Access control analysis method and device, electronic equipment and vehicle

Abstract

The invention discloses an access control analysis method and apparatus, an electronic device and a vehicle. The method comprises the steps of obtaining an access request initiated by a target application; transmitting the access request to a policy conversion engine; converting the access request into a standard tetrad through a strategy conversion engine; transmitting the standard tetrad to a strategy execution unit; the standard tetrad comprises a subject, an object, a resource and an action; forwarding the standard tetrad to a strategy decision unit through a strategy execution unit; performing strategy matching in a strategy management unit through a strategy decision unit based on the standard tetrad, and determining a request result of the access request according to a strategy matching result; a request result is returned to the strategy execution unit; a preset access control strategy is stored in the strategy management unit; and managing the access service authority of the access request according to the request result through a strategy execution unit. The security of access control analysis can be improved, and the method can be widely applied to the technical field of data processing.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to an access control analysis method, device, electronic equipment and vehicle. Background Art

[0002] Among the information security access control design and analysis methods currently used in the industry, most methods involve a single component or are based on risk assessment:

[0003] 1. Single component: With the storage module as the core, a four-stage computing model is established based on data partitioning service, daemon technology, Per module, access policy module, etc. to perform policy control on data access.

[0004] 2. Risk assessment: By adding risk assessment, the user's access control request is managed to confirm whether the risk value of the user's behavior is greater than the risk threshold, and the access control request is allowed or blocked based on the judgment result.

[0005] Based on the above technical solution, the shortcomings and deficiencies of the existing technology are:

[0006] Prior art 1 invented an access control method for a storage module, but overall consideration and protection of the entire vehicle is still lacking.

[0007] Existing technology 2 needs to add a risk assessment module, is greatly influenced by subjective factors, and cannot provide access control protection. Summary of the invention

[0008] The present invention aims to solve the problem of related technical limitations at least to a certain extent. To this end, the present invention proposes an access control analysis method, device, electronic device and vehicle, which can effectively improve the security of access control analysis.

[0009] On the one hand, an embodiment of the present invention provides an access control analysis method, including:

[0010] Obtaining the access request initiated by the target application; transmitting the access request to the policy conversion engine;

[0011] The access request is converted into a standard quadruple through a policy conversion engine; the standard quadruple is transmitted to a policy execution unit; the standard quadruple includes a subject, an object, a resource, and an action;

[0012] forwarding the standard quadruple to the policy decision unit through the policy execution unit;

[0013] The policy decision unit performs policy matching in the policy management unit based on the standard quadruple, and determines the request result of the access request according to the result of the policy matching; the request result is returned to the policy execution unit; the policy management unit stores the preset access control policy;

[0014] The access service rights of the access request are managed by the policy execution unit according to the request result.

[0015] In some embodiments, obtaining an access request initiated by a target application includes the following steps:

[0016] Receiving, at the target application, an access instruction input by the target object;

[0017] An access request to the passive entity is generated according to the access instruction.

[0018] In some embodiments, converting the access request into a standard quadruple by a policy conversion engine includes the following steps:

[0019] Confirm the subject according to the initiating object of the access request; the initiating object includes the target application or the target object that inputs the access instruction in the target application;

[0020] Determine the object according to the passive entity targeted by the access request; the passive entity includes at least one of a specified service, a specified resource, a specified device, and a specified network node;

[0021] Determine the action according to the interaction mode between the initiating object and the passive entity preset in the access request;

[0022] The resources are determined based on the expected access resources in the access request; the expected access resources include specific resources required for the specified resources and / or interaction mode.

[0023] In some embodiments, the access control policy includes an array of relationships between entities and resources they are allowed to access and authorized actions; performing policy matching in a policy management unit based on a standard quadruple, and determining a request result of the access request according to a result of the policy matching, including the following steps:

[0024] Based on the association relationship among subject, object, resource and action in the standard four-tuple, the relationship array of all access control policies in the policy management unit is traversed and matched;

[0025] When there is a relationship array identical to the association relationship in the policy management unit, the request result is determined to be a successful request; otherwise, the request result is determined to be a failed request.

[0026] In some embodiments, the access control policy includes a basic access control policy and an exclusive access control policy; traversing and matching the relationship array of all access control policies in the policy management unit includes the following steps:

[0027] Determine whether the target application is a dedicated application according to the application identifier of the target application;

[0028] When the target application is a dedicated application, a first traversal matching is performed on the relationship array of all dedicated access control policies in the policy management unit;

[0029] When the target application does not belong to a dedicated application, or when there is no matching result in the first traversal matching, a second traversal matching is performed on the relationship array of all basic access control policies in the policy management unit.

[0030] In some embodiments, the method further comprises the following steps:

[0031] In response to the policy management instruction of the policy management object, policy management is performed on the access control policy in the policy management unit.

[0032] In some embodiments, the request result includes a request success and a request failure; managing the access service rights of the access request according to the request result includes the following steps:

[0033] When the request result is successful, the access service permission of the access request initiated by the target application is set to allow access;

[0034] When the request result is a request failure, the access service permission of the access request initiated by the target application is set to deny access.

[0035] On the other hand, an embodiment of the present invention provides an access control analysis device, including:

[0036] The first module is used to obtain the access request initiated by the target application; transmit the access request to the policy conversion engine;

[0037] The second module is used to convert the access request into a standard quadruple through a policy conversion engine; transmit the standard quadruple to a policy execution unit; the standard quadruple includes a subject, an object, a resource and an action;

[0038] The third module is used to forward the standard quadruple to the policy decision unit through the policy execution unit;

[0039] The fourth module is used to perform policy matching in the policy management unit based on the standard four-tuple through the policy decision unit, determine the request result of the access request according to the result of the policy matching; return the request result to the policy execution unit; the policy management unit stores the preset access control policy;

[0040] The fifth module is used to manage the access service authority of the access request according to the request result through the policy execution unit.

[0041] In some embodiments, the apparatus further comprises:

[0042] The sixth module is used to perform policy management on the access control policy in the policy management unit in response to the policy management instruction of the policy management object.

[0043] On the other hand, an embodiment of the present invention provides an electronic device, including: a processor and a memory; the memory is used to store programs; the processor executes the program to implement the above-mentioned access control analysis method.

[0044] On the other hand, an embodiment of the present invention provides a computer storage medium, in which a program executable by a processor is stored. The program executable by the processor is used to implement the above-mentioned access control analysis method when executed by the processor.

[0045] On the other hand, an embodiment of the present invention provides a vehicle, which includes the above-mentioned access control analysis device or the above-mentioned electronic device.

[0046] The embodiment of the present invention obtains the access request initiated by the target application; transmits the access request to the policy conversion engine; converts the access request into a standard quadruple through the policy conversion engine; transmits the standard quadruple to the policy execution unit; the standard quadruple includes subject, object, resource and action; the standard quadruple is forwarded to the policy decision unit through the policy execution unit; the policy decision unit performs policy matching in the policy management unit based on the standard quadruple, and determines the request result of the access request according to the result of the policy matching; returns the request result to the policy execution unit; the policy management unit stores a preset access control policy; and the policy execution unit manages the access service authority of the access request according to the request result. The embodiment of the present invention implements an information security access control protection architecture based on SOA based on the policy conversion engine, the policy execution unit, the policy decision unit and the policy management unit. The embodiment of the present invention can improve the security of access control analysis and effectively realize information security access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The accompanying drawings are used to provide a further understanding of the technical solution of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the technical solution of the present invention and do not constitute a limitation on the technical solution of the present invention.

[0048] Figure 1 It is a schematic diagram of an implementation environment for performing access control analysis provided by an embodiment of the present invention;

[0049] Figure 2 It is a flowchart of an access control analysis method provided by an embodiment of the present invention;

[0050] Figure 3 A schematic diagram of an expanded flow of obtaining an access request initiated by a target application provided in an embodiment of the present invention;

[0051] Figure 4 A schematic diagram of the expansion process of the conversion standard quadruple provided in an embodiment of the present invention;

[0052] Figure 5 A schematic diagram of an expanded flow chart of determining a request result of an access request provided by an embodiment of the present invention;

[0053] Figure 6 A schematic diagram of the expansion process of traversal matching provided by an embodiment of the present invention;

[0054] Figure 7 A schematic diagram of the expansion process of managing access service rights for access requests provided by an embodiment of the present invention;

[0055] Figure 8 A schematic diagram of the overall architecture principle flow of access control analysis provided by an embodiment of the present invention;

[0056] Fig. 9 A schematic diagram of the structure of an access control analysis device provided by an embodiment of the present invention;

[0057] Fig.10 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0059] It should be noted that, although the functional modules are divided in the system schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system or the order in the flowchart. The terms "first / S100", "second / S200", etc. in the specification, claims and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0060] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0061] To facilitate the understanding of the technical solution of the present invention, the proprietary technical terms that may be applied in the technical solution of the present invention are first explained:

[0062] Access Control: Access control is the process of controlling access to resources by providing access to authorized subjects and preventing unauthorized access attempts.

[0063] SOA: Service-oriented architecture (SOA) is a component model that splits different functional units of an application (called services) and connects them through well-defined interfaces and protocols between these services. The interface is defined in a neutral way and should be independent of the hardware platform, operating system, and programming language that implements the service. This allows services built in a variety of systems to interact in a unified and universal way.

[0064] Subject: The subject is the active entity in the access operation, including all entities that can initiate access operations, such as people, processes, devices, etc. The subject is the initiator of the access and causes the flow of information or the change of system status.

[0065] Object: An object is a passive entity in an access operation. It is a resource that contains information or receives information and is passively accessed, such as files, devices, semaphores, network nodes, etc. In the flow of information, the object is under the control of the subject. Access to the object means access to the information contained in it.

[0066] Action: Action is the interactive way that information flows between subject and object, which is called "access mode" in some literature. Common actions include read, write, read / write and execute.

[0067] Permission (access right): whether the subject (s) is allowed to perform a certain action (a) on the object (o). If the subject can access it, it is allowed (pass); otherwise it is forbidden (deny). The concept of permission essentially describes a judgment on whether the subject has permission, which can be expressed by the function F as F(s,o,a) = {pass / deny} or F(s,o,a) = {1 / 0}. For example, in the Windows system, the user Alice (subject) with administrator privileges performs a modification (action) operation on the registry (object), and the access right = pass; the guest user Guest without administrator privileges performs a modification operation on the registry, and the access right = deny. Among them, the resource can be the object (o) itself (in this case, F is expressed as F(s,o,o,a)), or it can be a specific resource (r) required to perform the action (a) (in this case, F is expressed as F(s,o,r,a)).

[0068] Policy (access policy, access control policy): is a set of access rules for a subject to an object. This set of rules directly defines the subject's actions on the object and the object's conditional constraints on the subject. Policy embodies an authorization behavior, that is, the behavior of allowing a subject to be granted a set of privileges or (corresponding to privileges) security attributes.

[0069] Identifier: A symbol that uniquely represents the identity of an entity within a certain range. The main identifiers used in access control can be divided into subject identifiers, object identifiers, action identifiers, attribute identifiers, etc. The ability of access control to protect information resources comes from clearly defining the entire access operation process of "the subject performs a certain action on the object" and imposing restrictions on the process in some way. Therefore, whether the access control mechanism can be implemented correctly and whether it can meet the established security goals is closely related to the specific identification methods such as subjects, objects, and actions. Different identification methods also have their own advantages, disadvantages and focuses, which will have an important impact on access control strategies and specific implementation technologies.

[0070] Authorization: Authorization is the act of granting access rights to a subject. This definition contains at least two levels of meaning: ① the act of asserting that a subject can be granted a set of privileges or security attributes; ② the act of allowing the subject to access resources after determining that the subject has the corresponding access rights. The first level of meaning describes an authorization management behavior, which usually requires the participation of security administrators; while the second level of meaning describes an automated access control operation behavior, which is automatically implemented by the computer system.

[0071] Access control: refers to the process of explicitly allowing or restricting the user's access to data information and scope through some means after identifying the user's legal identity, preventing unauthorized access to resources, including preventing the use of resources in an unauthorized manner. When a subject makes a resource access request, the system must first confirm that it is a legitimate subject, not a fake deceiver, which is the process of identifying the subject (also called authentication). After the subject is authenticated, it will obtain a subject identifier to distinguish its identity. At this time, the system can determine whether the subject has the authority to perform access actions on the object based on the preset access control policy. This definition shows that the authorization management process often occurs before access control, and the former is the basis for the latter.

[0072] It is understandable that the access control analysis method provided in the embodiment of the present invention can be applied to any computer device with data processing and computing capabilities, and this computer device can be various types of terminals or servers. When the computer device in the embodiment is a server, the server is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. In some embodiments, the terminal is a smart phone, a tablet computer, a laptop computer, and a desktop computer, but is not limited to this.

[0073] like Figure 1 FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present invention. Figure 1 The implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be connected to a network wirelessly or wired to complete data transmission and exchange.

[0074] Server 101 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0075] In addition, the server 101 can also be a node server in the blockchain network. Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm.

[0076] The terminal 102 may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc. The terminal 102 may also be a vehicle-mounted terminal of various device types described above, but is not limited thereto. The terminal 102 and the server 101 may be directly or indirectly connected via wired or wireless communication, which is not limited in this embodiment of the present invention.

[0077] Based on the example Figure 1 In the implementation environment shown, an embodiment of the present invention provides an access control analysis method. The access control analysis method is applied to the server 101 as an example for explanation below. It can be understood that the access control analysis method can also be applied to the terminal 102.

[0078] Reference Figure 2 , Figure 2 The flowchart of the access control analysis method applied to the server provided by the embodiment of the present invention, the execution subject of the access control analysis method can be any of the aforementioned computer devices (including servers or terminals). Figure 2 , the method comprises the following steps:

[0079] S100, obtaining an access request initiated by a target application; transmitting the access request to a policy conversion engine;

[0080] It should be noted that in some embodiments, Figure 3As shown, obtaining the access request initiated by the target application may include the following steps: S101, receiving the access instruction input by the target object in the target application; S102, generating an access request to the passive entity according to the access instruction.

[0081] For example, in some specific implementations, first, a request for access to a service initiated by an application may be accepted, and then the request may be transmitted through a policy conversion engine.

[0082] S200, converting the access request into a standard quadruple through a policy conversion engine; transmitting the standard quadruple to a policy execution unit;

[0083] Among them, the standard quadruple includes subject, object, resource and action;

[0084] It should be noted that in some embodiments, Figure 4 As shown, the access request is converted into a standard quadruple through a policy conversion engine, including the following steps: S201, confirming the subject according to the initiating object of the access request; the initiating object includes the target application or the target object that inputs the access instruction in the target application; S202, determining the object according to the passive entity targeted by the access request; the passive entity includes at least one of a specified service, a specified resource, a specified device and a specified network node; S203, determining the action according to the interaction method between the initiating object and the passive entity preset in the access request; S204, determining the resource according to the expected access resource in the access request; the expected access resource includes the specified resource and / or the specific resource required for the interaction method.

[0085] Exemplarily, in some specific implementations, the access request is converted into a standard four-tuple, namely (subject; object; resource; action), by a policy conversion engine.

[0086] S300, forwarding the standard quadruple to the policy decision unit through the policy execution unit;

[0087] For example, in some specific implementations, after receiving the access control request, the policy execution unit forwards the processed message to the lower-level policy decision unit for execution. If access is allowed after processing, the corresponding access request operation is allowed to be executed.

[0088] S400, performing policy matching in the policy management unit based on the standard quadruple through the policy decision unit, determining the request result of the access request according to the result of the policy matching; and returning the request result to the policy execution unit;

[0089] Wherein, the policy management unit stores a preset access control policy;

[0090] It should be noted that the access control policy includes an array of relationships between entities and their allowed access resources and authorized actions; in some embodiments, such as Figure 5 As shown, policy matching is performed in the policy management unit based on the standard quadruple, and the request result of the access request is determined according to the result of the policy matching, which may include the following steps: S401, based on the association relationship among the subject, object, resource and action in the standard quadruple, traversing and matching the relationship array of all access control policies in the policy management unit; S402, when there is a relationship array with the same association relationship in the policy management unit, determining that the request result is a successful request; otherwise, determining that the request result is a failed request.

[0091] In some embodiments, the access control policy includes a basic access control policy and a dedicated access control policy; Figure 6 As shown, traversing and matching the relationship arrays of all access control policies in the policy management unit may include the following steps: S4011, determining whether the target application belongs to an exclusive application based on the application identifier of the target application; S4012, when the target application belongs to an exclusive application, performing a first traversal match on the relationship arrays of all exclusive access control policies in the policy management unit; S4013, when the target application does not belong to an exclusive application, or when there is no matching result in the first traversal match, performing a second traversal match on the relationship arrays of all basic access control policies in the policy management unit.

[0092] In some embodiments, the method may further include the following steps: performing policy management on the access control policy in the policy management unit in response to the policy management instruction of the policy management object.

[0093] For example, in some specific implementations, the policy decision unit provides access control functions for the on-board bus. The policy decision unit decides whether access to specific resources is allowed based on a local or distributed policy database (policy management unit). The policy decision unit decides which entities are allowed to access which resources based on the policy, and after making the decision, sends the result to the policy execution unit.

[0094] Specifically, the policy management unit stores policies in each control domain in a centralized or distributed manner, with the purpose of storing and distributing access control policies. The policy management unit contains at least two management policies: one is the basic access control policy, which provides platform-based general access control, and the other is the exclusive access control policy, which is a customized access control policy based on exclusive applications. The above access control policies are securely stored in the policy management unit in the form of standard quadruples, and the policies need to be prevented from being tampered with.

[0095] S500: managing the access service authority of the access request according to the request result through the policy execution unit.

[0096] It should be noted that the request result includes request success and request failure; in some embodiments, such as Figure 7 As shown, managing the access service permissions of access requests according to request results may include the following steps: S501. When the request result is a successful request, the access service permissions of the access request initiated by the target application are set to allow access; S502. When the request result is a failed request, the access service permissions of the access request initiated by the target application are set to deny access.

[0097] Exemplarily, in some specific implementations, the policy decision unit returns the request result to the policy execution unit; the policy execution unit allows or denies access to the service according to the feedback result.

[0098] In order to explain the principle of the technical solution of the present invention in detail, the overall process of the present invention is described below in combination with some specific embodiments. It is easy to understand that the following is an explanation of the technical principle of the present invention and cannot be regarded as a limitation of the present invention.

[0099] In view of the shortcomings of the existing technology, such as Figure 8 As shown, the present invention designs a method for controlling access to services based on SOA applications, which is mainly divided into a three-stage modular design, including a policy execution unit, a policy decision unit, and a policy management unit, for easy management and updating.

[0100] First, the application initiates an access request to the service. The request is converted into a standard four-tuple by the policy conversion engine, namely (subject; object; resource; action). After receiving the access control request, the policy execution unit forwards the processed message to the lower-level policy decision unit for execution. If access is allowed after processing, the corresponding access request operation is allowed to be executed.

[0101] Secondly, the policy decision unit provides access control for the on-board bus. The policy decision unit decides whether access to specific resources is allowed based on a local or distributed policy database (policy management unit). The policy decision unit decides which entities are allowed to access which resources based on the policy, and after making the decision, sends the result to the policy execution unit.

[0102] Finally, the policy management unit stores policies in each control domain in a centralized or distributed manner. Its purpose is to store and distribute access control policies. The policy management unit contains at least two management policies: one is the basic access control policy, which provides platform-based general access control, and the other is the exclusive access control policy, which is a customized access control policy based on exclusive applications. The above access control policies are securely stored in the policy management unit in the form of standard quadruples, and the policies need to be prevented from being tampered with.

[0103] The main process is described as follows:

[0104] 1. The application initiates a request to access the service;

[0105] 2. The request is converted into a four-tuple by the policy conversion engine;

[0106] 3. The policy execution unit submits the quadruple to the policy decision unit;

[0107] 4. The policy decision unit makes decisions based on the access control policies in the policy management unit. Unqueried requests are denied access by default.

[0108] 5. The access control policy is preset in the management unit and signed with SHA256-RSA3072. The private key of RSA3072 needs to be stored securely to prevent leakage of the private key.

[0109] 6. The policy decision unit returns the request result to the policy execution unit; the policy execution unit allows or denies access to the service based on the feedback result.

[0110] In summary, the present invention provides a method for analyzing and designing the missing standard for SOA-based vehicle information security access control protection in the development of intelligent connected vehicle information security. The method of the present invention is proposed to analyze and design a vehicle information security access control mechanism based on SOA. The purpose of the present invention is to propose an analysis and design method for vehicle information security access control based on SOA. The present invention makes up for the lack of an analysis method for vehicle information security access control based on SOA.

[0111] Specifically, the policy conversion engine, policy execution unit, policy decision unit, and policy management unit use a distributed access control solution; compared with centralized access control, centralized access control is not suitable for dealing with flexible and changeable application scenarios in the SOA architecture, and the distributed access control solution used in the present invention is suitable for updating and iterating access control policies. At the same time, the design of the access control policy of the present invention takes into account both general policies and exclusive policies, and proposes a protection solution for keys and policies, comprehensively considers security policies, and uses CRC verification technology to provide sufficient protection for access control policies.

[0112] On the other hand, Fig. 9 As shown, an embodiment of the present invention provides an access control analysis device 900, which may include:

[0113] The first module 901 is used to obtain an access request initiated by a target application and transmit the access request to a policy conversion engine;

[0114] The second module 902 is used to convert the access request into a standard quadruple through a policy conversion engine; transmit the standard quadruple to the policy execution unit; the standard quadruple includes a subject, an object, a resource and an action;

[0115] The third module 903 is used to forward the standard quadruple to the policy decision unit through the policy execution unit;

[0116] The fourth module 904 is used to perform policy matching in the policy management unit based on the standard four-tuple through the policy decision unit, determine the request result of the access request according to the result of the policy matching; return the request result to the policy execution unit; the policy management unit stores the preset access control policy;

[0117] The fifth module 905 is used to manage the access service authority of the access request according to the request result through the policy execution unit.

[0118] In some embodiments, the apparatus may further include:

[0119] The sixth module is used to perform policy management on the access control policy in the policy management unit in response to the policy management instruction of the policy management object.

[0120] The contents of the method embodiments of the present invention are all applicable to the device embodiments. The functions specifically implemented by the device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0121] On the other hand, an embodiment of the present invention further provides an electronic device, the electronic device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the access control analysis method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a vehicle-mounted computer, etc.

[0122] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0123] like Fig.10 As shown, Fig.10 The hardware structure of an electronic device 1000 of another embodiment is illustrated. The electronic device 1000 includes:

[0124] The processor 1001 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention.

[0125] The memory 1002 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1002 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1002, and the processor 1001 calls and executes the network node population optimization method of the embodiment of the present invention;

[0126] Input / output interface 1003, used to implement information input and output;

[0127] The communication interface 1004 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0128] A bus 1005 , which transmits information between various components of the device (e.g., the processor 1001 , the memory 1002 , the input / output interface 1003 , and the communication interface 1004 );

[0129] The processor 1001 , the memory 1002 , the input / output interface 1003 and the communication interface 1004 are connected to each other in communication within the device via the bus 1005 .

[0130] The electronic device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0131] The contents of the method embodiments of the present invention are all applicable to the electronic device embodiments. The functions specifically implemented by the electronic device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0132] Another aspect of an embodiment of the present invention further provides a computer-readable storage medium, wherein the storage medium stores a program, and the program is executed by a processor to implement the above method.

[0133] It should be noted that the computer-readable medium shown in the embodiment of the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (Compact Disc Read to Only Memory, CD to ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0134] The contents of the method embodiments of the present invention are all applicable to the computer-readable storage medium embodiments. The functions specifically implemented by the computer-readable storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0135] The embodiment of the present invention also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device can read the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the above method.

[0136] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0137] It should be noted that, although several modules of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0138] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD to ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation of the present invention.

[0139] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.

[0140] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified, one or more of the functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0141] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0142] The logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable instructions for implementing logical functions, and may be embodied in any computer-readable medium for use by an instruction execution device, apparatus or device (such as a computer-based device, a device including a processor, or other device that can fetch instructions from an instruction execution device, apparatus or device and execute the instructions), or in conjunction with such instruction execution device, apparatus or device. For purposes of this specification, "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution device, apparatus or device, or in conjunction with such instruction execution device, apparatus or device.

[0143] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0144] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution device. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0145] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0146] Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0147] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present invention.

Claims

1. An access control analysis method, characterized in that: The following steps are involved: Obtaining an access request initiated by a target application; transmitting the access request to a policy conversion engine; The access request is converted into a standard quadruple by the policy conversion engine; the standard quadruple is transmitted to the policy execution unit; the standard quadruple includes a subject, an object, a resource and an action; forwarding the standard quadruple to a policy decision unit through the policy execution unit; Performing policy matching in the policy management unit based on the standard quadruple through the policy decision unit, determining the request result of the access request according to the result of the policy matching; and returning the request result to the policy execution unit; The policy management unit stores a preset access control policy; The policy execution unit manages the access service authority of the access request according to the request result.

2. The access control analysis method according to claim 1, characterized in that: The step of obtaining the access request initiated by the target application comprises the following steps: receiving, at the target application, an access instruction input by a target object; The access request to the passive entity is generated according to the access instruction.

3. The access control analysis method according to claim 1, characterized in that: The step of converting the access request into a standard quadruple by the policy conversion engine comprises the following steps: Confirming the subject according to the initiating object of the access request; the initiating object includes the target application or the target object that inputs the access instruction in the target application; Determining the object according to a passive entity targeted by the access request; the passive entity includes at least one of a specified service, a specified resource, a specified device, and a specified network node; Determining the action according to the interaction mode between the initiating object and the passive entity preset in the access request; The resource is determined according to the expected access resource in the access request; the expected access resource includes the designated resource and / or the specific resource required by the interaction mode.

4. The access control analysis method according to claim 1, characterized in that: The access control policy includes an array of relationships between entities and resources they are allowed to access and authorized actions; performing policy matching in a policy management unit based on the standard quadruple and determining a request result of the access request according to the result of the policy matching include the following steps: Based on the association relationship among the subject, the object, the resource and the action in the standard quadruple, traversing and matching the relationship array of all the access control policies in the policy management unit; When the relationship array identical to the association relationship exists in the policy management unit, the request result is determined to be a successful request; otherwise, the request result is determined to be a failed request.

5. The access control analysis method according to claim 4, characterized in that: The access control policy includes a basic access control policy and an exclusive access control policy; the traversing and matching the relationship array of all the access control policies in the policy management unit includes the following steps: Determining whether the target application is a dedicated application according to the application identifier of the target application; When the target application belongs to the exclusive application, performing a first traversal match on the relationship array of all the exclusive access control policies in the policy management unit; When the target application does not belong to the dedicated application, or when the first traversal matching does not result in a match, a second traversal matching is performed on the relationship array of all the basic access control policies in the policy management unit.

6. The access control analysis method according to claim 1, characterized in that: The method further comprises the following steps: In response to the policy management instruction of the policy management object, policy management is performed on the access control policy in the policy management unit.

7. The access control analysis method according to claim 1, characterized in that: The request result includes a request success and a request failure; and managing the access service authority of the access request according to the request result includes the following steps: When the request result is that the request is successful, setting the access service permission of the access request initiated by the target application to allow access; When the request result is that the request fails, the access service authority of the access request initiated by the target application is set to deny access.

8. An access control analysis device, characterized in that: include: The first module is used to obtain the access request initiated by the target application; transmitting the access request to a policy conversion engine; The second module is used to convert the access request into a standard quadruple through the policy conversion engine; transmit the standard quadruple to the policy execution unit; the standard quadruple includes a subject, an object, a resource and an action; A third module is used to forward the standard quadruple to a policy decision unit through the policy execution unit; The fourth module is used to perform policy matching in the policy management unit based on the standard quadruple through the policy decision unit, determine the request result of the access request according to the result of the policy matching; return the request result to the policy execution unit; the policy management unit stores a preset access control policy; The fifth module is used to manage the access service authority of the access request according to the request result through the policy execution unit.

9. An electronic device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement the method according to any one of claims 1 to 7.

10. A vehicle, characterized in that: The vehicle includes the access control analysis device according to claim 8 or the electronic device according to claim 9.

Images