Access control method and device based on identity authentication

Abstract

The embodiment of the invention provides an access control method and device based on identity authentication, the access control method based on identity authentication is applied to an access control system, the system comprises a policy identity management server side and an identity agent side, and the method comprises the following steps: the identity agent side sends a registration request to the policy identity management server side; wherein the identity agent ends are in one-to-one correspondence with the assets; the policy identity management server side determines an asset label based on the registration request, determines an access control policy based on the asset label, and sends the access control policy to the identity agent side; and the identity agent side obtains the sending data and the receiving data of the assets, and performs access control based on the access control strategy. Therefore, the problems that an original asset IP cannot be recognized and accurate access control cannot be performed on a source visitor due to IP dynamic change, IP counterfeit, IP address conversion and the like can be avoided, the network security is improved, and meanwhile, the matching efficiency of access control is improved by using a specific identity information matching mechanism.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of network security technology, and in particular to an access control method based on identity authentication. Background Art

[0002] With the rapid development of the Internet, the number of IP addresses has increased dramatically, especially in the context of IPv4 address exhaustion, the deployment of IPv6 has brought a larger address space. Traditional firewalls need to process and match a large number of IP addresses, which increases the complexity of the matching process.

[0003] Traditional IP-based firewalls rely on linear search matching of ACLs to control the passage of data packets. As the scale of the network expands, ACL rules may become very large and complex, making management very difficult and prone to errors, and the matching speed decreases, affecting network performance.

[0004] In traditional network firewall technology, access control is usually based on matching the access tuple information (source IP, destination IP, protocol, port, etc.) with the pre-configured access control list (ACL) policy to decide whether to release or block traffic. This method relies heavily on IP addresses and has obvious limitations when facing scenarios such as dynamic IP changes, IP spoofing, and IP address translation (NAT). It also has the problem of low IP matching efficiency and cannot perform global and unified business logic-based configuration for all firewalls in the network. Therefore, a better solution is urgently needed. Summary of the invention

[0005] In view of this, the embodiments of this specification provide an access control method based on identity authentication. One or more embodiments of this specification also relate to an access control device based on identity authentication, a computing device, a computer-readable storage medium and a computer program to solve the technical defects existing in the prior art.

[0006] According to a first aspect of an embodiment of this specification, there is provided an access control method based on identity authentication, which is applied to an access control system. The system includes a policy identity management server and an identity agent. The method includes: The identity agent sends a registration request to the policy identity management server; the identity agent corresponds to the asset one by one; The policy identity management server determines the asset tag based on the registration request, determines the access control policy based on the asset tag, and sends the access control policy to the identity agent; The identity agent obtains the sending and receiving data of the asset and performs access control based on the access control policy.

[0007] In a possible implementation, the identity proxy sends a registration request to the policy identity management server, including: The identity agent obtains asset information or user information; Generate a registration request based on asset information or user information and send the registration request to the policy identity management server.

[0008] In a possible implementation, the policy identity management server determines the asset tag based on the registration request, and determines the access control policy based on the asset tag, including: The policy identity management server obtains the preset policy configuration; Generate an asset tag based on a preset policy configuration and a registration request; wherein the asset tag includes identity information; Assign corresponding access control policies based on identity information.

[0009] In a possible implementation, the identity agent obtains the sending data and receiving data of the asset and performs access control based on the access control policy, including: The identity agent obtains the asset's sending SYN message and receiving SYN message; Determine the target field based on sending a SYN message or receiving a SYN message; Access control is performed based on target fields and access control policies.

[0010] In a possible implementation, access control is performed based on the target field and the access control policy, including: When the identity proxy obtains the SYN message sent by the asset, the target access object is obtained based on the sent SYN message; Determine identity information based on asset tags; Determine access rights to target access objects based on identity information and access control policies; When the access permission is to allow access, the identity information is inserted into the target field to obtain the identity SYN message; Send the identity SYN message to the target access object.

[0011] In a possible implementation, access control is performed based on the target field and the access control policy, including: When the identity proxy obtains the received SYN message of the asset, the verification identity information is obtained based on the target field; Determine access rights to assets based on identity information and access control policies; When the access permission is granted, an identity SYN message is sent to the asset.

[0012] In a possible implementation, the method further includes: If the access permission is not allowed, the message is discarded.

[0013] According to a second aspect of the embodiment of this specification, there is provided an access control device based on identity authentication, which is applied to an access control system. The system includes a policy identity management server and an identity agent. The device includes: The request sending module is configured to send a registration request from the identity agent to the policy identity management server; wherein the identity agent corresponds to the asset one by one; The tag determination module is configured to determine the asset tag based on the registration request as a policy identity management server, determine the access control policy based on the asset tag, and send the access control policy to the identity agent; The access control module is configured to obtain the sending data and receiving data of the asset as an identity agent, and perform access control based on the access control policy.

[0014] According to a third aspect of an embodiment of this specification, a computing device is provided, including: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the above-mentioned access control method based on identity authentication are implemented.

[0015] According to a fourth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of the above-mentioned access control method based on identity authentication are implemented.

[0016] According to a fifth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned access control method based on identity authentication.

[0017] The embodiments of this specification provide an access control method and device based on identity authentication, wherein the access control method based on identity authentication is applied to an access control system, the system includes a policy identity management server and an identity agent, and the method includes: the identity agent sends a registration request to the policy identity management server; wherein the identity agent corresponds to the asset one-to-one; the policy identity management server determines the asset tag based on the registration request, and determines the access control policy based on the asset tag, and sends the access control policy to the identity agent; the identity agent obtains the sending data and receiving data of the asset, and performs access control based on the access control policy. This can avoid problems such as the inability to identify the original asset IP and the inability to perform accurate access control on the source visitor caused by dynamic IP changes, IP spoofing, IP address conversion, etc., improve network security, and use a unique identity information matching mechanism to improve the matching efficiency of access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a flow chart of an access control method based on identity authentication provided by an embodiment of this specification; Figure 2 It is a framework diagram of an access control method based on identity authentication provided by an embodiment of this specification; Figure 3 is a timing diagram of an access control method based on identity authentication provided by an embodiment of this specification; Figure 4 This is a control principle diagram of an access control method based on identity authentication provided by an embodiment of this specification; Figure 5 It is a structural diagram of an access control device based on identity authentication provided by an embodiment of this specification; Figure 6 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0019] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0020] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0021] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0022] First, the terms involved in one or more embodiments of this specification are explained.

[0023] IP address: Internet Protocol Address, also translated as Internet Protocol address.

[0024] NAT: Network Address Translation, which converts private IP addresses into public IP addresses, allowing multiple devices in a local area network to share a public IP address to access the Internet.

[0025] TCP: Transmission Control Protocol, a connection-oriented reliable transmission protocol that ensures the integrity and reliability of data during network transmission.

[0026] ACL: Access Control List, which is used to control access rights to network devices or system resources.

[0027] IPs are randomly assigned in the cloud computing era or in traditional DHCP network environments, so they cannot stably represent computing nodes (communication entities), and thus cannot implement access control of communication entities through IP-oriented policies. In addition, the IP information of data packets can be easily tampered with, thereby achieving counterfeiting of access sources.

[0028] Furthermore, when the source IP reaches the destination IP, it often undergoes NAT address translation (especially in container network cluster scenarios, where this situation is more common). At this time, the destination cannot directly make access control decisions based on the source IP.

[0029] Furthermore, with the rapid development of the Internet, the number of IP addresses has increased dramatically, especially in the context of IPv4 address exhaustion, the deployment of IPv6 has brought a larger address space. Traditional firewalls need to process and match a large number of IP addresses, which increases the complexity of the matching process.

[0030] Furthermore, traditional IP-based firewalls rely on linear search matching of ACLs to control the passage of data packets. As the scale of the network expands, ACL rules may become very large and complex, making management very difficult and prone to errors, and the matching speed decreases, affecting network performance.

[0031] Therefore, in this specification, an access control method based on identity authentication is provided. This specification also relates to an access control device based on identity authentication, a computing device, and a computer-readable storage medium, which are used to solve the above problems, which are described in detail one by one in the following embodiments.

[0032] See also Figure 1 , Figure 1 A flowchart of an access control method based on identity authentication provided according to an embodiment of the present specification is shown, which is applied to an access control system. The system includes a policy identity management server and an identity agent, and specifically includes the following steps.

[0033] Step 101: The identity agent sends a registration request to the policy identity management server; wherein the identity agent corresponds to the asset one-to-one.

[0034] The identity agent can be software or hardware, used to process TCP SYN packets and implement access control based on identity IDs. For example, the identity agent can be an agent program deployed in assets. Correspondingly, the identity management server can be software or hardware, used to receive registered identity information of intranet assets, configure access control policies, and distribute identity rules and corresponding identity IDs. For example, the identity management server can be a device deployed separately on proprietary hardware. Assets can be information technology assets, which are any information or data, software or hardware used by an organization during its business operations. Hardware assets include physical computing devices, such as physical servers in data centers, desktop computers, mobile devices, laptops, keyboards, and printers. On the other hand, software assets include applications that are usually licensed by user or machine, as well as software systems and databases built using open source resources. Software assets also include cloud-based assets and cloud services, such as software as a service (SaaS) applications.

[0035] In a possible implementation, the identity agent sends a registration request to the policy identity management server, including: the identity agent obtains asset information or user information; generates a registration request based on the asset information or user information, and sends the registration request to the policy identity management server.

[0036] In practical applications, see Figure 2 The system includes a policy identity management server and an identity detection agent deployed on intranet assets. Figure 3 ,The agent first registers asset information or user information with the server.

[0037] For example, the agent obtains the asset information of asset A: the host of the R&D department, generates a registration request based on the asset information, and sends the registration request to the policy identity management server for registration.

[0038] Step 102: The policy identity management server determines the asset tag based on the registration request, determines the access control policy based on the asset tag, and sends the access control policy to the identity agent.

[0039] In one possible implementation, the policy identity management server determines an asset tag based on a registration request, and determines an access control policy based on the asset tag, including: the policy identity management server obtains a preset policy configuration; generates an asset tag based on the preset policy configuration and the registration request; wherein the asset tag includes identity information; and allocates a corresponding access control policy based on the identity information.

[0040] The preset policy configuration may be manually configured, for example, the assets of the R&D department cannot access the assets of the service department.

[0041] In practical applications, see Figure 3 ,System users configure identity-based access policies on the management server.,The server aggregates the registration information, combines the policy configuration,,calculates the identity rules and identity IDs that each agent should implement, and sends them to the,agents.

[0042] For example, the policy identity management server has deployed a preset policy configuration. When receiving a registration request sent by the agent, the policy identity management server determines the asset tag based on the identity information of the asset in the registration request. Using the above example, the asset information of asset A is: the host of the R&D department. Then, an ID is selected from the identity ID pool of the R&D department, and the ID is bound to asset A. In addition, the access control policy corresponding to the R&D department is also bound to the ID.

[0043] It should be noted that the identity information can be N globally unique digital IDs generated by the identity management server based on the unique identifier of the asset or user when registering the identity agent program or the tag configured by the administrator, which may include 1 asset ID or user identity ID and n tag IDs.

[0044] The embodiment of this specification provides identity services, generates an identity ID or asset ID for each physical asset, maintains an identity list across the entire network, and provides active identity registration services online. It allows administrators to write control policies (tag policies) based on business access for identities, rather than directly writing policies for IPs.

[0045] Step 103: The identity agent obtains the sending data and receiving data of the asset, and performs access control based on the access control policy.

[0046] In one possible implementation, the identity agent obtains the sending data and receiving data of the asset, and performs access control based on the access control policy, including: the identity agent obtains the sending SYN message and receiving SYN message of the asset; determines the target field based on the sending SYN message or the receiving SYN message; and performs access control based on the target field and the access control policy.

[0047] The target field may be an option field of the SYN message.

[0048] In actual applications, the TCP SYN message is the first message to establish a TCP connection. The option field of the SYN message can be used to carry the identity information of the visitor. Figure 4The identity detection agent of the visited party can determine whether to retain and pass it to the upper-layer application service or discard the SYN message by checking the identity information field in the received SYN message. If the SYN message is discarded by the agent, the visitor will not be able to establish a TCP connection with the visited application, which can achieve the purpose of blocking access. Based on the method of carrying identity in the SYN packet, this identity information will not be affected by NAT and can be directly used at the destination end to make access control decisions at the source end.

[0049] For example: there is a workload asset running an office OA website business. When the identity agent running on the asset is registered to the identity management server, the asset unique identifier used is the globally unique UUID value u generated by the agent based on the operating system ID of the asset. At the same time, the administrator assigns the business group label OA and the role label WEB to the registered asset based on the actual business of the workload asset. The identity management server program will generate a globally unique digital ID for U, OA, and WEB respectively: UID (for example, 10001), OAID (for example, 10002), and WEBID (for example, 10003), and send it to the identity agent of the workload asset, where UID belongs to the asset ID, and OAID and WEBID belong to the tag ID (TagID) (only the asset ID is involved in this example, not the user identity ID). When the application on the asset initiates TCP access to the outside, the identity agent of the asset will attach the identity information shown in the following figure to the TCP SYN message: Table 1

[0050] At the same time, the management server will maintain a mapping table of asset uuid to asset id, and tag to tag id: Table 2

[0051] The embodiments of this specification configure rules based on identity information (asset ID or identity ID or business tag, etc.), so that network policy management is associated with the actual business of the asset, and the dependence on IP is eliminated, which can greatly reduce the number of policies and management costs. At the same time, when performing identity-based matching, the identity agent of the asset can completely achieve fast search and matching through simple operations such as rule aggregation, deduplication, and comparison of digital IDs, which greatly improves the efficiency of rule matching.

[0052] In one possible implementation, access control is performed based on a target field and an access control policy, including: obtaining a target access object based on the sent SYN message when an identity agent obtains a SYN message sent by an asset; determining identity information based on an asset tag; determining access rights to the target access object based on the identity information and the access control policy; when the access right is to allow access, inserting identity information into a target field to obtain an identity SYN message; and sending the identity SYN message to the target access object.

[0053] In actual applications, access control of assets includes control over data packets sent outward. For outgoing SYN packets, the user's own identity ID is added to the option field.

[0054] For example, asset A sends data packet D. The proxy program obtains data packet D and parses it to obtain the destination address of data packet D, which is asset B of the service department. Based on the previously issued access control policy and the identity information of asset A, it determines whether asset A is allowed to access the destination address. If the access control policy allows it, that is, the access control policy contains the permission for assets in the R&D department to access assets in the service department, then the identity information of asset A is inserted into the option field of the SYN message of data packet D, and then data packet D is sent to the target address.

[0055] The embodiment of the present specification inserts ID information into each TCP SYN data packet sent, and can solve the identity counterfeiting problem through encryption or hash signature processing.

[0056] In a possible implementation, access control is performed based on the target field and the access control policy, including: when the identity proxy obtains the received SYN message of the asset, obtaining the verification identity information based on the target field; determining the access right to the asset based on the identity information and the access control policy; when the access right is to allow access, sending the identity SYN message to the asset. When the access right is not to allow access, discarding the message.

[0057] In actual applications, access control of assets includes control of received data packets. For received SYN packets, the agent checks the source asset ID information in the option field and matches it with the rules of the destination asset. If it matches the whitelist, it is released, otherwise it is discarded directly.

[0058] For example, asset A receives data packet S, obtains ID information from the SYN message, and determines based on the ID information that data packet S comes from asset B in the service department. It then makes a judgment based on the access control policy. If the ID information exists in the accessible list of the access control policy, that is, the assets of the service department are allowed to access the assets of the R&D department, then the data packet S is released. On the contrary, if the access control policy does not allow the assets of the service department to access the assets of the R&D department, then the data packet S is discarded.

[0059] It should be noted that policy judgment can also be made based on multi-dimensional IDs. For example, when N digital ID information in the identity information is passed to the agent program of the accessed asset, the accessed agent program can make matching judgments based on the identity policy rules it receives from the identity management server, such as: allowing or blocking m identity IDs or asset IDs; allowing or blocking M-dimensional tag IDs. The judgment process may include but is not limited to the following rule situations: 1. Allow or block a rule that specifies m identity IDs or asset IDs: This can be done by directly judging whether the received identity ID or asset ID (uid) exists in the list of m identity IDs or asset IDs in the rule; 2. Allow or block the rule that specifies the M-dimensional tag id: It is necessary to determine whether the n tag ids in the received identity information are a superset of the M-dimensional tag id in the rule.

[0060] Continuing with the above example, the visitor identity information contains the tag IDs of the application business group tag oa and the application role tag web: oaid (10002) and webid (10003); the asset being visited belongs to the database business. If the allow rule received by the agent of the database business asset only contains the tag ID (webid) of the application role tag web, it means that the database business allows any web role to access it, that is, the tag set {oaid, webid} in the visitor identity information is a superset of the tag set {webid} in the rule, which means that this rule is matched.

[0061] The embodiment of this specification implements identity-based access control on the packet-sending subject by matching rules on the inserted ID for each incoming TCP SYN packet.

[0062] It should be noted that the access control method of this solution can be implemented based on a variety of systems. For example, in a Linux system, iptables' nfqueue or ebpf and other technologies are used to implement access control on TCP packets; in a Windows system, wfp technology is used to implement access control on TCP packets. This specification does not limit the specific implementation method.

[0063] The embodiments of this specification provide an access control method and device based on identity authentication, wherein the access control method based on identity authentication is applied to an access control system, the system includes a policy identity management server and an identity agent, and the method includes: the identity agent sends a registration request to the policy identity management server; wherein the identity agent corresponds to the asset one-to-one; the policy identity management server determines the asset tag based on the registration request, and determines the access control policy based on the asset tag, and sends the access control policy to the identity agent; the identity agent obtains the sending data and receiving data of the asset, and performs access control based on the access control policy. This can avoid problems such as the inability to identify the original asset IP and the inability to perform accurate access control on the source visitor caused by dynamic IP changes, IP spoofing, IP address conversion, etc., improve network security, and use a unique identity information matching mechanism to improve the matching efficiency of access control.

[0064] Corresponding to the above method embodiment, this specification also provides an access control device embodiment based on identity authentication, Figure 5 FIG. 1 shows a schematic diagram of a structure of an access control device based on identity authentication provided by an embodiment of the present specification. Figure 5 As shown, it is applied to an access control system, the system includes a policy identity management server and an identity agent, and the device includes: The request sending module 501 is configured to send a registration request from the identity agent to the policy identity management server; wherein the identity agent corresponds to the asset one by one; The tag determination module 502 is configured as a policy identity management server to determine the asset tag based on the registration request, determine the access control policy based on the asset tag, and send the access control policy to the identity agent; The access control module 503 is configured to obtain the sending data and receiving data of the asset through the identity agent, and perform access control based on the access control policy.

[0065] In a possible implementation, the request sending module 501 is further configured to: The identity agent obtains asset information or user information; Generate a registration request based on asset information or user information and send the registration request to the policy identity management server.

[0066] In a possible implementation, the tag determination module 502 is further configured to: The policy identity management server obtains the preset policy configuration; Generate an asset tag based on a preset policy configuration and a registration request; wherein the asset tag includes identity information; Assign corresponding access control policies based on identity information.

[0067] In a possible implementation, the access control module 503 is further configured to: The identity agent obtains the asset's sending SYN message and receiving SYN message; Determine the target field based on sending a SYN message or receiving a SYN message; Access control is performed based on target fields and access control policies.

[0068] In a possible implementation, the access control module 503 is further configured to: When the identity proxy obtains the SYN message sent by the asset, the target access object is obtained based on the sent SYN message; Determine identity information based on asset tags; Determine access rights to target access objects based on identity information and access control policies; When the access permission is to allow access, the identity information is inserted into the target field to obtain the identity SYN message; Send the identity SYN message to the target access object.

[0069] In a possible implementation, the access control module 503 is further configured to: When the identity proxy obtains the received SYN message of the asset, the verification identity information is obtained based on the target field; Determine access rights to assets based on identity information and access control policies; When the access permission is granted, an identity SYN message is sent to the asset.

[0070] In a possible implementation, the access control module 503 is further configured to: If the access permission is not allowed, the message is discarded.

[0071] The above is a schematic scheme of an access control device based on identity authentication of this embodiment. It should be noted that the technical scheme of the access control device based on identity authentication and the technical scheme of the access control method based on identity authentication belong to the same concept, and the details of the technical scheme of the access control device based on identity authentication that are not described in detail can be found in the description of the technical scheme of the access control method based on identity authentication.

[0072] Figure 6 The block diagram of a computing device 600 according to an embodiment of the present specification is shown. The components of the computing device 600 include but are not limited to a memory 610 and a processor 620. The processor 620 is connected to the memory 610 via a bus 630, and the database 650 is used to store data.

[0073] The computing device 600 also includes an access device 640 that enables the computing device 600 to communicate via one or more networks 660. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 640 may include one or more of any type of network interface (e.g., a network interface card (NIC)) that is wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a world-wide interoperability for microwave access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, and a near field communication (NFC).

[0074] In one embodiment of the present specification, the above components of the computing device 600 and Figure 6 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 6 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0075] The computing device 600 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or a personal computer (PC). The computing device 600 may also be a mobile or stationary server.

[0076] Among them, the processor 620 is used to execute the following computer executable instructions, which, when executed by the processor, implement the steps of the above-mentioned access control method based on identity authentication. The above is a schematic scheme of a computing device of this embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the above-mentioned access control method based on identity authentication belong to the same concept. The details of the technical scheme of the computing device that are not described in detail can be found in the description of the technical scheme of the above-mentioned access control method based on identity authentication.

[0077] An embodiment of the present specification further provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the above-mentioned access control method based on identity authentication.

[0078] The above is a schematic scheme of a computer-readable storage medium of this embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the access control method based on identity authentication belong to the same concept, and the details not described in detail in the technical scheme of the storage medium can be found in the description of the technical scheme of the access control method based on identity authentication.

[0079] An embodiment of the present specification further provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned access control method based on identity authentication.

[0080] The above is a schematic scheme of a computer program of this embodiment. It should be noted that the technical scheme of the computer program and the technical scheme of the access control method based on identity authentication belong to the same concept, and the details not described in detail in the technical scheme of the computer program can be found in the description of the technical scheme of the access control method based on identity authentication.

[0081] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0082] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0083] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0084] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0085] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. An access control method based on identity authentication, characterized in that: Applied to an access control system, the system includes a policy identity management server and an identity agent, and the method includes: The identity agent sends a registration request to the policy identity management server; wherein the identity agent corresponds to the asset one by one; The policy identity management server determines the asset tag based on the registration request, determines the access control policy based on the asset tag, and sends the access control policy to the identity agent; The identity proxy obtains the sending data and receiving data of the asset, and performs access control based on the access control policy.

2. The method according to claim 1, characterized in that The identity agent sends a registration request to the policy identity management server, including: The identity agent obtains asset information or user information; A registration request is generated based on the asset information or the user information, and the registration request is sent to the policy identity management service end.

3. The method according to claim 1, characterized in that The policy identity management server determines the asset tag based on the registration request, and determines the access control policy based on the asset tag, including: The policy identity management server obtains a preset policy configuration; generating an asset tag based on the preset policy configuration and the registration request; wherein the asset tag includes identity information; A corresponding access control policy is allocated based on the identity information.

4. The method according to claim 1, characterized in that: The identity proxy obtains the sending data and receiving data of the asset, and performs access control based on the access control policy, including: The identity proxy obtains the sending SYN message and receiving SYN message of the asset; Determining a target field based on the sending SYN message or the receiving SYN message; Access control is performed based on target fields and access control policies.

5. The method according to claim 4, characterized in that Access control is performed based on target fields and access control policies, including: When the identity proxy obtains the sent SYN message of the asset, obtaining the target access object based on the sent SYN message; determining identity information based on the asset tag; Determining access rights to the target access object based on the identity information and the access control policy; In the case where the access permission is to allow access, inserting the identity information into the target field to obtain an identity SYN message; The identity SYN message is sent to the target access object.

6. The method according to claim 4, characterized in that Access control is performed based on target fields and access control policies, including: When the identity proxy obtains the received SYN message of the asset, obtaining the verification identity information based on the target field; Determining access rights to the asset based on the identity information and the access control policy; When the access permission is to allow access, the identity SYN message is sent to the asset.

7. The method according to claim 5 or 6, characterized in that: Also includes: When the access permission is that access is not permitted, the message is discarded.

8. An access control device based on identity authentication, characterized in that: Applied to an access control system, the system includes a policy identity management server and an identity agent, and the device includes: A request sending module, configured to send a registration request from the identity agent to the policy identity management server; wherein the identity agent corresponds to the asset one by one; A tag determination module, configured for the policy identity management server to determine an asset tag based on the registration request, determine an access control policy based on the asset tag, and send the access control policy to the identity agent; The access control module is configured to enable the identity agent to obtain the sending data and receiving data of the asset and perform access control based on the access control policy.

9. A computing device, characterized in that include: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the access control method based on identity authentication according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the access control method based on identity authentication as described in any one of claims 1 to 7.

Images