An ABAC-based image search method

Abstract

The application provides an ABAC-based image search method, comprising the following steps: generating a candidate image set, a user calling an ABAC-based image search service to obtain a search result selected image set; setting an access control strategy, the access control strategy being used to determine what kind of attribute the candidate image has and under what kind of search environment the candidate image can be selected into the search result; thereby completing the conversion from the access control strategy to the search strategy; the search service determining the search result image set according to the search strategy. The method supports user-defined search application templates. The method supports fast and accurate image search in the case of real-time generation and addition of new images. The method can meet the user's fine-grained, scenario-based and customized image search business requirements. For the service party, candidate images can be flexibly added at any time. In the security scene, the method can quickly search for target images in a large set of candidate images collected by a camera.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of image search, in particular to an image search method based on ABAC. BACKGROUND

[0002] In the prior art image search method, an image search service provider collects candidate images, numbers each candidate image, extracts information respectively, and establishes an image index library. An image search user inputs a search keyword or keyword combination, and sends a search request to the service provider. The service provider queries the image index library, and returns the search result to the user.

[0003] The main difficulties of the prior art are as follows:

[0004] 1. Users have difficulty in carrying out fine-grained, scenario-based and customized image search services.

[0005] 2. The search service provided by the service provider at present mainly relies on the index library established in advance, and it is difficult to cope with the situation of new images being generated and added at any time. SUMMARY

[0006] The present application aims to solve at least one of the technical problems in the prior art that users have difficulty in carrying out fine-grained, scenario-based and customized image search services, and the search service provided by the service provider at present mainly relies on the index library established in advance, and it is difficult to cope with the situation of new images being generated and added at any time.

[0007] To this end, the present application provides an image search method based on ABAC.

[0008] The present application provides an image search method based on ABAC, comprising the following steps:

[0009] S1. Generating a candidate image set, a user obtains a search result selected image set by calling an image search service based on ABAC;

[0010] S2. Setting an access control policy, the access control policy is used to determine what kind of attributes the candidate image has and under what search environment the candidate image can be selected into the search result; thereby completing the conversion from the access control policy to the search strategy;

[0011] S3. The search service determines a search result image set according to the search strategy.

[0012] The image search method based on ABAC according to the above technical solution of the present application can further have the following additional technical features:

[0013] In the technical solution, in S1, each candidate image CP entity corresponds to a subject in ABAC; the search result selected image EP entity corresponds to an object in ABAC; the search business environment SE entity corresponds to an environment in ABAC; and the selected search action SA entity corresponds to an action in ABAC.

[0014] In the technical solution, the attributes of each candidate image CP entity, the search result selected image EP entity, the search business environment SE entity and the selected search action SA entity are described using the XACML language and an ABAC access control policy.

[0015] In the technical solution, S2 is used to generate a search policy, and the generation of the search policy includes:

[0016] S21, a search policy template is set, which is used as a search scene template to edit the names and data types of various entities in a search business, can be adapted to various actual application scenes, thereby realizing scene customization.

[0017] S22, search policy management, the search policy corresponds to an access control policy in ABAC, a user sets the search policy, thereby determining an image type meeting a search requirement; the user inputs {CP attribute set, EP attribute set, SE attribute set, SA attribute set}, the meaning of one search policy represents whether CP is allowed to select EP under the scene described in the SE attribute set; and the search policy management includes addition, deletion, modification, query and conflict detection of the search policy.

[0018] In the technical solution, in S21, the search entity item name is input by a user to describe the name and type of an entity attribute in ABAC; and the search entity item value includes one or more of string, tree, select, radio, number, float and time.

[0019] In the technical solution, in S22, the search policy management uses the XACML language to describe the search policy and stores the search policy in an XML file format, and the search policy includes a target and an effect.

[0020] The target includes a resource, a subject, an action and an environment.

[0021] The effect includes permission and rejection.

[0022] In the technical solution, the search policy further includes a condition.

[0023] The condition includes additional auxiliary information of a search environment.

[0024] In the above technical solution, before the search strategy XML file is written into the hard disk, conflict detection needs to be performed first to detect whether the newly established search strategy is incompatible with the existing strategy; if a conflict occurs, the search strategy management should prompt the user to complete conflict resolution, and then write the search strategy XML file into the hard disk.

[0025] In the above technical solution, S3 is search strategy execution, including the following steps:

[0026] S301, a user sets a search strategy through a search strategy management point (PAP);

[0027] S302, the user initiates a search request to a policy execution point (PEP);

[0028] S303, the policy execution point (PEP) sends a request to a Context processor; the policy execution point (PEP) and the policy decision point (PDP) support a distributed deployment mode, and multiple points can be deployed at the same time;

[0029] S304, the Context processor sends request context information to the policy decision point (PDP) for saving a search state;

[0030] S305, the policy decision point (PDP) sends an attribute information query request to the Context processor;

[0031] S306, the Context processor sends an attribute query request to a policy information point (PIP);

[0032] S307, a search service loads a set of CPs and sends them to an image recognition system to identify attribute values of the images; the identification item name is the same as the CP attribute name defined in the search strategy template;

[0033] S308, the policy information point (PIP) acquires a CP attribute value set, an EP attribute value set, an SE attribute value set, and SA attribute value information;

[0034] S309, the policy information point (PIP) summarizes attribute information and returns it to the Context processor;

[0035] S310, the Context processor sends attribute information to the policy decision point (PDP);

[0036] S311, the policy information point (PIP) comprehensively judges the search strategy and the attribute information to determine whether the CP can be selected into the EP; each candidate image needs to execute a judgment process once, and the judgment process needs to be executed multiple times in a loop; the number of execution times depends on the number of images in the candidate image set; response context information is returned to the Context processor;

[0037] S312, the Context processor sends the decision result of the policy decision point (PDP) to the policy enforcement point (PEP);

[0038] S313, the policy enforcement point (PEP) returns the EP set to the user, and the EP set is the image set of the selected search result.

[0039] In any of the above technical solutions, the candidate image set allows new images to be added at any time, and the search strategy continues to be executed after the new images are added.

[0040] To sum up, due to the adoption of the above technical features, the beneficial effects of the present application are:

[0041] Supports user-defined search application templates, supports fine and fine-grained image search, and supports fast and accurate image search in the case of real-time generation and addition of new images.

[0042] The method can meet the user's fine-grained, scenario-based and customized image search business needs. For the service provider, candidate images can be added at any time. In the security scenario, the method can quickly search for target images in a large set of candidate images collected by a camera. The scheme can also be applied to other non-image data search, such as voice, text, and video.

[0043] Additional aspects and advantages of the present application will become apparent from the following description with reference to the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0044] The above and / or additional aspects and advantages of the present application will become apparent and more readily appreciated from the following description of the embodiments, taken in conjunction with the accompanying drawings, in which:

[0045] Figure 1 is a flowchart of an ABAC-based image search method according to an embodiment of the present application;

[0046] Figure 2 is a flowchart of search strategy execution in an ABAC-based image search method according to an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to more clearly understand the above-mentioned purposes, features and advantages of the present application, the present application will be further described in detail below in conjunction with the drawings and specific embodiments. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0048] In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present application. However, it will be apparent to one skilled in the art that the present application can be practiced without the specific details set forth in this description. In other instances, well-known methods, procedures, components, and circuits have not been described in detail so as not to unnecessarily obscure aspects of the present application.

[0049] In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present application. However, it will be apparent to one skilled in the art that the present application can be practiced without the specific details set forth in this description. In other instances, well-known methods, procedures, components, and circuits have not been described in detail so as not to unnecessarily obscure aspects of the present application. Figures 1-2 A method for ABAC-based image search is described below according to some embodiments of the present application.

[0050] A method for ABAC-based image search is described below according to some embodiments of the present application.

[0051] As shown in Figures 1-2 , a method for ABAC-based image search is proposed in the first embodiment of the present application, including the following steps:

[0052] S1, generating a candidate image set, a user obtains a search result selected image set by calling an ABAC-based image search service;

[0053] In S1, each candidate image CP entity corresponds to a subject in ABAC; the search result selected image EP entity corresponds to an object in ABAC; the search business environment SE entity corresponds to an environment in ABAC; and the selected search action SA entity corresponds to an action in ABAC.

[0054] The attributes of each candidate image CP entity, search result selected image EP entity, search business environment SE entity, and selected search action SA entity are described using XACML language and ABAC access control policy.

[0055] The candidate image set allows new images to be added at any time, and the search strategy continues to be executed after the new images are added.

[0056] S2, setting an access control policy, which is used to determine what kind of attributes the candidate image has and under what kind of search environment the candidate image can be selected as the search result; thereby completing the conversion from the access control policy to the search strategy;

[0057] Step S2 is used to generate a search strategy, which includes:

[0058] S21, setting a search strategy template, which is used as a search scene template to edit the names and data types of various entities in the search business, can adapt to various actual application scenes, and thereby realizes scene customization;

[0059] The search entity item name in S21 is inputted by the user, and is used to describe the name and type of the entity attribute in ABAC; the search entity item value includes one or more of string, tree, select, radio, number, float, and time.

[0060] S22, search strategy management, the search strategy corresponds to the access control strategy in ABAC, the user sets the search strategy, thereby determining the image type meeting the search requirement; the user inputs {CP attribute set, EP attribute set, SE attribute set, and SA attribute set}, the meaning of one search strategy represents whether the CP is allowed to be selected in the EP under the condition described in the SE attribute set; the search strategy management includes the addition, deletion, modification, query, and conflict detection of the search strategy.

[0061] The search strategy management in S22 uses the XACML language to describe the search strategy, and stores the search strategy in the XML file format, the search strategy includes a target and an effect;

[0062] The target includes a resource, a subject, an action, and an environment;

[0063] The effect includes permission and rejection.

[0064] The search strategy further includes a condition;

[0065] The condition includes additional auxiliary information of the search environment.

[0066] Before writing the search strategy XML file into the hard disk, the conflict detection needs to be performed first, to detect whether the newly established search strategy is incompatible with the existing strategy; if the conflict occurs, the search strategy management should prompt the user to complete the conflict resolution, and then write the search strategy XML file into the hard disk.

[0067] S3, the search service determines the search result image set according to the search strategy.

[0068] S3 is the execution of the search strategy, including the following steps:

[0069] S301, the user sets the search strategy through a search strategy management point (PAP);

[0070] S302, the user initiates a search request to a policy execution point (PEP);

[0071] S303, the policy execution point (PEP) sends a request to a Context processor; the policy execution point (PEP) and the policy decision point (PDP) support a distributed deployment mode, and multiple points can be deployed at the same time;

[0072] S304, the Context processor sends a request context information to a policy decision point (PDP) for saving the search state;

[0073] S305, the policy decision point (PDP) sends an attribute information query request to the Context processor;

[0074] S306, the Context processor sends an attribute query request to a policy information point (PIP);

[0075] S307, the search service loads a set of CPs and sends them to an image recognition system to identify the attribute values of the images; the identification item name is the same as the CP attribute name defined in the search strategy template;

[0076] S308, the policy information point (PIP) acquires the CP attribute value set, the EP attribute value set, the SE attribute value set and the SA attribute value information;

[0077] S309, the policy information point (PIP) summarizes the attribute information and returns it to the Context processor;

[0078] S310, the Context processor sends the attribute information to the policy decision point (PDP);

[0079] S311, the policy information point (PIP) makes a judgment by comprehensively searching the search strategy and the attribute information to determine whether the CP can be selected into the EP; the judgment process needs to be executed once for each candidate image, and the judgment process needs to be executed repeatedly for multiple times; the number of execution times depends on the number of images in the candidate image set; the response context information is returned to the Context processor;

[0080] S312, the Context processor sends the judgment result of the policy decision point (PDP) to a policy execution point (PEP);

[0081] S313, the policy execution point (PEP) returns the EP set to the user, and the EP set is the image set of the selected search result.

[0082] The second embodiment of the application proposes an image search method based on ABAC, and on the basis of the first embodiment, as shown in the figure, the attribute-based access control mechanism (ABAC, attribute based access control) uses attributes as the basic elements of access control, and can flexibly use the attribute set owned by an entity to determine whether to grant it access rights. Figures 1-2

[0083] The method comprises the following steps:

[0084] ​S1, generating a candidate image set, a user calls an ABAC-based image search service to obtain a search result selected image set;

[0085] Wherein, each candidate image CP entity corresponds to a subject in ABAC; the search result selected image EP entity corresponds to an object in ABAC; the search business environment SE entity (such as time, place, etc.) corresponds to an environment in ABAC; and the selected search action SA entity corresponds to an action in ABAC.

[0086] The attributes of the above entities and the ABAC access control policy are described using the XACML language.

[0087] S2, setting an access control policy, which is used to determine what kind of candidate image has what kind of attribute and can be selected in what kind of search environment to obtain a search result, thereby completing the conversion from the access control policy to the search strategy;

[0088] S3, the search service determines a search result image set according to the search strategy.

[0089] The candidate image set also allows new images to be added at any time, and the search strategy continues to be executed. Meanwhile, the method introduces a search strategy template, which can be used for user search scene customization.

[0090] Step S2 is used to generate a search strategy, and the generation of the search strategy includes:

[0091] S21, setting a search strategy template, which is used as a search scene template to edit the names and data types of various entities in the search business, the entities mainly include {CP, EP, SE, SA}, which can be adapted to various actual application scenes, thereby realizing scene customization;

[0092] The search entity item name can be input by the user to describe the name and type of the entity attribute in ABAC; the search entity item value includes one or more of string, tree, select, radio, number, float, and time. As shown in the following table:

[0093] Numeric Type Optional Explanation string is Normal string tree is Tree structure, which can be used to represent an organization. radio is Radio type structure select is Can be used to represent a level range. number is Can be used to represent an integer range. float is Can be used to represent a decimal range. time is Can be used to represent a time range.

[0094] S22, search strategy management SPM, the search strategy corresponds to the access control policy in ABAC, the user sets the search strategy to determine the image type that meets the search requirement; the user inputs {CP attribute set, EP attribute set, SE attribute set, SA attribute set}, which means that the CP is allowed to be selected in the EP under the description of the SE attribute set; the search strategy management includes the addition, deletion, modification, query, and conflict detection of the search strategy.

[0095] The search strategy management uses the XACML language to describe the search strategy and stores it in an XML file format. The search strategy uses the XACML language to describe, including three components, namely, Target, Effect and Condition. As shown in the following table:

[0096]

[0097] Before writing the search strategy XML file into the hard disk, conflict detection needs to be performed first to detect whether the newly established search strategy is incompatible with the existing strategy. If a conflict occurs, the search strategy management should prompt the user to complete conflict resolution, and then write the search strategy XML file into the hard disk.

[0098] S3, the search service determines a search result image set according to the search strategy.

[0099] S3 is the search strategy execution, and the specific process is as shown in Figure 2 , including the following steps:

[0100] S301, the user sets the search strategy through a search strategy management point (PAP);

[0101] S302, the user initiates a search request to a policy execution point (PEP);

[0102] S303, the policy execution point (PEP) sends a request to the Context processor; the policy execution point (PEP) and the policy decision point (PDP) support a distributed deployment mode, and multiple points can be deployed at the same time;

[0103] S304, the Context processor sends the request context information to the policy decision point (PDP) for saving the search state;

[0104] S305, the policy decision point (PDP) sends an attribute information query request to the Context processor;

[0105] S306, the Context processor sends an attribute query request to the policy information point (PIP);

[0106] S307, the search service loads a set of CPs and sends them to the image recognition system to identify the attribute values of human bodies, animals and objects in the image. The identification item name is the same as the CP attribute name defined in the search strategy template;

[0107] S308, the policy information point (PIP) acquires the CP attribute value set, the EP attribute value set, the SE attribute value set and the SA attribute value information;

[0108] S309, the PIP aggregates the attribute information and returns it to the Context processor;

[0109] S310, the Context processor sends the attribute information to the PDP;

[0110] S311, the PIP comprehensively searches the policy and attribute information to make a decision, and decides whether the CP can be selected as the EP. The decision process needs to be performed once for each candidate image, and needs to be performed repeatedly for multiple times. The number of times of execution depends on the number of images in the candidate image set; the Context processor returns the response context information to the Context processor;

[0111] S312, the Context processor sends the decision result of the PDP to the PEP;

[0112] S313, the PEP returns the EP set to the user, and the EP set is the image set of the selected search result.

[0113] In this specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0114] Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. An image search method based on ABAC, characterized in that, Includes the following steps: S1. Generate a candidate image set. Users can obtain the selected image set by calling the ABAC-based image search service. S2. Set an access control policy, which is used to determine what attributes a candidate image has and under what search environment it can be selected as a search result; thereby completing the transformation from access control policy to search policy. S3. The search service determines the set of search result images based on the search strategy. Step S2 is used to generate a search strategy, which includes: S21. Set a search strategy template. The search strategy template serves as a search scenario template and is used to edit the names and data types of various entities in the search business. It can be adapted to various actual application scenarios, thereby achieving scenario customization. S22. Search strategy management: The search strategy corresponds to the access control strategy in ABAC. The user sets the search strategy to determine the image types that meet the search requirements. The user inputs {CP attribute set, EP attribute set, SE attribute set, SA attribute set}. The meaning of a search strategy indicates whether CP is allowed to be selected as EP under the conditions described by the SE attribute set. The search strategy management includes adding, deleting, modifying, querying and conflict detection of search strategies. S3 executes the search strategy, including the following steps: S301. Users set search strategies through the search strategy management point (PAP). S302, The user initiates a search request to the policy execution point PEP; S303, the policy execution point (PEP) sends a request to the context processor; the policy execution point (PEP) and the policy decision point (PDP) support a distributed deployment mode, and multiple points can be deployed simultaneously; S304: The Context processor sends a request context information to the policy decision point (PDP) to save the search state; S305, The Policy Decision Point (PDP) sends an attribute information query request to the Context Processor; S306, The Context processor sends an attribute query request to the Policy Information Point (PIP); S307. The search service loads a set of CPs and sends them to the image recognition system to identify the attribute values ​​of the image; the name of the identified item is the same as the CP attribute name defined in the search strategy template. S308, Policy Information Point (PIP) obtains the CP attribute value set, EP attribute value set, SE attribute value set, and SA attribute value information; S309. The Policy Information Point (PIP) summarizes the attribute information and returns it to the Context processor. S310, the Context processor sends attribute information to the policy decision point (PDP); S311. The strategy information point (PIP) makes a judgment based on the comprehensive search strategy and attribute information to determine whether the CP can be selected into the EP. Each candidate image needs to be judged once, and the judgment process needs to be executed multiple times. The number of executions depends on the number of images in the candidate image set. The response context information is returned to the Context processor. S312, The Context processor sends the decision result of the Policy Decision Point (PDP) to the Policy Execution Point (PEP); S313. The strategy execution point PEP returns the EP set to the user. The EP set is the set of images selected in the search results.

2. The image search method based on ABAC according to claim 1, characterized in that, In S1, each candidate image CP entity corresponds to the subject in ABAC; the selected search image EP entity corresponds to the object in ABAC; the search business environment SE entity corresponds to the environment in ABAC; and the selected search action SA entity corresponds to the action in ABAC.

3. The image search method based on ABAC according to claim 1, characterized in that, Use XACML language to describe the attributes and ABAC access control policies of each candidate image CP entity, the search result selected image EP entity, the search business environment SE entity, the selected search action SA entity, and the CP entity selected as the search action.

4. The image search method based on ABAC according to claim 1, characterized in that, In S21, the name of the entity item to be searched is user-defined and used to describe the name and type of the entity attribute in ABAC; the numerical value of the entity item to be searched includes one or more of string, tree, select, radio, number, float, and time.

5. The image search method based on ABAC according to claim 4, characterized in that, In S22, the search strategy management uses the XACML language to describe the search strategy and stores it in XML file format. The search strategy includes the objective and the utility. The objectives include resources, subjects, actions, and environment; The utility includes permission and denial.

6. The image search method based on ABAC according to claim 5, characterized in that, The search strategy also includes conditions; The conditions include additional auxiliary information about the search environment.

7. The image search method based on ABAC according to claim 5, characterized in that, Before writing the search strategy XML file to the hard drive, a conflict detection is required to check whether the newly created search strategy is incompatible with existing strategies. If a conflict occurs, the search strategy management should prompt the user to resolve the conflict before writing the search strategy XML file to the hard drive.

8. An image search method based on ABAC according to any one of claims 1 to 7, characterized in that, The candidate image set allows new images to be added at any time, and the search strategy continues to be executed after a new image is added.

Images