Self-protection access control method based on RBAC model
By acquiring and merging user access policy data in the RBAC system and dynamically adjusting the RBAC model to respond to internal attacks, the problem of the traditional RBAC system's lack of automatic adaptation in the face of internal attacks is solved, achieving higher security and stability.
Patent Information
- Application Number
- CN202411446132.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-16
- Publication Date
- 2025-01-21
AI Technical Summary
When facing internal attacks, traditional RBAC systems lack automated means to dynamically adapt to changing security needs, which makes it difficult for system administrators to adjust RBAC policies in a timely manner, which may lead to sensitive information leakage or service interruption.
By obtaining user access strategy data, generate identity service element models and authorized service element models, and use ATLAS conversion language to merge into RBAC models. Through periodic monitoring user behavior, identify potential attack types, and adjust the RBAC model based on the type of attack, deploy and execute after verification, and realize dynamic response security threats.
It realizes dynamic response to security threats, reduces manual intervention, ensures the security, stability and reliability of the system, and is suitable for access control management in complex IT network environments.
Smart Images
Figure CN119337351A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of information security technology, and in particular to a self-protection access control method based on a RBAC model. Background Art
[0002] With the rapid development of informatization, the IT infrastructure of enterprises has become more complex, and the demand for internal personnel to access key resources has also increased. This has made role-based access control (RBAC) a widely adopted management method to regulate and control user access to resources. However, the design and implementation of RBAC models are often complex and vulnerable to internal threats. Especially when the system is attacked from within, quickly identifying and responding to these attacks is crucial to protecting corporate assets. Traditional RBAC systems usually rely on manual configuration and management, and lack automated means to dynamically adapt to changing security needs. When an attack occurs, system administrators often find it difficult to adjust RBAC policies in a timely manner, which may lead to sensitive information leakage or service interruption, and fail to respond quickly and take appropriate security measures in the face of potential attacks. Summary of the invention
[0003] The purpose of the present invention is to provide a self-protection access control method based on the RBAC model, which can automatically respond to internal attacks and ensure the security of access control policies.
[0004] The technical solution of the present invention is:
[0005] In a first aspect, the present application provides a self-protection access control method based on the RBAC model, which comprises the following steps:
[0006] S1. Obtain user access policy data, extract the user's identity service information and authorization service information, and input them into the LDAP model and PERMIS model respectively to generate the identity service metamodel and the authorization service metamodel;
[0007] S2, based on the Atlas transformation language, the identity service metamodel and the authorization service metamodel are merged into the RBAC model;
[0008] S3, identify potential attack types of user behaviors through the RBAC model, and adjust the RBAC model according to the attack type;
[0009] S4, perform object constraint language verification on the adjusted RBAC model;
[0010] S5. Convert the verified RBAC model into LDAP and PERMIS service models and deploy them to the target system to execute the new user access policy data;
[0011] S6. Continuously monitor the access control status of the target system, collect new user access policy data to update the LDAP and PERMIS service models, repeat steps S1 to S5 to record all adaptation processes and results, and complete the access control process.
[0012] Further, step S1 includes:
[0013] S11, obtaining the identity service information of the target system through the monitoring component in the MAPE-K loop of the SAAF controller, and storing the identity service information in a .txt file;
[0014] S12, input the .txt file representing the identity service information into the LDAP model to generate an identity service metamodel, describing the corresponding user and role allocation;
[0015] S13, obtaining authorization service information in the authorization management infrastructure of the target system through the monitoring component in the MAPE-K loop of the SAAF controller, and storing it in a .txt file;
[0016] S14. Input the .txt file representing the authorization service information into the PERMIS model to generate an authorization service metamodel to describe the current access control rules.
[0017] Further, step S2 includes:
[0018] S21. Check the integrity, correctness and uniqueness of the identity service metamodel and the authorization service metamodel;
[0019] S22. Use the Atlas transformation language to merge the identity service metamodel and the authorization service metamodel into the RBAC model;
[0020] S23. Create a virtual test environment to simulate the access behavior of legitimate users within their authority, and determine through testing whether the RBAC model works normally. If so, continue with step S3; if not, return to step S22 to re-convert the model and perform simulation testing.
[0021] Further, step S3 includes:
[0022] S31, obtaining the behavior information of the current user, and summarizing and analyzing the user behavior through the KMeans clustering algorithm;
[0023] S32. Identify potential attack types of user behaviors through the RBAC model and select solutions from predefined options;
[0024] S33. Adjust the correspondence between role information and authorization information in the RBAC model according to the solution.
[0025] Further, step S4 includes:
[0026] S41, combining the RBAC model with the applied adaptability constraints to generate an rbacDSML model;
[0027] S42, using the rbacDSML model to perform object constraint language verification on the adjusted RBAC model to ensure that the RBAC model complies with the RBAC standard and adaptability constraints;
[0028] S43. Determine whether the verification process is normal. If so, generate an adaptive RBAC model based on the verification result. If not, check the tool configuration of the rbacDSML model and the rules of the object constraint language, and re-verify after correction.
[0029] Furthermore, step S6 also includes: determining whether the adaptation process is successful, if so, completing the access control process, if not, automatically generating a report for subsequent analysis and improvement, and continuously optimizing the adaptation strategy and system configuration based on the feedback results.
[0030] In a second aspect, the present application provides an electronic device, including:
[0031] A memory for storing one or more programs;
[0032] processor;
[0033] When the one or more programs are executed by the processor, a self-protection access control method based on the RBAC model as described in any one of the first aspects is implemented.
[0034] In a third aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a self-protection access control method based on an RBAC model as described in any one of the first aspects above.
[0035] Compared with the prior art, the present invention has at least the following advantages or beneficial effects:
[0036] The present invention discloses a self-protection access control method based on RBAC model. The monitoring component in the MAPE-K cycle of the SAAF controller generates identity service and authorization service models, and the Atlas conversion language is used to merge these models into a unified RBAC model. Then, the user behavior is periodically monitored, the behavior information is analyzed and attacks are identified, a suitable solution is selected according to the attack type, and the RBAC model is adjusted according to the solution. After verification, the model is deployed and executed, thereby realizing dynamic response to security threats, reducing manual intervention, ensuring the security, stability and reliability of the system, and being suitable for access control management in complex IT network environments. BRIEF DESCRIPTION OF THE DRAWINGS
[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.
[0038] Figure 1 A step diagram of a self-protection access control method based on the RBAC model of the present invention;
[0039] Figure 2 It is a flowchart of the steps for generating the RBAC model;
[0040] Figure 3 This is a schematic diagram of the conversion process of the RBAC model;
[0041] Figure 4 It is a schematic diagram of the adaptation process of the RBAC model;
[0042] Figure 5 This is a schematic diagram of the verification process of the RBAC model;
[0043] Figure 6 This is a schematic diagram of the deployment and execution process of the RBAC model;
[0044] Figure 7 It is a schematic diagram of the monitoring and feedback process of the RBAC model;
[0045] Figure 8 The figure is a schematic structural block diagram of an electronic device.
[0046] Icon: 101, memory; 102, processor; 103, communication interface. DETAILED DESCRIPTION
[0047] Terminology explanation:
[0048] RBAC: (Role-Based Access Control) role-based access control;
[0049] SAAF: Adaptive Access;
[0050] LDAP: (Lightweight Directory Access Protocol) Lightweight Directory Access Protocol;
[0051] PERMIS: Role Management Infrastructure Standard;
[0052] rbacDSML: An open source plug-in for IBM Rational Software Architect that ensures the consistency of RBAC models and their satisfaction with scenarios.
[0053] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.
[0054] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.
[0055] It should be noted that, in this article, the term "comprises" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprises..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.
[0056] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.
[0057] Example 1
[0058] See also Figure 1 , Figure 1 The figure shows a step diagram of a self-protection access control method based on the RBAC model provided in an embodiment of the present application.
[0059] In a first aspect, the present application provides a self-protection access control method based on the RBAC model, which comprises the following steps:
[0060] S1. Obtain user access policy data, extract the user's identity service information and authorization service information, and input them into the LDAP model and PERMIS model respectively to generate the identity service metamodel and the authorization service metamodel;
[0061] S2, based on the Atlas transformation language, the identity service metamodel and the authorization service metamodel are merged into the RBAC model;
[0062] S3, identify potential attack types of user behaviors through the RBAC model, and adjust the RBAC model according to the attack type;
[0063] S4, perform object constraint language verification on the adjusted RBAC model;
[0064] S5. Convert the verified RBAC model into LDAP and PERMIS service models and deploy them to the target system to execute the new user access policy data;
[0065] S6. Continuously monitor the access control status of the target system, collect new user access policy data to update the LDAP and PERMIS service models, repeat steps S1 to S5 to record all adaptation processes and results, and complete the access control process.
[0066] As a preferred implementation, please refer to Figure 2 , step S1 comprises:
[0067] S11, obtaining the identity service information of the target system through the monitoring component in the MAPE-K loop of the SAAF controller, and storing the identity service information in a .txt file;
[0068] S12, input the .txt file representing the identity service information into the LDAP model to generate an identity service metamodel, describing the corresponding user and role allocation;
[0069] S13, obtaining authorization service information in the authorization management infrastructure of the target system through the monitoring component in the MAPE-K loop of the SAAF controller, and storing it in a .txt file;
[0070] S14. Input the .txt file representing the authorization service information into the PERMIS model to generate an authorization service metamodel to describe the current access control rules.
[0071] As a preferred implementation, please refer to Figure 3 , step S2 comprises:
[0072] S21. Check the integrity, correctness and uniqueness of the identity service metamodel and the authorization service metamodel;
[0073] S22. Use the Atlas transformation language to merge the identity service metamodel and the authorization service metamodel into the RBAC model;
[0074] S23, creating a virtual test environment;
[0075] S24. Simulate the access behavior of legitimate users within their authority scope through a virtual test environment, and determine whether the RBAC model works normally through testing. If so, continue with step S3; if not, return to step S22 to re-convert the model and perform simulation testing.
[0076] As a preferred implementation, please refer to Figure 4 , step S3 comprises:
[0077] S31, obtaining the behavior information of the current user, and summarizing and analyzing the user behavior through the KMeans clustering algorithm;
[0078] S32, identify potential attack types of user behaviors through RBAC model;
[0079] S33, select a solution from predefined options based on the attack type;
[0080] S34. Adjust the correspondence between role information and authorization information in the RBAC model according to the solution.
[0081] It should be noted that the predefined options include:
[0082] Increase, limit or remove the access rights that an individual has;
[0083] Increase or limit the access scope defined by RBAC access control rules;
[0084] Warnings about individual behavior;
[0085] Further monitor behavior.
[0086] As a preferred implementation, please refer to Figure 5 , step S4 comprises:
[0087] S41, combining the RBAC model with the applied adaptability constraints to generate an rbacDSML model;
[0088] S42, using the rbacDSML model to perform object constraint language verification on the adjusted RBAC model to ensure that the RBAC model complies with the RBAC standard and adaptability constraints;
[0089] S43. Determine whether the verification process is normal. If so, generate an adaptive RBAC model based on the verification result. If not, check the tool configuration of the rbacDSML model and the rules of the object constraint language, and re-verify after correction.
[0090] As a preferred implementation, please refer to Figure 6 , step S5 specifically includes:
[0091] S51: The SAAF controller uses the RBAC2USER conversion program to convert the RABC model output in step S4 into a new user identity model, and deploys it back to the LDAP service model in the target system;
[0092] S52: The SAAF controller uses the RBAC2PERMIS conversion program to convert the RABC model output in step S4 into a new access control policy model, and deploys it back to the PERMIS service model in the target system;
[0093] S53: Check the effectiveness of the model deployed in step S51 and step S52 in the target system and monitor its execution effect. If the model is not effective, check the deployment steps and configuration, make corrections and re-execute steps S51 and S52.
[0094] As a preferred implementation, step S6 also includes: determining whether the adaptation process is successful, if so, completing the access control process, if not, automatically generating a report for subsequent analysis and improvement, and continuously optimizing the adaptation strategy and system configuration based on the feedback results.
[0095] Specifically, see Figure 7 , step S6 comprises:
[0096] S61: Review and update user role assignment and authorization information on a regular basis, and remove unnecessary roles or authorizations based on actual conditions;
[0097] S62: Monitor the access control status of the target system periodically and collect new user behavior data to detect potential attacks;
[0098] S63: Repeat steps S1 to S5 according to the new data obtained in steps S61 and S62 to record all adaptation processes and results, and complete the access control process.
[0099] Example 2
[0100] See also Figure 8 , Figure 8 A schematic structural block diagram of an electronic device provided in an embodiment of the present application.
[0101] An electronic device includes a memory 101, a processor 102 and a communication interface 103, wherein the memory 101, the processor 102 and the communication interface 103 are electrically connected to each other directly or indirectly to realize data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses or signal lines. The memory 101 can be used to store software programs and modules, and the processor 102 executes various functional applications and data processing by executing the software programs and modules stored in the memory 101. The communication interface 103 can be used to communicate signaling or data with other node devices.
[0102] Among them, the memory 101 can be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc.
[0103] The processor 102 may be an integrated circuit chip with signal processing capability. The processor 102 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.
[0104] It is understood that the structure shown in the figure is only for illustration, and a self-protection access control method based on the RBAC model may also include more or fewer components than those shown in the figure, or have a different configuration than those shown in the figure. Each component shown in the figure may be implemented by hardware, software or a combination thereof.
[0105] In the embodiments provided in the present application, it should be understood that the disclosed method can also be implemented in other ways. The embodiments described above are merely schematic, for example, the flowchart or block diagram in the accompanying drawings shows the possible implementation architecture, functions and operations of the method and computer program product according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of the boxes in the block diagram and / or the flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.
[0106] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.
[0107] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.
[0108] To sum up, the self-protection access control method based on the RBAC model provided in the embodiment of the present application can be dynamically adjusted according to the monitoring data in the actual operating environment to adapt to the ever-changing security needs. Compared with the static access control strategy in the prior art, the present invention has greater flexibility and can better cope with the changing security challenges in complex IT environments.
[0109] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.
[0110] It will be apparent to those skilled in the art that the present application is not limited to the details of the exemplary embodiments described above, and that the present application can be implemented in other specific forms without departing from the spirit or essential features of the present application. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the present application is defined by the appended claims rather than the above description, and it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims be included in the present application. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.
Claims
1. A self-protection access control method based on RBAC model, characterized in that: The following steps are involved: S1. Obtain user access policy data, extract the user's identity service information and authorization service information, and input them into the LDAP model and PERMIS model respectively to generate the identity service metamodel and the authorization service metamodel; S2, based on the Atlas transformation language, the identity service metamodel and the authorization service metamodel are merged into the RBAC model; S3, identify potential attack types of user behaviors through the RBAC model, and adjust the RBAC model according to the attack type; S4, perform object constraint language verification on the adjusted RBAC model; S5. Convert the verified RBAC model into LDAP and PERMIS service models and deploy them to the target system to execute the new user access policy data; S6. Continuously monitor the access control status of the target system, collect new user access policy data to update the LDAP and PERMIS service models, repeat steps S1 to S5 to record all adaptation processes and results, and complete the access control process.
2. A self-protection access control method based on RBAC model as claimed in claim 1, characterized in that: Step S1 includes: S11, obtaining the identity service information of the target system through the monitoring component in the MAPE-K loop of the SAAF controller, and storing the identity service information in a .txt file; S12, input the .txt file representing the identity service information into the LDAP model to generate an identity service metamodel, describing the corresponding user and role allocation; S13, obtaining authorization service information in the authorization management infrastructure of the target system through the monitoring component in the MAPE-K loop of the SAAF controller, and storing it in a .txt file; S14. Input the .txt file representing the authorization service information into the PERMIS model to generate an authorization service metamodel to describe the current access control rules.
3. A self-protection access control method based on RBAC model as claimed in claim 1, characterized in that: Step S2 includes: S21. Check the integrity, correctness and uniqueness of the identity service metamodel and the authorization service metamodel; S22. Use the Atlas transformation language to merge the identity service metamodel and the authorization service metamodel into the RBAC model; S23. Create a virtual test environment to simulate the access behavior of legitimate users within their authority, and determine through testing whether the RBAC model works normally. If so, continue with step S3; if not, return to step S22 to re-convert the model and perform simulation testing.
4. A self-protection access control method based on RBAC model as claimed in claim 1, characterized in that: Step S3 includes: S31, obtaining the behavior information of the current user, and summarizing and analyzing the user behavior through the KMeans clustering algorithm; S32. Identify potential attack types of user behaviors through the RBAC model and select solutions from predefined options; S33. Adjust the correspondence between role information and authorization information in the RBAC model according to the solution.
5. A self-protection access control method based on RBAC model as claimed in claim 1, characterized in that: Step S4 includes: S41, combining the RBAC model with the applied adaptability constraints to generate an rbacDSML model; S42, using the rbacDSML model to perform object constraint language verification on the adjusted RBAC model to ensure that the RBAC model complies with the RBAC standard and adaptability constraints; S43. Determine whether the verification process is normal. If so, generate an adaptive RBAC model based on the verification result. If not, check the tool configuration of the rbacDSML model and the rules of the object constraint language, and re-verify after correction.
6. A self-protection access control method based on RBAC model as claimed in claim 1, characterized in that: Step S6 also includes: determining whether the adaptation process is successful, if so, completing the access control process, if not, automatically generating a report for subsequent analysis and improvement, and continuously optimizing the adaptation strategy and system configuration based on the feedback results.
7. An electronic device, characterized in that: include: A memory for storing one or more programs; processor; When the one or more programs are executed by the processor, a self-protection access control method based on the RBAC model as described in any one of claims 1 to 6 is implemented.
8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, a self-protection access control method based on the RBAC model as described in any one of claims 1 to 6 is implemented.