Attribute-based access control system and method in DDS

Abstract

The application discloses a DDS attribute-based access control system and method thereof, and belongs to the technical field of Internet and industrial Internet of Things. The access control system comprises an authentication server CA, a publisher, a subscriber and a policy decision module, and the access control method comprises the following steps: S1, obtaining a publisher / subscriber access control policy; S2, obtaining a publisher / subscriber attribute; S3, deciding the control policy; and S4, executing access control. The DDS attribute-based access control system and method thereof can combine the attribute-based access control technology with the communication process of DDS, realize dynamic publisher / subscriber permission control, shield some illegal information at the bottom layer by using the eBPF technology, avoid DoS attacks, improve the communication efficiency and safety of DDS, and further improve the performance of the access control mechanism.

Description

Technical Field

[0001] This invention relates to the fields of Internet and Industrial Internet of Things (IIoT) technology, and in particular to an attribute-based access control system and method in DDS. Background Technology

[0002] In 2005, the International Telecommunication Union (ITU) released the "Internet Report—Internet of Things," announcing the arrival of the ubiquitous "Internet of Things" (IoT) communication era. The IoT is considered the third wave of the world's information industry, following computers and the internet. In the current network era, IoT applications are widespread, not only in urban public safety but also in industrial production safety, environmental quality monitoring, and smart transportation and smart homes, improving people's quality of life and accelerating development in various fields. DDS (Distributed Data System) communication middleware in the IoT has significant advantages over other communication protocols. However, traditional DDS technology focuses on the real-time performance and reliability of information publishing and subscription, paying little attention to the security threats faced in critical distributed application environments, severely restricting the in-depth application of DDS in these areas. To address these issues, the OMG released DDS security specifications versions 1.0 and 1.1 in 2016 and 2018 respectively, adding security mechanisms to DDS to address threats such as unauthorized subscriptions, unauthorized publishing, and insecure channel transmission—DDS security. While DDS security solves most security problems, its access control mechanism only determines permissions based on conditions such as topic and domain, which is unsuitable for complex scenarios. Furthermore, with the development of mobile internet, most data in the Internet of Things (IoT) is dynamic; for example, the location of a DDS data publisher changes constantly as the publisher moves. Currently, DDS Security cannot control access to data with dynamically changing attributes, limiting the application of DDS in mobile internet.

[0003] Access control technology is one of the core technologies for ensuring communication security. Existing access control models include Discretionary Access Control (DAC), Mandatory Access Control (MAC), Role-Based Access Control (RBAC), Task-Based Access Control, Spatiotemporally Dependent Access Control, and Attribute-Based Access Control (ABAC). Attribute-based access control (ABAC) uses attributes to uniformly describe the three main entities in access control: subject, object, and permission. It formally models security requirements using the relationships between these attributes and achieves effective access to subject resources through predefined attribute-based access policies. ABAC effectively solves the problem of large-scale dynamic user expansion in distributed open environments, enabling fine-grained access control and authorization.

[0004] eBPF originated from Berkeley Bag Filtering in 1992, which eliminated unnecessary packet copying between the kernel and user space. In 2013, BPF added new features such as map and tail call, significantly improving performance. The modified version was named eBPF to distinguish it from classic BPF. eBPF is closer to native language than classic BPF and opens new mount points in the kernel, allowing programs to run based on events, making it highly efficient. It supports in-kernel programming and can enhance other tracers. Integrating eBPF with ABAC requires solving how to allow eBPF to obtain ABAC's decision results and how to make an accurate judgment based on those results to avoid "false positives"—intercepting messages that should have been received. Summary of the Invention

[0005] To address the problems and shortcomings of existing technologies, this invention proposes an attribute-based access control system and method for DDS. This system combines attribute-based access control (ABAC) technology with the DDS communication process. It utilizes the DDS's topic-based publish / subscribe communication mechanism to update publisher / subscriber attribute information in real time. Based on the dynamic changes in attribute values, dynamic publish / subscribe permission control is achieved according to a predetermined access control policy. Furthermore, by leveraging eBPF technology, some illegal information can be shielded at the underlying level, mitigating DoS attacks and improving the communication efficiency and security of DDS, while further enhancing the performance of the access control mechanism.

[0006] To achieve the above objectives, this invention provides an attribute-based access control method in DDS, comprising the following steps:

[0007] S1. Obtaining the access control policy of publishers / subscribers: Publishers / subscribers upload their own access control policies to the authentication server (CA). The CA signs and authenticates the policies and then distributes them to the PAP (Policy Management Point) program of the publishers and subscribers to ensure the authenticity and integrity of the access control policies.

[0008] S2. Obtaining publisher / subscriber attributes: The PIP (Attribute Information Point) program publishes the attribute information of its own publisher or subscriber to the attribute domain, and subscribes to the attribute information of all other publishers / subscribers from the attribute domain. It saves the information and determines whether the attribute information of this publisher / subscriber has been determined by the access control policy. If it has not been determined by the access control policy, step S3 is triggered.

[0009] S3. Determination of control policy: The PDP (Policy Decision Point) program obtains the access control policy stored in the PAP (Policy Management Point) program and the publisher / subscriber attribute information stored in the PIP (Attribute Information Point) program, determines the access control policy, and then writes the determination result into the eBPF map.

[0010] S4. Access Control Execution: When the PEP (Policy Enforcement Point) program receives a data packet, it determines whether it is a DDS data packet. If it is a DDS data packet, it parses the data packet and reads the determination result of the access control policy stored in the eBPF map. The kernel filters the data or sends it to the publisher / subscriber program for communication.

[0011] Preferably, the attribute information in step S2 is topic information on an attribute domain, and the data type of this topic information is described by IDL:

[0012] struct Attr{

[0013] string AttrName;

[0014] int AttrType;

[0015] string AttrValue;

[0016] };

[0017] struct Attrs{

[0018] sequence <attr>AttrsSeq;

[0019] };

[0020] The Attr structure includes AttrName (attribute name), AttrType (attribute value type), and AttrValue (attribute value). The Attrs structure uses the Attr type sequence to represent a set of publisher / subscriber attribute information.

[0021] Preferably, in step S2, the PIP (Attribute Information Point) program stores the subscribed attribute information in the form of map{ID,{flag,attr1,attr2,...,attrn}}, where ID is the unique identifier of the publisher / subscriber (guID), flag indicates whether the attribute information of the publisher / subscriber has changed, and attr1,attr2,...,attrn are the attribute information of the publisher / subscriber.

[0022] Preferably, in step S2, when the PIP (Attribute Information Point) program stores the subscribed attribute information in the form of map{ID,{flag,attr1、attr2、…、attrn}}, it first checks whether the attribute information for this ID has been stored. If it has not been stored, the value of flag is set to 1, the attribute information is stored, and the access control policy is triggered. If it has been stored, the subscribed attribute information and the stored attribute information are compared. If they are not the same, the value of flag is set to 1, the stored attribute information for this ID is updated, and the access control policy is triggered. If they are the same, no operation is performed on the stored attribute information for this ID and flag, and the subscribed attribute information is discarded.

[0023] Preferably, in step S3:

[0024] S31. The PDP (Policy Decision Point) program polls the publisher / subscriber attribute information stored in the PIP (Attribute Information Point) program, obtains the attribute information {ID, {flag, attr1, attr2, ..., attrn}} with flag 1, and changes the value of flag to 0.

[0025] S32, the PDP (Policy Decision Point) program obtains the publisher / subscriber's access control policy from the PAP (Policy Management Point) program;

[0026] S33. The PDP (Policy Decision Point) program determines the access control policy based on the obtained subscriber / publisher attribute information and the publisher / subscriber access control policy. If the attributes and attribute values ​​in the subscriber / publisher satisfy the predicates or constraints of the attributes and attribute values ​​in the publisher / subscriber, the policy determination result is Permit; otherwise, the policy determination result is Deny.

[0027] S34. The PDP (Policy Decision Point) program writes the decision result into the eBPF map in the form of map{srcPort_desID, decision result}. Where srcPort is the port used by the publisher / subscriber program where the PDP (Policy Decision Point) program is located, desID is the ID in the attribute information obtained in step S31, and the decision result is the policy decision result Permit / Deny in step S33.

[0028] Preferably, in step S4:

[0029] S41. When the PEP (Policy Execution Point) program receives a data packet at the kernel network card driver layer, it determines whether it is a DDS packet based on the packet structure. If it is a DDS packet, it executes step S42; otherwise, it does not perform any operation.

[0030] S42. The PEP (Policy Execution Point) program parses the DDS data packet to obtain the guID and Port in the data packet, and queries the eBPF map for the policy determination result based on the Port and guID.

[0031] S43. When the PEP (Policy Execution Point) program finds the decision result to be Permit, it returns the result code XDP_PASS (Pass) and passes the data packet to the DDS program; otherwise, it returns the result code XDP_DROP (Drop) and filters the data packet in the kernel.

[0032] This invention also provides an attribute-based access control system in DDS, including an authentication server (CA), publishers, subscribers, and a policy determination module.

[0033] The Certificate Authority (CA) server is a third-party authoritative organization used to sign and authenticate access control policies uploaded by publishers / subscribers, and then distribute the signed access control policies to ensure their authenticity and integrity.

[0034] The publisher includes a DDS publisher program, a PIP (Attribute Information Point) program, a PAP (Policy Management Point) program, and a PDP (Policy Decision Point) program running on the same host. The DDS publisher program is used to publish data. The PIP program is used to subscribe to and save the attribute information of subscribers from attribute domains. The PAP program stores access control policies issued by the Certificate Authority (CA). The PDP program performs access control policy determinations and writes the determination results into the eBPF map.

[0035] The subscribers include a DDS subscriber program, a PIP (Attribute Information Point) program, a PAP (Policy Management Point) program, and a PDP (Policy Decision Point) program running on the same host. The DDS subscriber program is used to subscribe to data. The PIP program is used to subscribe to and save the subscriber's attribute information from the attribute domain. The PAP program stores the access control policies issued by the Certificate Authority (CA). The PDP program performs the access control policy determination and writes the determination result into the eBPF map.

[0036] The policy determination module is located in the operating system kernel of the host where the publisher and subscriber are located. It includes an eBPF map and a PEP (policy enforcement point) program (eBPF program). The eBPF map is used to store the determination results of access control policies. The PEP program (eBPF program) is mounted on the network card driver layer and is used to read the determination results of access control policies stored in the eBPF map and execute access control policies.

[0037] Therefore, the attribute-based access control system and method in DDS provided by this invention achieve the following beneficial effects:

[0038] 1. The attribute-based access control strategy adopted in this invention performs access control throughout the entire communication phase. It utilizes the DDS's own communication mechanism to update its attribute information in real time, enabling permission control for attributes whose values ​​change dynamically. This improves upon traditional DDS communication access control mechanisms that only determine permissions based on conditions such as topic and domain, making them unsuitable for complex scenarios and enhancing its flexibility and applicability.

[0039] 2. By utilizing eBPF technology to determine DDS access control at the kernel level, some illegal information can be shielded at the underlying level, avoiding DoS attacks, improving the security and efficiency of the DDS communication process, and further enhancing the performance of the access control mechanism.

[0040] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0041] Figure 1 This is a method architecture diagram of an embodiment of an attribute-based access control system and method in a DDS according to the present invention;

[0042] Figure 2 This is a communication process diagram of an embodiment of an attribute-based access control system and method in a DDS according to the present invention. Detailed Implementation

[0043] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0044] Unless otherwise defined, the technical or scientific terms used in this invention shall have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in this invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. The terms "set," "installed," and "connected" should be interpreted broadly; for example, they can refer to a fixed connection, a detachable connection, or an integral connection; a mechanical connection or an electrical connection; a direct connection or an indirect connection through an intermediate medium; or a connection within two components. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0045] Example

[0046] This invention provides an attribute-based access control system in DDS, including an authentication server (CA), publishers, subscribers, and a policy determination module.

[0047] The Certificate Authority (CA) server is a third-party authoritative organization used to sign and authenticate the access control policies uploaded by publishers / subscribers, and to distribute the signed access control policies to ensure the authenticity and integrity of the access control policies.

[0048] The publisher includes a DDS publisher program, a PIP (Attribute Information Point) program, a PAP (Policy Management Point) program, and a PDP (Policy Decision Point) program running on the same host. The DDS publisher program is used to publish data, the PIP program is used to subscribe to and save the attribute information of subscribers from attribute domains, the PAP program is used to store access control policies issued by the authentication server (CA), and the PDP program is used to perform access control policy determination and write the determination result into the eBPF map.

[0049] The subscribers include a DDS subscriber program, a PIP (Attribute Information Point) program, a PAP (Policy Management Point) program, and a PDP (Policy Decision Point) program running on the same host. The DDS subscriber program is used to subscribe to data. The PIP program is used to subscribe to and save the subscriber's attribute information from the attribute domain. The PAP program is used to store the access control policies issued by the authentication server (CA). The PDP program is used to perform the determination of the access control policies and write the determination results into the eBPF map.

[0050] The policy determination module is located in the operating system kernel of the host where the publisher and subscriber are located. It includes an eBPF map and a PEP (policy enforcement point) program (eBPF program). The eBPF map is used to store the determination results of access control policies. The PEP program (eBPF program) is mounted on the network card driver layer and is used to read the determination results of access control policies stored in the eBPF map and execute access control policies.

[0051] An attribute-based access control method in DDS includes the following steps:

[0052] Set up a scenario where a specific topic, "attributes," is designated as the subject for DDS publishers / subscribers to send their attribute information, thus establishing an attribute domain. The publisher is located within the library of Southeast University's Sipailou Campus. The publisher's access control policy is {location="Xuanwu District, Nanjing City, Jiangsu Province", DomainID=5, topic="DNU"} (location is in Xuanwu District, Nanjing City, Jiangsu Province, Domain ID is 5, topic is Dongda), guID is 0x10111111, and the publisher's program port is 1223. The subscriber's access control policy is {location="Nanjing City, Jiangsu Province", DomainID=5, topic="DNU"} (location is in Nanjing City, Jiangsu Province, Domain ID is 5, topic is Dongda), guID is 0x10111112, and the subscriber's program port is 1222.

[0053] S1. Obtaining Publisher / Subscriber Control Policies: Publishers and subscribers upload their own defined access control policies {location="Xuanwu District, Nanjing City, Jiangsu Province", DomainID=5, topic="Dongda"} and {location="Nanjing City, Jiangsu Province", DomainID=5, topic="Dongda"} to the authentication server CA. The CA signs and authenticates them, and then distributes them to the PAP (Policy Management Point) program.

[0054] S2. Obtaining Publisher / Subscriber Attributes: The PIP (Attribute Information Point) program subscribes to the subscriber / publisher attributes from the attribute domain: {location="Xuanwu District, Nanjing City, Jiangsu Province", DomainID=5, topic="attribute"} / {location="Nanjing City, Jiangsu Province", DomainID=5, topic="attribute"}. It then stores the attribute information in the PIP (Attribute Information Point) in the form of map{0x10111111,{1,location="Xuanwu District, Nanjing City, Jiangsu Province", DomainID=5}} / map{0x10111112,{1,location="Nanjing City, Jiangsu Province", DomainID=5}}, triggering access control policy determination.

[0055] S3. Determination of access control results: The above steps further include:

[0056] The S31.PDP (Policy Decision Point) program polls the publisher / subscriber attribute information stored in the PIP (Attribute Information Point) program, retrieves the attribute information with flag 1: {0x10111111,{1,location="Xuanwu District, Nanjing City, Jiangsu Province",DomainID=5}} / {0x10111112,{1,location="Nanjing City, Jiangsu Province",DomainID=5}}, and changes the value of flag to 0.

[0057] The S32.PDP (Policy Decision Point) program retrieves the publisher / subscriber's access control policy from the PAP (Policy Management Point) program: {location="Xuanwu District, Nanjing City, Jiangsu Province", DomainID=5, topic="Dongda"} / {location="Nanjing City, Jiangsu Province", DomainID=5, topic="Dongda"};

[0058] The S33.PDP (Policy Decision Point) program determines the access control policy based on the obtained subscriber / publisher attribute information and the publisher / subscriber access control policy. The attributes and attribute values ​​in the subscriber / publisher satisfy the predicates or constraints of the attributes and attribute values ​​in the publisher / subscriber, and the policy determination result is Permit.

[0059] The S34.PDP (Policy Decision Point) program writes the decision result into the eBPF map in the form of map{1222_0x10111112, Permit} / map{1223_0x10111111, Permit}.

[0060] S4. Execution of access control results: The steps further include:

[0061] The S41.PEP (Policy Execution Point) program receives a data packet at the kernel network card driver layer. It determines whether the packet is a DDS packet based on the packet structure. If it is a DDS packet, it executes step S42; otherwise, it does not perform any operation.

[0062] The S42.PEP (Policy Execution Point) program parses the DDS data packet to obtain the guID (0x10111111 / 0x10111112) and Port (1223 / 1222) in the data packet. Based on the Port and guID (1223_0x10111111 / 1222_0x10111112), it queries the eBPF map for the policy determination result.

[0063] The S43.PEP (Policy Execution Point) program retrieves a Permit result and returns the result code XDP_PASS (Transfer). The data packet is then transferred to the DDS program for data communication.

[0064] Therefore, this invention provides an attribute-based access control system and method in DDS, which combines attribute-based access control (ABAC) technology with the DDS communication process to achieve dynamic publish / subscribe permission control. Utilizing eBPF technology, some illegal information can be shielded at the underlying level to circumvent DoS attacks, improving the communication efficiency and security of DDS, while further enhancing the performance of the access control mechanism.

[0065] Finally, it should be noted that those skilled in the art will realize that the embodiments described herein are to help readers understand the principles of the present invention. The above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.< / attr>

Claims

1. An attribute-based access control method in DDS, characterized in that: Includes the following steps: S1. Obtaining the publisher / subscriber access control policy: The publisher / subscriber uploads its own access control policy to the authentication server (CA). The CA signs and authenticates the policy, and then distributes it to the publisher's and subscriber's PAP program. S2. Obtaining publisher / subscriber attributes: The PIP program publishes the attribute information of its own publisher or subscriber to the attribute domain, and subscribes to the attribute information of all publishers / subscribers from the attribute domain. It saves the information and determines whether the attribute information of the publisher / subscriber has been determined by the access control policy. If it has not been determined by the access control policy, step S3 is triggered. S3. Determination of control policy: The PDP program obtains the access control policy stored in the PAP program and the publisher / subscriber attribute information stored in the PIP program, determines the access control policy, and then writes the determination result into the eBPF map. S4. Execution of access control: When the PEP program receives a data packet, it determines whether it is a DDS data packet. If it is a DDS data packet, it parses the data packet and reads the judgment result of the access control policy stored in the eBPF map. The kernel filters the data or sends it to the publisher / subscriber program for communication. The attribute information in step S2 is topic information on an attribute domain, and the data type of this topic information is described by IDL as follows: struct Attr{ string AttrName; int AttrType; string AttrValue; }； struct Attrs{ sequence <attr> AttrsSeq;< / attr> }； The Attr structure includes AttrName, AttrType, and AttrValue. The Attrs structure uses the Attr type sequence to represent a set of publisher / subscriber attribute information. In step S2, the PIP program stores the subscribed attribute information in the form of map{ID, {flag,attr1,attr2, ...,attrn}}, where ID is the unique identifier guID of the publisher / subscriber, flag indicates whether the attribute information of the publisher / subscriber has changed, and attr1,attr2, ...,attrn are the attribute information of the publisher / subscriber. In step S2, when the PIP program stores the subscribed attribute information in the form of map{ID, {flag,attr1、attr2、…、attrn}}, it first checks whether the attribute information of this ID has been stored based on the ID. If it has not been stored, the value of flag is set to 1, the attribute information is stored, and the access control policy is triggered. If it has been stored, the subscribed attribute information and the stored attribute information are compared. If they are not the same, the value of flag is set to 1, the stored attribute information of this ID is updated, and the access control policy is triggered. If they are the same, no operation is performed on the stored attribute information of this ID and flag, and the subscribed attribute information is discarded. In step S3: S31. The PDP program polls the publisher / subscriber attribute information stored in the PIP program, obtains the attribute information {ID, {flag, attr1, attr2, ..., attrn}} with flag 1, and changes the value of flag to 0; S32. The PDP program obtains the publisher / subscriber's access control policy from the PAP program; S33. The PDP program determines the access control policy based on the obtained subscriber / publisher attribute information and the publisher / subscriber access control policy. If the attributes and attribute values ​​in the subscriber / publisher satisfy the predicates or constraints of the attributes and attribute values ​​in the publisher / subscriber, the policy determination result is Permit; otherwise, the policy determination result is Deny. S34. The PDP program writes the judgment result into the eBPF map in the form of map{srcPort_desID, judgment result}, where srcPort is the port used by the publisher / subscriber program where the PDP program is located, desID is the ID in the attribute information obtained in step S31, and the judgment result is the policy judgment result Permit / Deny in step S33.

2. The attribute-based access control method in a DDS according to claim 1, characterized in that: In step S4: S41. When the PEP program receives a data packet at the kernel network card driver layer, it determines whether it is a DDS packet based on the packet structure. If it is a DDS packet, it executes step S42; otherwise, it does not perform any operation. S42. The PEP program parses the DDS data packet to obtain the guID and Port in the data packet, and queries the eBPF map for the policy determination result based on the Port and guID. S43. When the PEP program finds a Permit result, it returns the result code XDP_PASS and passes the data packet to the DDS program; otherwise, it returns the result code XDP_DROP and filters the data packet in the kernel.

3. An attribute-based access control system in a DDS, used to execute an attribute-based access control method in a DDS according to any one of claims 1-2, characterized in that: This includes the Certificate Authority (CA), publishers, subscribers, and policy determination modules. The Certificate Authority (CA) server is a third-party authoritative organization used to sign and authenticate access control policies uploaded by publishers / subscribers, and then distribute the signed access control policies. The publisher includes a DDS publisher program, a PIP program, a PAP program, and a PDP program running on the same host. The DDS publisher program is used to publish data. The PIP program is used to subscribe to and save the attribute information of subscribers from attribute domains. The PAP program is used to store access control policies issued by the authentication server (CA). The PDP program is used to perform access control policy determinations and write the determination results into the eBPF map. The subscribers include a DDS subscriber program, a PIP program, a PAP program, and a PDP program running on the same host. The DDS subscriber program is used to subscribe to data. The PIP program is used to subscribe to and save the subscriber's attribute information from the attribute domain. The PAP program is used to store the access control policies issued by the authentication server (CA). The PDP program is used to perform access control policy judgments and write the judgment results into the eBPF map. The policy determination module is located in the operating system kernel of the host where the publisher and subscriber are located. It includes an eBPF map and a PEP program. The eBPF map is used to store the determination results of access control policies. The PEP program is mounted on the network card driver layer and is used to read the determination results of access control policies stored in the eBPF map and execute access control policies.

Images