A dynamic access control method and system

Abstract

The present invention discloses a dynamic access control method and system, which relate to the field of industrial Internet security, including a service provision interface, a Client Puzzle computing power screening module, an access processing module and a blockchain transaction module; the service provision interface includes an access mode recognition contract APRC(), an access monitoring service and a computing power screening execution contract ASEC(); the access processing module includes a permission revocation contract PREC(), an initial access processing contract FAPC() and a repeated access processing contract RAPC(); the computing power screening module includes a computing power screening execution contract ASEC(), a puzzle generation contract PuzzleGenc() and a solution verification contract PAnswerVC(); a blockchain transaction module, wherein the blockchain transaction module stores data in a blockchain in the form of a blockchain transaction, ensuring that higher efficiency and better flexibility can be achieved when processing repeated access problems of access subjects.

Description

Technical Field

[0001] The present invention relates to the field of industrial Internet security, and in particular to a dynamic access control method and system. Background Art

[0002] With the rapid development of emerging information science and technologies such as mobile Internet, Internet of Things, cloud computing and big data, the existing industrial development model is gradually changing from the traditional manual management and operation model to an intelligent industrial manufacturing model that integrates innovative development with emerging information science and technologies.

[0003] At present, the industrial Internet model combined with cloud computing technology is the key development and research target and field of the industry and academia, and the industrial Internet cloud service model based on "cloud integration" is the hottest topic in current research and development. Compared with the traditional industrial Internet cloud service model based on "cloud separation", the industrial Internet cloud service model based on "cloud integration" can not only ensure the real-time and accuracy of the industrial manufacturing decision-making and control process, but also can perceive the characteristics and status of the production entities in the industrial manufacturing process vertically and horizontally, so that resource users can transparently and efficiently use the computing resources, network resources, storage resources, user resources and data resources of the industrial cloud and terminals, and realize a more flexible, networked and intelligent industrial manufacturing process.

[0004] Therefore, there is an urgent need for a dynamic access control system to solve the above problems. Summary of the invention

[0005] To solve the above problems, the present application provides a dynamic access control system, including a service provision interface, a Client Puzzle computing power screening module, an access processing module and a blockchain transaction module;

[0006] The service provision interface includes access mode recognition contract APRC(), access monitoring service and computing power screening execution contract ASEC();

[0007] Preferably, the contract APRC() is a functional smart contract that provides access control services to the access subject AS, and is also a service provision interface of the access processing module;

[0008] The access monitoring service is to monitor the operation behavior of the access subject AS after successfully accessing the access object AO, and dynamically manage the access permission of AS according to the operation behavior and attribute changes of AS;

[0009] The contract ASEC () is a functional smart contract that provides computing power screening services to AS, and is also the service provider interface of the computing power screening module.

[0010] The access processing module includes the permission revocation contract PREC (), the initial access processing contract FAPC () and the repeated access processing contract RAPC ();

[0011] Preferably, the contract PREC() is a functional smart contract that provides access permission management services to the Permission Administrator (PA);

[0012] Contract FAPC() is a smart contract that provides access control services to the AS that initiates the initial request to access the AO;

[0013] Contract RAPC() is a smart contract that provides access control transactions to ASs that repeatedly make requests to access AOs.

[0014] The computing power screening module includes the computing power screening execution contract ASEC(), the puzzle generation contract PuzzleGenc() and the solution verification contract PAnswerVC();

[0015] Preferably, ASEC() is an interface for AS to interact with the blockchain network, providing computing power screening services for AS that accesses AO for the first time, so that AS is qualified to initiate the initial access request through the computing power screening results obtained by the service;

[0016] PuzzleGenc() is a smart contract that provides puzzle generation services. IP AS and MAC AS To generate the puzzle PuzzleAO that uniquely identifies AS;

[0017] PAnswerVC() verifies the timeliness and completeness of the answer PuzzleAS obtained when the AS solves the puzzle input by ASEC(), and then responds the verification result to AS.

[0018] Preferably, the computing power screening module includes a computing power screening algorithm AAFS-CP based on Client Puzzle;

[0019] The AAFS-CP consists of a six-tuple ACPSetup(),APuzzleGen(),APuzzleSolve(),APAnswerV(), , The composition setting has constraints, where is a one-way hash function, Is the signature verification function.

[0020] Preferably, the constraints are as follows:

[0021] The effective computing power test answer of AAFS-CP is the one solved by AS within the target time;

[0022] AAFS-CP sets target time and target computing power cost when constructing and verifying puzzles;

[0023] There is a preset difficulty threshold, and questions exceeding the difficulty threshold are answered through AS;

[0024] AAFS-CP can adjust the difficulty of the generated puzzles;

[0025] AS cannot predict the answers to difficult questions;

[0026] AAFS-CP can verify the answers to the puzzles solved by AS without storing relevant information of the puzzles;

[0027] A puzzle generated by AAFS-CP corresponds to a unique identifier of an AS.

[0028] A blockchain transaction module stores data in the blockchain in the form of blockchain transactions, wherein the data includes access identification filter AIF data, access restriction filter ARF data, access attributes and access policy data.

[0029] Preferably, the access identification filter AIF consists of a fingerprint extraction algorithm fex(), a hash function hash() and n buckets, wherein each bucket has m insertion slots;

[0030] The unit storage content structure of each AIF insertion slot is a multi-content fingerprint label consisting of a MAC address fingerprint MACF, an access identification Token fingerprint TokenF, and an access admission time EPT—an access identification fingerprint label AIFT.

[0031] Wherein, MACF is the MAC address of AS obtained by fingerprint extraction algorithm fex();

[0032] TokenF is the legal access identification TokenAIT of AS obtained by the fex() algorithm;

[0033] EPT is the time when TokenF is generated, and this time is the only basis for determining whether AIT is expired or invalid;

[0034] AIT is composed of the IP address of AS IP AS 、MAC address MACAS , Access code ACC AS , Access Subject Type AOT AS and access verification code APC AS composition;

[0035] in, IP AS and MAC AS It is the subject information provided by AS to AO when it first accesses AO.

[0036] ACC AS The access code granted to the AS after the AO manually reviews the AS's situation. That is, the AS can only initiate repeated access with this access code;

[0037] AOT AS An identification code to distinguish the AS type;

[0038] APC AS It is the verification code of AIT, used to verify the validity of AIT.

[0039] Preferably, the access restriction filter ARF consists of a fingerprint extraction algorithm fex(), a hash function hash() and n buckets, wherein each bucket has m insertion slots;

[0040] The unit storage content structure of each insertion slot in the ARF is a multi-content fingerprint label consisting of a MAC address fingerprint MACF and a restricted access approval time LAAT - a restricted access fingerprint label ARFT;

[0041] Wherein, MACF is the MAC address of AS obtained by the fingerprint extraction algorithm fex();

[0042] LAAT means AO determines the MAC address is MAC AS The AS cannot apply for the system time when accessing AO again.

[0043] The present invention also provides a dynamic access control method. INC PA = NULL, the access processing module runs the following steps:

[0044] S1. When the parameters input by the access mode identification contract APRC() are INC PA , AIT AS ,MAC AS When INC PA =0, jump to S2;

[0045] like INC PA =1, jump to S3;

[0046] Otherwise, respond to APRC() with the execution result and end;

[0047] S2. Call the access identification fingerprint tag deletion algorithm AIFT_Del () and enter the parameters AIT AS and MAC AS To delete the ATFT corresponding to AS in AIF AS operation, when AIFT_Del ( AIT AS , MAC AS )After the execution is completed, respond to APRC () with the execution result and end;

[0048] S3. Call the algorithm for adding restricted access fingerprint tags ARFT_Add () and enter the parameters MAC AS To perform the operation of adding the ARFTAS corresponding to the access information of the AS restricted from accessing the AO to the ARF;

[0049] when ARFT_Add ()After execution, call AIFT_Del () and enter the parameters AIT AS and MAC AS To delete the ATFT corresponding to AS in AIF AS operation; finally, when AIFT_Del After () is executed, it responds to APRC () with the execution result and ends.

[0050] Preferably, when INC PA ==NULL, the access processing module runs the following steps:

[0051] Step 1: The access processing module receives the request initiator and sends a NAR containing the parameters to the system. AS , INC PA , IP AS , MAC AS , ACCAS , AIT AS and CheckResult Puzzle Requests;

[0052] Step 2. According to the parameters MAC AS Request ARF to determine whether the object AS of the request initiator is an object with restricted access to AO: If the ARF response result shows that AS is an object with restricted access to AO, then reject AS's access request and end; otherwise, jump to step 3;

[0053] Step 3. According to the parameters MAC AS Request AIF to determine whether AS is qualified to initiate repeated access requests: If the AIF response result shows that AS is qualified to initiate repeated access requests, jump to step 4; otherwise, jump to step 10;

[0054] Step 4. Determine the parameters ACC AS Is it NULL: If ACC AS ==NULL, then reject the access request of AS this time and end; otherwise, jump to step 5;

[0055] Step 5. The access processing module requests the AS from the AIF. AIFT AS After AIF responds to the access processing module AIFT AS ,check AIFT AS Timeliness: If AIFT AS If the timeliness test is passed, jump to step 6; otherwise, jump to step 10;

[0056] Step 6. According to the parameters PrK AO , IP AS , MAC AS , ACC AS and REI AS . AOT AS check AIFT AS Completeness: If AIFT AS If the integrity check is passed, jump to step 7;

[0057] Otherwise, reject the access request of AS and end;

[0058] Step 7. According to the parameter NAR AS Evaluate and decide whether the AS can be granted access permission this time: If NAR AS If the authorization evaluation decision is passed, jump to step 8;

[0059] Otherwise, reject the access request of AS and end;

[0060] Step 8. When the access request initiated by the AS is an initial access request, jump to step 9; when the access request initiated by the AS is a repeated access request, and AIFT AS If the validity check is passed, the AS access permission is granted and the process ends; otherwise, the AS access permission is granted and an update request is made to AIF. AIFT AS The EPT ends to maintain its timeliness;

[0061] Step 9. The access processing module initiates a request to the PA to review the AS access information, and waits for the PA to respond with the review result. ACC AS After that, judge ACC AS Is it false: If ACC AS ==false, it means that the access information of AS has not passed the review, and the access request of AS is rejected at this time, and the process ends; otherwise, the access permission of AS is granted and the AS is responded to. ACC AS , and at the same time, add the access information of the AS to the AIF request, thereby ensuring that it is qualified to initiate repeated access requests in the future, and then end;

[0062] Step 10. Determine whether the AS submitted parameters when initiating the access request CheckResult Puzzle : If the AS does not submit parameters CheckResult Puzzle , then reject the access request of AS this time, and end; otherwise, jump to step 11;

[0063] Step 11. Verification CheckResult Puzzle Whether it satisfies completeness: If CheckResult Puzzle If the integrity check fails, the AS's access request will be rejected and the AIF will be requested to delete the access request. AIFT AS, end; otherwise, when the access request initiated by the AS is an initial access request, jump to step 7; and when the access request initiated by the AS is a repeated access request, jump to step 6.

[0064] Preferably, the access processing module satisfies the following conditions when processing the access request of the AS:

[0065] For ASs that are accessed for the first time but have not yet accessed AO, after applying for access, such objects not only need to meet the access conditions of AO, but also need to pass the manual review of the AO administrator after initially obtaining access rights before they can be formally authorized and access AO.

[0066] For ASs that have been connected to AO, when such objects repeatedly access AO, it is first necessary to verify whether they are ASs that have passed the review and been authorized to access in the early stage, and whether the AS is an expired AS that has not been accessed for a long time. Then, on this basis, it is decided whether it meets the access control decision.

[0067] The AS that is added to the prohibited access list by the AO cannot apply for new access rights.

[0068] In summary, compared with traditional technologies, the dynamic access control method and system of the present invention combines the fine-grained, dynamic, decision-making continuity and attribute variability of usage control (Usage Control, UCON) with the ability of Client Puzzle algorithm to screen and prove the computing power of devices, thereby constructing a dynamic access control model based on UCON to ensure higher efficiency and better flexibility when dealing with repeated access problems of access subjects.

[0069] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 A framework diagram of a dynamic access control system of the present invention;

[0071] Figure 2 A dynamic access control method of the present invention is INC PA When !=NULL, access the operation diagram of the access processing module. DETAILED DESCRIPTION

[0072] The technical solution of the present invention is further described below by means of the accompanying drawings and embodiments. It should be noted that unless otherwise specifically stated, the relative arrangement of components and steps, numerical expressions and numerical values ​​described in these embodiments do not limit the scope of the present application.

[0073] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present application, its application, or uses.

[0074] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered part of the specification.

[0075] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not limiting. Therefore, other examples of the exemplary embodiments may have different values.

[0076] Unless otherwise defined, technical or scientific terms used in the present invention shall have the common meanings understood by one having ordinary skills in the field to which the present invention belongs.

[0077] like Figure 1 As shown, the present invention provides a dynamic access control system, including a service provision interface, a Client Puzzle computing power screening module, an access processing module and a blockchain transaction module;

[0078] The service provision interface includes access mode recognition contract APRC(), access monitoring service and computing power screening execution contract ASEC();

[0079] The access processing module includes the permission revocation contract PREC (), the initial access processing contract FAPC () and the repeated access processing contract RAPC ();

[0080] The computing power screening module includes the computing power screening execution contract ASEC(), the puzzle generation contract PuzzleGenc() and the solution verification contract PAnswerVC();

[0081] A blockchain transaction module stores data in the blockchain in the form of blockchain transactions, wherein the data includes access identification filter AIF data, access restriction filter ARF data, access attributes and access policy data.

[0082] Further, the contract APRC() is a functional smart contract for providing access control services to the access subject AS, and is also a service provision interface of the access processing module;

[0083] The algorithm details of the contract APRC() are as follows:

[0084] enter: NAR AS , INC PA ,IP AS , MAC AS , ACC AS , REI AS , CheckResult Puzzle ;

[0085] Output: Boolean or Result FAPC ;

[0086] Identify the processing mode of PA:

[0087] if ( INC PA != NULL) and then;

[0088] Result PREC NULL;

[0089] APC AS SiV ( PrK AO , IP AS , MAC AS , ACC AS , REI AS . AOT AS );

[0090] AIT AS CreateToken ( IP AS , MAC AS , ACC AS , REI AS . AOT AS , APC AS );

[0091] Result PREC PREC ( INC PA , AIT AS ,MAC AS );

[0092] if ( Result PREC == true) and then;

[0093] return true;

[0094] end if;

[0095] return false;

[0096] end if;

[0097] Identify the access mode of AS:

[0098] Result FAPC , Result RAPC NULL;

[0099] if ( ACC AS == NULL) and then;

[0100] Result FAPC FAPC ( NAR AS , IP AS , MAC AS , REI AS , CheckResult Puzzle );

[0101] if ( Result FAPC != false) and then;

[0102] return Result FAPC ;

[0103] end if;

[0104] return false;

[0105] end if;

[0106] Result RAPC RAPC ( NARAS , IP AS , MAC AS , ACC AS , REI AS , CheckResult Puzzle );

[0107] if ( Result RAPC == true) and then;

[0108] return true;

[0109] end if;

[0110] return false.

[0111] The access monitoring service is to monitor the operation behavior of the access subject AS after successfully accessing the access object AO, and dynamically manage the access permission of AS according to the operation behavior and attribute changes of AS;

[0112] The contract ASEC () is a functional smart contract that provides computing power screening services to AS, and is also the service provider interface of the computing power screening module.

[0113] Furthermore, the contract PREC() is a functional smart contract that provides access permission management services to the Permission Administrator (PA);

[0114] The algorithm details of the contract PREC() are as follows:

[0115] enter: INC PA , AIT AS , MAC AS ;

[0116] Output: Boolean ;

[0117] Result AIFT_Del , Result ARFT_Add NULL;

[0118] if ( INC PA == 0) and then;

[0119] AIFT_Del ( AIT AS , MAC AS );

[0120] return true;

[0121] else if ( INC PA == 1) and then;

[0122] ARFT_Add ( MAC AS );

[0123] AIFT_Del ( AIT AS , MAC AS );

[0124] return true;

[0125] else then;

[0126] return false;

[0127] end if.

[0128] Contract FAPC() is a smart contract that provides access control services to the AS that initiates the initial request to access the AO;

[0129] The algorithmic details of the contract FAPC() are shown below.

[0130] enter: NAR AS , IP AS , MAC AS , REI AS , CheckResult Puzzle ;

[0131] Output: Boolean or ACC AS ;

[0132] Result ARFT_Find , Result AIFT_Find , , Result ADecision , ACC AS , APCAS , AIT AS NULL;

[0133] Result ARFT_Find ARFT_Find ( MAC AS ); Result AIFT_Find AIFT_Find ( MAC AS );

[0134] if ( Result ARFT_Find == true || Result AIFT_Find == true || CheckResult Puzzle ==NULL) and then;

[0135] access denied;

[0136] return false;

[0137] end if;

[0138] Get the current system time NTime FAPC ;

[0139] SiV ( PrK AO , Hash ( IP AS , MAC AS , REI AS , CheckResult Puzzle . CheckCo de Puzzle ));

[0140] if (( NTime FAPC - Timestamp CC > MaxTime CC ) || CheckResult Puzzle . SivCode Puzzle != ) and then;

[0141] access denied;

[0142] return false;

[0143] end if;

[0144] Result ADecision ADecision ( NAR AS );

[0145] if ( Result ADecision == false) and then;

[0146] access denied;

[0147] return false;

[0148] end if;

[0149] ACC AS MAudit ( IP AS , MAC AS , REI AS );

[0150] if ( ACC AS == "denied") and then;

[0151] access denied;

[0152] return false;

[0153] end if;

[0154] APC AS SiV ( PrK AO , IP AS , MAC AS , ACC AS , REI AS . AOT );

[0155] AIT AS CreateToken ( IP AS , MAC AS , ACC AS , REI AS . AOT , APC AS );

[0156] AIFT_Add ( MAC AS , AIT AS );

[0157] Grant AS access permission;

[0158] return ACC AS .

[0159] Contract RAPC() is a smart contract that provides access control transactions to ASs that repeatedly make requests to access AOs.

[0160] The algorithm details of the contract RAPC() are shown below.

[0161] enter: NAR AS , IP AS , MAC AS , ACC AS , REI AS , CheckResult Puzzle ;

[0162] Output: Boolean ;

[0163] Result ARFT_Find , Result AIFT_Find , AIF AS , , Result ADecision , APC AS , AIT AS , f Token NULL;

[0164] Result ARFT_Find ARFT_Find ( MAC AS ); AIFT AS AIFT_Find ( MAC AS );

[0165] if ( Result ARFT_Find == true || AIFT AS == false) and then;

[0166] access denied;

[0167] return false;

[0168] end if;

[0169] Get the current system time STime Now1 ;

[0170] if ( STime Now1 - AIFT AS . EPT > Time OverDue ) and then;

[0171] if ( CheckResult Puzzle == NULL) and then;

[0172] access denied;

[0173] return false;

[0174] end if;

[0175] SiV ( PrK AO , Hash ( CheckResult Puzzle . CheckCode Puzzle , IP AS , MAC AS , REI AS));

[0176] if (( NTime FAPC - Timestamp CC > MaxTime CC ) || CheckResult Puzzle . SivCode Puzzle != ) and then;

[0177] access denied;

[0178] AIFT_Del ( MAC AS );

[0179] return false;

[0180] end if;

[0181] end if;

[0182] APC AS SiV ( PrK AO , IP AS , MAC AS , ACC AS , REI AS . AOT );

[0183] AIT AS CreateToken ( IP AS , MAC AS , ACC AS , REI AS . AOT , APC AS );

[0184] f Token fex ( AIT AS ); Result ADecision ADecision ( NAR AS );

[0185] if ( AIF AS . f Token != f Token || Result ADecision == false) and then;

[0186] access denied;

[0187] return false;

[0188] end if;

[0189] if ( CheckResult Puzzle != NULL) and then;

[0190] AIFT_Modi ( MAC AS , AIT AS );

[0191] end if;

[0192] Grant AS access permission;

[0193] return true.

[0194] Furthermore, ASEC () is an interface for AS to interact with the blockchain network, providing computing power screening services for AS that accesses AO for the first time, so that AS can obtain the qualifications to initiate the initial access request through the computing power screening results obtained by the service;

[0195] PuzzleGenc() is a smart contract that provides puzzle generation services. IP AS and MAC AS To generate the puzzle PuzzleAO that uniquely identifies AS;

[0196] PAnswerVC() verifies the timeliness and completeness of the answer PuzzleAS obtained when the AS solves the puzzle input by ASEC(), and then responds the verification result to AS.

[0197] Furthermore, the computing power screening module includes the Client Puzzle-based computing power screening algorithm AAFS-CP;

[0198] The AAFS-CP consists of a six-tuple ACPSetup(),APuzzleGen(),APuzzleSolve(),APAnswerV(), , The composition setting has constraints, where is a one-way hash function, Is the signature verification function.

[0199] Furthermore, the constraints are as follows:

[0200] The effective computing power test answer of AAFS-CP is the one solved by AS within the target time;

[0201] AAFS-CP sets target time and target computing power cost when constructing and verifying puzzles;

[0202] There is a preset difficulty threshold, and questions exceeding the difficulty threshold are answered through AS;

[0203] AAFS-CP can adjust the difficulty of the generated puzzles;

[0204] AS cannot predict the answers to difficult questions;

[0205] AAFS-CP can verify the answers to the puzzles solved by AS without storing relevant information of the puzzles;

[0206] A puzzle generated by AAFS-CP corresponds to a unique identifier of an AS.

[0207] Furthermore, the access identification filter AIF consists of a fingerprint extraction algorithm fex(), a hash function hash() and n buckets, where each bucket has m insertion slots;

[0208] The unit storage content structure of each AIF insertion slot is a multi-content fingerprint label consisting of a MAC address fingerprint MACF, an access identification Token fingerprint TokenF, and an access admission time EPT—an access identification fingerprint label AIFT.

[0209] Wherein, MACF is the MAC address of AS obtained by fingerprint extraction algorithm fex();

[0210] TokenF is the legal access identification TokenAIT of AS obtained by the fex() algorithm;

[0211] EPT is the time when TokenF is generated, and this time is the only basis for determining whether AIT is expired or invalid;

[0212] AIT is composed of the IP address of AS IP AS 、MAC address MAC AS , Access code ACC AS , Access Subject Type AOT AS and access verification code APC AS composition;

[0213] in, IP AS and MAC AS It is the subject information provided by AS to AO when it first accesses AO.

[0214] ACC AS The access code granted to the AS after the AO manually reviews the AS's situation. That is, the AS can only initiate repeated access with this access code;

[0215] AOT AS An identification code to distinguish the AS type;

[0216] APC AS It is the verification code of AIT, used to verify the validity of AIT.

[0217] Furthermore, the access restriction filter ARF consists of a fingerprint extraction algorithm fex(), a hash function hash(), and n buckets, where each bucket has m insertion slots;

[0218] The unit storage content structure of each insertion slot in the ARF is a multi-content fingerprint label consisting of a MAC address fingerprint MACF and a restricted access approval time LAAT - a restricted access fingerprint label ARFT;

[0219] Wherein, MACF is the MAC address of AS obtained by the fingerprint extraction algorithm fex();

[0220] LAAT means AO determines the MAC address is MAC AS The AS cannot apply for access to the AO system time again.

[0221] The present invention also provides a dynamic access control method, such as Figure 2 As shown, when INCPA = NULL, the access processing module runs the following steps:

[0222] S1. When the parameters input by the access mode identification contract APRC() are INC PA , AIT AS , MAC AS When INC PA =0, jump to S2;

[0223] like INC PA =1, jump to S3;

[0224] Otherwise, respond to APRC() with the execution result and end;

[0225] S2. Call the access identification fingerprint tag deletion algorithm AIFT_Del () and enter the parameters AIT AS and MAC AS To delete the ATFT corresponding to AS in AIF AS operation, when AIFT_Del ( AIT AS , MAC AS )After the execution is completed, respond to APRC () with the execution result and end;

[0226] S3. Call the algorithm for adding restricted access fingerprint tags ARFT_Add () and enter the parameters MAC AS To perform the operation of adding the ARFTAS corresponding to the access information of the AS restricted from accessing the AO to the ARF;

[0227] when ARFT_Add ()After execution, call AIFT_Del () and enter the parameters AIT AS and MAC AS To delete the ATFT corresponding to AS in AIF AS operation; finally, when AIFT_Del After () is executed, it responds to APRC () with the execution result and ends.

[0228] Furthermore, when INC PA ==NULL, the access processing module runs the following steps:

[0229] Step 1: The access processing module receives the request initiator and sends a NAR containing the parameters to the system. AS , INC PA , IP AS , MAC AS , ACC AS , AIT AS and CheckResult Puzzle Requests;

[0230] Step 2. According to the parameters MAC AS Request ARF to determine whether the object AS of the request initiator is an object with restricted access to AO: If the ARF response result shows that AS is an object with restricted access to AO, then reject AS's access request and end; otherwise, jump to step 3;

[0231] Step 3. According to the parameters MAC AS Request AIF to determine whether AS is qualified to initiate repeated access requests: If the AIF response result shows that AS is qualified to initiate repeated access requests, jump to step 4; otherwise, jump to step 10;

[0232] Step 4. Determine the parameters ACC AS Is it NULL: If ACC AS ==NULL, then reject the access request of AS this time and end; otherwise, jump to step 5;

[0233] Step 5. The access processing module requests the AS from the AIF. AIFT AS After AIF responds to the access processing module AIFT AS ,check AIFT AS Timeliness: If AIFT AS If the timeliness test is passed, jump to step 6; otherwise, jump to step 10;

[0234] Step 6. According to the parameters PrK AO , IP AS , MAC AS , ACC AS and REI AS. AOT AS check AIFT AS Completeness: If AIFT AS If the integrity check is passed, jump to step 7;

[0235] Otherwise, reject the access request of AS and end;

[0236] Step 7. According to the parameter NAR AS Evaluate and decide whether the AS can be granted access permission this time: If NAR AS If the authorization evaluation decision is passed, jump to step 8;

[0237] Otherwise, reject the access request of AS and end;

[0238] Step 8. When the access request initiated by the AS is an initial access request, jump to step 9; when the access request initiated by the AS is a repeated access request, and AIFT AS If the validity check is passed, the AS access permission is granted and the process ends; otherwise, the AS access permission is granted and an update request is made to AIF. AIFT AS The EPT ends to maintain its timeliness;

[0239] Step 9. The access processing module initiates a request to the PA to review the AS access information, and waits for the PA to respond with the review result. ACC AS After that, judge ACC AS Is it false: If ACC AS ==false, it means that the access information of AS has not passed the review, and the access request of AS is rejected at this time, and the process ends; otherwise, the access permission of AS is granted and the AS is responded to. ACC AS , and at the same time, add the access information of the AS to the AIF request, thereby ensuring that it is qualified to initiate repeated access requests in the future, and then end;

[0240] Step 10. Determine whether the AS submitted parameters when initiating the access request CheckResult Puzzle : If the AS does not submit parameters CheckResult Puzzle , then reject the access request of AS this time, and end; otherwise, jump to step 11;

[0241] Step 11. Verification CheckResult PuzzleWhether it satisfies completeness: If CheckResult Puzzle If the integrity check fails, the AS's access request will be rejected and the AIF will be requested to delete the access request. AIFT AS , end; otherwise, when the access request initiated by the AS is an initial access request, jump to step 7; and when the access request initiated by the AS is a repeated access request, jump to step 6.

[0242] Furthermore, when the access processing module processes the access request of the AS, the following conditions are met:

[0243] For ASs that are accessed for the first time but have not yet accessed AO, after applying for access, such objects not only need to meet the access conditions of AO, but also need to pass the manual review of the AO administrator after initially obtaining access rights before they can be formally authorized and access AO.

[0244] For ASs that have been connected to AO, when such objects repeatedly access AO, it is first necessary to verify whether they are ASs that have passed the review and been authorized to access in the early stage, and whether the AS is an expired AS that has not been accessed for a long time. Then, on this basis, it is decided whether it meets the access control decision.

[0245] The AS that is added to the prohibited access list by the AO cannot apply for new access rights.

[0246] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that they can still modify or replace the technical solution of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified technical solution to deviate from the spirit and scope of the technical solution of the present invention.

Claims

1. A dynamic access control system, characterized in that: Including service provision interface, Client Puzzle computing power screening module, access processing module and blockchain transaction module; The service provision interface includes access mode recognition contract APRC(), access monitoring service and computing power screening execution contract ASEC(); The access processing module includes the permission revocation contract PREC (), the initial access processing contract FAPC () and the repeated access processing contract RAPC (); The computing power screening module includes the computing power screening execution contract ASEC(), the puzzle generation contract PuzzleGenc() and the solution verification contract PAnswerVC(); A blockchain transaction module, wherein the blockchain transaction module stores data in the form of blockchain transactions in the blockchain, wherein the data includes access identification filter AIF data, access restriction filter ARF data, access attributes and access policy data; Among them, the contract APRC() is a functional smart contract that provides access control services to the access subject AS, and is the service provision interface of the access processing module; The access monitoring service is to monitor the operation behavior of the access subject AS after it successfully accesses the access object AO, and dynamically manage the access permission of AS according to the operation behavior and attribute changes of AS; The computing power screening execution contract ASEC () is a functional smart contract that provides computing power screening services to AS. It is the service provision interface of the computing power screening module. Contract PREC() is a functional smart contract that provides access permission management services to the permission administrator PA; Contract FAPC() is a smart contract that provides access control services to the AS that initiates the initial request to access the AO; Contract RAPC() is a smart contract that provides access control services to the AS that repeatedly makes requests to access the AO; ASEC () is the interface for AS to interact with the blockchain network. It provides computing power screening services for AS that accesses AO for the first time, so that AS can obtain the computing power screening results obtained by this service to be qualified to initiate the initial access request; PuzzleGenc() is a smart contract that provides puzzle generation services. IP AS and MAC AS To generate the puzzle PuzzleAO that uniquely identifies AS, the IP address of AS is IP AS 、MAC address is MAC AS ; PAnswerVC() verifies the timeliness and completeness of the answer PuzzleAS obtained when the AS solves the puzzle input by ASEC(), and then responds the verification result to AS.

2. A dynamic access control system according to claim 1, characterized in that: The computing power screening module includes the computing power screening algorithm AAFS-CP based on Client Puzzle; The AAFS-CP consists of a six-tuple ACPSetup(), APuzzleGen(), A PuzzleSolve(), APAnswerV(), , Composition, and set constraints, where is a one-way hash function, is the signature verification function, ACPSetup() is the initialization method of AAFS-CP, APuzzleGen() is the problem generation method of AAFS-CP, APuzzleSolve() is the problem solving method of AAFS-CP, and APAnswerV() is the answer verification method of AAFS-CP; The constraints are as follows: The effective computing power test answer of AAFS-CP is the one solved by AS within the target time; AAFS-CP sets target time and target computing power cost when constructing and verifying puzzles; There is a preset difficulty threshold, and questions exceeding the difficulty threshold are answered through AS; AAFS-CP can adjust the difficulty of the generated puzzles; AS cannot predict the answers to difficult questions; AAFS-CP can verify the answers to the puzzles solved by AS without storing relevant information of the puzzles; A puzzle generated by AAFS-CP corresponds to a unique identifier of an AS.

3. A dynamic access control system according to claim 1, characterized in that: The access identification filter AIF consists of a fingerprint extraction algorithm fex (), a hash function hash () and n buckets, where each bucket has m insertion slots; The unit storage content structure of each AIF insertion slot is a multi-content fingerprint label consisting of a MAC address fingerprint MACF, an access identification Token fingerprint TokenF, and an access admission time EPT—an access identification fingerprint label AIFT. Wherein, MACF is the MAC address of AS obtained by fingerprint extraction algorithm fex(); TokenF is the AS legal access identification AIT fingerprint extraction algorithm fex() calculation; EPT is the time when TokenF is generated, and this time is the only basis for determining whether AIT is expired or invalid; AIT is composed of the IP address of AS IP AS 、MAC address MAC AS , Access code ACC AS , Access Subject Type AOT AS and access verification code APC AS composition; in, IP AS and MAC AS It is the subject information provided by AS to AO when it first accesses AO. ACC AS The access code granted to the AS after the AO manually reviews the AS's situation. That is, the AS can only initiate repeated access with this access code; AOT AS An identification code to distinguish the AS type; APC AS It is the verification code of AIT, used to verify the validity of AIT.

4. A dynamic access control system according to claim 1, characterized in that: The access restriction filter ARF consists of a fingerprint extraction algorithm fex (), a hash function hash () and n buckets, where each bucket has m insertion slots; The unit storage content structure of each insertion slot in the ARF is a multi-content fingerprint label consisting of a MAC address fingerprint MACF and a restricted access approval time LAAT - a restricted access fingerprint label ARFT; Wherein, MACF is the MAC address of AS obtained by the fingerprint extraction algorithm fex(); LAAT means AO determines the MAC address is MAC AS The AS cannot apply for access to the AO system time again.

5. A dynamic access control method, characterized in that: when INC PA = NULL, the access processing module operates in the following steps: INC PA is the access control operation code for privileged administrators. INC PA !=NULL means the operation code INCPA is not empty: S1. When the parameters input by the access mode identification contract APRC() are INC PA , AIT AS , MAC AS When INC PA =0, then jump to S2, where INC PA Access control operation code for privileged administrators, AIT AS The access token of the access principal. MAC AS MAC physical address of the access subject; like INC PA =1, jump to S3; Otherwise, respond to APRC() with the execution result and end; S2. Call the access identification fingerprint tag deletion algorithm AIFT_Del () and enter the parameters AIT AS and MAC AS To delete the ATFT corresponding to AS in AIF AS The operation is the operation of accessing the access identification fingerprint tag of the access subject. AIFT_Del Right now AIT AS , MAC AS After the execution is completed, the execution result is responded to APRC () and the process ends. AIFT_Del Fingerprint tag removal algorithm for access identification; S3. Call the algorithm for adding restricted access fingerprint tags ARFT_Add () and enter the parameters MAC AS To perform the operation of adding the ARFTAS corresponding to the access information of the AS restricted from accessing the AO to the ARF; when ARFT_Add ()After execution, call AIFT_Del () and enter the parameters AIT AS and MAC AS To delete the ATFT corresponding to AS in AIF AS operation; finally, when AIFT_Del After () is executed, it responds to APRC () with the execution result and ends.

6. A dynamic access control method according to claim 5, characterized in that: when INC PA ==NULL, the operation of the access processing module includes the following steps, among which, INC PA ==NULL means the operation code INCPA is empty: Step 1: The access processing module receives the request initiator and sends a NAR containing the parameters to the system. AS , INC PA , IP AS , MAC AS , ACC AS , REI AS and CheckResult Puzzle Request by NAR AS The original access request of the access subject. INC PA Access control operations for privileged administrators, REI AS For the access subject, CheckResult Puzzle To indicate the result of the verification problem; Step 2. According to the parameters MAC AS Request ARF to determine whether the object AS of the request initiator is an object with restricted access to AO: If the ARF response result shows that AS is an object with restricted access to AO, then reject AS's access request and end; otherwise, jump to step 3; Step 3. According to the parameters MAC AS Request AIF to determine whether AS is qualified to initiate repeated access requests: If the AIF response result shows that AS is qualified to initiate repeated access requests, jump to step 4; otherwise, jump to step 10; Step 4. Determine the parameters ACC AS Is it NULL: If ACC AS ==NULL, then reject the access request of AS this time and end; otherwise, jump to step 5; Step 5. The access processing module requests the AS from the AIF. AIFT AS After AIF responds to the access processing module AIFT AS ,check AIFT AS Timeliness: If AIFT AS If the timeliness test is passed, jump to step 6; otherwise, jump to step 10; Step 6. According to the parameters PcqI AO , IP AS , MAC AS , ACC AS and REI AS . AOT AS check AIFT AS The integrity of PcqI AO for Access the private key of the object AO, PcqI It is the abbreviation of Private Key, AO is the abbreviation of Access Object, and AS is the IP address. IP AS 、MAC address MAC AS , Access code ACC AS , Access Subject Type AOT AS , REI AS For AS IP AS and MAC AS Other subject information, including REI AS . AOT AS Refers to the identification code that distinguishes the AS type AOT AS ,if AIFT AS If the integrity check is passed, jump to step 7; Otherwise, reject the access request of AS and end; Step 7. According to the parameter NAR AS Evaluate and decide whether the AS can be granted access permission this time: If NAR AS If the authorization evaluation decision is passed, jump to step 8; Otherwise, reject the access request of AS and end; Step 8. When the access request initiated by the AS is an initial access request, jump to step 9; when the access request initiated by the AS is a repeated access request, and AIFT AS If the validity check is passed, the AS access permission is granted and the process ends; otherwise, the AS access permission is granted and an update request is made to AIF. AIFT AS The EPT ends to maintain its timeliness; Step 9. The access processing module initiates a request to the PA to review the AS access information, and waits for the PA to respond with the review result. ACC AS After that, judge ACC AS Is it false: If ACC AS ==false, it means that the access information of AS has not passed the review, and the access request of AS is rejected at this time, and the process ends; otherwise, the access permission of AS is granted and the AS is responded to. ACC AS , and at the same time, add the access information of the AS to the AIF request, thereby ensuring that it is qualified to initiate repeated access requests in the future, and then end; Step 10. Determine whether the AS submitted parameters when initiating the access request CheckResult Puzzle : If the AS does not submit parameters CheckResult Puzzle , then reject the access request of AS this time, and end; otherwise, jump to step 11; Step 11. Verification CheckResult Puzzle Whether it satisfies completeness: If CheckResult Puzzle If the integrity check fails, the AS's access request will be rejected and the AIF will be requested to delete the access request. AIFT AS , end; otherwise, when the access request initiated by the AS is an initial access request, jump to step 7; and when the access request initiated by the AS is a repeated access request, jump to step 6.

7. A dynamic access control method according to claim 6, characterized in that: When the access processing module processes the access request of the AS, the following conditions are met: For ASs that are accessed for the first time but have not yet been connected to the AO, after applying for access, such objects must not only meet the access conditions of the AO, but also pass the manual review of the AO administrator after obtaining the initial access rights before they can be formally authorized and connected to the AO; For ASs that have been connected to AO, when such objects repeatedly access AO, it is first necessary to verify whether they are ASs that have passed the review and are authorized to access in the previous period, and whether the AS is an expired AS that has not been accessed for a long time. Then, on this basis, it is decided whether they meet the access control decision; The AS that is added to the prohibited access list by the AO cannot apply for new access rights.

Images