Security Policy Transparency Mechanism Architecture Based on Merkle Tree, and Access Control Method and System

Abstract

The present invention relates to the field of network security technology, and particularly relates to a security policy transparency mechanism architecture, access control method and system based on a Merkle tree. Auditing protection of policy operations based on a Merkle Tree can transparently audit security policies, enhance the monitoring ability of each PEP (Policy Enforcement Point) for the PMP (Policy Management Point), improve the security of the security management ecosystem itself, achieve trusted network data access, enable the policy enforcement point to verify the correctness and effectiveness of the policy, enhance the anti-attack ability of the security policy management itself, improve the transparency of the security policy management system, be able to combat internal threats and misoperations, enhance the integrity and traceability of the security policy maintenance process, use the audit logs of the issued security policies to mitigate the problems of security policy tampering and inconsistency, be able to avoid the security team from issuing different security policies on multiple sub-domains, and provide guarantee for enterprises to achieve compliance management and consistent implementation of basic security policies.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a Merkle tree-based security policy transparent mechanism architecture and an access control method and system. Background Art

[0002] Dynamic security policy issuance and continuous policy improvement are key features of a zero-trust architecture. Policy repositories and policy administration points (PAPs) are core elements of the NIST (National Institute of Standards and Technology) zero-trust architecture. Continuous monitoring and defined policies ensure dynamic authentication and authorization. Furthermore, PBAC (Policy-Based Access Control), recently proposed by PlainID, integrates the ABAC (determining access rights based on user characteristics, object characteristics, and operation types) and RBAC (granting access rights based on roles) models. As a core element of the next-generation IAM (Identity and Access Management), PBAC is attracting increasing attention from scholars and enterprises. Under PBAC, authorization can be set using natural language policies and flexibly configured and managed based on different scenarios, such as tasks or events. However, in complex systems or multi-departmental organizations, security policies are frequently adjusted and optimized to meet changing business needs. Therefore, ensuring the standardization of the security policy maintenance process, enhancing transparency, and ensuring policy credibility are crucial.

[0003] One approach to addressing this problem is to implement an integrity verification mechanism, using a hash algorithm or pre-set verification rules to verify the parameters corresponding to each policy content. Once the parameters pass verification, the security policy is distributed to the security protection device. Another approach is to combine the decentralized and tamper-proof advantages of blockchain technology and adopt a multi-controller election method to achieve policy security assurance. The integrity verification method can ensure the integrity of policy data, but it cannot guarantee the transparency of the policy maintenance process and the trust assessment of security policy management itself through mechanism design. The blockchain method can prevent tampering of security policy data and provide distributed security guarantees, but actual deployment requires addressing the availability of on-chain policy data. Furthermore, it cannot address the issue of misoperation or malicious manipulation of policies by legitimate personnel or management nodes. Summary of the Invention

[0004] To this end, the present invention provides a security policy transparency mechanism architecture based on a Merkle tree, an access control method, and a system, which can transparently audit security policies, enhance the monitoring ability of each PEP (Policy Enforcement Point) for the PMP (Policy Management Point), improve the security of the security management ecosystem itself, and achieve trusted network data access.

[0005] According to the design scheme provided by the present invention, a security policy transparency mechanism architecture based on a Merkle tree is provided for network security access control, including: a policy library, a policy information point, a policy management point connected to the policy library, a policy decision point connected to the policy library and the policy information point, and a policy enforcement point connected to the policy decision point, where

[0006] The policy library is used to store the policy rules preset for access control of the subject or object;

[0007] The policy information point is used to collect and provide access information about the subject and / or object to the policy decision point;

[0008] The policy management point is used to manage the policy rules and the policy pool in the policy library according to the network environment, generate a policy management log for auditing and managing the policy rules based on the Merkle tree, and use the policy management log to update the newly added policy rules to the Merkle tree regularly;

[0009] The policy decision point is used to select applicable policy rules from the policy pool according to the access information and send them to the policy enforcement point;

[0010] The policy enforcement point is used to cache the selected policy rules and feedback them to the corresponding subject and / or object, and perform anomaly detection on the selected policy rules using the issued policy management log

[0011] As the security policy transparency mechanism architecture based on the Merkle tree in the present invention, further, the policy management point is further provided with a policy management record point for connecting to the policy library, storing policies in the policy management record point using the Merkle tree, managing the policy rules and the policy pool based on the Merkle tree at the policy management point, and caching and feedbacking the policy rules based on the Merkle tree at the policy enforcement point.

[0012] As the security policy transparency mechanism architecture based on the Merkle tree in the present invention, further, when the policy management log audits and manages the policy rules based on the Merkle tree, each leaf node in the Merkle tree corresponds to a hash value of a policy rule, the value on the leaf node is the hash value of the data, and the value on the non-leaf node is the hash calculation result of the concatenated values of the two child nodes of the non-leaf node.

[0013] As the security policy transparency mechanism architecture based on Merkle tree in the present invention, further, a monitor is also provided at the policy management point for monitoring all policy management logs and checking whether there are abnormal behaviors and illegal policy operations in the logs, and the monitor checks the Merkle tree consistency by requesting the Merkle tree root from the policy management logs.

[0014] As the security policy transparency mechanism architecture based on Merkle tree in the present invention, further, an audit point for auditing and verifying the target policy in the policy management logs is also provided at the policy management node.

[0015] Further, the present invention also provides an access control method based on the security policy transparency mechanism, which is implemented based on the above security policy transparency mechanism architecture, and the implementation process includes:

[0016] Deploy the security policy transparency mechanism architecture in the access control application scenario, add the policy rules of each role in the application scenario to the policy library, and use the policy management logs to add the added policy rules as new leaf nodes to the Merkle tree;

[0017] For the user access request, collect the user information using the policy information point, verify the user identity and the user role access policy rules based on the user information using the policy decision point and the policy management logs, and authorize the user who passes the verification using the access policy rules;

[0018] The authorized user accesses the application scenario business data according to the access policy rule permissions.

[0019] As the access control method based on the security policy transparency mechanism of the present invention, further, when using the policy management logs to add the added policy rules as new leaf nodes to the Merkle tree, the policy management logs specify the received root policy information point list, and regularly merge the newly added policy rules into the policy management logs, and merge the policy rules into the Merkle tree within a fixed time range of the maximum merge delay.

[0020] As the access control method based on the security policy transparency mechanism of the present invention, further, for the Merkle tree, use the leaf nodes to correspond to the hash values of each policy rule, the value on the leaf node is the hash value of the policy rule data, and the value on the non-leaf node is the hash calculation result of the concatenated values of the two child nodes of the non-leaf node.

[0021] As the access control method based on the security policy transparency mechanism of the present invention, further, the policy decision point and the policy management log are utilized, and the user identity and the access policy rules of the user role are verified according to the user information, including: First, for the security policy request of the policy enforcement point, the response data corresponding to the user, the user information, and the digital signature of the Merkle tree root node are obtained; Then, combining the obtained response data and the verified user information, the root node HASH value of the Merkle tree is calculated locally, and the obtained digital signature is verified using the public key to determine whether it corresponds to the calculated root node HASH value. If it corresponds, the user is determined to be verified successfully.

[0022] Further, the present invention also provides an access control system based on the security policy transparency mechanism, which is implemented based on the above security policy transparency mechanism architecture, including: a controller, a security management server, a log server, an authentication server, and a domain control gateway connected to the controller, and an application scenario service server connected to the domain control gateway, where,

[0023] The application scenario service server serves as the policy enforcement point, and the domain control gateway is deployed in its business domain;

[0024] The controller serves as the policy decision point, and the security management server serves as a combination of the policy management point and the policy information point, both of which are deployed in the security management area. Security access policy rules are added to the application scenario service access through the security management server and the policy management log is synchronously generated, and the policy management log is synchronized to the log server. The log server generates a timestamp and a hash digest for the policy operation records in the policy management node, and at the same time adds the policy as a new leaf node to the Merkle tree; and the authentication server is used to verify and authorize the identity and access policy of the accessing user.

[0025] The beneficial effects of the present invention:

[0026] Compared with the traditional network security policy management mechanism, the present invention performs policy operation audit protection based on the Merkle Tree, enabling the policy enforcement point to verify the correctness and effectiveness of the policy, enhancing the anti-attack ability of the security policy management itself; improving the transparency of the security policy management system by introducing a multi-party supervision mechanism to combat internal threats and misoperations; and enhancing the integrity and traceability of the security policy maintenance process by ensuring the non-tamperable nature of the security policy operation process records based on the cryptographic mechanism. By providing the audit log of the issued security policy, the problems of security policy tampering and inconsistency (the transparency of policy management work) are alleviated, and it is possible to avoid the security team from issuing different security policies on multiple sub-domains, providing guarantee for the enterprise to achieve compliance management and the consistent execution of basic security policies, and having good application prospects. Description of the Drawings

[0027] Figure 1 Schematic diagram of the security policy transparent working mechanism architecture in the embodiment;

[0028] Figure 2 Example of the access control mechanism under NIST 800-162 in the embodiment;

[0029] Figure 3 Schematic diagram of the implementation process of the policy transparent mechanism in the office scenario in the embodiment. Detailed implementation manners

[0030] To make the objectives, technical solutions and advantages of the present invention clearer and more understandable, the present invention will be further described in detail below with reference to the accompanying drawings and technical solutions.

[0031] An embodiment of the present invention provides a security policy transparent mechanism architecture based on a Merkle tree for network security access control. Refer to Figure 1 as shown, it includes: a policy library, policy information points, a policy management point connected to the policy library, a policy decision point connected to the policy library and the policy information points, and a policy execution point connected to the policy decision point. Among them,

[0032] The policy library is used to store the policy rules preset for access control of subjects or objects;

[0033] The policy information points are used to collect and provide access information about subjects and / or objects to the policy decision point;

[0034] The policy management point is used to manage the policy rules and policy pool in the policy library according to the network environment, generate a policy management log for auditing and managing the policy rules based on the Merkle tree, and regularly update the newly added policy rules to the Merkle tree by using the policy management log;

[0035] The policy decision point is used to select applicable policy rules from the policy pool according to the access information and send them to the policy execution point;

[0036] The policy execution point is used to cache the selected policy rules and feedback them to the corresponding subjects and / or objects, and perform anomaly detection on the selected policy rules by using the issued policy management log.

[0037] The ultimate goal of policy transparency is that the policy execution point only accepts publicly recorded policies, and it is impossible for the policy management point or the policy decision point to formulate or issue policies without publicity. At the same time, it also avoids the security team from issuing different security policies on multiple subdomains, providing guarantee for the enterprise to achieve compliance management and the consistent execution of basic security policies.

[0038] Such as Figure 2As shown, in the existing ABAC access control model, the Policy Decision Point (PDP) coordinates with the Policy Information Point (PIP) that can provide access information about the subject or object, and retrieves applicable policy rules from the only Policy Repository in the system. The Policy Administration Point (PAP) performs routine management such as adding, deleting, and modifying policy rules and policy sets. However, when implementing and deploying this control model in an actual system, considering that requesting the PDP for each access may cause a long response time for access control, in the embodiments of this case, refer to Figure 1 As shown, a database with public auditing, only adding policies, and anti-tampering features is used. The Policy Administration Point and the Policy Repository are set as domain management roles, the Policy Decision Point PDP and the PEP are set as policy consumer roles. Further, a monitor is provided on the Policy Administration Point to monitor all policy management logs and check whether there are abnormal behaviors and illegal policy operations in the logs. The monitor checks the Merkle tree consistency by requesting the Merkle tree header from the policy management logs; an audit point for auditing and verifying the target policy in the policy management logs is also provided on the policy management node. The monitor and the audit point are used as the Monitor and Auditor roles for reviewing the policy management process. The three major features of PT logs: append-only, cryptographically verifiable, and publicly auditable. And it can accept policies that have expired, are pending release, have been revoked, or are not fully valid in other aspects, and reject the release of policies without a valid verification chain to the known root policy information point. PT logs generally specify a list of accepted root policy information points PIP. And the logs will regularly merge newly added policies into the logs; the logs promise to merge the policies into the Merkle Tree within a fixed time range of the Maximum Merge Delay (MMD).

[0039] Therefore, in the embodiments of this case, it can be considered to pre-cache the policy result at the Policy Enforcement Point (PEP) after each PDP calculation is completed, so as to improve the system response efficiency or avoid the problem of security decision failure caused by the offline of the Policy Administration Point (PAP) or the Policy Information Point (PIP).

[0040] As a preferred embodiment, further, the policy management point is further provided with a policy management record point for connecting to the policy library. Policies are stored in the policy management record point using a Merkle tree, and the policy rules and policy pool are managed at the policy management point based on the Merkle tree. The policy rules are cached and fed back at the policy execution point based on the Merkle tree. When the policy management log audits and manages the policy rules based on the Merkle tree, each leaf node in the Merkle tree corresponds to a hash value of a policy rule. The value on the leaf node is the hash value of the data, and the value on the non-leaf node is the hash calculation result of the concatenated values of the two child nodes of the non-leaf node.

[0041] In a Merkle tree, the value on its leaf node is the hash value of the data. The value on the non-leaf node is the hash of the concatenated values of the two child nodes of that node. This can quickly perform integrity verification and rapid data comparison to find inconsistent data. In the PT logs within the policy transparency framework, a Merkel Hash Tree is used to store policies, and each leaf node is a hash value of a policy. The hash algorithm used is sha-256. The characteristics of the Merkle tree can be expressed as follows: Any slight change in any leaf node will cause a relatively large change in the root node; it can quickly locate the modification. If the data in a certain leaf node is modified, it will affect the root hash value. When it is found that the hash value of the root node Root has changed, it is possible to quickly locate the actually changed data block along the root node in at most O(logn) time; zero-knowledge proof means that the prover can make the verifier believe that a certain assertion is correct without providing useful information to the verifier.

[0042] When the PEP submits a security policy request, in addition to returning the response data corresponding to the user, the server also needs to return the information related to the verification object and the digital signature of the root node of the Merkle HASH tree. The user combines the received response data and the verification object, calculates the HASH value of the root node of the Merkle HASH tree locally, and then uses the public key obtained from the server to verify whether the returned digital signature corresponds to the calculated root node HASH value. Due to the security characteristics of the one-way HASH itself, if the attacker makes any modification to the returned result or the verification object, it will cause the PEP verification to fail.

[0043] Figure 1In it, monitors (Merkle Consistency Proof) can be set to monitor all logs and check for abnormal behaviors and illegal policy operations. Each new entry in each log is checked, and a copy of the entire logs is saved for inspection. At the same time, consistency checks are also carried out. To complete the above tasks, a request is sent to the logs for the signed tree head (STH) for verification. The consistency proof of the Merkle Tree is to verify the append-only feature of the PT logs. This means that only policies can be added, and policies inside cannot be modified or deleted. The PT logs automatically update the newly added policies to the Merkle Tree at regular intervals. To verify this feature, it is necessary to verify that the tree before the change is a subset of the tree after the change, and that the newly added policy entries are all behind the old tree.

[0044] Auditors, as Merkle Audit Proof. Verifying whether a certain policy is in the logs is generally done by the Auditor. During the verification process, the Auditor needs to know the list of nodes of the Merkle Tree in the logs and the path of the policy to be verified in the Merkle Tree so that the corresponding hash value can be calculated. The Auditor can be regarded as the second function of the Monitor or a component of the PEP. Because, in the framework, the PEP can query the signed policy timestamp (SPT) obtained from the audit server through the Auditor to perform Merkle Audit Proof to prove whether the policy is in the logs. First, a request is sent to the logs for the index of the policy in the tree and the audit path (an array of Merkle Tree nodes encoded in base64, proving that the policy is included), and then calculations and judgments are made.

[0045] Furthermore, based on the above architecture, an embodiment of the present invention also provides an access control method based on a security policy transparency mechanism, and the implementation process includes:

[0046] Deploy the security policy transparency mechanism architecture in the access control application scenario, and add the policy rules of each role in the application scenario to the policy library. Use the policy management log to add the added policy rules as new leaf nodes to the Merkle tree;

[0047] For a user access request, use the policy information point to collect user information, use the policy decision point and the policy management log to verify the user identity and the user role access policy rules based on the user information, and authorize the user who passes the verification using the access policy rules;

[0048] Authorized users access the business data of the application scenario according to the access policy rules and permissions.

[0049] When using the policy management log to add the added policy rules as new leaf nodes to the Merkle tree, the policy management log specifies the list of root policy information points to be received, and regularly merges the newly added policy rules into the policy management log, and merges the policy rules into the Merkle tree within a fixed time range of the maximum merge delay.

[0050] As a preferred embodiment, further, use the policy decision point and the policy management log to verify the user identity and user role access policy rules according to the user information, including: First, obtain the response data corresponding to the user for the security policy request of the policy enforcement point, and verify the user information and the digital signature of the Merkle tree root node; Then, combine the obtained response data and the verified user information, calculate the HASH value of the root node of the Merkle tree locally, and use the public key to verify whether the obtained digital signature corresponds to the calculated root node HASH value. If they correspond, it is determined that the user verification is passed.

[0051] Further, the embodiment of the present invention also provides an access control system based on the security policy transparency mechanism, which is implemented based on the above security policy transparency mechanism architecture, including: a controller, a security management server, a log server, an authentication server, and a domain control gateway connected to the controller, and an application scenario business server connected to the domain control gateway, where <F

[0052] The application scenario business server serves as a policy enforcement point, and the domain control gateway is deployed in its business domain;

[0053] The controller serves as a policy decision point, and the security management server serves as a combination of a policy management point and a policy information point, both of which are deployed in the security management area. Add security access policy rules for application scenario business access through the security management server and synchronously generate a policy management log, and synchronize the policy management log to the log server. The log server generates a timestamp and a hash digest for the policy operation records in the policy management node, and at the same time adds the policy as a new leaf node to the Merkle tree; and uses the authentication server to verify and authorize the identity and access policy of the accessing user.

[0054] See Figure 3As shown in the figure, the deployment and working principle of the policy transparency mechanism are further explained in combination with a typical office scenario. For zero-trust security deployment in real office scenarios, a domain control gateway can be deployed in the business domain of the OA server as a policy execution point. The controller is deployed in the security management area as a policy decision point, and the security management server serves as a combination of the policy management point and the policy information point. When the administrator adds a security policy for OA access through the security management server, the security management server simultaneously generates a policy management log and sends it to the log server. The log server generates a timestamp and HASH summary for the policy operation record, and adds the policy as a new leaf node to the Merkle tree, updating the log tree.

[0055] When company employees access the OA server remotely, the controller authenticates the visitor's identity. The controller then authorizes the user based on the policy decision logic. After receiving the policy, the domain control gateway simultaneously sends a policy verification request to the log server. Once the verification is successful, the user is authorized based on the issued policy. At this point, users can access office business data according to their permissions.

[0056] Unless otherwise specifically stated, the relative steps, numerical expressions and values of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0057] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0058] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0059] Those of ordinary skill in the art can understand that all or part of the steps in the above method can be completed by instructing relevant hardware through a program, and the program can be stored in a computer-readable storage medium, such as: read-only memory, disk, or optical disc, etc. Optionally, all or part of the steps of the above embodiments can also be implemented using one or more integrated circuits. Correspondingly, each module / unit in the above embodiments can be implemented in the form of hardware or in the form of a software function module. The present invention is not limited to any specific form of combination of hardware and software.

[0060] Finally, it should be noted that the above-described embodiments are only specific embodiments of the present invention, used to illustrate the technical solutions of the present invention, rather than limiting it. The protection scope of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: any person skilled in the art within the technical scope disclosed by the present invention can still modify the technical solutions described in the foregoing embodiments, or can easily think of changes, or make equivalent replacements for some of the technical features; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims

1. An access control method based on a security policy transparency mechanism, characterized in that Based on the implementation of the security policy transparency mechanism architecture, the security policy transparency mechanism architecture includes: a policy library, policy information points, a policy management point connected to the policy library, a policy decision point connected to the policy library and the policy information points, and a policy enforcement point connected to the policy decision point. Among them, the policy library is used to store the policy rules preset for access control of subjects or objects; the policy information points are used to collect and provide access information about subjects and / or objects to the policy decision point; the policy management point is used to manage the policy rules and the policy pool in the policy library according to the network environment, generate a policy management log for auditing and managing the policy rules based on the Merkle tree, and regularly update the newly added policy rules to the Merkle tree using the policy management log; the policy decision point is used to select applicable policy rules from the policy pool based on the access information and send them to the policy enforcement point; the policy enforcement point is used to cache the selected policy rules and feedback them to the corresponding subjects and / or objects, and perform anomaly detection on the selected policy rules using the issued policy management log; moreover, the policy management point and the policy library are set as the domain management role, the policy decision point and the policy enforcement point are set as the policy consumption role, a monitor for monitoring all policy management logs and checking for abnormal behaviors and illegal policy operations in the logs, and an audit point for auditing and verifying the target policy in the policy management log are set on the policy management point, and the monitor checks the Merkle tree consistency by requesting the Merkle tree header from the policy management log; the policy management point is also provided with a policy management record point for connecting to the policy library, storing policies using the Merkle tree in the policy management record point, managing the policy rules and the policy pool based on the Merkle tree at the policy management point, and caching and feedbacking the policy rules based on the Merkle tree at the policy enforcement point; when the policy management log audits and manages the policy rules based on the Merkle tree, each leaf node in the Merkle tree corresponds to the hash value of a policy rule, the value on the leaf node is the hash value of the data, and the value on the non-leaf node is the hash calculation result of the concatenated values of the two child nodes of the non-leaf node; The access control implementation process includes: Deploy the security policy transparency mechanism architecture in the access control application scenario, add the policy rules of each role in the application scenario to the policy library, and use the policy management log to add the added policy rules as new leaf nodes to the Merkle tree; For a user access request, use the policy information point to collect user information, use the policy decision point and the policy management log to verify the user identity and the access policy rules of the user role based on the user information, and authorize the user who passes the verification using the access policy rules; The authorized user accesses the application scenario business data according to the access policy rule permissions.

2. The access control method based on the security policy transparency mechanism according to claim 1, wherein When adding the added policy rules as new leaf nodes to the Merkle tree using the policy management log, the policy management log specifies the received list of root policy information points and periodically merges the newly added policy rules into the policy management log, and merges the policy rules into the Merkle tree within a fixed time range of the maximum merge delay.

3. The access control method based on the security policy transparency mechanism according to claim 1 or 2, characterized in that For the Merkle tree, leaf nodes are used to correspond to the hash values of each policy rule. The value on the leaf node is the hash value of the policy rule data, and the value on the non-leaf node is the hash calculation result of the concatenated values of the two child nodes of the non-leaf node.

4. The access control method based on the security policy transparency mechanism according to claim 1, wherein, Using the policy decision point and the policy management log, verify the user identity and user role access policy rules based on the user information, including: First, obtain the response data corresponding to the user and verify the user information and the digital signature of the Merkle tree root node for the security policy request of the policy enforcement point; then, combine the obtained response data and the verified user information, calculate the HASH value of the Merkle tree root node locally, and use the public key to verify whether the obtained digital signature corresponds to the calculated root node HASH value. If they correspond, it is determined that the user verification is passed.

5. An access control system based on a security policy transparency mechanism, characterized in that, Based on the implementation of the security policy transparency mechanism architecture, the security policy transparency mechanism architecture includes: a policy library, policy information points, a policy management point connected to the policy library, a policy decision point connected to the policy library and the policy information points, and a policy enforcement point connected to the policy decision point. Among them, the policy library is used to store the policy rules preset for access control of the subject or object; the policy information points are used to collect and provide access information about the subject and / or object to the policy decision point; the policy management point is used to manage the policy rules and the policy pool in the policy library according to the network environment, generate a policy management log for auditing and managing the policy rules based on the Merkle tree, and regularly update the newly added policy rules to the Merkle tree using the policy management log; the policy decision point is used to select applicable policy rules from the policy pool based on the access information and send them to the policy enforcement point; the policy enforcement point is used to cache the selected policy rules and feedback them to the corresponding subject and / or object, and perform anomaly detection on the selected policy rules using the issued policy management log; moreover, the policy management point and the policy library are set as the domain management role, the policy decision point and the policy enforcement point are set as the policy consumption role, a monitor for monitoring all policy management logs and checking whether there are abnormal behaviors and illegal policy operations in the logs, and an audit point for auditing and verifying the target policy in the policy management log are set on the policy management point, and the consistency of the Merkle tree is checked by the monitor by requesting the Merkle tree head from the policy management log; the policy management point is also provided with a policy management record point for connecting to the policy library, the policy is stored in the policy management record point using the Merkle tree, the policy rules and the policy pool are managed based on the Merkle tree at the policy management point, and the policy rules are cached and fed back based on the Merkle tree at the policy enforcement point; when the policy management log audits and manages the policy rules based on the Merkle tree, each leaf node in the Merkle tree corresponds to a hash value of a policy rule, the value on the leaf node is the hash value of the data, and the value on the non-leaf node is the hash calculation result of the concatenated values of the two child nodes of the non-leaf node; The access control system includes: a controller, a security management server, a log server, an authentication server, and a domain control gateway connected to the controller, and an application scenario business server connected to the domain control gateway. Among them, The application scenario business server serves as the policy enforcement point, and the domain control gateway is deployed in its business domain; The controller, as the policy decision point, and the security management server, as a combination of the policy management point and the policy information point, are both deployed in the security management area. The security management server adds security access policy rules for the application scenario business access and synchronously generates policy management logs, and synchronizes the policy management logs to the log server. The log server generates timestamps and hash digests for the policy operation records in the policy management node, and at the same time adds the policy as a new leaf node to the Merkle tree; and uses the authentication server to verify and authorize the identity of the accessing user and the access policy.

Images