Hss overreach access protection method, system, electronic device and storage medium

Abstract

The application relates to the technical field of safety protection, and discloses an HSS unauthorized access protection method, which comprises the following steps: obtaining an original access request of a user to an HSS server, analyzing attribute information and a user private key corresponding to the original access request; adding the attribute information to the original access request to obtain an access request containing the attribute information, and generating an access control strategy according to the access request containing the attribute information; querying an access resource list corresponding to the access control strategy in the HSS server, generating a verification private key by using a preset encryption algorithm based on the access resource list and the attribute information, and prohibiting the access to resources corresponding to the access resource list when the verification private key is inconsistent with the user private key. The application further discloses an HSS unauthorized access protection system, an electronic device and a storage medium. The application can improve the security of the HSS server.

Description

Technical Field

[0001] This invention relates to the field of security protection technology, and in particular to an HSS unauthorized access protection method, system, electronic device and storage medium. Background Technology

[0002] HSS (Home Subscriber Server) is a server in the data platform that stores user subscription information. It is used to manage user subscription data and user privacy data such as mobile user location information. In order to ensure the security of user privacy data, access control is required to prevent unauthorized access and use of user privacy data and improve the security of user privacy data.

[0003] Existing server access control methods suffer from single-point control and centralized control decisions. Access control mechanisms only authorize based on static policies specified by users, and cannot group authorization according to multiple user attribute tags, nor can they dynamically change permissions according to changes in user attributes. They can only achieve single mapping authorization from user to role and role to permission, which is inflexible and lacks scalability. This leads to users exceeding their authority to access HSS data, causing leakage of user privacy data and resulting in poor security of user privacy data. Summary of the Invention

[0004] This invention provides a method, system, electronic device, and storage medium for protecting against unauthorized access to HSS, with the main purpose of solving the problem of low deployment efficiency of distributed data.

[0005] To achieve the above objectives, the present invention provides an HSS unauthorized access protection method, comprising:

[0006] Obtain the user's original access request to the HSS server, and parse the attribute information and user private key corresponding to the original access request;

[0007] The attribute information is added to the original access request to obtain an access request containing the attribute information, and an access control policy is generated based on the access request containing the attribute information.

[0008] Find the access resource list corresponding to the access control policy in the HSS server, and generate a verification private key based on the access resource list and the attribute information using a preset encryption algorithm;

[0009] If the private key does not match the user's private key, access to the HSS server resources corresponding to the HSS server resources in the access resource list is prohibited.

[0010] Optionally, parsing the attribute information and user private key corresponding to the original access request includes:

[0011] Determine the Uniform Resource Identifier and access request message corresponding to the original access request, and extract the message fields from the access request message;

[0012] The parsing rules corresponding to the original access request are obtained using the Uniform Resource Identifier, and the message fields are parsed using the parsing rules to obtain the attribute information and user private key corresponding to the original access request.

[0013] Optionally, the step of parsing the message fields using the parsing rules to obtain the attribute information and user private key corresponding to the original access request includes:

[0014] Extract the parsing functions from the parsing rules, and generate a parsing rule tree based on the parsing functions;

[0015] The parsing execution order of the parsing function is determined based on the rule tree;

[0016] The message fields are processed according to the parsing execution order to obtain the attribute information and user private key corresponding to the original access request.

[0017] Optionally, adding the attribute information to the original access request to obtain an access request containing the attribute information includes:

[0018] Obtain the access request message of the original access request and determine the message fields of the access request message;

[0019] The attribute information is converted into the fields corresponding to the message fields to obtain the attribute information fields;

[0020] The attribute information field is added to a preset message position in the access request message to obtain an access request containing attribute information.

[0021] Optionally, generating an access control policy based on the access request containing attribute information includes:

[0022] Parse the request information in the access request containing attribute information to obtain the attribute request information;

[0023] The attribute request information is categorized to obtain multiple category information, and the information value range in each category information is determined;

[0024] Based on the information value range, the category permissions for each category information are determined and a category information-category permission hash table is constructed. Based on the permission hash table, the access control policy is obtained.

[0025] Optionally, the step of generating a verification private key using a preset encryption algorithm based on the access resource list and the attribute information includes:

[0026] Initialize a fixed word length, and normalize the access resource list and the attribute information according to the fixed word length to obtain a normalized access resource list and attribute information;

[0027] The access resource list and the attribute information are normalized using the following formula:

[0028]

[0029] Where Z is the normalized list of accessed resources or attribute information, x is the list of accessed resources or attribute information, M is the maximum word length in the list of accessed resources or attribute information, and N is the fixed word length;

[0030] The normalized list of accessed resources and attribute information are mapped to obtain mapped data, and the mapped data is truncated.

[0031] The truncated mapping data is iterated a preset number of times to obtain the verification private key.

[0032] Optionally, the normalized list of accessed resources and attribute information can be mapped using the following formula to obtain mapped data:

[0033] f(Z)=uZ(1-Z),u∈(3.571448…,4)

[0034] Where f(Z) is the mapping data, u is the preset mapping parameter, and Z is the normalized list of access resources or attribute information.

[0035] To address the above problems, the present invention also provides an HSS unauthorized access protection system, the system comprising:

[0036] The request parsing module is used to obtain the user's original access request to the HSS server and parse the attribute information and user private key corresponding to the original access request.

[0037] An access control policy generation module is used to add the attribute information to the original access request to obtain an access request containing the attribute information, and to generate an access control policy based on the access request containing the attribute information.

[0038] The verification private key generation module is used to find the access resource list corresponding to the access control policy in the HSS server, and generate a verification private key based on the access resource list and the attribute information using a preset encryption algorithm.

[0039] The privilege escalation protection module is used to prohibit access to the HSS server resources corresponding to the HSS server resources in the access resource list when the private key is inconsistent with the user's private key.

[0040] To address the above problems, the present invention also provides an electronic device, the electronic device comprising:

[0041] At least one processor; and,

[0042] A memory communicatively connected to the at least one processor; wherein,

[0043] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the HSS unauthorized access protection method described above.

[0044] To address the aforementioned problems, the present invention also provides a computer-readable storage medium storing at least one computer program, which is executed by a processor in an electronic device to implement the HSS unauthorized access protection method described above.

[0045] In this embodiment of the invention, the attribute information and user private key corresponding to the original access request are parsed; and an access control policy is generated based on the access request containing the attribute information. This allows for fine-grained segmentation of users based on attribute information and flexible generation of access control policies. Simultaneously, the corresponding access resource list in the HSS is obtained based on the access control policy, effectively preventing users from accessing resources that are inaccessible according to the attribute information, thus improving the data security of the HSS. A verification private key is generated using the access resource list and attribute information; the verification private key is then compared with the user's private key to ensure consistency, prevent the theft of the user's private key, and prevent unauthorized access by unauthorized users, thereby further improving the data security of the HSS. Therefore, the HSS unauthorized access protection method, system, electronic device, and computer-readable storage medium proposed in this invention can solve the problem of unauthorized access to the HSS. Attached Figure Description

[0046] Figure 1 This is a flowchart illustrating an embodiment of the HSS unauthorized access protection method provided by the present invention.

[0047] Figure 2 This is a schematic diagram of the process for generating access control policies according to an embodiment of the present invention;

[0048] Figure 3 This is a functional block diagram of an HSS unauthorized access protection system provided in an embodiment of the present invention;

[0049] Figure 4 This is a schematic diagram of the structure of an electronic device that implements the HSS unauthorized access protection method according to an embodiment of the present invention.

[0050] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0051] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0052] This application provides a method for protecting against unauthorized access to HSS (Hyperspaced Substances). The executing entity of the HSS unauthorized access protection method includes, but is not limited to, at least one of the following electronic devices that can be configured to execute the method provided in this application: a server, a terminal, etc. In other words, the HSS unauthorized access protection method can be executed by software or hardware installed on a terminal device or a server device, and the software can be a blockchain platform. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cloud server cluster. The server can be an independent server or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0053] Reference Figure 1 The diagram shown is a flowchart illustrating an HSS (Host Security Shield) unauthorized access protection method according to an embodiment of the present invention. In this embodiment, the HSS unauthorized access protection method includes:

[0054] S1. Obtain the user's original access request to the HSS server, and parse the attribute information and user private key corresponding to the original access request.

[0055] In this embodiment of the invention, the original access request is an initial access request sent by the user to the HSS server to request access rights from the HSS server. It includes basic user information, such as user account name and password, as well as attribute information and user private key used to verify user permissions, thereby determining the legitimacy of the original access request.

[0056] In this embodiment of the invention, the attribute information is the user attributes included in the original request and the attribute level corresponding to the user attributes, such as the user's age attribute, job attribute, position attribute, etc., which are used to indicate the user's access permissions. The private key is a unique identifier generated when encrypting user data in the HSS server. After encrypting the resource, the private key is returned to the user. When the user sends an access request, the private key is carried for access permission verification to ensure the security of data access.

[0057] In this embodiment of the invention, parsing the attribute information and user private key corresponding to the original access request includes:

[0058] Determine the Uniform Resource Identifier and access request message corresponding to the original access request, and extract the message fields from the access request message;

[0059] The parsing rules corresponding to the original access request are obtained using the Uniform Resource Identifier, and the message fields are parsed using the parsing rules to obtain the attribute information and user private key corresponding to the original access request.

[0060] In this invention, the parsing rules are generated according to the query message parsing protocol pre-defined by the Uniform Resource Identifier. Different Uniform Resource Identifiers correspond to different user servers. Therefore, obtaining the corresponding parsing rules based on the Uniform Resource Identifier makes the parsing results more accurate.

[0061] Furthermore, in this embodiment of the invention, the step of parsing the message fields using the parsing rules to obtain the attribute information and user private key corresponding to the original access request includes:

[0062] Extract the parsing functions from the parsing rules, and generate a parsing rule tree based on the parsing functions;

[0063] The parsing execution order of the parsing function is determined based on the rule tree;

[0064] The message fields are processed according to the parsing execution order to obtain the attribute information and user private key corresponding to the original access request.

[0065] In this embodiment of the invention, the parsing function is the operator that appears in the parsing rule. Specifically, the parsing function in the parsing rule can be extracted using a preset operator table to generate a parsing rule tree, further determining the parsing execution order of the parsing function, avoiding confusion in the parsing process, and improving the parsing efficiency and the accuracy of the parsing results.

[0066] S2. Add the attribute information to the original access request to obtain an access request containing attribute information, and generate an access control policy based on the access request containing attribute information.

[0067] In this embodiment of the invention, by adding attribute information to the original access request, the access request containing attribute information can be obtained based on the attribute information, thereby enabling access control of the original access request based on the attribute information and further generating access control policies.

[0068] In this embodiment of the invention, the access control policy is an access control mechanism used to determine the resource corresponding to the access request based on attribute information, and to judge the attribute information, for example, whether the attribute information meets the conditions for resource access, thereby determining the resource that can be accessed for each attribute information.

[0069] In this embodiment of the invention, adding the attribute information to the original access request to obtain an access request containing the attribute information includes:

[0070] Obtain the access request message of the original access request and determine the message fields of the access request message;

[0071] The attribute information is converted into the fields corresponding to the message fields to obtain the attribute information fields;

[0072] The attribute information field is added to a preset message position in the access request message to obtain an access request containing attribute information.

[0073] In this embodiment of the invention, the access request message is the access request message of the original access request in S1 above. The attribute information is converted into fields consistent with the access request message to ensure the consistency of data fields in the access request message. In this embodiment of the invention, the attribute information field can be added to the message position after the user basic information in the access request message, so that the position of the attribute information in the access request message is clearer.

[0074] Furthermore, in the embodiments of the present invention, see... Figure 2 As shown, generating an access control policy based on the access request containing attribute information includes:

[0075] S21. Parse the request information in the access request containing attribute information to obtain the attribute request information;

[0076] S22. The attribute request information is categorized to obtain multiple category information, and the information value range in each category information is determined;

[0077] S23. Determine the category permissions for each category information based on the information value range and construct a category information-category permission hash table, and obtain the access control policy based on the permission hash table.

[0078] In this embodiment of the invention, the attribute request information is the field information contained in the access request containing attribute information, such as user basic information, attribute information, role information corresponding to the attribute, etc. Specifically, this embodiment of the invention can use the above-described method for parsing the original access request to parse the access request containing attribute information.

[0079] In another optional embodiment of the present invention, the multiple categories of information include, but are not limited to, basic information of the user for role information, resource type information of the access request, operation type information, operation purpose information, and time information of the access request. Specifically, the information value domain represents the information level of each information category, such as the level of the user's age, the information level of the user's job title, and the information level of the user's identity category, thereby determining the permission information of the access request containing attribute information based on the information value domain.

[0080] In this embodiment of the invention, the category information-category permission hash table stores category information and corresponding category permissions by mapping them to a location in the table using a hash function. This allows for a one-to-one correspondence between category information and corresponding category permissions, thereby determining the permissions of attribute information and ultimately obtaining the access control policy.

[0081] In this embodiment of the invention, the user's attribute request information can be divided through the category information, thereby achieving fine-grained division of user request information. This enables access control for resources accessed in HSS servers with different permission levels, preventing users from accessing resources they do not have permission to access, and further improving resource security in HSS servers.

[0082] S3. Locate the access resource list corresponding to the access control policy in the HSS server, and generate a verification private key based on the access resource list and the attribute information using a preset encryption algorithm.

[0083] In this embodiment of the invention, the resource list is the resources in the HSS server that can be accessed by the access control policy. Specifically, the access control policy can be used to traverse the HSS server to determine the access resource list corresponding to the access control policy in the HSS server.

[0084] In this embodiment of the invention, the preset encryption algorithm can be a Logistic mapping (single-peak impression) based encryption algorithm. This encryption algorithm is a quadratic polynomial mapping (recursive relation). By adding perturbation terms to the resource list and attribute information through mapping, the resource list and attribute information are transformed into noisy ciphertext. Thus, when the access to the resource list and attribute information is encrypted using the preset encryption algorithm, a verification private key is generated.

[0085] In this embodiment of the invention, the step of generating a verification private key using a preset encryption algorithm based on the access resource list and the attribute information includes:

[0086] Initialize a fixed word length, and normalize the access resource list and the attribute information according to the fixed word length to obtain a normalized access resource list and attribute information;

[0087] The normalized list of accessed resources and attribute information are mapped to obtain mapped data, and the mapped data is truncated.

[0088] The truncated mapping data is iterated a preset number of times to obtain the verification private key.

[0089] In this embodiment of the invention, since the access resource list and attribute information are information with inconsistent dimensions, including but not limited to text information or numerical information, it is necessary to normalize the access resource list and attribute information to make them dimensionless data, thereby eliminating the differences between different information and improving the accuracy of encryption.

[0090] In this embodiment of the invention, the data truncation ensures that the word length of the mapped data is consistent with the fixed word length, thereby reducing the amount of computation. By performing a preset number of iterations on the truncated mapped data, this embodiment of the invention can make the sequence of verification private keys more random, thereby ensuring the security of the verification private key. Specifically, the truncated mapped data can be iterated 200 times to obtain the verification private key.

[0091] Furthermore, the access resource list and the attribute information are normalized using the following formula:

[0092]

[0093] Where Z is the normalized list of accessed resources or attribute information, x is the list of accessed resources or attribute information, M is the maximum word length in the list of accessed resources or attribute information, and N is the fixed word length.

[0094] In this embodiment of the invention, for example, if the fixed word length is initialized to 6, then all resource lists in the HSS server are normalized using a fixed word length of 6 to ensure the feasibility of private key verification. The fixed word length can limit the word length of the normalized access resource list or attribute information to a certain range, thereby restricting the access resource list or attribute information and improving information security.

[0095] In this embodiment of the invention, the normalized list of accessed resources and attribute information are mapped using the following formula to obtain mapped data:

[0096] f(Z)=uZ(1-Z),u∈(3.571448…,4)

[0097] Where f(Z) is the mapping data, u is the preset mapping parameter, and Z is the normalized list of access resources or attribute information.

[0098] In this embodiment of the invention, the preset encryption algorithm can double-encrypt the information in the resource list based on the access resource list and attribute information, while ensuring the consistency of the private key that can be accessed. This allows the system to verify the private key to determine whether a user has exceeded their access rights, thereby further improving the resource security in the HSS server.

[0099] If the verification private key does not match the user's private key, execute S4 to prohibit access to the HSS server resources corresponding to the access resource list.

[0100] In this embodiment of the invention, if the private key does not match the user's private key, it indicates that the user does not have permission to access the HSS server resources corresponding to the access resource list, and there is a risk of unauthorized access. Therefore, access to the HSS server resources corresponding to the access resource list is prohibited.

[0101] When the verified private key matches the user's private key, execute S5 to allow access to the HSS server resources corresponding to the access resource list.

[0102] In this embodiment of the invention, when the private key is verified to be consistent with the user's private key, it indicates that the list of resources that the user can access is the resource access resource list, and the user has the permission to access the HSS server resources corresponding to the access resource list, so access to the HSS server resources corresponding to the access resource list is allowed.

[0103] In this embodiment of the invention, the attribute information and user private key corresponding to the original access request are parsed; and an access control policy is generated based on the access request containing the attribute information. This allows for fine-grained user segmentation based on attribute information and flexible generation of access control policies. Simultaneously, the corresponding access resource list in the HSS is obtained based on the access control policy, effectively preventing users from accessing resources that are inaccessible according to the attribute information, thus improving the data security of the HSS. A verification private key is generated using the access resource list and attribute information; the verification private key is then compared with the user's private key to ensure consistency, prevent the theft of the user's private key, and prevent unauthorized access by unauthorized users, thereby further improving the data security of the HSS. Therefore, the HSS unauthorized access protection method proposed in this invention can solve the problem of unauthorized access to the HSS.

[0104] like Figure 3 The diagram shown is a functional block diagram of an HSS unauthorized access protection system provided in an embodiment of the present invention.

[0105] The HSS (Hyperaccess Control System) unauthorized access protection system 100 described in this invention can be installed in an electronic device. Depending on the functions implemented, the HSS unauthorized access protection system 100 may include a request parsing module 101, an access control policy generation module 102, a private key verification generation module 103, and an unauthorized access protection module 104. The module described in this invention can also be referred to as a unit, which refers to a series of computer program segments that can be executed by the processor of an electronic device and can perform a fixed function, and which are stored in the memory of the electronic device.

[0106] In this embodiment, the functions of each module / unit are as follows:

[0107] The request parsing module 101 is used to obtain the user's original access request to the HSS server and parse the attribute information and user private key corresponding to the original access request.

[0108] The access control policy generation module 102 is used to add the attribute information to the original access request to obtain an access request containing attribute information, and generate an access control policy based on the access request containing attribute information.

[0109] The verification private key generation module 103 is used to find the access resource list corresponding to the access control policy in the HSS server, and generate a verification private key based on the access resource list and the attribute information using a preset encryption algorithm.

[0110] The privilege escalation protection module 104 is used to prohibit access to the HSS server resources corresponding to the HSS server resources in the access resource list when the private key is inconsistent with the user's private key.

[0111] In detail, the modules in the HSS unauthorized access protection system 100 described in this embodiment of the invention adopt the same approach as described above when in use. Figures 1 to 2 The method used is the same as the HSS unauthorized access protection method described in the article, and can produce the same technical effect, so it will not be repeated here.

[0112] like Figure 4 The diagram shown is a structural schematic of an electronic device that implements the HSS unauthorized access protection method according to an embodiment of the present invention.

[0113] The electronic device 1 may include a processor 10, a memory 11, a communication bus 12 and a communication interface 13, and may also include a computer program stored in the memory 11 and capable of running on the processor 10, such as an HSS unauthorized access protection program.

[0114] In some embodiments, the processor 10 may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. The processor 10 is the control unit of the electronic device, connecting various components of the entire electronic device through various interfaces and lines. It executes programs or modules stored in the memory 11 (e.g., executing HSS unauthorized access protection programs) and calls data stored in the memory 11 to perform various functions of the electronic device and process data.

[0115] The memory 11 includes at least one type of readable storage medium, including flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 11 can be an internal storage unit of an electronic device, such as a portable hard drive. In other embodiments, the memory 11 can be an external storage device of the electronic device, such as a plug-in portable hard drive, Smart Media Card (SMC), Secure Digital (SD) card, Flash Card, etc. Furthermore, the memory 11 can include both internal and external storage units of the electronic device. The memory 11 can be used not only to store application software and various types of data installed on the electronic device, such as the code of an HSS (Hardware Security Service) access control program, but also to temporarily store data that has been output or will be output.

[0116] The communication bus 12 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be divided into an address bus, a data bus, a control bus, etc. The bus is configured to enable communication between the memory 11 and at least one processor 10, etc.

[0117] The communication interface 13 is used for communication between the aforementioned electronic device and other devices, including a network interface and a user interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a Wi-Fi interface, Bluetooth interface, etc.), typically used to establish communication connections between the electronic device and other electronic devices. The user interface may be a display, an input unit (such as a keyboard), or, optionally, a standard wired or wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen, etc. The display may also be appropriately referred to as a screen or display unit, used to display information processed in the electronic device and to display a visual user interface.

[0118] The figure only shows an electronic device with components. Those skilled in the art will understand that the structure shown in the figure does not constitute a limitation on the electronic device and may include fewer or more components than shown, or combine certain components, or have different component arrangements.

[0119] For example, although not shown, the electronic device may also include a power supply (such as a battery) to power various components. Preferably, the power supply can be logically connected to the at least one processor 10 through a power management system, thereby enabling functions such as charging management, discharging management, and power consumption management through the power management system. The power supply may also include one or more DC or AC power supplies, recharging systems, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components. The electronic device may also include various sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be described in detail here.

[0120] It should be understood that the embodiments described are for illustrative purposes only and are not limited to this structure in the scope of the patent application.

[0121] The HSS (Hardware Access Protection) program stored in the memory 11 of the electronic device 1 is a combination of multiple instructions. When run in the processor 10, it can achieve the following:

[0122] Obtain the user's original access request to the HSS server, and parse the attribute information and user private key corresponding to the original access request;

[0123] The attribute information is added to the original access request to obtain an access request containing the attribute information, and an access control policy is generated based on the access request containing the attribute information.

[0124] Find the access resource list corresponding to the access control policy in the HSS server, and generate a verification private key based on the access resource list and the attribute information using a preset encryption algorithm;

[0125] If the private key does not match the user's private key, access to the HSS server resources corresponding to the HSS server resources in the access resource list is prohibited.

[0126] Specifically, the specific implementation method of the processor 10 for the above instructions can be referred to the description of the relevant steps in the corresponding embodiment of the accompanying drawings, and will not be repeated here.

[0127] Furthermore, if the modules / units integrated in the electronic device 1 are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. The computer-readable storage medium can be volatile or non-volatile. For example, the computer-readable medium may include: any entity or system capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, or a read-only memory (ROM).

[0128] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor of an electronic device, can perform the following:

[0129] Obtain the user's original access request to the HSS server, and parse the attribute information and user private key corresponding to the original access request;

[0130] The attribute information is added to the original access request to obtain an access request containing the attribute information, and an access control policy is generated based on the access request containing the attribute information.

[0131] Find the access resource list corresponding to the access control policy in the HSS server, and generate a verification private key based on the access resource list and the attribute information using a preset encryption algorithm;

[0132] If the private key does not match the user's private key, access to the HSS server resources corresponding to the HSS server resources in the access resource list is prohibited.

[0133] In the several embodiments provided by this invention, it should be understood that the disclosed devices, systems, and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and other division methods may be used in actual implementation.

[0134] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0135] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional modules.

[0136] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0137] Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be embraced within the invention. No appended diagram markings in the claims should be construed as limiting the scope of the claims.

[0138] Furthermore, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or systems stated in a system claim may also be implemented by a single unit or system through software or hardware. The terms "first," "second," etc., are used to indicate names and do not indicate any specific order.

[0139] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for protecting against unauthorized access in HSS, characterized in that, The method includes: Obtain the user's original access request to the HSS server, and parse the attribute information and user private key corresponding to the original access request; The attribute information is added to the original access request to obtain an access request containing attribute information, and an access control policy is generated based on the access request containing attribute information; wherein, adding the attribute information to the original access request to obtain an access request containing attribute information includes: obtaining the access request message of the original access request and determining the message fields of the access request message; converting the attribute information into fields corresponding to the message fields to obtain attribute information fields; adding the attribute information fields to a preset message position in the access request message to obtain an access request containing attribute information; The process involves finding the access resource list corresponding to the access control policy in the HSS server, and generating a verification private key based on the access resource list and the attribute information using a preset encryption algorithm. The step of generating the verification private key based on the access resource list and the attribute information includes: initializing a fixed word length, and normalizing the access resource list and the attribute information according to the fixed word length to obtain a normalized access resource list and attribute information. The access resource list and the attribute information are normalized using the following formula: wherein, is the normalized access resource list or attribute information, is the access resource list or attribute information, is the maximum word length in the access resource list or attribute information, is the fixed word length; The normalized list of accessed resources and attribute information are mapped to obtain mapping data, and the mapping data is truncated. The truncated mapping data is iterated a preset number of times to obtain the verification private key. If the private key does not match the user's private key, access to the HSS server resources corresponding to the HSS server resources in the access resource list is prohibited.

2. The HSS overreach access protection method of claim 1, wherein, The parsing of the attribute information and user private key corresponding to the original access request includes: Determine the Uniform Resource Identifier and access request message corresponding to the original access request, and extract the message fields from the access request message; The parsing rules corresponding to the original access request are obtained using the Uniform Resource Identifier, and the message fields are parsed using the parsing rules to obtain the attribute information and user private key corresponding to the original access request.

3. The HSS overreach access protection method of claim 2, wherein, The step of parsing the message fields using the parsing rules to obtain the attribute information and user private key corresponding to the original access request includes: Extract the parsing functions from the parsing rules, and generate a parsing rule tree based on the parsing functions; The parsing execution order of the parsing function is determined based on the rule tree; The message fields are processed according to the parsing execution order to obtain the attribute information and user private key corresponding to the original access request.

4. The HSS overreach access protection method of claim 1, wherein, The step of generating an access control policy based on the access request containing attribute information includes: Parse the request information in the access request containing attribute information to obtain the attribute request information; The attribute request information is categorized to obtain multiple category information, and the information value range in each category information is determined; Based on the information value range, the category permissions for each category information are determined and a category information-category permission hash table is constructed. Based on the permission hash table, the access control policy is obtained.

5. The HSS overreach access protection method of claim 1, wherein, The normalized list of accessed resources and attribute information are mapped using the following formula to obtain the mapped data: wherein, is the mapping data, is a preset mapping parameter, is the normalized access resource list or attribute information.

6. A system for protection against unauthorized access of an HSS, characterized by The system includes: The request parsing module is used to obtain the user's original access request to the HSS server and parse the attribute information and user private key corresponding to the original access request. An access control policy generation module is used to add the attribute information to the original access request to obtain an access request containing attribute information, and to generate an access control policy based on the access request containing attribute information; wherein, adding the attribute information to the original access request to obtain an access request containing attribute information includes: obtaining the access request message of the original access request and determining the message fields of the access request message; converting the attribute information into fields corresponding to the message fields to obtain attribute information fields; and adding the attribute information fields to a preset message position in the access request message to obtain an access request containing attribute information. The verification private key generation module is used to find the access resource list corresponding to the access control policy in the HSS server, and generate a verification private key based on the access resource list and the attribute information using a preset encryption algorithm; wherein, the step of generating the verification private key based on the access resource list and the attribute information using a preset encryption algorithm includes: initializing a fixed word length, and normalizing the access resource list and the attribute information according to the fixed word length to obtain a normalized access resource list and attribute information; The access resource list and the attribute information are normalized using the following formula: in, This refers to the normalized list of accessed resources or attribute information. This refers to the list of accessed resources or attribute information. The maximum word length in the accessed resource list or attribute information. The fixed word length; The normalized list of accessed resources and attribute information are mapped to obtain mapping data, and the mapping data is truncated. The truncated mapping data is iterated a preset number of times to obtain the verification private key. The privilege escalation protection module is used to prohibit access to the HSS server resources corresponding to the HSS server resources in the access resource list when the private key is inconsistent with the user's private key.

7. An electronic device, comprising: The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the HSS unauthorized access protection method as described in any one of claims 1 to 5.

8. A computer readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the HSS unauthorized access protection method as described in any one of claims 1 to 5.

Images