Security operation software method based on multi-dimensional access control strategy

Abstract

The invention relates to the technical field of identity information security, in particular to a security operation software method based on a multi-dimensional access control strategy, which comprises a multi-dimensional access control model, a dynamic authority management module, a strategy engine module, a security strategy module, an auditing function module and an access control decision system. The invention has the advantages that the invention relates to an access control method and system based on multi-dimensional set calculation, belongs to the technical field of identity information security, and particularly relates to a method and system for dynamic division, organization management, role management and access control of users based on multi-dimensional data set calculation. The dynamic set operation allows the user to construct terms conforming to the scene of the user, and the dynamic set operation is used to solve the problems of large modeling workload, difficult adjustment, large technical research and development workload, low performance and the like caused by multiple sets of authority models.

Description

Technical Field

[0001] The present invention relates to the technical field of identity information security, and in particular to a software method for secure operation based on a multi-dimensional access control strategy. Background Art

[0002] In computer system security, role-based access control (RBAC) or role-based security is a method of limiting access to a system to authorized users. It is a method of implementing mandatory access control (MAC) or discretionary access control (DAC). Role-based access control (RBAC) is a policy-neutral access control mechanism defined around roles and permissions. RBAC components such as role-permission, user-role, and role-role relationships make it simple to perform user assignments.

[0003] The RBAC-based role security model defines the infrastructure for the access control model, and the inherent meaning of "role" is broad and generalized. A role is a behavior that is appropriately classified for an authorized target (usually a user).

[0004] In more complex authentication scenarios, there are dependencies between roles, which are not well defined in the RBAC model. Usually managers are faced with a variety of terms such as organizational structure, role, department position, user group, and user group. Directly using the semantics of "role" often confuses the difference between broad roles and narrow roles, resulting in poor scenario applicability and bringing potential security risks to access control. Summary of the invention

[0005] The technical problem to be solved by the present invention is to establish an access control mechanism that conforms to real scenarios, and a unified access control solution can be used in different scenarios and semantics.

[0006] To solve the above technical problems, the technical solution provided by the present invention is: a software method for secure operation based on a multi-dimensional access control strategy, including a multi-dimensional access control model, a dynamic authority management module, a policy engine module, a security policy module, an audit function module, and an access control decision system;

[0007] Multidimensional access control model: Building a static multidimensional spatial access control model based on role-based access control;

[0008] Dynamic permission management module: This type of technology allows access permissions to be dynamically adjusted according to different contextual conditions at runtime.

[0009] Policy engine module: In multi-dimensional access control policies, the policy engine module is used to parse and execute complex access control policies.

[0010] Security policy module: involves how to model security policies and verify whether these policies can effectively protect system resources without introducing vulnerabilities.

[0011] Audit function module: When implementing multi-dimensional access control strategies, the system also needs to have an audit function to record access logs and generate reports that meet compliance requirements.

[0012] Access control decision system: responsible for processing access requests and making decisions.

[0013] As an improvement, the multi-dimensional access control model includes

[0014] S1. Define role dimensions: List all the classification methods involved in detail at the beginning of establishing the authority model;

[0015] 1 2 3 Before creating the initial model, confirm the semantics of various general roles R, R, R… according to the actual business scenario;

[0016] S2. Establish the relationship between role dimensions, requiring different role dimensions to be orthogonal;

[0017] S3. When all role dimensions are defined, expand the associated dimensions.

[0018] As an improvement, before allocating multiple roles, the type of generalized role is clearly specified; in the initial state, different roles must be orthogonal; establish an association relationship between multiple roles, mount a certain role to the leaf node of the node of another role, and repeat the same mounting action until all nodes are mounted; repeat the above process until all roles are mounted.

[0019] As an improvement, the dynamic permission management module can update the permission settings in real time according to the user's geographic location, time, device type and other information.

[0020] As an improvement, the security policy module includes a policy modeling tool and a verification algorithm.

[0021] As an improvement, the access control decision system includes one or more processors; a memory for storing one or more programs; and a software method for secure operation based on a multidimensional access control strategy as described in any one of claims 1-5 when one or more of the programs are executed by one or more processors.

[0022] The advantages of the present invention over the existing technology are: the present invention relates to an access control method and system based on multidimensional set computing, belonging to the field of identity information security technology, and in particular to a method and system for dynamic user division, organization management, role management, and access control based on multidimensional data set computing. Compared with the traditional RABC / ABAC permission model, the present invention uses dynamic set computing to allow users to construct terms that suit their own scenarios, and uses dynamic set computing to solve the problems of large modeling workload, difficulty in adjustment, large technical research and development workload, and poor performance brought about by multiple sets of permission models. DETAILED DESCRIPTION

[0023] The following will be combined with the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0024] The present application fully explains the problems of the prior art in the technical background, and there are no superordinate or general problems. The problems to be solved by the present application are described in detail in the following invention content and specific implementation methods, the technical problems to be solved by the technical scheme are clarified, and it is determined that the technical scheme of the present application has beneficial effects relative to the objective prior art.

[0025] An embodiment provided by the present invention:

[0026] A software method for secure operation based on a multi-dimensional access control strategy includes a multi-dimensional access control model, a dynamic permission management module, a policy engine module, a security policy module, an audit function module, and an access control decision system. A multi-dimensional access control model: A static multi-dimensional spatial access control model is constructed based on role-based access control; this model usually covers multi-angle management of access rights, not limited to the traditional role-based (RB software method for secure operation based on a multi-dimensional access control strategy C) model, but may also involve attribute-based (software method for secure operation based on a multi-dimensional access control strategy B software method for secure operation based on a multi-dimensional access control strategy C), policy-based (PB software method for secure operation based on a multi-dimensional access control strategy C) and other models. These models consider multiple factors such as the user's role, attribute, context, etc. to determine access rights. Dynamic permission management module: This type of technology allows access rights to be dynamically adjusted according to different contextual conditions at runtime. For example, the system can update permission settings in real time based on information such as the user's geographic location, time, and device type.

[0027] Policy engine module: In a multidimensional access control strategy, the policy engine module is used to parse and execute complex access control policies. These engines are able to process policy rules from different sources and ensure that access rights are granted or denied when policy conditions are met.

[0028] Security policy module: involves how to model security policies and verify whether these policies can effectively protect system resources without introducing vulnerabilities.

[0029] Audit function module: When implementing a multi-dimensional access control strategy, the system also needs to have an audit function to record access logs and generate reports that meet compliance requirements. This helps track and analyze access behaviors and discover potential security issues.

[0030] Access control decision system: responsible for processing access requests and making decisions. This system needs to be able to efficiently handle policy evaluation and decision making to ensure real-time and accuracy.

[0031] Specific:

[0032] S1. Define role dimensions: List all possible classification methods as detailed as possible at the beginning of establishing the permission model;

[0033] S2. Establish the relationship between role dimensions, requiring different role dimensions to be orthogonal;

[0034] S3. When all role dimensions are defined, expand the associated dimensions;

[0035] S4. Generate an authorization unit for access control, and perform calculations on the authorization unit to obtain a user set and a resource set in the authorization unit.

[0036] To facilitate understanding, different role allocation actions can be expressed using terms commonly used in traditional RBAC, such as "dividing organizations", "dividing roles", and "grouping".

[0037] Before the initial model is created, the semantics of various general roles R1, R2, R3, R... are confirmed according to the actual business scenarios, and the semantics are ensured to be clear, unique, and independent. The defined relationship types should be concrete and easy for managers or users to understand. In the same application system, relationship types with similar meanings or ambiguous semantics should be avoided as much as possible. Although the operation rules focus only on the relationship between sets, inappropriate naming may lead to operational errors by managers. Common concrete semantics include "organization", "department", "group", "role", "position", etc.

[0038] The second step is to add the specific role node r to the classification, where r represents the specific role, such as {Beijing Branch, Shanghai Branch, Guangdong Branch∈Organization}

[0039] The third step is to analyze whether there is an association relationship between roles. In this embodiment, there is no association relationship between roles, and the creation of the initial model is completed.

[0040] The fourth step is to directly create an authorization unit for the role. The authorization unit contains a triple: 1. The role vector is a one-dimensional vector set, such as {(Beijing)}, 2. The authorization target user set corresponding to the role {u1,u2,u3...}, 3. The accessible resource set {s1,s2,s3...}.

[0041] The authorization unit finally obtained by this example is in the form of ((o),{'u1','u2'},{'s1','s2'}), that is, users {u1,u2...} can access resources {s1,s2...}. This example proves that the access control system of multidimensional set computing is fully compatible with the RBAC system.

[0042] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the application disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope of the present application is indicated by the claims.

[0043] It should be understood that the present application is not limited to the above description, and various modifications and changes can be made without departing from its scope. The above-described embodiments of the present application do not constitute a limitation on the scope of protection of the present application.

Claims

1. A software method for secure operation based on a multi-dimensional access control strategy, characterized in that: It includes multi-dimensional access control model, dynamic permission management module, policy engine module, security policy module, audit function module and access control decision system; Multidimensional access control model: Building a static multidimensional spatial access control model based on role-based access control; Dynamic permission management module: This type of technology allows access permissions to be dynamically adjusted according to different contextual conditions at runtime. Policy engine module: In multi-dimensional access control policies, the policy engine module is used to parse and execute complex access control policies. Security policy module: Involves how to model security policies and verify whether these policies can effectively protect system resources without introducing vulnerabilities. Audit function module: When implementing multi-dimensional access control strategies, the system also needs to have an audit function to record access logs and generate reports that meet compliance requirements. Access control decision system: responsible for processing access requests and making decisions.

2. The software method for secure operation based on a multi-dimensional access control strategy according to claim 1, characterized in that: The multi-dimensional access control model includes S1. Define role dimensions: List all the classification methods involved in detail at the beginning of establishing the authority model; 1.2.3 Before creating the initial model, confirm the semantics of various general roles R, R, R… according to the actual business scenario; S2. Establish the relationship between role dimensions, requiring different role dimensions to be orthogonal; S3. When all role dimensions are defined, expand the associated dimensions.

3. The software method for secure operation based on a multi-dimensional access control strategy according to claim 2, characterized in that: Before performing the allocation of multiple roles, the type of generalized role must be clearly specified; in the initial state, different roles must be orthogonal; establish the association relationship between multiple roles, mount a role to the leaf node of another role's node, and repeat the same mounting action until all nodes are mounted; Repeat the above process until all roles are mounted.

4. The software method for secure operation based on a multi-dimensional access control strategy according to claim 1, characterized in that: The dynamic permission management module can update the permission settings in real time according to the user's geographical location, time, device type and other information.

5. The software method for secure operation based on multi-dimensional access control strategy according to claim 1, characterized in that: The security policy module includes a policy modeling tool and a verification algorithm.

6. The access control decision system according to claim 1, characterized in that: The access control decision system includes one or more processors; A memory for storing one or more programs; when one or more of the programs are executed by one or more processors, a software method for secure operation based on a multi-dimensional access control strategy as described in any one of claims 1 to 5 is implemented.