A data dynamic authorization system and method for multi-dimensional sensitive attributes of data

Abstract

The present invention proposes a data dynamic authorization method and system for multi-dimensional sensitive attributes of data, which belongs to the field of power network security. The method combines the convenience of multi-dimensional sensitive attributes of data in policy management and the ability of trust decision-making in fine-grained policy specification generation, while giving real-time properties to attribute parameters to achieve dynamic data authorization. The method provides a more flexible data authorization solution, which simplifies the complexity of data authorization management by combining trust and attributes, allowing permissions to change with changes in the surrounding environment, and providing exclusive access rights for specific terminal groups through the attributes of power marketing terminals. The present invention automatically sets exclusive restrictions for certain users through attribute extraction and trust calculation, thereby better organizing and reducing the number of required constraint policies.

Description

Technical Field

[0001] The present invention belongs to the technical field of power network security, and in particular to a data dynamic authorization system and method based on multi-dimensional sensitive attributes of data. Background Art

[0002] Data dynamic authorization technology originated in the 1970s and has gone through four stages of development. The most representative ones are the BLP and Biba models that guarantee confidentiality and integrity respectively, which led the first stage of the development of the entire data dynamic authorization technology. Since then, with the improvement of network security protection requirements and the enrichment of network scenarios, scholars have carried out more flexible data dynamic authorization research to address the problem of insufficient flexibility of the BLP and Biba models, forming the second stage of data dynamic authorization technology represented by the Trusted Computer System Evaluation Criteria (TCSEC) proposed by the US Department of Defense. Since then, as the third stage in 2000, with the popularization of computers and the Internet, the scale of network users has grown rapidly, and the corresponding software systems have also been rapidly deployed and applied. In order to subdivide access rights for users of different roles, role-based data dynamic authorization has emerged and become an effective solution. In recent years, with the increasingly mature application of new generation information and communication technologies such as cloud computing, big data, the Internet of Things, mobile Internet, and artificial intelligence, the traditional closed environment-oriented data dynamic authorization model is difficult to adapt, and attribute-based data dynamic authorization technology has been applied. Since attributes are inherent in the subject and object, the dynamic data authorization strategy is more targeted and does not require manual prior allocation, making dynamic data authorization more flexible and accurate. Relevant attributes can be flexibly expanded as needed and can be combined with security mechanisms such as encryption to ensure data security on the basis of fine-grained dynamic data authorization.

[0003] In the field of power information network security, data dynamic authorization technology has received much attention and research. Since 2011, the International Electrotechnical Commission IEC / TC 57 has formulated "Power System Management and Related Information Exchange. Data and Communication Security. Part 8: Role-based Access Control" IEC / TS62351-8-2011. In response to the problem of unauthorized access in the power dispatching automation system, a data dynamic authorization model based on role credibility is proposed. Part of the information in the user identity authentication result is extracted to confirm the user role, and the credibility threshold is set for the user role, so as to formulate the corresponding data dynamic authorization strategy. Since then, similar research results on role-based power system data dynamic authorization technology have also been developed, such as task- and role-based smart distribution network data dynamic authorization technology, which mainly solves the role-based data dynamic authorization problem in different power scenarios.

[0004] With the development of attribute-based data dynamic authorization technology, a smart grid data dynamic authorization technology based on attribute encryption (Ciphertext-Policy Attributed-based Encryption, CP-ABE) integrates attribute data authorization and attribute encryption technology. In addition, a hierarchical attribute-based data dynamic authorization and revocable encryption transmission method not only improves the flexibility of attribute data authorization, but also reduces the computational complexity of traditional encryption transmission. In view of the security problem that data dynamic authorization technology may be forged, a security-optimized data dynamic authorization model is proposed, which introduces the concept of supervisory group SG (Supervise Group) to supervise the security attributes of the access subject and the dynamic authorization of data, prevent attribute forgery and authority escalation, and enhance the security of the data dynamic authorization system.

[0005] In response to the demand for secure data authorization in more business scenarios of the power system, relevant researchers have also proposed many other data authorization schemes, such as a dynamic authorization method for power big data security data based on fine-grained attributes, a dynamic authorization method for smart grid system interoperability data based on IEC-62351-8, and other achievements, including dynamic authorization of data in dynamic charging scenarios of electric vehicles based on offline authentication authorization, dynamic authorization of data in power information systems combining artificial neural networks and artificial immunity, dynamic authorization of data at the boundary of power networks based on multi-level attribute encryption, dynamic authorization of data at power payment terminals integrating trust and reputation, and so on.

[0006] However, the data authorization methods studied above do not consider the dynamic changes in the attributes of the access subject or the trust of the role under the influence of network attacks. Here, it should be possible to dynamically conduct risk assessment based on the abnormal composition of the attributes, and make dynamic decisions based on the assessment results, and take dynamic disposal operations such as cutting abnormal attributes and shrinking data authorization policies. The power marketing terminal is deployed in an uncontrolled user site environment. It is possible that the legitimate power terminal is exploited by attackers to cause abnormal changes in hardware, software, user attributes or roles. Therefore, it is necessary to organically combine these models with the power marketing terminal environment, and effectively perceive the trust of the hardware, applications, and users of the power marketing terminal, and use the trust evaluation results to dynamically adjust the permission policy, so as to achieve fine-grained data authorization for the power marketing terminal business.

[0007] Data dynamic authorization for multi-dimensional sensitive attributes of data is to decide whether to grant or deny access to the terminal based on the attributes of the power marketing terminal, environmental conditions and a set of specified policies. In attribute-based data dynamic authorization, permissions can reflect actual physical parameters such as the type, location and business of the object, and fine-grained data authorization can be implemented based on attribute-specified data authorization policies. The granularity of data dynamic authorization for multi-dimensional sensitive attributes of data is finer, and its focus is on attributes to form detailed data authorization rules.

[0008] At the same time, when configuring attribute-based data authorization, as the number of attributes continues to increase, it becomes difficult to generate rules, requiring a lot of manual deployment and system maintenance. In addition, the existing attribute-based data authorization model adopts a static strategy, assuming that the attributes of the object remain unchanged during operation, and cannot provide dynamic data authorization. Moreover, due to changes in the environment or tasks of the power marketing terminal, when the terminal changes from trusted to untrusted, the terminal's access operation may pose a threat to the main station system. The traditional role-based permission allocation model has the problem of insufficient flexibility in permission allocation, and it also cannot meet the real-time dynamic data authorization based on fusion attributes and trust decisions mentioned in this chapter. It is necessary to change the corresponding permissions according to the current attribute changes of the terminal. Summary of the invention

[0009] In order to overcome the "single point breakthrough, global loss of control" problem of existing static coarse-grained data authorization on terminals, this paper studies data dynamic authorization technology based on trust and attributes. The minimum access rights are granted in real time based on the trust and attributes of the terminal. Finer-grained risk assessment and access rights reduction, isolation and blocking control are performed on abnormally trusted terminals. In addition, innovative data dynamic authorization and attack dynamic defense modes are constructed, thus providing a data dynamic authorization system and method for multi-dimensional sensitive attributes of data.

[0010] According to a first aspect, an embodiment of the present invention discloses a data dynamic authorization system oriented to multi-dimensional sensitive attributes of data, including:

[0011] The policy implementation module is used to proxy the terminal's access request and execute the data authorization policy based on the access behavior control of the final data dynamic authorization result;

[0012] The attribute authority module is used to store the latest attribute information;

[0013] A policy decision module, connected to the policy implementation module and the attribute authority module, for dynamically making decisions on data authorization policies based on attribute information in the attribute authority module;

[0014] The policy management module is connected to the policy decision module and the policy implementation module, and is used to create, store, detect conflicts and destroy terminal data dynamic authorization policies.

[0015] Optionally, the attribute authority module includes: a terminal attribute authority module, an environment attribute authority module and a trust attribute authority module:

[0016] The terminal attribute authority module is used to store the terminal's current user information, the terminal's static attributes, and the terminal's behavioral identity fingerprint information;

[0017] The environmental attribute authority module is used to store the location information and working time information of the terminal;

[0018] The trust attribute authority module is used to perform behavior pattern recognition and trust evaluation result calculation.

[0019] Optionally, the policy decision module adopts a centralized execution scheme for policy decision and implementation on the main station system side. After receiving each access request from the terminal, it will determine whether the terminal attribute information has changed. If there is no change, the existing data authorization policy will be maintained. Otherwise, the data authorization policy will be dynamically decided and generated based on the latest terminal attribute information.

[0020] Optionally, the information interaction elements between the modules include attribute elements and strategy elements;

[0021] The attribute element is a feature related to the terminal, which is represented by an attribute quintuple, including an attribute identifier, an attribute name, an attribute domain, an attribute value, and an attribute type; the attribute type includes dynamic and static;

[0022] The policy elements define whether a terminal can operate a specified resource under a specific environment, and are represented by a policy quintuple, including terminal attributes, access resources, on-site environment, operations, and rules.

[0023] According to a second aspect, an embodiment of the present invention discloses a data dynamic authorization method for multi-dimensional sensitive attributes of data, including:

[0024] When a terminal requests access to any business resource, the request is intercepted by the policy implementation module and forwarded to the policy decision module for data authorization policy decision;

[0025] After receiving the decision request, the policy decision module extracts the latest terminal attribute authority, trust attribute authority and environment attribute authority from the attribute authority module, and determines whether the current attribute value of the terminal has changed. If not, the current data authorization policy is maintained, otherwise, the next step is entered;

[0026] The policy decision module calculates the corresponding data authorization sub-policy according to the current attributes of the terminal, extracts the data authorization sub-policy from the policy management module according to the principle of minimum data authorization authority allocation, and generates a set of data authorization sub-policies that adapt to the authority of the terminal attributes, and obtains the final data dynamic authorization result according to the data authorization policy composite generation algorithm;

[0027] The policy decision module feeds back the generated data authorization policy to the policy management module, which performs conflict detection, merging and updating;

[0028] The policy management module feeds back the sub-policies that differ between the latest data authorization policy and the data authorization policy at the previous moment to the policy implementation module for execution;

[0029] After receiving the latest final data dynamic authorization result, the policy implementation module controls and handles the terminal access behavior.

[0030] Optionally, the data authorization sub-policy calculation includes:

[0031] The data authorization strategy is generated by logical operation. Let the variable x i Indicates rule i , the authorization result takes values ​​0 and 1; if rule rule consists of n sub-rules rule1,…,rule n Through logical operations, the corresponding algebraic expression is p = f(x1,…,x n ); Substitute the corresponding 0 and 1 into p to obtain the authorization result of rule rule.

[0032] Optionally, the logic operation includes: a Boolean function composed of Boolean operations, wherein the Boolean operations include AND operations and OR operations;

[0033] The AND operation means that the terminal is allowed to perform corresponding operations on the master system only when all data authorization rules agree to the authorization. The AND operation reflects the principle of minimum authorization, that is, the AND operation rule=rule1∧rule2 is expressed as p=f1(x1,x2)=x1∧x2=x1x2;

[0034] The OR operation means that when any data authorization rule agrees to the authorization, the terminal is allowed to perform corresponding operations on the master system. The OR operation reflects the maximum authorization principle, that is, the OR operation rule=rule1∨rule2 is expressed as p=f2(x1,x2)=x1∨x2=x1+x2.

[0035] Optionally, the control and disposal of the terminal access behavior is specifically performed by:

[0036] The final data dynamic authorization result P is a collection of multiple data authorization rules. If the number of data authorization rules is m, the corresponding algebraic expressions are f1,…,f m ; The final data dynamic authorization result can be expressed as P = F (f1, f2, f m ); For the power marketing system terminal, the attributes of the data authorization sub-strategy include:

[0037]

[0038] Among them, Att(p) is the attribute of the data authorization sub-policy, u i is the terminal identifier, For terminal u i The authoritative value of the attribute, is the subject attribute, is the environmental attribute, is the trustworthiness authority value, S(p) is the object business service resource accessed by the terminal, and L(p) is the minimum attribute authority value set required to access the object business service resource;

[0039] The object business service resource S(p) accessed by the terminal is shown in the following formula:

[0040] S(p)={s1,s2,…s n}

[0041] Among them, s1, s2, …s n Any business service in the business service resources provided by the power marketing master station system, service s j The set of authoritative values ​​for the attributes required for access is defined as:

[0042]

[0043] L(p) is the service s j The corresponding set of attribute authority values:

[0044]

[0045] in, For services j Access the specific attribute authoritative value required;

[0046] Each attribute is subjected to attribute mapping comparison and calculation according to the logic operation to obtain the final data dynamic authorization result.

[0047] Optionally, the specific calculation method of the final data dynamic authorization result is:

[0048] Get a single attribute u i The permission set corresponding to the authority value in For the attribute u i Authority value is obtained in o n The permission value is {Allow=1, Deny=0};

[0049] The authoritative value set of each attribute of the terminal is similarly matched and summarized with the minimum attribute authoritative value set required to access the object business service resources to obtain the final data dynamic authorization result of the terminal.

[0050] Optionally, the final data dynamic authorization result is expressed by the following formula:

[0051]

[0052] The technical solution of the present invention has the following advantages:

[0053] 1. The data dynamic authorization system for multi-dimensional sensitive attributes of data provided by the present invention calculates the final data dynamic authorization result based on the attribute authority obtained in real time, which solves the problem that the existing data dynamic authorization system of the power marketing terminal cannot dynamically adjust the access strategy according to the real-time operation status on site. It combines the convenience of the former in policy management with the ability of the latter in generating fine-grained policy specifications, and at the same time gives the attribute parameters real-time performance to realize dynamic data authorization.

[0054] 2. The data dynamic authorization method for multi-dimensional sensitive attributes of data provided by the present invention provides a more flexible data authorization solution by setting a terminal attribute authority module, an environmental attribute authority module and a trust authority module in the attribute authority module. By combining trust and attributes, permissions are allowed to change with the surrounding environment, which can simplify the complexity of data authorization management; provide exclusive access rights for specific terminal groups through the attributes of power marketing terminals; and automatically set exclusive restrictions for certain users by making trust dependent attributes, thereby better organizing and reducing the number of required constraint policies.

[0055] 3. The data dynamic authorization method for multi-dimensional sensitive attributes of data provided by the present invention obtains corresponding authority authorization through the current attributes and trustworthiness of the terminal, thereby ensuring the security of the main station system and the safe and controllable terminal behavior. By introducing policy constraints into the authority allocation model, the authority allocation scope of the terminal can be effectively limited, thereby dynamically adjusting the authority according to the changes in the attribute values ​​of the terminal attributes. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0057] Figure 1 It is a principle block diagram of a specific example of a data dynamic authorization system for multi-dimensional sensitive attributes of data in an embodiment of the present invention;

[0058] Figure 2 It is a flowchart of a specific example of a method for dynamic data authorization oriented to multi-dimensional sensitive attributes of data in an embodiment of the present invention. DETAILED DESCRIPTION

[0059] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0060] In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicating the orientation or positional relationship, are based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance.

[0061] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, it can also be the internal connection of two components, it can be a wireless connection, or it can be a wired connection. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0062] In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0063] The embodiment of the present invention discloses a data dynamic authorization system for multi-dimensional sensitive attributes of data, such as Figure 1 As shown, the system includes:

[0064] Terminal 1: sends a request to access a service resource.

[0065] Policy Enforcement Point (PEP) Module 2: Data dynamic authorization policy execution part, responsible for proxy forwarding of terminal access requests and access behavior control based on the final data dynamic authorization results. The specific data authorization execution operation is to allow or prohibit the terminal-related service access message request to pass.

[0066] Policy Decision Point (PDP) module 3: The core component of data dynamic authorization policy formulation and generation, responsible for dynamically making decisions on data authorization policies based on the terminal attribute information in the attribute authority module. After receiving each access request from the terminal, PDP will first determine whether the terminal attribute information has changed. If it has not changed, the existing data authorization policy will be maintained. Otherwise, the data authorization policy will be dynamically decided and generated based on the latest terminal attribute information.

[0067] Policy Authority (PA) module 4: The management and maintenance part of the data dynamic authorization policy is responsible for the creation, storage, conflict detection and destruction of the terminal dynamic data authorization policy.

[0068] Attribute Authority (AA) module 5: It is the basic basis for generating data dynamic authorization policy decisions and stores the latest attribute authority. It is subdivided into terminal attribute authority module, environment attribute authority module and trust attribute authority module.

[0069] The Subject Attribute Authority (SAA) module 51 includes the original static attributes such as the current user information of the terminal, the current terminal type, and the terminal behavior identity fingerprint information.

[0070] Environment Attribute Authority (EAA) module 52: contains the location information and working time information of the terminal.

[0071] Trust Attribute Authority (TAA) module 53: performs behavior pattern recognition and trust evaluation result calculation.

[0072] Business access module 6: Make business access decisions based on data dynamic authorization policies.

[0073] For example, in the core part of the above data dynamic authorization architecture, policy decision-making and implementation can have two working modes: one is decentralized execution on the power marketing terminal side, and the other is centralized execution on the master station system side. There are some disadvantages in executing on the terminal side, such as the low security of the policy, easy tampering, and occupying terminal resources. In addition, how to maintain the consistency of the policy in the terminal is also a problem. Therefore, considering the above factors, a centralized execution solution for policy decision-making and implementation on the master station system side is adopted.

[0074] Exemplarily, the information interaction elements between modules include attributes and strategies, which are defined as:

[0075] 1) Attribute (Att). Attribute refers to the characteristics related to the terminal, which is defined by a five-tuple, including attribute identifier (AttID), attribute name (AttName), attribute domain (AttDomain), attribute value (AttSepc) and attribute type (RType), namely:

[0076] Att={AttID,AttName,AttDomain,AttSpec,RType}.

[0077] 2) Policy (Policy, p). The policy specifies whether the terminal can operate on the specified resource under a specific environment. It is defined by a five-tuple, including terminal attributes (uatt), access resources (ratt), on-site environment (eatt), operation (operate) and rule (rule), namely:

[0078] p={uatt,ratt,eatt,operate,rule}.

[0079] The embodiment of the present invention discloses a data dynamic authorization method for multi-dimensional sensitive attributes of data, such as Figure 2 As shown, the method comprises the following steps:

[0080] S1: Waiting for a terminal to request access to a certain service resource;

[0081] S2: The PEP module intercepts the request sent by the terminal and forwards it to the PDP module for dynamic data authorization policy decision;

[0082] S3: After receiving the decision request, the PDP module extracts the latest SAA, TAA, and EAA from the AA module;

[0083] S4: Determine whether the current attribute value of the terminal has changed;

[0084] S5: When the current attributes of the terminal change, the PDP module calculates the corresponding data authorization sub-policy according to the current attributes of the terminal, extracts the data authorization sub-policy p from the policy management module, and generates a data authorization sub-policy p adapted to the authority of the terminal attributes according to the principle of minimum data authorization authority allocation. * The final data dynamic authorization result P is obtained based on the data dynamic authorization strategy composite generation algorithm;

[0085] S6: The PDP module feeds back the generated data authorization policy to the PA module, which performs conflict detection, merging, updating and other maintenance management;

[0086] S7: In order to reduce the system computing overhead and the interference to the terminal access behavior, the PA module only feeds back the sub-policies that differ between the latest data authorization policy and the data authorization policy at the previous moment to the PEP for execution;

[0087] S8: When the current attributes of the terminal have not changed, the previous authorization policy is maintained;

[0088] S9: After receiving the latest data dynamic authorization policy, the PEP module controls and disposes the terminal access behavior;

[0089] S10: Wait again for the terminal to request access to a certain service resource.

[0090] Exemplarily, the data dynamic authorization policy compound generation algorithm used in S5 adopts a Boolean function composed of AND (AND, ∧) and OR (OR, ∨) Boolean operations to compound the rules to obtain a semantically rich complex data dynamic authorization policy.

[0091] The data dynamic authorization policy is generated by logical operation, and its logical operation is defined as follows:

[0092] Definition and operation AND: It means that the terminal is allowed to perform corresponding operations on the master system only when all data dynamic authorization rules agree to the authorization. The AND operation reflects the principle of minimum authorization.

[0093] For example, rule = rule1∧rule2, dec i Indicates rule i The authorization result is dec=dec1∧dec2. If the authorization is approved as 1 and the authorization is not approved as 0, then dec=1 if and only if dec1=1 and dec2=1.

[0094] Definition or operation OR: indicates that when a data dynamic authorization rule agrees to the authorization, the terminal is allowed to perform corresponding operations on the master system, or the operation reflects the maximum authorization principle.

[0095] For example, rule = rule1∨rule2, dec i Indicates rule i The authorization result is dec=dec1∨dec2. If the authorization is approved as 1 and the authorization is not approved as 0, then dec=1 when dec1=1 or dec2=1.

[0096] Let variable x i Indicates rule i , the authorization result takes values ​​0 and 1. Then the operation rule=rule1∧rule2 can be written as p=f1(x1,x2)=x1∧x2=x1x2; or the operation rule=rule1∨rule2 can be written as p=f2(x1,x2)=x1∨x2=x1+x2. Therefore, if rule rule is composed of n sub-rules rule1,…,rule n By combining the AND operation and the OR operation, the combination relationship can be expressed by × and + to obtain the corresponding algebraic expression p = f(x1,…,x n ). Substitute the corresponding 0 and 1 into p to get the authorization result of rule rule.

[0097] For example, the control and disposal of terminal access behavior described in S9 uses permission allocation based on policy constraints. The specific method is as follows: for a data dynamic authorization system for multi-dimensional sensitive attributes of data, the data dynamic authorization policy is a collection of multiple data authorization rules. If the number of data authorization rules is m, then the corresponding algebraic expressions are f1,…,f m ; Then the final data dynamic authorization result P can be expressed as P = F (f1, f2, f m ); For the power marketing system terminal, the attribute Att(p) of its strategy p is defined as a four-tuple:

[0098]

[0099] Among them, u i is the terminal identifier, For terminal u i The authoritative value of the attribute, is the subject attribute (user information, meter number, chip number, etc.), Environmental attributes (network protection strategy, area, location, etc.), is the trust authority value, S(p) is the object business service resource accessed by the terminal, and L(p) is the minimum attribute authority value set required to access the object business service resource.

[0100] Similarly, the business service resources S(p) that can be accessed are as follows:

[0101] S(p)={s1,s2,…s n}

[0102] s1,s2,…s n A specific business service among the business service resources provided by the power marketing master station system. j The set of authoritative values ​​for the attributes required for access is defined as:

[0103]

[0104] L(p) is the service s j The corresponding set of attribute authority values:

[0105]

[0106] in, For services j Access the specific attribute authoritative value you want.

[0107] In order to realize the decision-making generation of data dynamic authorization strategy, each attribute is mapped and compared according to logical operation to calculate the final data dynamic authorization strategy P:

[0108] First get a single attribute u i The permission set corresponding to the authority value in For the attribute u i Authority value is obtained in o n The permission value is {Allow=1, Deny=0.

[0109] For example, a terminal is granted power information collection authority (ValueCollect), remote smart payment authority (RemotePay), remote fee control power-off authority (RemoteCharge) and power load control authority (Loadcontrol), and its final data dynamic authorization policy P = {ValueCollect = Allow, RemotePay = Allow, RemoteCharge = Allow, LoadControl = Allow;

[0110] Secondly, the authoritative value set of each attribute of the terminal is similarly matched and summarized with the minimum attribute authoritative value set required to access the object business service resources to obtain the final data dynamic authorization policy P of the terminal.

[0111] The calculation process of the final data dynamic authorization result P is as follows:

[0112]

[0113] Although the exemplary embodiments and their advantages have been described in detail, those skilled in the art may make various changes, substitutions and modifications to these embodiments without departing from the spirit of the present invention and the scope of protection defined by the appended claims, and such modifications and variations all fall within the scope defined by the appended claims. For other examples, those of ordinary skill in the art should readily understand that the order of the process steps may be changed while maintaining the scope of protection of the present invention.

[0114] In addition, the scope of application of the present invention is not limited to the processes, mechanisms, manufactures, material compositions, means, methods and steps of the specific embodiments described in the specification. From the disclosure of the present invention, it will be easily understood by those skilled in the art that the processes, mechanisms, manufactures, material compositions, means, methods or steps that currently exist or will be developed in the future, which perform substantially the same functions as the corresponding embodiments described in the present invention or obtain substantially the same results, can be applied according to the present invention. Therefore, the claims attached to the present invention are intended to include these processes, mechanisms, manufactures, material compositions, means, methods or steps within their scope of protection.

Claims

1. A data dynamic authorization system for multi-dimensional sensitive attributes of data, characterized in that: include: The policy implementation module is used to proxy and forward the terminal's access request, and to control the terminal's access behavior based on the final data dynamic authorization result and execute the data dynamic authorization policy; The attribute authority module is used to store the latest attribute information; A policy decision module, connected to the policy implementation module and the attribute authority module, for dynamically deciding and formulating a final data dynamic authorization result based on the attribute information in the attribute authority module; A policy management module, connected to the policy decision module and the policy implementation module, for creating, storing, detecting conflicts and destroying terminal data dynamic authorization policies; When a terminal requests access to any business resource, the request is intercepted by the policy implementation module and forwarded to the policy decision module for data authorization policy decision; After receiving the decision request, the policy decision module extracts the latest terminal attribute authority, trust attribute authority and environment attribute authority from the attribute authority module, and determines whether the current attribute value of the terminal has changed. If not, the current data authorization policy is maintained, otherwise, the next step is entered; The policy decision module calculates the corresponding data authorization sub-policy according to the current attributes of the terminal, extracts the data authorization sub-policy from the policy management module according to the principle of minimum data authorization authority allocation, generates a set of data authorization sub-policies that are adapted to the authority of the terminal attributes, and obtains the final data dynamic authorization result according to the data authorization policy composite generation algorithm; The policy decision module feeds back the generated data authorization policy to the policy management module, which performs conflict detection, merging and updating; The policy management module feeds back the sub-policies that differ between the latest data authorization policy and the data authorization policy at the previous moment to the policy implementation module for execution; After receiving the latest final data dynamic authorization result, the policy implementation module controls and handles the terminal access behavior; The data authorization sub-strategy calculation includes: The data authorization strategy is generated by logical operation. Let the variable x i Indicates rule i , the authorization result p takes values ​​0 and 1; if rule rule consists of n sub-rules rule1,…,rule n Through logical operations, the corresponding algebraic expression is p = f(x1,…,x n ) ; Substitute the corresponding 0 and 1 into p to obtain the authorization result of rule rule; The logical operations include: A Boolean function composed of Boolean operations, wherein the Boolean operations include AND operations and OR operations; The AND operation means that when all data authorization rules agree to the authorization, the terminal is allowed to perform corresponding operations on the master system. The AND operation reflects the principle of minimum authorization, that is, the AND operation rule=rule1∧rule2 is expressed as p=f1(x1,x2)=x1∧x2=x1x2; The OR operation means that when any data authorization rule agrees to the authorization, the terminal is allowed to perform the corresponding operation on the master station system. The OR operation reflects the maximum authorization principle, that is, the OR operation rule=rule1∨rule2 is expressed as p=f2(x1,x2)=x1∨x2=x1+x2; The controlling and handling of terminal access behavior includes: The final data dynamic authorization result P is a collection of multiple data authorization rules. If the number of data authorization rules is m, the corresponding algebraic expressions are f1,…,f m ; The final data dynamic authorization result is expressed as P = F (f1, f2, f m ); For the power marketing system terminal, the attributes of the data authorization sub-strategy include: Among them, Att(p) is the attribute of the data authorization sub-policy, u i is the terminal identifier, For terminal u i The authoritative value of the attribute, is the subject attribute, is the environmental attribute, is the trustworthiness authority value, S(p) is the object business service resource accessed by the terminal, and K(p) is the minimum attribute authority value set required to access the object business service resource; The object business service resource S(p) accessed by the terminal is shown in the following formula: S(p)={s1,s2,…s n } Among them, s1, s2, …s n Any business service in the business service resources provided by the power marketing master station system, service s j The set of authoritative values ​​of the attributes required for access is defined as: L(p) is the service s j The corresponding set of attribute authority values: in, For services j Access the specific attribute authoritative value required; Perform attribute mapping comparison and calculation on each attribute according to the logic operation to obtain the final data dynamic authorization result; The specific calculation method for the final data dynamic authorization result is: Get a single attribute u i The permission set corresponding to the authority value in For the attribute u i Authority value is obtained in o n The permission value is {Allow=1, Deny=0}; The authoritative value set of each attribute of the terminal is similarly matched and summarized with the minimum authoritative value set of attributes required to access the object business service resources to obtain the final data dynamic authorization result of the terminal; The final data dynamic authorization result is expressed by the following formula:

2. The data dynamic authorization system for multi-dimensional sensitive attributes of data according to claim 1 is characterized in that: The attribute authority module includes: a terminal attribute authority module, an environment attribute authority module and a trust attribute authority module; The terminal attribute authority module is used to store the terminal current user information, terminal static attributes and terminal behavior identity fingerprint information; The environmental attribute authority module is used to store the location information and working time information of the terminal; The trust attribute authority module is used to perform behavior pattern recognition and trust evaluation result calculation.

3. The data dynamic authorization system for multi-dimensional sensitive attributes of data according to claim 1 is characterized in that: The policy decision module adopts a centralized execution scheme for policy decision and implementation on the main station system side. After receiving the access request from the terminal, it will first determine whether the terminal attribute information has changed. If not, the existing data authorization policy will be maintained. Otherwise, the data authorization policy will be dynamically decided and generated based on the latest terminal attribute information.

4. The data dynamic authorization system for multi-dimensional sensitive attributes of data according to claim 1 is characterized in that: The information interaction elements between modules include attribute elements and strategy elements; The attribute element is a feature related to the terminal, which is represented by an attribute quintuple, and the attribute quintuple includes: attribute identifier, attribute name, attribute domain, attribute value and attribute type; the attribute type includes dynamic and static; The policy elements define whether the terminal can operate on the specified resources under a specific environment, and are represented by a policy quintuple, which includes: terminal attributes, access resources, on-site environment, operations and rules.

Images