An access control authorization method based on fuzzy rough sets

Abstract

The present invention discloses an access control authorization method based on fuzzy rough sets, which is used to optimize attributes and fine-grained access control. In this method, the value of the attribute required by the request is uncertain, and the attribute value is converted into a fuzzy membership value to achieve the conversion of traditional attributes to fuzzy attributes. The system introduces attribute simplification points, and through expert evaluation of the user's membership of authorization, the attribute value is simplified, and the membership relationship of the attribute is specified by upper and lower approximate values, and the possible membership relationship between the two is specified, thereby achieving efficient access authorization under massive data. At the same time, the user authorization level and resource sensitivity are used as judgment conditions to measure user access behavior, and the user authorization rights and resources are authorized by the definition of authorization hierarchy, thereby achieving fine-grained access control and meeting the security access requirements of resource access in practical applications.

Description

Technical Field

[0001] The present invention belongs to the field of computer software development, and particularly designs an efficient fine-grained access authorization method in a cloud environment. Background Art

[0002] Access control is a core technology in information security, primarily preventing malicious users from illegally accessing resources and legitimate users from unauthorized access requests. However, with the increasing dynamism, flexibility, and complexity of computer systems, traditional access control methods, such as discretionary access control (DAC), are no longer sufficient. This is especially true in cloud environments, where the number of users is rapidly increasing and network barriers exist between users and cloud service providers. New access control and authorization methods are urgently needed to address these challenges.

[0003] Currently, in a diverse environment, access control mainly faces the following problems. 1. Limitations of permission management: In new technologies, the demand for cross-domain access is increasing. Changes between users and resources lead to more frequent changes in permissions, which is dynamic and uncertain. At the same time, the current authentication and access criteria are flawed, and the authorization process is complicated. 2. Security of services: The lack of trust assessment of users in the access control model will lead to illegal access by malicious users, which will damage the confidentiality of resources. Although there are currently many solutions to introduce trust mechanisms, they lack strong support in terms of computing efficiency, reliability, and feasibility. 3. User privacy protection: The access control model controls user access behavior, but lacks security considerations from the user's perspective. User requests for resources often involve some personal privacy information, which is often private. Therefore, when ensuring that users have legal access to resources, more attention should be paid to security in data management.

[0004] In summary, how to enhance access authorization flexibility, improve authorization efficiency, and protect user privacy in a cloud environment has become an urgent problem to be solved in this field. Summary of the Invention

[0005] In order to solve the technical problems mentioned in the above background technology, the present invention proposes an access control authorization method based on fuzzy rough sets.

[0006] In order to achieve the above technical objectives, the technical solution of the present invention is:

[0007] An access control authorization method based on fuzzy rough sets includes the following steps:

[0008] (1) Initialization phase: the system first collects attributes and hands them over to the attribute authority AA;

[0009] (2) The attribute authority AA sends the attribute set to the attribute reduction point ARP for attribute reduction, and then sends it to the policy management point PAP to formulate relevant policies;

[0010] (3) When a user applies for a resource, the original request NAR is first sent to the policy enforcement point PEP;

[0011] (4) The policy implementation point PEP requests attributes from the attribute reduction point ARP, and sends the returned attribute set construction request to the policy decision point PDP;

[0012] (5) The policy decision point (PDP) determines the relevant attributes and user identity, interacts with the policy management point (PAP), and evaluates the access policy. If all attributes meet the conditions, the evaluation result is Permit, indicating that authorization is allowed; if the evaluation result is Part_Permit, it indicates partial authorization and executes (6); otherwise, authorization is denied.

[0013] (6) Calculate the user's authority through the partial authorization judgment method and determine the specific method authorized by the user;

[0014] (7) The policy management point PAP records the access and enters it into the log system.

[0015] Furthermore, the specific process of attribute reduction in step (2) is as follows:

[0016] (201) Initialize attributes: First, list all the attributes involved in a resource, which is recorded as the attribute set Attr = {A1, A2, ..., A n}, and list the simulated user set U={U1,U2,U3,…,U n}, where U and Attr are both finite sets, and the mapping value of U to Attr is the membership degree Val U×A , represents the fuzzy relationship between the user set and the attribute set, and takes a fuzzy value between [0,1]. ij The closer it is to 1, the more it represents the current object x i For attribute y j On the contrary, the object's membership to the attribute is lower;

[0017] (202) Authorization evaluation: The expert judgment method evaluates the simulation set, denoted as D = {d1, d2, ..., d m}, d i Represents the expert's opinion on object x i Authorization evaluation under attribute set V;

[0018] (203) Fuzzy membership judgment: If the upper approximate membership function is greater than the lower approximate membership function, it means that the current attribute membership judgment relationship is unclear and is listed as a non-key attribute. If the lower approximate membership function is greater than or equal to the lower approximate membership function, it means that the user's membership relationship can be distinguished and is listed as a key attribute. The lower approximate membership function and the upper approximate membership function are:

[0019] B (a)=inf u∈U {(1-Val(u,a))∨B(u)} (1-1)

[0020]

[0021] Among them, u is the user, U is the user set, Val(u,a) represents the fuzzy relationship between user U and attribute a, Val(u,a)∈[0,1], and B(u) represents the decision attribute of user u.

[0022] Furthermore, the specific process of authorization evaluation in step (5) is as follows:

[0023] (501) If the membership of any attribute is lower than the upper approximate membership of the current attribute after simplification, a rejection response is returned and the authorization evaluation ends;

[0024] (502) If all attribute memberships are greater than the upper approximate membership, it means that the user has the right to authorize. Next, partial authorization and authorization judgment need to be performed, and then enter (503);

[0025] (503) If all attribute values ​​are greater than the lower approximate membership, it means that the user is a trusted user and can access all resources. The evaluation result is Permit, indicating that authorization is allowed, and this authorization evaluation ends;

[0026] (504) If at least one attribute value is between the upper approximate membership and the lower approximate membership, the evaluation result is Part_Permit, indicating partial authorization. Then, it is necessary to further determine the authorization level. The calculation formula for the authorization level is as follows:

[0027]

[0028] Among them, α is the user authorization level, that is, the user credibility, α∈[0,1], its value is related to the value of the user's attribute. When the user's membership of each attribute is higher, the user credibility is higher, that is, α is larger, otherwise it is smaller, y i Indicates the i-th attribute value of the current user, represents the upper approximate membership of the i-th attribute, D (y i) represents the lower approximate membership of the i-th attribute, β represents the sensitivity of the resource. The more sensitive the resource, the larger β is. m is a real number greater than β. If the sensitivity of a resource is the same as or greater than m, then the resource is considered too tempting to the user, meaning that such access rights should not be granted. a is a natural number greater than 1. The greater the user authorization level is than the resource sensitivity, the more trustworthy the user is, and the higher the authorization level is granted. Conversely, the lower the level is. In addition, when the resource sensitivity is closer to m, the more sensitive the resource is and the lower the authorization level is. AL is the authorization level, that is, the authorization level of the user. The value of AL determines the final size of the user's permissions.

[0029] The beneficial effects brought about by adopting the above technical solution are:

[0030] (1) The attribute set is reduced and the authorization efficiency is improved. When the attribute scale is large, after the attribute is fuzzified, the redundant attributes are eliminated and the key attributes are extracted from the results of expert evaluation to achieve the effect of attribute simplicity. Considering the existence of common attributes that are not critical to the authorization decision, the upper and lower approximate membership degrees are used as boundaries to screen out common attributes, reduce the attribute set, thereby reducing the authorization evaluation time and improving the authorization efficiency.

[0031] (2) The authorization strategy was optimized, and partial authorization was proposed. The authorization level was judged by the user authorization level and resource sensitivity, and the user's access behavior was restricted based on the relationship between the authorization level and the permission. The traditional authorization model was refined, and authorization was achieved under different user needs, thereby improving the overall reliability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is an access control model based on fuzzy rough sets;

[0033] Figure 2 It is an access control model workflow based on fuzzy rough sets; DETAILED DESCRIPTION

[0034] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings.

[0035] An access control authorization method based on fuzzy rough sets includes the following steps:

[0036] Step 1: The system collects attributes and sends them to the attribute authority AA;

[0037] Step 2: The attribute authority (AA) sends the attribute set to the attribute reduction point (ARP) for attribute reduction, and then sends it to the policy management point (PAP) to formulate relevant policies.

[0038] Step 3: The user sends a NAR request to the policy enforcement point (PEP) to request resources.

[0039] Step 4: The policy enforcement point (PEP) requests attributes from the attribute reduction point (ARP) and sends the returned attribute set construction request to the policy decision point (PDP).

[0040] Step 5: The Policy Decision Point (PDP) combines the relevant attributes with the user's identity, interacts with the Policy Administration Point (PAP), and evaluates the access policy. If all attributes meet the requirements, the evaluation result is Permit, indicating authorization is allowed. If the evaluation result is Part_Permit, it indicates partial authorization and the execution proceeds to Step 6. Otherwise, the authorization is denied.

[0041] Step 6: Perform partial authorization decision method to calculate the user's authority and determine the specific method authorized by the user;

[0042] Step 7: The policy administration point PAP records the access and enters the statistics into the log system.

[0043] In this embodiment, the following preferred solution can be used to achieve the attribute simplification in step 2 above:

[0044] 201. Initialize attributes: First, list all the attributes involved in a resource, which are recorded as attribute set Attr = {A1, A2, ..., A n}, and list the simulated user set U={U1,U2,U3,…,U n}, where U and Attr are both finite sets, and the mapping value of U to Attr is the membership degree Val U×A , represents the fuzzy relationship between the user set and the attribute set, and takes a fuzzy value between [0,1]. ij The closer it is to 1, the more it represents the current object x i For attribute y j On the contrary, the object's membership to the attribute is lower;

[0045] 202. Authorization Evaluation: The expert evaluation method evaluates the simulation set, which is recorded as D = {d1, d2, ..., d m}, d i Represents the expert's opinion on object x i Authorization evaluation under attribute set V;

[0046] 203. Fuzzy membership judgment: If the upper approximate membership function is greater than the lower approximate membership function, it means that the current attribute membership judgment relationship is unclear and is listed as a non-key attribute. If the lower approximate membership function is greater than or equal to the lower approximate membership function, it means that the user's membership relationship can be distinguished and is listed as a key attribute. The lower approximate membership function and the upper approximate membership function are:

[0047] B (a)=inf u∈U {(1-Val(u,a))∨B(u)} (1-1)

[0048]

[0049] Among them, u is the user, U is the user set, Val(u,a) represents the fuzzy relationship between user U and attribute a, Val(u,a)∈[0,1], and B(u) represents the decision attribute of user u.

[0050] In this embodiment, if Figure 2 The following preferred solution can be used to implement the authorization evaluation in step 5 above:

[0051] 501. If the membership of any attribute is lower than the upper approximate membership of the current attribute after simplification, a rejection response is returned and the authorization evaluation ends.

[0052] 502. If all attribute memberships are greater than the upper approximate membership, it means that the user has the authorization right. Next, partial authorization and authorization judgment need to be performed, and then enter (503);

[0053] 503. If all attribute values ​​are greater than the lower approximate membership, the user is a trusted user and can access all resources. The evaluation result is Permit, indicating that authorization is allowed, and this authorization evaluation ends.

[0054] 504. If at least one attribute value is between the upper approximate membership and the lower approximate membership, the evaluation result is Part_Permit, indicating partial authorization. Then, further determination of the authorization level is required. The calculation formula for the authorization level is as follows:

[0055]

[0056] Among them, α is the user authorization level, that is, the user credibility, α∈[0,1], its value is related to the value of the user's attribute. When the user's membership of each attribute is higher, the user credibility is higher, that is, α is larger, otherwise it is smaller, y i Indicates the i-th attribute value of the current user, represents the upper approximate membership of the i-th attribute, D (y i) represents the lower approximate membership of the ith attribute, β represents the sensitivity of the resource, the more sensitive the resource, the larger β is, m is a real number greater than β, if the sensitivity of a resource is the same as or greater than m, then it is considered that the resource is too tempting to the user, which means that such access rights should not be formulated, a is a natural number greater than 1, the greater the user authorization level is than the resource sensitivity, the more trustworthy the user is, and the higher the authorization level is, and vice versa. In addition, when the resource sensitivity is closer to m, it means that the resource is more sensitive and the authorization level is smaller. AL is the authorization level, that is, the authorization level of the user. The value of AL determines the final user authority. This example can define four authorization levels. The authorization matrix table is as follows, G i Indicates the authorization level, describes different access policies, and determines the authorization level based on the value of AL

[0057] Table 1 Authorization level distribution table

[0058]

[0059] The embodiments are only for illustrating the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution in accordance with the technical idea proposed by the present invention shall fall within the protection scope of the present invention.

Claims

1. The access control authorization method based on fuzzy rough sets is characterized by: The following steps are involved: (1) Initialization phase: the system first collects attributes and hands them over to the attribute authority AA; (2) The attribute authority AA sends the attribute set to the attribute reduction point ARP for attribute reduction, and then sends it to the policy management point PAP to formulate relevant policies. The specific steps are as follows: (201) Initialize attributes: First, list all the attributes involved in a resource, which is recorded as the attribute set Attr = {A1, A2, ..., A n }, and list the simulated user set U={U1,U2,U3,…,U n }, where U and Attr are both finite sets, and the mapping value of U to Attr is the membership degree Val U×A , represents the fuzzy relationship between the user set and the attribute set, and takes a fuzzy value between [0,1]. ij The closer it is to 1, the more it represents the current object x i For attribute y j On the contrary, the object's membership to the attribute is lower; (202) Authorization evaluation: The expert judgment method evaluates the simulation set, denoted as D = {d1, d2, ..., d m }, d i Represents the expert's opinion on object x i Authorization evaluation under attribute set V; (203) Fuzzy membership judgment: If the upper approximate membership function is greater than the lower approximate membership function, it means that the current attribute membership judgment relationship is unclear and is listed as a non-key attribute. If the lower approximate membership function is greater than or equal to the lower approximate membership function, it means that the user's membership relationship can be distinguished and is listed as a key attribute. (3) When a user applies for a resource, the original request NAR is first sent to the policy enforcement point PEP; (4) The policy implementation point PEP requests attributes from the attribute reduction point ARP, and sends the returned attribute set construction request to the policy decision point PDP; (5) The policy decision point (PDP) determines the relevant attributes and user identity, interacts with the policy management point (PAP), and evaluates the access policy. If all attributes meet the conditions, the evaluation result is Permit, indicating that authorization is allowed; if the evaluation result is Part_Permit, it indicates partial authorization and executes (6); otherwise, authorization is denied. The specific steps are as follows: (501) If the membership of any attribute is lower than the upper approximate membership of the current attribute after simplification, a rejection response is returned and the authorization evaluation ends; (502) If all attribute memberships are greater than the upper approximate membership, it means that the user has the right to authorize. Next, partial authorization and authorization judgment need to be performed, and then enter (503); (503) If all attribute values ​​are greater than the lower approximate membership, it means that the user is a trusted user and can access all resources. The evaluation result is Permit, indicating that authorization is allowed, and this authorization evaluation ends; (504) If at least one attribute value is between the upper approximate membership and the lower approximate membership, the evaluation result is Part_Permit, indicating partial authorization, and further determination of the authorization level is required; (6) Calculate the user's authority through the partial authorization judgment method and determine the specific method authorized by the user; (7) The policy management point PAP records the access and enters it into the log system.

2. The access control authorization method based on fuzzy rough sets according to claim 1, characterized in that: The specific process of attribute reduction in step (2) is as follows: (201) Initialize attributes: First, list all the attributes involved in a resource, which is recorded as the attribute set Attr = {A1, A2, ..., A n }, and list the simulated user set U={U1,U2,U3,…,U n }, where U and Attr are both finite sets, and the mapping value of U to Attr is the membership degree Val U×A , represents the fuzzy relationship between the user set and the attribute set, and takes a fuzzy value between [0,1]. ij The closer it is to 1, the more it represents the current object x i For attribute y j On the contrary, the object's membership to the attribute is lower; (202) Authorization evaluation: The expert judgment method evaluates the simulation set, denoted as D = {d1, d2, ..., d m }, d i Represents the expert's opinion on object x i Authorization evaluation under attribute set V; (203) Fuzzy membership judgment: If the upper approximate membership function is greater than the lower approximate membership function, it means that the current attribute membership judgment relationship is unclear and is listed as a non-key attribute. If the lower approximate membership function is greater than or equal to the lower approximate membership function, it means that the user's membership relationship can be distinguished and is listed as a key attribute. The lower approximate membership function and the upper approximate membership function are: B (a)=inf u∈U {(1-Val(u,a))∨B(u)} (2-1) Among them, u is the user, U is the user set, Val(u,a) represents the fuzzy relationship between user U and attribute a, Val(u,a)∈[0,1], and B(u) represents the decision attribute of user u.

3. The access control authorization method based on fuzzy rough sets according to claim 1, characterized in that: The specific process of authorization evaluation in step (5) is as follows: (501) If the membership of any attribute is lower than the upper approximate membership of the current attribute after simplification, a rejection response is returned and the authorization evaluation ends; (502) If all attribute memberships are greater than the upper approximate membership, it means that the user has the right to authorize. Next, partial authorization and authorization judgment need to be performed, and then enter (503); (503) If all attribute values ​​are greater than the lower approximate membership, it means that the user is a trusted user and can access all resources. The evaluation result is Permit, indicating that authorization is allowed, and this authorization evaluation ends; (504) If at least one attribute value is between the upper approximate membership and the lower approximate membership, the evaluation result is Part_Permit, indicating partial authorization. Then, it is necessary to further determine the authorization level. The calculation formula for the authorization level is as follows: Among them, α is the user authorization level, that is, the user credibility, α∈[0,1], its value is related to the value of the user's attribute. When the user's membership of each attribute is higher, the user credibility is higher, that is, α is larger, otherwise it is smaller, y i Indicates the i-th attribute value of the current user, represents the upper approximate membership of the i-th attribute, D (y i ) represents the lower approximate membership of the i-th attribute, β represents the sensitivity of the resource, the more sensitive the resource, the larger β is, m is a real number greater than β, if the sensitivity of a resource is the same as or greater than m, then it is considered that the resource is too tempting to the user, which means that such access rights should not be formulated, a is a natural number greater than 1, the greater the user authorization level is than the resource sensitivity, the more likely the user is to be trusted, and the higher the authorization level is granted, and vice versa; in addition, when the resource sensitivity is closer to m, it means that the resource is more sensitive and the authorization level is smaller, AL is the authorization level, that is, the authorization level of the user, and the value of AL determines the final user permission size.

Images