randomly distributed within the authorization space, but exhibits structured migration and linkage characteristics across permission levels. Furthermore, it deviates from the normal access assumption based on the independent isolation of each permission pool under a hierarchical authorization system. Specifically, in normal access scenarios, the behavior of the accessing subject is limited to adjacent permission pools, exhibiting strong local stability and weak correlation between cross-pool behaviors. The permission collision behavior is relatively independent; however, in abnormal access scenarios, the accessing subject frequently switches the access scope, operation type or quota boundary between different permission pools, resulting in significant synchronicity and strong correlation of the collision behavior across permission pools. This increases the possibility of risks such as lateral probing, permission jump or policy bypass on the user end during the permission control process. Therefore, this method conducts correlation analysis on the permission collision behavior of different level permission pool areas. When the correlation of cross-permission pool collision behavior is identified as enhanced, it is used as a risk enhancement factor to adjust and correct the basic access risk. This achieves risk identification of non-independent access mode behavior and improves data security and system anti-analysis capability through dynamic permission adjustment.

[0083] In specific implementation, during the process of constructing multi-level permission pooling metrics based on fine-grained access authorization information, the authorization information in the access token is parsed. This authorization information includes at least the access scope, the action set, the access quota, and the authorization validity period (exp). Based on this authorization information, the system constructs a multi-level permission pooling metric system. According to the accessible space size of the fine-grained access authorization, the total data space is divided into multiple permission pool regions of increasing size based on resource granularity, operational complexity, and data sensitivity level. Each permission pool region corresponds to a different range of permissible permission collisions.

[0084] In some embodiments, during the process of setting the pooling time window of the permission pool scale and performing permission collision feature identification, for any permission pool area, a corresponding pooling time sliding window is set, and the access behavior of the access subject is continuously sampled within the pooling time sliding window. The sampled data includes at least the access resource identifier, operation type change sequence, access number change, and quota usage progress. The system performs permission collision feature identification on the access behavior based on the sampled data, specifically including identifying the access subject's scope switching behavior, action switching behavior, quota approximation behavior, and policy triggering behavior within the permission pool, and extracting the permission collision behavior feature vector of the corresponding permission pool area.

[0085] Specifically, the collision correlation monitoring based on the permission collision behavior characteristics corresponding to each permission pool region includes: performing cross-pool correlation analysis on the permission collision behavior feature vectors generated for different permission pool regions. In practice, the feature vectors of each permission pool are input into a time-series correlation model to calculate the behavior similarity between different permission pools and obtain a permission collision correlation index. In some embodiments, a dynamic time warping model commonly used in behavior similarity learning is adopted to perform similarity learning on the permission collision behavior characteristics of each permission pool region. By performing time alignment and feature embedding on the behavior sequences of different permission pool regions, the behavior similarity between each permission pool is calculated to obtain a permission collision correlation index. When the permission collision correlation index is higher than a preset threshold, it is determined that there is a cross-permission pool behavior coupling phenomenon, and the correlation is mapped to a risk correction factor.

[0086] Specifically, when the cross-permission pool correlation exceeds a preset threshold, the corresponding risk correction factor weight is determined based on the threshold range of the permission collision correlation index and the preset segmented mapping function. The segmented mapping function is used to map the permission collision correlation from a continuous numerical space to a segmented continuous weight space. The specific segmented mapping rules can be determined based on historical experience or multiple experiments, which will not be elaborated on in this application. Then, the risk correction factor is fused with the basic access risk value to obtain a new access risk value, which is used for a new round of dynamic permission adjustment and access control decisions, including but not limited to the downgrading of access tokens, narrowing of access scope, adjustment of access number limits, and triggering of secondary zero-knowledge authentication. The user-end permissions are dynamically adjusted for risk, realizing a two-layer risk control mechanism based on basic risk assessment and cross-permission pool behavior correlation correction.

[0087] In some embodiments, reference Figure 3 As shown, Figure 3 This is a hardware system architecture diagram shown in some embodiments of this application, in which: 1. Access request initiated (B→C) 2. Request Interception and Context Collection (C) 3. Strategy Consultation Request (C→D) 4. Risk Assessment and Strategy Matching (D) 5. Return to dynamic authentication requirements (D→C) 6. Zero-knowledge challenge distributed (C→B) 7. Security Certificate Generation (B) 8. Submit a zero-knowledge proof (B→C) 9. Proof Verification and State Verification (C) 10. Issuing fine-grained authorizations (C→B) 11. Accessing resources with a token (B→E) 12. Authorization Verification (E→C) 13. Controlled Data Return (E→B) The hardware system in this application includes a client device B, an access control gateway C, a policy decision server D, and a data resource server E. Client device B sends a data access request to the access control gateway C, which triggers the access control process. The access control gateway C intercepts the access request and collects contextual information related to the request, such as device status, network environment, and historical behavior. Subsequently, the access control gateway C sends the access request and contextual information to the policy decision server D for policy consultation and risk assessment. The policy decision server D performs risk analysis and policy matching based on the contextual information, generates dynamic authentication requirements, and returns them to the client device B. Access control gateway C generates a zero-knowledge authentication challenge based on dynamic authentication requirements and sends it to client device B. Client device B generates a zero-knowledge proof response within a secure execution environment and submits it to access control gateway C. Access control gateway C verifies the zero-knowledge proof and performs validation based on the user's identity and revocation status. Upon successful authentication, it issues a fine-grained access authorization and access token to client device B. Client device B then sends a data access request to data resource server E carrying the access token. Data resource server E performs authorization validation on the access token and, upon successful validation, returns controlled data based on the fine-grained access authorization, completing the access control process.

[0088] In some embodiments, reference Figure 4 As shown, Figure 4 This is an access control flowchart shown in some embodiments of this application. In this flowchart, the access subject client initiates an access request to the access control gateway; the access control gateway intercepts the access request and sends the relevant context information to the policy engine for analysis; the policy engine performs a risk assessment based on the context information and generates a dynamic authentication requirement, which is returned to the access control gateway; the access control gateway sends a zero-knowledge authentication challenge to the access subject client according to the dynamic authentication requirement; the access subject client generates a zero-knowledge proof in a secure environment and returns the proof result to the access control gateway; while verifying the zero-knowledge proof, the access control gateway initiates an identity status query to the identity service, which returns the access subject's identity validity information; after both the proof verification and identity validity verification pass, the access control gateway issues a fine-grained access authorization to the access subject client; the access subject client sends an access request to the data service carrying the fine-grained access authorization; the data service verifies the authorization information, and after successful verification, returns restricted data to the access subject client, completing the access control process.

[0089] Furthermore, in another aspect of this application, in some embodiments, this application provides a fine-grained access control system with a dynamic policy decision-making mechanism, the system including a dynamic verification unit, referenced... Figure 5 The figure is a schematic diagram of the exemplary hardware and / or software structure of a dynamic verification unit according to some embodiments of this application. The dynamic verification unit 200 includes: an access request unit 201, a risk identification unit 202, a challenge information generation unit 203, a zero-knowledge authentication unit 204, and a token verification unit 205, which are described below: Access request unit 201 is used to receive data access requests sent by the access subject; The risk identification unit 202 is used to construct a risk identification vector based on the access context information corresponding to the data access request, and to calculate the access risk value based on a preset risk function and the risk identification vector. The challenge information generation unit 203 is used to input the access risk value into the dynamic access control policy engine, generate dynamic authentication requirements corresponding to the current access request through risk level mapping, and generate zero-knowledge authentication challenge information based on the dynamic authentication requirements. The zero-knowledge authentication unit 204 is used by the client to generate a zero-knowledge proof response based on the zero-knowledge authentication challenge information; to perform dynamic zero-knowledge authentication based on the authentication result of the zero-knowledge proof response and the identity status of the access subject; and to generate fine-grained access authorization and access token according to the authentication result. The token verification unit 205 is used to verify the validity of the access token, and when the verification is successful, it returns restricted data to the access subject according to the fine-grained access authorization.

[0090] The foregoing has provided a detailed example of a fine-grained access control method and system with a dynamic policy decision-making mechanism provided in the embodiments of this application. It is understood that the corresponding device includes hardware structures and / or software modules for executing each function in order to achieve the above functions.

[0091] Those skilled in the art should readily recognize that, based on the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a certain function in the application is executed in a manner that drives hardware or computer software depends on the specific application and design constraints of the technical solution. Therefore, those skilled in the art can use different methods to implement the described function for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0092] In addition, this application also provides a computer terminal device, which includes a memory and a processor. The memory stores code, and the processor is configured to acquire the code and execute the fine-grained access control method of the dynamic policy decision mechanism described above.

[0093] In some embodiments, reference Figure 6 The figure is a schematic diagram of the structure of a computer terminal device implementing a fine-grained access control method with a dynamic policy decision-making mechanism according to some embodiments of this application. The fine-grained access control method with a dynamic policy decision-making mechanism in the above embodiments can... Figure 6 The computer terminal device 300 shown is used to implement this, and the computer terminal device 300 includes at least one communication bus 301, communication interface 302, processor 303 and memory 304.

[0094] The processor 303 may be a general-purpose central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more fine-grained access control methods for controlling the execution of a dynamic policy decision-making mechanism in this application.

[0095] The communication bus 301 may include a path for transmitting information between the aforementioned components.

[0096] Memory 304 may be read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions, random access memory (RAM) or other types of dynamic storage devices capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CDROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disks or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. Memory 304 may exist independently and be connected to processor 303 via communication bus 301. Memory 304 may also be integrated with processor 303.

[0097] The memory 304 stores program code for executing the scheme of this application, and its execution is controlled by the processor 303. The processor 303 executes the program code stored in the memory 304. The program code may include one or more software modules. In the above embodiments, the generation of zero-knowledge authentication challenge information can be achieved by the processor 303 and one or more software modules in the program code in the memory 304.

[0098] Communication interface 302 uses any transceiver-like device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area network (WLAN), etc.

[0099] Optionally, the computer terminal device 300 may also include a power supply 305 for providing power to various devices or circuits in the real-time computer terminal device.

[0100] In a specific implementation, as one example, a computer terminal device may include multiple processors, each of which may be a single-core (single CPU) processor or a multi-core (multiCPU) processor. Here, a processor may refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).

[0101] The aforementioned computer terminal device can be a general-purpose computer terminal device or a dedicated computer terminal device. In specific implementations, the computer terminal device can be a desktop computer, a portable computer, a network server, a handheld digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device, or an embedded device. This application does not limit the type of computer terminal device.

[0102] In addition, other aspects of this application provide a computer-readable storage medium storing at least one computer program, which is loaded and executed by a processor to implement the operations performed by the fine-grained access control method of the dynamic policy decision mechanism described above.

[0103] In summary, the fine-grained access control method and system with a dynamic policy decision-making mechanism disclosed in this application involves receiving a data access request sent by an access subject; constructing a risk identification vector based on the access context information corresponding to the data access request; calculating an access risk value based on a preset risk function and the risk identification vector; inputting the access risk value into a dynamic access control policy engine; generating dynamic authentication requirements corresponding to the current access request through risk level mapping; generating zero-knowledge authentication challenge information based on the dynamic authentication requirements; generating a zero-knowledge proof response based on the zero-knowledge authentication challenge information; performing dynamic zero-knowledge authentication based on the authentication result of the zero-knowledge proof response and the identity status of the access subject; generating fine-grained access authorization and access token based on the authentication result; validating the access token; and returning restricted data to the access subject based on the fine-grained access authorization when the verification passes. This method can achieve trusted authentication and dynamic risk control of data resource access behavior without disclosing the sensitive identity information and authentication factors of the access subject, thereby improving the security of data access.

[0104] The above descriptions are merely embodiments of this application, and common knowledge such as specific technical solutions or characteristics in the solutions are not described in detail here. It should be noted that those skilled in the art can make several modifications and improvements without departing from the technical solutions of this application, and these should also be considered within the scope of protection of this application, without affecting the effectiveness of the implementation of this application or the practicality of the patent.

[0105] The scope of protection claimed in this application shall be determined by the content of its claims. The specific embodiments described in the specification can be used to interpret the content of the claims. Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of the invention. Therefore, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application also intends to include these modifications and variations.

Claims

1. A fine-grained access control method with a dynamic policy decision-making mechanism, characterized in that, include: Receive data access requests sent by the accessing entity; A risk identification vector is constructed based on the access context information corresponding to the data access request, and an access risk value is calculated based on a preset risk function and the risk identification vector. The access risk value is input into the dynamic access control policy engine, and dynamic authentication requirements corresponding to this access request are generated through risk level mapping. Zero-knowledge authentication challenge information is generated based on the dynamic authentication requirements; The client generates a zero-knowledge proof response based on the zero-knowledge authentication challenge information; Dynamic zero-knowledge authentication is performed based on the authentication result of the zero-knowledge proof response and the identity status of the accessing subject. And generate fine-grained access authorization and access tokens based on the authentication results; The access token is validated, and if the validation passes, restricted data is returned to the access subject based on the fine-grained access authorization.

2. The method as described in claim 1, characterized in that, Before receiving a data access request from the accessing subject, the following steps are also included: Generate long-term secret materials and device-bound secret materials for the accessing subject; Based on the long-term secret material and the secret material bound to the device, identity public key verification parameters and identity status records are generated.

3. The method as described in claim 1, characterized in that, After receiving the data access request sent by the accessing subject, the process further includes: generating a session identifier bound to the data access request, specifically including: Obtain the data access request and perform normalization preprocessing on the data access request; Based on the request information in the normalized data access request, an anti-collision hash algorithm is used to generate an access request digest; A one-time random number is generated and combined with the access request digest, and a session identifier is generated through a hash operation.

4. The method as described in claim 1, characterized in that, Constructing a risk identification vector based on the access context information corresponding to the data access request specifically includes: collecting context information from the device side, network side, behavior side, and data resource side corresponding to the data access request and performing vectorized encoding processing; and concatenating the context information based on a preset field order to construct the risk identification vector corresponding to the data access request.

5. The method as described in claim 1, characterized in that, The generation of zero-knowledge authentication challenge information based on the dynamic authentication requirements specifically includes: Read the session state information corresponding to the current access request; Extract authentication strength parameters, authentication rounds, challenge length, and authentication factor combination information from dynamic authentication requirements, and construct challenge generation parameters based on the current session state; Generate a one-time random number, combine the session identifier, access request digest, policy version digest, authentication round identifier and the one-time random number in a preset order, and use a collision-resistant hash algorithm to generate a zero-knowledge authentication challenge value; Based on the authentication information in the dynamic authentication requirements and the zero-knowledge authentication challenge value, zero-knowledge authentication challenge information is generated.

6. The method as described in claim 1, characterized in that, The validity verification of the access token specifically includes: The access token is parsed to extract the token payload information and digital signature information; The digital signature information is verified based on the public key pre-configured by the access control gateway. If the signature verification fails, the access token is deemed invalid and the access request is rejected. When the signature verification is successful, the access token is checked for access behavior based on the token payload information. If the behavior check fails, the access token is determined to be invalid and the access request is rejected. If the behavior verification passes, the validity verification of the access token is deemed successful.

7. The method as described in claim 1, characterized in that, After returning restricted data to the access subject based on the fine-grained access authorization upon successful verification, the process further includes: monitoring the access subject's data access behavior for risks, and resetting permissions when the real-time access risk value changes.

8. A fine-grained access control system with a dynamic policy decision-making mechanism, comprising a dynamic verification unit, said dynamic verification unit being used to execute the fine-grained access control method with a dynamic policy decision-making mechanism as described in any one of claims 1 to 7, characterized in that, The dynamic verification unit includes: The access request unit is used to receive data access requests sent by the access subject; The risk identification unit is used to construct a risk identification vector based on the access context information corresponding to the data access request, and to calculate the access risk value based on a preset risk function and the risk identification vector. The challenge information generation unit is used to input the access risk value into the dynamic access control policy engine, generate dynamic authentication requirements corresponding to the current access request through risk level mapping, and generate zero-knowledge authentication challenge information based on the dynamic authentication requirements. The zero-knowledge authentication unit is used by the client to generate a zero-knowledge proof response based on the zero-knowledge authentication challenge information; to perform dynamic zero-knowledge authentication based on the authentication result of the zero-knowledge proof response and the identity status of the access subject; and to generate fine-grained access authorization and access token according to the authentication result. The token verification unit is used to verify the validity of the access token, and when the verification passes, it returns restricted data to the access subject based on the fine-grained access authorization.

9. A computer terminal device, characterized in that, The computer terminal device includes a memory and a processor. The memory stores code, and the processor is configured to retrieve the code and execute a fine-grained access control method for a dynamic policy decision mechanism as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing at least one computer program, characterized in that, The computer program is loaded and executed by a processor to perform the operations of the fine-grained access control method of a dynamic policy decision-making mechanism as described in any one of claims 1 to 7.

Images