Security access control method, system, device, vehicle and medium based on soa

Abstract

The invention discloses an SOA-based security access control method, system and device, a vehicle and a medium, and relates to the technical field of vehicle software services. The system comprises a strategy execution unit, strategy decision units and a strategy management unit, the strategy decision units and the strategy management unit are distributed at different positions, the strategy execution unit receives a service access request from a client and converts the service access request into a preset standard tetrad form to obtain a request tetrad, the request tetrad comprises a subject, an object, a resource and an action, and the subject and the object are sent to the client. And forwarding the request tetrad to a policy decision unit corresponding to the object according to the request tetrad. And the strategy decision-making unit queries the resource control strategy stored in the strategy management unit according to the request quadruple to obtain a resource access control result. And the strategy execution unit performs service calling control according to the resource access control result so as to return a service request response to the client. According to the invention, the comprehensiveness and flexibility of vehicle-mounted information protection in the SOA architecture can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of vehicle software services, and in particular to a SOA-based security access control method, system, device, vehicle and medium. Background Art

[0002] In-vehicle SOA (Service-Oriented Architecture) is a software architecture design pattern widely used in the automotive industry. It aims to divide the automotive software system into a series of independent and reusable services. These services communicate and collaborate through well-defined interfaces and protocols to achieve high modularity, scalability and maintainability of the automotive software system. The SOA architecture itself does not provide security mechanisms such as access control, so devices connected to the in-vehicle Ethernet and applications running on it can access the SOA service interface provided by the architecture without authorization, which can easily lead to in-vehicle information leakage. At present, in order to improve the access security of the SOA architecture, the storage module is mainly used as the core to establish a four-stage computing model based on data partitioning service, daemon technology, Per module, access policy module, etc., and policy control is performed on data access in a single component of the storage module, but there is a lack of overall consideration and protection of the entire vehicle service request. Summary of the invention

[0003] The main purpose of the embodiments of the present application is to propose a SOA-based security access control system, method, device, vehicle and medium, aiming to improve the comprehensiveness and flexibility of vehicle-mounted information protection in the SOA architecture.

[0004] To achieve the above-mentioned purpose, an embodiment of the present application proposes a SOA-based security access control method, which is applied to a SOA-based security access control system. The SOA-based security access control system includes a policy execution unit, a policy decision unit and a policy management unit distributed in different locations. The security access control method applied to the policy execution unit includes the following steps:

[0005] Receive service access requests from clients;

[0006] Converting the service access request into a preset standard four-tuple form to obtain a request four-tuple, wherein the request four-tuple includes a subject, an object, a resource, and an action;

[0007] forwarding the request quadruple to a policy decision unit corresponding to the object according to the request quadruple, so as to receive a resource access control result from the policy decision unit;

[0008] Performing service call control according to the resource access control result to return a service request response to the client;

[0009] The policy decision unit is used to query the resource control policy stored in the policy management unit according to the request quadruple to obtain a resource access control result.

[0010] In some embodiments, converting the service access request into a standard four-tuple form to obtain a request four-tuple includes the following steps:

[0011] Parsing the service access request to obtain a request header, a resource locator, and a request body data;

[0012] Determine a subject in the request quad according to the request header, wherein the subject is used to represent a client requesting an in-vehicle service;

[0013] Determining the in-vehicle service to be called according to the resource locator;

[0014] Determine the resources in the request quad according to the associated resources of the in-vehicle service, and determine the objects in the request quad according to the distribution locations of the associated resources;

[0015] The action in the request quad is determined according to the interaction mode between the in-vehicle service and the associated resource.

[0016] In some embodiments, forwarding the request quadruple to a corresponding policy decision unit according to the request quadruple comprises the following steps:

[0017] authenticating the client that initiates the service access request according to the subject in the request quadruple;

[0018] When the client passes the identity authentication, the request quadruple is forwarded to the policy decision unit corresponding to the object;

[0019] When the client fails to pass the identity authentication, a request failure message is returned to the client.

[0020] In some embodiments, performing service call control according to the resource access control result to return a service request response to the client includes the following steps:

[0021] Determine whether the subject is allowed to access the resources in the request quad according to the resource access control result;

[0022] When the subject is allowed to access the resources in the request quadruple, the in-vehicle service is called according to the request body data to obtain feedback data of the in-vehicle service, and the feedback data is returned to the client as a service request response;

[0023] When the subject is not allowed to access the resources in the request quadruple, a request failure message is returned to the client as a service request response.

[0024] To achieve the above-mentioned purpose, another aspect of the embodiment of the present application proposes a SOA-based security access control method, which is applied to a SOA-based security access control system. The SOA-based security access control system includes a policy execution unit, a policy decision unit and a policy management unit distributed in different locations. The security access control method applied to the policy decision unit includes the following steps:

[0025] Receiving a request quadruple from the policy execution unit, wherein the request quadruple includes a subject, an object, a resource, and an action, wherein the request quadruple is obtained by the policy execution unit, the policy execution unit receives a service access request from a client, and converts the service access request into a preset standard quadruple form to obtain a request quadruple;

[0026] Querying the resource control policy stored in the policy management unit according to the request quadruple to obtain a resource access control result;

[0027] The resource access control result is sent to the policy execution unit, so that the policy execution unit performs service call control according to the resource access control result, so as to return a service request response to the client.

[0028] In some embodiments, the policy management unit uses a private key to store the resource control policy, and the resource control policy stored in the policy management unit includes at least one of a basic access control policy and an exclusive access control policy;

[0029] The querying of the resource control policy stored in the policy management unit according to the request quadruple to obtain a resource access control result comprises the following steps:

[0030] Determine the access role according to the subject in the request quadruple;

[0031] Select and query the basic access control policy or the exclusive access control policy in the policy management unit according to the access role.

[0032] To achieve the above-mentioned purpose, another aspect of the embodiment of the present application proposes a security access control system based on SOA, including a policy execution unit, a policy decision unit and a policy management unit distributed in different locations;

[0033] The policy execution unit is used to receive a service access request from a client; convert the service access request into a preset standard four-tuple form to obtain a request four-tuple, wherein the request four-tuple includes a subject, an object, a resource and an action;

[0034] forwarding the request quadruple to a policy decision unit corresponding to the object according to the request quadruple;

[0035] The policy decision unit is used to query the resource control policy stored in the policy management unit according to the request quadruple to obtain a resource access control result;

[0036] The policy execution unit is further used to receive the resource access control result from the policy decision unit, and perform service call control according to the resource access control result to return a service request response to the client.

[0037] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes an electronic device, which includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the SOA-based security access control method described in the above embodiment is implemented.

[0038] To achieve the above objectives, another aspect of an embodiment of the present application provides a vehicle, comprising the SOA-based security access control system or electronic device described in the above embodiment.

[0039] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes a storage medium, which is a computer-readable storage medium used for computer-readable storage, and the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the SOA-based security access control method described in the above embodiment.

[0040] The present application proposes a SOA-based security access control method, system, device, vehicle and medium. The system includes a policy execution unit, a policy decision unit and a policy management unit distributed in different locations. The policy execution unit receives a service access request from a client, converts the service access request into a preset standard four-tuple form to obtain a request four-tuple. The request four-tuple includes a subject, an object, a resource and an action. The request four-tuple is forwarded to the policy decision unit corresponding to the object according to the request four-tuple. The policy decision unit queries the resource control policy stored in the policy management unit according to the request four-tuple to obtain a resource access control result. The policy execution unit performs service call control according to the resource access control result to return a service request response to the client. The present application parses the access resources involved in the service access request in the policy execution unit to form a request four-tuple, and then performs resource access control by using a distributed access control scheme, thereby realizing service control in the policy execution unit and improving the comprehensiveness and flexibility of vehicle information protection in the SOA architecture. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 is a flow chart of a security access control method applied to a policy execution unit provided in an embodiment of the present application;

[0042] Figure 2 yes Figure 1 Flow chart of step S102 in FIG.

[0043] Figure 3 yes Figure 1 Flow chart of step S103 in FIG.

[0044] Figure 4 yes Figure 1 Flow chart of step S104 in FIG.

[0045] Figure 5 is a flowchart of a security access control method applied to a policy decision unit provided in an embodiment of the present application;

[0046] Figure 6 yes Figure 5 Flow chart of step S502 in FIG.

[0047] Figure 7 is a schematic diagram of a SOA-based security access control system provided in an embodiment of the present application;

[0048] Figure 8 It is a schematic diagram of the interaction of various units in the SOA-based security access control system provided by an embodiment of the present application;

[0049] Fig. 9 is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application;

[0050] Fig.10 It is a schematic diagram of the overall process of secure access control provided by an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0052] It should be noted that, although the functional modules are divided in the system schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0054] Service-oriented software architecture SOA, with its standardized service interface, loosely coupled service mechanism and composable and extensible service characteristics, has laid a solid framework foundation for the realization of "software-defined cars". Service-oriented software architecture SOA, with its standardized service interface, loosely coupled service mechanism and composable and extensible service characteristics, has provided a framework foundation for the realization of "software-defined cars". Vehicles are equipped with a universal domain controller designed based on SOA, which makes the vehicle have better scalability, good platform functions, flexible functional configuration and higher intelligence level. The domain control architecture divides the vehicle electrical system into several large functional blocks (such as air conditioning control, multimedia screen control, etc.) according to their functions. The attributes of each functional block are unified and the degree of functional coupling with other functional blocks is low. This functional block is called a control domain. The functional block uses a powerful multi-core central computer to replace the previous multiple distributed ECUs, mainly processing logical operations and instruction issuance. Sensors, actuators, nodes, etc. in the domain system are connected by hard wires, CAN, and LIN buses, and the communication between different domains is carried out by Ethernet with higher transmission performance and larger capacity as the backbone network to undertake information exchange tasks. Each sub-function in each control domain is designed as a service, and the implementation of the function is implemented in the domain controller where it is located. The implementation of each service may require the use of underlying hardware resources or storage data and other resources. Therefore, when service consumers access services, they need to consider the security access to resources such as vehicle information.

[0055] Based on this, the embodiments of the present application propose a SOA-based security access control system, method, device, vehicle and medium, which can comprehensively protect the in-vehicle information in the SOA architecture.

[0056] The SOA-based security access control method, system, device, vehicle and medium provided in the embodiments of the present application are specifically illustrated through the following embodiments. First, the SOA-based security access control method in the embodiments of the present application is described.

[0057] The SOA-based security access control method provided in the embodiment of the present application relates to the field of vehicle software service technology. The SOA-based security access control method provided in the embodiment of the present application can be applied to the terminal, can also be applied to the server side, and can also be software running in the terminal or the server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or it can be configured as a server cluster or distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements a SOA-based security access control method, etc., but is not limited to the above forms.

[0058] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0059] The SOA-based security access control method of the present application embodiment is applied to a SOA-based security access control system. Figure 7The system includes a policy execution unit, a policy decision unit and a policy management unit distributed in different locations. The policy execution unit can be distributed in a central server to interact with a client, receive and process service access requests from the client. The policy decision unit provides access control functions for the on-board bus. The policy decision module decides whether access to specific resources is allowed based on the policy management unit, that is, which entities are allowed to access which resources according to the policy, and sends the result to the policy execution unit after making a decision. Policy decision units are distributed in each control domain (i.e., domain controller) to query the policy in the corresponding policy management unit according to the request quadruple. The policy management unit can be in each control domain (i.e., domain controller) in a centralized or distributed manner. When the policy management unit is set in a centralized manner, the policy management unit stores the source access policy of the entire vehicle. When the policy management unit is distributed in each control domain in a distributed manner, each policy management unit is used to store the resource access policy in the corresponding control domain.

[0060] Based on the above security access control system, please refer to Figure 1 The security access control method applied to the above-mentioned policy execution unit may include but is not limited to steps S101 to S105:

[0061] Step S101, receiving a service access request from a client;

[0062] Step S102, converting the service access request into a preset standard four-tuple form to obtain a request four-tuple, wherein the request four-tuple includes a subject, an object, a resource, and an action;

[0063] Step S103, forwarding the request quadruple to the policy decision unit corresponding to the object according to the request quadruple, so as to receive the resource access control result from the policy decision unit;

[0064] Step S104: performing service call control according to the resource access control result to return a service request response to the client.

[0065] In this embodiment, the client can be an upper-layer application. When the upper-layer application needs to implement certain functions, it can be implemented by calling the vehicle service. At this time, the upper-layer application, as the client, sends a service access request, i.e., a service call request, to the policy execution unit of the server. The policy execution unit includes a policy conversion engine. The policy conversion engine pre-stores a standard four-tuple format, such as (subject; object; resource; action). After receiving the service access request, the policy conversion engine uses the preset standard four-tuple to convert the service access request into a request four-tuple. Among them, the meaning of each element in the request four-tuple, i.e., the standard four-tuple format, is explained as follows:

[0066] The subject is the active entity in the access operation, including all entities that can initiate access operations, such as people, processes, devices, applications, etc. The subject is the initiator of the access and causes the flow of information or the change of the system state. In this embodiment, the subject of the request quadruple can be the identity representation of the client.

[0067] The object is a passive entity in the access operation, and is a resource that contains information or receives information and passively accepts access, such as files, devices, semaphores, network nodes, etc. The subject's access to the object means access to the information contained therein. In this embodiment, the object of the request quadruple can be the control domain where the associated resources of the in-vehicle service to be called by the client are located. It can be understood that the implementation of the in-vehicle service function may need to rely on other services, business data, and hardware implementation, which can be understood as the associated resources of the in-vehicle service, and the service to be called itself is also a resource. The associated resources may be distributed on the control domain where the in-vehicle service is located, or may be distributed on other control domains. Therefore, the control domain indicated by the object can be one or more.

[0068] Resources refer to the resources that the in-vehicle service functions rely on, that is, the associated resources of the above-mentioned in-vehicle services.

[0069] Actions are interactions in which information flows between subjects and objects, such as read, write, read / write, and execute.

[0070] Furthermore, the policy execution unit can encrypt the request quadruple and forward it to the policy decision unit of the control domain indicated by the object. By converting the request into a quadruple form, the security of the data in the interaction process is ensured. The policy decision unit determines whether the subject has the authority to access the relevant resources by querying the local resource access control policy, and then returns the resource access control result to the policy execution unit. The policy execution unit executes service access or denies service access according to the resource access control result.

[0071] See also Figure 2 In some embodiments, step S102 may include but is not limited to steps S201 to S205:

[0072] Step S201, parsing the service access request to obtain the request header, resource locator and request body data;

[0073] Step S202, determining a subject in the request quadruple according to the request header, wherein the subject is used to represent the client requesting the in-vehicle service;

[0074] Step S203, determining the in-vehicle service to be called according to the resource locator;

[0075] Step S204, determining resources in the request quad according to the associated resources of the in-vehicle service, and determining objects in the request quad according to the distribution locations of the associated resources;

[0076] Step S205 : determining the action in the request quadruple according to the interaction mode between the in-vehicle service and the associated resources.

[0077] In this embodiment, the interaction method between the client and the server can be a current universal protocol, such as the http protocol. The policy conversion engine parses the service access request to obtain the request header, resource locator and request body data. The request header contains user identity information, so the main content in the request quad can be determined based on the request header. The resource locator contains the location path of the service to be accessed, and the in-vehicle service that the client needs to access can be determined based on the location path indicated by the resource locator. The associated resources of the in-vehicle service can be determined through the in-vehicle service function, and the object in the request quad can be determined by querying according to the distribution location of the associated resources (that is, the control domain where each resource is located). At the same time, the action in the request quad is determined according to the interaction method between the in-vehicle service and the associated resources.

[0078] See also Figure 3 In some embodiments, step S103 may include but is not limited to steps S301 to S303:

[0079] Step S301, authenticating the client that initiates the service access request according to the subject in the request quadruple;

[0080] Step S302: When the client passes the identity authentication, the request quadruple is forwarded to the policy decision unit corresponding to the object;

[0081] Step S303: When the client fails to pass the identity authentication, a request failure message is returned to the client.

[0082] In this embodiment, after the policy conversion engine converts the service access request into a request quad, the policy execution unit can authenticate the client that initiates the service access request based on the main content in the request quad. If the client's identity information is authenticated by the server and stored in the server, it can be determined that the client has passed the identity authentication. Otherwise, it has failed the identity authentication. When the client passes the identity authentication, the request quad is forwarded to the policy decision unit corresponding to the object to perform subsequent resource access control processes. When the client fails the identity authentication, a request failure message is returned to the client to reject the client's service access request. This embodiment can improve the security of vehicle data by authenticating the client.

[0083] See also Figure 4In some embodiments, step S104 may include but is not limited to steps S401 to S404:

[0084] Step S401, judging whether the subject is allowed to access the resources in the request quad according to the resource access control result;

[0085] Step S402, when the subject is allowed to access the resources in the request quadruple, the vehicle service is called according to the request body data to obtain feedback data of the vehicle service, and the feedback data is returned to the client as a service request response;

[0086] Step S403: When the subject is not allowed to access the resources in the request quadruple, a request failure message is returned to the client as a service request response.

[0087] In this embodiment, after the policy execution unit receives the resource access control result from the policy decision unit, it can determine whether the subject is allowed to access the resources in the request quadruple according to the resource access control result. Specifically, it can be to integrate the resource access control results of each policy decision unit to determine whether the subject is allowed to access all resources indicated in the request quadruple. When the subject is allowed to access the resources in the request quadruple, indicating that the client has the calling authority of the target vehicle service, the calling parameters are determined according to the request body data in the service access request, and the vehicle service is called using the calling parameters to obtain the feedback data of the vehicle service, and the feedback data is returned to the client as a service request response, and the client successfully accesses the service. When the subject is not allowed to access the resources in the request quadruple, indicating that the client does not have the calling authority of the target vehicle service, a request failure message is returned to the client as a service request response, and the client fails to access the service. This embodiment improves the comprehensiveness of vehicle information protection during service provision by comprehensively analyzing the associated resources of the vehicle service and performing comprehensive resource access control in a distributed manner.

[0088] Based on the above security access control system, please refer to Figure 5 The security access control method applied to the above-mentioned policy decision unit may include but is not limited to steps S501 to S503:

[0089] Step S501, receiving a request quadruple from a policy execution unit, wherein the request quadruple includes a subject, an object, a resource, and an action, wherein the request quadruple is obtained by the policy execution unit, the policy execution unit receives a service access request from a client, and converts the service access request into a preset standard quadruple form to obtain the request quadruple;

[0090] Step S502, querying the resource control policy stored in the policy management unit according to the request quadruple to obtain a resource access control result;

[0091] Step S503: Send the resource access control result to the policy execution unit, so that the policy execution unit performs service call control according to the resource access control result to return a service request response to the client.

[0092] In this embodiment, after receiving the request quad from the policy execution unit, the policy decision unit queries the resource access control policy of the subject stored in the database through the policy management unit for the subject indicated in the request resource quad, so as to determine whether the subject has the access right to the resource indicated in the request quad, and generates a resource access control result according to the query result, and returns the resource access control result to the policy execution unit. The resource access control result indicates whether the subject is allowed to access the relevant resources or not.

[0093] In this embodiment, the policy management unit is built on the database to manage and update the stored resource access control policy, which is used to indicate the scope of resources that the subject can access. The resource access control policy can be securely stored in the policy management unit in the form of a standard quadruple, and the resource access control policy is securely protected by a private key to prevent the policy from being tampered with. For example, the resource access control policy is signed and protected using SHA256-RSA3072 in the policy management unit, where the private key of RSA3072 can be encrypted for secure storage to prevent private key leakage.

[0094] In this embodiment, the resource control policy stored in the policy management unit includes at least one of a basic access control policy and a dedicated access control policy. The basic access control policy provides a platform-based universal access control, and the dedicated access control policy is based on a customized access control policy for a dedicated application.

[0095] See also Figure 6 In some embodiments, step 502 may include but is not limited to steps S601 to S602:

[0096] Step S601, determining the access role according to the subject in the request quadruple;

[0097] Step S602: Select a basic access control policy or a dedicated access control policy in a query policy management unit according to the access role.

[0098] In this embodiment, users can be divided into roles, specifically into two types of roles. One type corresponds to common roles, and a basic access control policy can be used to determine the scope of resources that this type of role can access. Generally, most users belong to this type of role. The other type corresponds to an exclusive customized role, which adopts an exclusive access control policy different from other roles. The policy management unit stores exclusive access control policies corresponding to different roles. After receiving the request quadruple, the policy decision unit determines the corresponding access role according to the subject therein. If the access role is a common role, the basic access control policy in the query policy management unit is selected to determine whether it can access the resources specified by the quadruple; if the access role is an exclusive customized role, the exclusive access control policy corresponding to the role in the query policy management unit is selected to determine whether it can access the resources specified by the quadruple.

[0099] According to some embodiments of this application, please refer to Fig.10 , the overall process of secure access control in the embodiment of the present application is described as follows:

[0100] S1, the client application initiates a service access request;

[0101] S2, the server-side policy execution unit converts the service access request into a four-tuple form to obtain a request four-tuple, and forwards the request four-tuple to the server-side policy decision unit;

[0102] S3, the server-side policy decision unit queries the policy management unit according to the request quadruple to determine the resource access control result, and returns the resource access control result to the server-side policy execution unit;

[0103] S4, the server-side policy execution unit performs service access control according to the resource access control result. When the resource access control result indicates that the subject is allowed to access the resources in the request quadruple, the in-vehicle service indicated in the service access request is called to obtain feedback data; when the resource access control result indicates that the subject is not allowed to access the resources in the request quadruple, a request failure message is generated;

[0104] S5, the server-side policy execution unit takes the feedback data or the request failure message as the request response, and returns the request response to the client.

[0105] See also Figure 7 , the embodiment of the present application also provides a security access control system based on SOA, including a policy execution unit, a policy decision unit and a policy management unit distributed in different locations;

[0106] The policy execution unit is used to receive a service access request from a client; convert the service access request into a preset standard four-tuple form to obtain a request four-tuple, wherein the request four-tuple includes a subject, an object, a resource and an action;

[0107] forwarding the request quadruple to the policy decision unit corresponding to the object according to the request quadruple;

[0108] The policy decision unit is used to query the resource control policy stored in the policy management unit according to the request quadruple to obtain the resource access control result;

[0109] The policy execution unit is also used to receive the resource access control result from the policy decision unit, and perform service call control according to the resource access control result to return a service request response to the client.

[0110] In this embodiment, please refer to Figure 8 ,The interaction process of each unit in the SOA-based security access control system is as follows:

[0111] The application initiates a service access request, which is converted into a request quadruple by the policy conversion engine. The policy execution unit submits the request quadruple to the policy decision unit. The policy decision unit makes a decision based on the resource access control policy in the policy management unit. Requests that are not queried are denied access by default. The policy decision unit returns the resource access control result to the policy execution unit. The policy execution unit allows the invocation of the in-vehicle service or denies access to the service based on the resource access control result.

[0112] It can be understood that the contents of the above method embodiments are all applicable to the present system embodiments, the functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0113] The embodiment of the present application also provides an electronic device, the electronic device comprising: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, and the program is executed by the processor to realize the above-mentioned SOA-based security access control method. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0114] See also Fig. 9 , Fig. 9 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0115] The processor 901 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0116] The memory 902 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store an operating system and other applications. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 902, and the processor 901 calls and executes the SOA-based security access control method of the embodiment of this application;

[0117] Input / output interface 903, used to implement information input and output;

[0118] Communication interface 904, used to realize communication interaction between the device and other devices, which can be realized by wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0119] A bus 905 that transmits information between various components of the device (e.g., the processor 901, the memory 902, the input / output interface 903, and the communication interface 904);

[0120] The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0121] The embodiment of the present application also provides a vehicle, which includes the above-mentioned SOA-based security access control system or the electric drive assembly of the electronic device. Specifically, the vehicle can be a private car, such as a sedan, SUV, MPV or pickup truck. The vehicle can also be an operating vehicle, such as a van, bus, small truck or large trailer. The vehicle can be a gasoline vehicle or a new energy vehicle. When the vehicle is a new energy vehicle, it can be a hybrid vehicle or a pure electric vehicle.

[0122] An embodiment of the present application also provides a storage medium, which is a computer-readable storage medium used for computer-readable storage. The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned SOA-based security access control method.

[0123] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0124] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0125] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0126] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0127] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0128] In the several embodiments provided in the present application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the above modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, systems or units, which can be electrical, mechanical or other forms.

[0129] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0130] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0131] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0132] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A security access control method based on SOA, characterized in that: Applied to a SOA-based security access control system, the SOA-based security access control system includes a policy execution unit, a policy decision unit and a policy management unit distributed in different locations, and the security access control method applied to the policy execution unit includes the following steps: Receive service access requests from clients; Converting the service access request into a preset standard four-tuple form to obtain a request four-tuple, wherein the request four-tuple includes a subject, an object, a resource, and an action; forwarding the request quadruple to a policy decision unit corresponding to the object according to the request quadruple, so as to receive a resource access control result from the policy decision unit; Performing service call control according to the resource access control result to return a service request response to the client; The policy decision unit is used to query the resource control policy stored in the policy management unit according to the request quadruple to obtain a resource access control result.

2. The SOA-based security access control method according to claim 1, characterized in that: The step of converting the service access request into a standard four-tuple form to obtain a request four-tuple includes the following steps: Parsing the service access request to obtain a request header, a resource locator, and a request body data; Determine a subject in the request quad according to the request header, wherein the subject is used to represent a client requesting an in-vehicle service; Determining the in-vehicle service to be called according to the resource locator; Determine the resources in the request quad according to the associated resources of the in-vehicle service, and determine the objects in the request quad according to the distribution locations of the associated resources; The action in the request quadruple is determined according to the interaction mode between the in-vehicle service and the associated resource.

3. The SOA-based security access control method according to claim 2 is characterized in that: The step of forwarding the request quadruple to a corresponding policy decision unit according to the request quadruple comprises the following steps: authenticating the client that initiates the service access request according to the subject in the request quadruple; When the client passes the identity authentication, the request quadruple is forwarded to the policy decision unit corresponding to the object; When the client fails to pass the identity authentication, a request failure message is returned to the client.

4. The SOA-based security access control method according to claim 3 is characterized in that: The performing service call control according to the resource access control result to return a service request response to the client comprises the following steps: Determine whether the subject is allowed to access the resources in the request quad according to the resource access control result; When the subject is allowed to access the resources in the request quadruple, the in-vehicle service is called according to the request body data to obtain feedback data of the in-vehicle service, and the feedback data is returned to the client as a service request response; When the subject is not allowed to access the resources in the request quadruple, a request failure message is returned to the client as a service request response.

5. A security access control method based on SOA, characterized in that: Applied to a SOA-based security access control system, the SOA-based security access control system includes a policy execution unit, a policy decision unit and a policy management unit distributed in different locations, and the security access control method applied to the policy decision unit includes the following steps: Receiving a request quadruple from the policy execution unit, wherein the request quadruple includes a subject, an object, a resource, and an action, wherein the request quadruple is obtained by the policy execution unit, the policy execution unit receives a service access request from a client, and converts the service access request into a preset standard quadruple form to obtain a request quadruple; Querying the resource control policy stored in the policy management unit according to the request quadruple to obtain a resource access control result; The resource access control result is sent to the policy execution unit, so that the policy execution unit performs service call control according to the resource access control result, so as to return a service request response to the client.

6. The SOA-based security access control method according to claim 5, characterized in that: The policy management unit uses a private key to store the resource control policy, and the resource control policy stored in the policy management unit includes at least one of a basic access control policy and an exclusive access control policy; The querying of the resource control policy stored in the policy management unit according to the request quadruple to obtain a resource access control result comprises the following steps: Determine the access role according to the subject in the request quadruple; Select and query the basic access control policy or the exclusive access control policy in the policy management unit according to the access role.

7. A security access control system based on SOA, characterized in that: It includes a policy execution unit, a policy decision unit and a policy management unit distributed in different locations; The policy execution unit is used to receive a service access request from a client; convert the service access request into a preset standard quadruple form to obtain a request quadruple, wherein the request quadruple includes a subject, an object, a resource, and an action; and forward the request quadruple to a policy decision unit corresponding to the object according to the request quadruple; The policy decision unit is used to query the resource control policy stored in the policy management unit according to the request quadruple to obtain a resource access control result; The policy execution unit is further used to receive the resource access control result from the policy decision unit, and perform service call control according to the resource access control result to return a service request response to the client.

8. An electronic device, characterized in that: The electronic device includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the steps of the SOA-based security access control method as described in any one of claims 1 to 6 are realized.

9. A vehicle, characterized in that: It includes the SOA-based security access control system as claimed in claim 7 or the electronic device as claimed in claim 8.

10. A computer storage medium, the storage medium being a computer-readable storage medium, used for computer-readable storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the SOA-based security access control method according to any one of claims 1 to 6.

Images