A closed-loop method to prevent role inheritance based on reverse iteration

Abstract

The present invention relates to a closed-loop role inheritance prevention method based on reverse iteration, comprising the following steps: setting the parent role to be built as r1, and the child role to be built as r2; setting the iteration variable as i, the temporary variable as j, i=j=1; searching all the existing parent roles of the parent role to be built r1 in the inheritance relationship database, and saving them in the set fi(r1); judging whether fi(r1) is an empty set, if it is an empty set, the inheritance relationship between the parent role to be built r1 and the child role to be built r2 is established; if it is not an empty set, executing step S4; S4: judging whether the child role to be built r2 exists in the set fi(r1), if the child role to be built r2 belongs to the set fi(r1), then an i+1-element role inheritance closed loop is formed, the algorithm triggers the role closed loop prevention, and throws an abnormal alarm. The present invention can effectively prevent the generation of improper role inheritance from causing damage to the system.

Description

Technical Field

[0001] The invention relates to an application algorithm for role inheritance in a role access control system, in particular to a closed-loop role inheritance prevention method based on reverse iteration. Background Art

[0002] Role inheritance is an important part of the role-based access control system in the big data environment. Through the inheritance relationship between roles, the parent role can obtain the permissions of the child role. Roles with advanced permissions do not need to configure their permissions one by one, but obtain their permissions through multiple inheritances; when the system permissions are changed, it is not necessary to modify the corresponding permissions for each role. Therefore, role inheritance improves the management efficiency and dynamic adaptability of the big data access control system.

[0003] If the inheritance relationship between roles cannot be clearly regulated and restricted, the inheritance relationship will be disordered and chaotic. The disordered and chaotic inheritance relationship between roles not only seriously restricts the applicability of the role-based access control system in the big data environment, but also greatly increases the management burden of the system administrator on the role inheritance relationship, and also makes the system face serious privacy and security leakage problems. If the inheritance relationship between roles depends on the manual control of the administrator, if there is a slight negligence, the role inheritance relationship is set to form a closed loop, which may cause serious role fusion accidents and even cause the access control system to crash. Therefore, designing an active detection algorithm for the closed loop of role inheritance to automatically prevent improper inheritance relationships between roles is of great research significance for protecting the security of the system and user data. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a closed-loop method for preventing role inheritance based on reverse iteration in response to the problems existing in the prior art.

[0005] The technical solution adopted by the present invention to solve the above technical problem is: a closed-loop method for preventing role inheritance based on reverse iteration, including an inheritance relationship database, including the following steps:

[0006] S1: Set the parent role to be created to r1, and the child role to be created to r2; set the iteration variable to i (1, 2, 3, ... n), the temporary variable to j (1, 2, 3, ... n), and start from i = j = 1;

[0007] S2: Search the inheritance database for all existing parent roles of the parent role r1 to be created, and save them in the collection f i (r1);

[0008] S3: Determine f i (r1) whether it is an empty set. If it is an empty set, the inheritance relationship between the parent role r1 to be created and the child role r2 to be created is established; if it is not an empty set, execute step S4;

[0009] S4: Determine whether the child role r2 to be created exists in the set f i In (r1), if the sub-role r2 to be created belongs to the set f i (r1), that is, the child role r2 to be created is the parent role of the parent role r1 to be created. If the inheritance relationship between the child role r2 to be created and the parent role r1 to be created is established at this time, then an i+1-element role inheritance closed loop is formed on the role inheritance chain of the child role r2 to be created relative to the parent role r1 to be created. The algorithm triggers the role closed loop blocking, throws an abnormal alarm, and jumps to step S5;

[0010] S5: If the child role r2 to be created does not belong to the set f i (r1), temporary variable j = j + 1, for set f i For each role in (r1), search for the set f in the inheritance relation database i The parent role set of each role in (r1) and merge the parent role set of each role into the set f j In (r1), the iteration variable i=j, and the process jumps to step S3 to repeat the judgment;

[0011] S6: End the inheritance relationship setting.

[0012] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention provides a closed-loop method for preventing role inheritance based on reverse iteration, which detects whether there is a role inheritance closed-loop relationship on the role inheritance chain by reversely iterating the inheritance chain of the parent role. If there is no closed-loop relationship, the role inheritance relationship is established. If a closed-loop inheritance relationship is detected, the role inheritance is blocked, effectively preventing improper role inheritance from causing damage to the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 The present invention is a flow chart of a closed-loop method for preventing role inheritance based on reverse iteration.

[0014] Figure 2 This is a schematic diagram of Example 1. DETAILED DESCRIPTION

[0015] The present invention is further described in detail below with reference to the accompanying drawings.

[0016] like Figure 1 As shown, a closed-loop method for preventing role inheritance based on reverse iteration includes providing an inheritance relationship database, and includes the following steps:

[0017] S1: Set the parent role to be created to r1, and the child role to be created to r2; set the iteration variable to i (1, 2, 3, ... n), the temporary variable to j (1, 2, 3, ... n), and start from i = j = 1;

[0018] S2: Search the inheritance database for all existing parent roles of the parent role r1 to be created, and save them in the collection f i (r1);

[0019] S3: Determine f i (r1) whether it is an empty set. If it is an empty set, the inheritance relationship between the parent role r1 to be created and the child role r2 to be created is established; if it is not an empty set, execute step S4;

[0020] S4: Determine whether the child role r2 to be created exists in the set f i In (r1), if the sub-role r2 to be created belongs to the set f i (r1), that is, the child role r2 to be created is the parent role of the parent role r1 to be created. If the inheritance relationship between the child role r2 to be created and the parent role r1 to be created is established at this time, then an i+1-element role inheritance closed loop is formed on the role inheritance chain of the child role r2 to be created relative to the parent role r1 to be created. The algorithm triggers the role closed loop blocking, throws an abnormal alarm, and jumps to step S5;

[0021] S5: If the child role r2 to be created does not belong to the set f i (r1), temporary variable j = j + 1, for set f i For each role in (r1), search for the set f in the inheritance relation database i The parent role set of each role in (r1) and merge the parent role set of each role into the set f j In (r1), the iteration variable i=j, and the process jumps to step S3 to repeat the judgment;

[0022] S6: End the inheritance relationship setting.

[0023] The above algorithm detects whether there is a role inheritance closed-loop relationship on the role inheritance chain by reverse iteration of the inheritance chain of the parent role. If there is no closed-loop relationship, the role inheritance relationship is established. If a closed-loop inheritance relationship is detected, the role inheritance is blocked, effectively preventing improper role inheritance from causing damage to the system.

[0024] Embodiment 1:

[0025] The role-based access control system has been set up as Figure 2The inheritance relationship shown is a role set ROLES, ROLES = {r1, r2, r3, ..., r15}, where r3, r4, r5, r6 are the parent roles of r1, r7, r8, r9 are the parent roles of r3, r10, r11, r12 are the parent roles of r4, and r13, r14, r15, r2 are the parent roles of r6; set the role inheritance relationship this time, set the parent role to be r1, and the child role to be r2, and use the closed-loop role inheritance prevention algorithm based on reverse iteration proposed by the present invention to verify whether an inheritance relationship can be established between the parent role to be established r1 and the child role to be established r2, and the specific steps are as follows:

[0026] a. Let the parent role to be inherited be r1, the child role to be inherited be r2, set the iteration variable i and temporary variable j, i=j=1;

[0027] b. Get the parent role of r1 and save it in the set f1(r1), that is: f1(r1) = {r3, r4, r5, r6};

[0028] c. Determine that f1(r1) is not an empty set S4: Continue execution

[0029] d, calculate the set {r2} and f i (r1), that is, {r2}∧f1(r1). Since {r2}∧f1(r1) is the empty set r2, it does not exist in the set f1(r1), so continue with step e.

[0030] e: Find the parent role set of each role in the set f1(r1) and combine them into the set f2(r1), where the parent role set of r3 in f1(r1) is {r7, r8, r9}, the parent role set of r4 is {r9, r10, r11, r12}, the parent role set of r5 is the empty set, and the parent role set of r6 is {r13, r14, r15, r2}, so f2(r1)={r7, r8, r9}∪{r9, r10, r11, r12}∪{}∪{r13, r14, r15, r2}={r7, r8, r9, r9, r10, r11, r12, r13, r14, r15, r2};

[0031] f: Since f2(r1) is not an empty set, it is calculated that {r2}∧f2(r1)={r2}≠r2 itself is the indirect parent role of r1. If r2 is made the child role of r1 at this time, a 3-way closed loop is formed, triggering the role closed loop blocking, throwing an abnormal alarm, and stopping the inheritance relationship construction.

[0032] The results of Example 1 prove that the algorithm of the present invention can effectively detect and prevent the emergence of role inheritance loops, reduce the privacy data leakage and access control system crash caused by setting improper inheritance relationships, which is sufficient to show that the algorithm is effective.

Claims

1. A closed-loop method for preventing role inheritance based on reverse iteration, comprising an inheritance relationship database, characterized in that: The steps include: S1: Set the parent role to be created to r1, and the child role to be created to r2; set the iteration variable to i (1, 2, 3, ... n), the temporary variable to j (1, 2, 3, ... n), and start from i = j = 1; S2: Search the inheritance database for all existing parent roles of the parent role rl to be created and save them in the collection f i (r1); S3: Determine f i (r1) whether it is an empty set. If it is an empty set, the inheritance relationship between the parent role r1 to be created and the child role r2 to be created is established; if it is not an empty set, execute step S4; S4: Determine whether the child role r2 to be created exists in the set f i In (r1), if the sub-role r2 to be created belongs to the set f i (r1), it leads to the formation of i+1-element role inheritance closed loop, the algorithm triggers the role closed loop blocking, throws an abnormal alarm, and jumps to step S5; S5: If the child role r2 to be created does not belong to the set f i (r1), temporary variable j = j + 1, for set f i For each role in (r1), search for the set f in the inheritance relation database i The parent role set of each role in (r1) and merge the parent role set of each role into the set f j In (r1), the iteration variable i=j, and the process jumps to step S3 to repeat the judgment; S6: End the inheritance relationship setting.

Images