Identity authentication and authority control method for edge node of low-bandwidth network

Abstract

The invention relates to a low-bandwidth network edge node identity authentication and authority control method, and belongs to the technical field of information security. According to the edge node bidirectional identity authentication method suitable for the low-bandwidth network environment provided by the invention, the handshake frequency during authentication message interaction is reduced, and the contradiction between the calculation efficiency and the communication bandwidth is balanced, so that the problems of large certificate scale, high calculation amount, large network bandwidth occupation and the like in the traditional identity authentication are effectively solved.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular relates to a method for identity authentication and authority control of edge nodes in a low-bandwidth network. Background Art

[0002] In a mobile communication environment, network nodes are usually faced with practical needs such as temporary networking, dynamic interconnection, random access, and random exit. The topology structure is adjusted regularly, and mobile nodes communicate in a relay manner. In order to maintain the robustness, flexibility, and security of information transmission, node authentication, permission control, and dynamic transfer technology research are carried out. Among them, the computing, communication, and storage resources of network edge nodes are relatively limited, and they cannot independently carry certain complex computing tasks, which makes the deployment of corresponding security mechanisms more difficult. How to make traditional authentication methods suitable for low-bandwidth network environments; how to achieve fine-grained centralized control of distributed access rights; and how to deal with the real-time transfer of permissions between mobile nodes and trust domains are all urgent problems to be solved in low-bandwidth network edge node authentication and permission control.

[0003] At present, identity authentication mechanism, as the first line of defense for information system security, can be used to prevent network security threats such as illegal access and visit, counterfeiting, post-repudiation, retransmission attacks, etc., mainly including authentication methods such as passwords, biometric fingerprints, and digital certificates; access control mechanism is used to prevent malicious users from logging into information systems and performing illegal operations, such as autonomous access control, mandatory access control, role-based access control and other policy models.

[0004] In recent years, relevant research has achieved a series of important results, but there are still the following shortcomings:

[0005] (1) Cryptographic identity authentication methods, represented by digital certificates, are limited by low-bandwidth and weak-connection network environments, and the maintenance process of private keys or private information is complicated and cumbersome, making it impossible to balance security and convenience;

[0006] (2) Traditional access control methods such as role-based access control are static, have coarse control granularity, poor scalability and flexibility, and are difficult to adapt to complex and changing application scenarios such as permission redistribution and permission transfer. Summary of the invention

[0007] 1. Technical issues to be resolved

[0008] The technical problem to be solved by the present invention is to solve the problem of network access security protection of low-bandwidth mobile communication environment information system.

[0009] (II) Technical solution

[0010] In order to solve the above technical problems, the present invention provides a low-bandwidth network edge node identity authentication and authority control method, which includes three stages: node identity authentication, user authority control, and intra-domain authority transfer; wherein, in the node identity authentication stage, the node unique code is used as a credential to realize two-way identity authentication between network edge nodes; nodes that pass the authentication in the node identity authentication stage can perform user authority control and intra-domain authority transfer operations, and in the user authority control stage, an access controller based on characteristic attributes is built to complete the access control policy matching of network edge nodes; in the intra-domain authority transfer stage, key characteristic attributes are extracted, and an evaluation of user authority transfer within the same trust domain is performed.

[0011] Preferably, the execution process of the node identity authentication phase is:

[0012] (1) A network edge node sends a query message to the trust domain master node, appending the node's unique code;

[0013] (2) The master node of the trust domain sends a response message to the network edge node to complete the node unique code exchange;

[0014] (3) The network edge node and the trust domain master node execute the Diffie-Hellman key exchange protocol to generate a session key pair, and perform a two-way interactive identity authentication operation based on a random string to determine the legitimacy of the identities of the network edge node and the trust domain master node. The network edge node returns the identity authentication result to the trust domain master node. If the authentication passes, the next step is executed, otherwise the authentication fails.

[0015] (4) The network edge node successfully joins the current trust domain, and the node identity authentication process ends.

[0016] Preferably, the execution process of the user authority control stage is:

[0017] (1) After the network edge node that has successfully joined the current trust domain receives access permission request information from a user, it obtains the user's characteristic attribute information, calculates the user attribute value, and sends it to the access controller;

[0018] (2) The access controller constructs access permission request information with attributes based on the operating environment and access resource conditions and sends it to the decision module;

[0019] (3) The decision module matches the access control policies in the local access control policy library one by one, determines whether the access rights are legal, and feeds back the access control results to the access controller;

[0020] (4) The access controller allows or blocks user access based on the permission control results.

[0021] Preferably, the execution process of the intra-domain authority transfer phase is:

[0022] (1) After receiving a user's permission transfer request, the new network edge node determines the current trust domain status, extracts the user's key feature attribute information, calculates the user attribute value, and sends the permission transfer request information to the old network edge node;

[0023] (2) The old network edge node evaluates the user's permission transfer request, determines whether the permission transfer is legal, and feeds back the user attribute value to the new network edge node;

[0024] (3) The new network edge node configures user access rights to application services;

[0025] (4) The old network edge node updates the local access control policy library and configures user access rights to application services.

[0026] Preferably, in the node identity authentication stage, it is assumed that the network edge node 4 requests to join the trust domain A, and the trust domain A already includes the trusted network edge nodes 1, 2 and 3. At the same time, it is assumed that the network edge node 3 is the master node of the trust domain. In the initialization stage of the mobile communication network, all network nodes pre-agree on a certain fixed operation mode, determine the public parameters of the Diffie-Hellman key exchange protocol, and assign a unique code and root key to the network edge node. For a certain network edge node i, its unique code is preset as ID i , the root key is KR i ; i represents the node number; then the execution process of the node identity authentication phase is as follows:

[0027] (1) Network edge node 4 sends a query message to network edge node 3, where the query message includes a unique code ID 4 of network edge node 4;

[0028] (2) Network edge node 3 sends a response message to network edge node 4, where the response message includes a unique code ID3 of network edge node 3;

[0029] (3) Network edge node 4 performs two-way identity authentication with network edge node 3, the steps of which are as follows:

[0030] a. The network edge node 3 performs the Diffie-Hellman key exchange protocol based on its own unique code ID3, the root key KR3, and the unique code ID4 of the network edge node 4 to calculate the session key KT3;

[0031] b. The network edge node 4 executes the Diffie-Hellman key exchange protocol based on its own unique code ID4, the root key KR4, and the unique code ID3 of the network edge node 3 to calculate the session key KT4, satisfying that KT3 and KT4 are encryption and decryption keys for each other;

[0032] c. The network edge node 3 selects a random string m, encrypts it using KT3, and sends it to the network edge node 4;

[0033] d. After receiving the message, the network edge node 4 uses KT4 to decrypt the string m, performs a pre-agreed fixed operation, selects a random string n, concatenates the operation result of the string m with the string n in sequence, encrypts the string with KT4, and sends the string to the network edge node 3;

[0034] e. After receiving it, the network edge node 3 uses KT3 to decrypt and obtain the string m * and n, if the result of m after fixed operation is equal to m * If they are equal, the network edge node 4 is determined to be legitimate, otherwise it is determined to be illegal and the authentication fails; if the network edge node 4 is determined to be legitimate, a pre-agreed fixed operation is performed on n, the identity authentication result P is sequentially concatenated with the operation result of the string n, encrypted using KT3, and sent to the network edge node 4;

[0035] f. After receiving it, the network edge node 4 uses KT4 to decrypt and obtain the identity authentication result P and string n * , if the result of n after fixed operation is equal to n * If they are equal, the network edge node 3 is determined to be legitimate, otherwise it is determined to be illegal and the authentication fails; if the network edge node 3 is determined to be legitimate, the identity authentication result P is encrypted using KT4 and sent to the network edge node 3;

[0036] g. The network edge node 3 uses KT3 to decrypt and obtain the authentication result P. The authentication is passed, allowing the network edge node 4 to access the current trust domain;

[0037] (4) Network edge node 4 successfully joins trust domain A.

[0038] Preferably, in the user authority control stage, it is assumed that user X requests access rights to application service ① from the network edge node 4, and sends access rights request information through the service interface of the network edge node 4. The specific process of the user authority control stage is as follows:

[0039] (1) The network edge node 4 obtains the characteristic attribute information of user X, calculates the hash value as the attribute value of user X, and sends it to the access controller;

[0040] (2) The access controller consists of three components: a policy execution point, a permission evaluation point, and an access authorization point. Based on the access permission request information, the permission evaluation point obtains the operating environment attributes and access resource attributes, and combines the attribute values ​​of user X to construct the access permission request information with attributes and send it to the decision module.

[0041] (3) After receiving the access permission, the decision module compares the access permission request information with the access control policies in the local access control policy library one by one. If the attribute values ​​match, the access permission is granted according to the corresponding access control policy. Otherwise, the permission request is rejected and the permission control result is returned to the access authorization point of the access controller.

[0042] (4) After the access controller receives the permission control result, the policy execution point releases or blocks user access through the service interface based on the permission control result.

[0043] Preferably, in the intra-domain authority transfer stage, it is assumed that user X in the trust domain A currently has access rights to the network edge node 1, i.e., the application service ① of the old network edge node, and requests to access the application service ① of the network edge node 4, i.e., the new network edge node, and the intra-domain authority transfer operation is completed by the network edge node 1 and the network edge node 4 together; then the process of the intra-domain authority transfer stage is specifically as follows:

[0044] (1) User X logs in to network edge node 4. If network edge node 4 determines that network edge node 1 is a trusted node in the same trust domain as it, it extracts the key characteristic attributes of user X, encapsulates them into attribute values, and sends permission transfer request information to network edge node 1. Otherwise, it rejects the permission request.

[0045] (2) After receiving the request, the access controller and decision module evaluate the permission transfer request of user X. If the evaluation passes, the attribute value of user X is sent to the network edge node 4. Otherwise, the permission request is rejected.

[0046] (3) After receiving the information, the network edge node 4 configures the access rights of user X to the application service ①;

[0047] (4) Network edge node 1 updates the local access control policy library to allow user X from network edge node 4 to access application service ①.

[0048] The present invention also provides a system for implementing the method.

[0049] (III) Beneficial effects

[0050] (1) The present invention proposes a two-way identity authentication method for edge nodes suitable for low-bandwidth network environments. By reducing the number of handshakes during authentication message interaction, the contradiction between computing efficiency and communication bandwidth is balanced, effectively solving the problems of large certificate size, high computational complexity, and high network bandwidth usage in traditional identity authentication.

[0051] (2) The present invention implements distributed fine-grained control of user access to application services, strikes a balance between bandwidth, permission control granularity and security level, has a certain degree of flexibility and scalability, and can better adapt to the operating environment of network edge nodes. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 It is a low-bandwidth network edge node identity authentication flow chart, which provides the application scenarios, data flow and interaction relationship of the node identity authentication stage of the present invention;

[0053] Figure 2 The present invention is a low-bandwidth network edge node authority control flow chart, which provides the application scenarios, core elements and working principles of the user authority control phase and the intra-domain authority transfer phase of the present invention. DETAILED DESCRIPTION

[0054] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0055] The present invention provides a method for identity authentication and permission control of edge nodes in a low-bandwidth network. This method directly reduces the resource occupancy rate and performance loss rate of the network edge node identity authentication process, realizes dynamic and secure adjustment of access rights of highly complex and highly mobile users, and solves the network access security protection problem of information systems in low-bandwidth mobile communication environments to a certain extent. The present invention is oriented to the mobile communication network trust domain, which refers to a set of network nodes that have achieved mutual trust under the control of a set of the same security policies, and carries out information system identity authentication and permission control through characteristic attributes such as user identity, job level, geographic location, and affiliation.

[0056] The technical solution used by the present invention to solve its technical problems is: a low-bandwidth network edge node identity authentication and authority control method. The method mainly covers three important stages: node identity authentication, user authority control, and intra-domain authority transfer. Among them, in the node identity authentication stage, the node unique code is used as a credential to realize two-way identity authentication between network edge nodes; the nodes that pass the authentication in the node identity authentication stage can perform user authority control and intra-domain authority transfer operations. In the user authority control stage, an access controller based on characteristic attributes is built to complete the access control policy matching of network edge nodes; in the intra-domain authority transfer stage, key characteristic attributes are extracted to carry out an evaluation of user authority transfer within the same trust domain. The user authority control stage and the intra-domain authority transfer stage can be executed in parallel. The method flow of the present invention is:

[0057] 1. Figure 1 This is the low-bandwidth network edge node identity authentication process. The specific steps are:

[0058] (1) A network edge node sends a query message to the trust domain master node, appending the node's unique code;

[0059] (2) The master node of the trust domain sends a response message to the network edge node to complete the node unique code exchange;

[0060] (3) The network edge node and the trust domain master node execute the Diffie-Hellman key exchange protocol to generate a session key pair, and conduct a two-way interactive identity authentication based on a random string to determine the legitimacy of the identities of the network edge node and the trust domain master node. The network edge node returns the identity authentication result to the trust domain master node. If the authentication is successful, the next step is executed, otherwise the authentication fails.

[0061] (4) The network edge node successfully joins the current trust domain, and the node identity authentication process ends.

[0062] 2. Figure 2 Contains the user authority control process for low-bandwidth network edge nodes. The specific steps are as follows:

[0063] (1) After receiving a user's access permission request information, the network edge node obtains the user's characteristic attribute information, calculates the user attribute value, and sends it to the access controller;

[0064] (2) The access controller constructs access permission request information with attributes based on the operating environment and access resource conditions and sends it to the decision module;

[0065] (3) The decision module matches the access control policies in the local access control policy library one by one, determines whether the access rights are legal, and feeds back the access control results to the access controller;

[0066] (4) The access controller allows or blocks user access based on the permission control results.

[0067] 3. Figure 2 Contains the permission transfer process within the low-bandwidth network edge node domain. The specific steps are:

[0068] (1) After receiving a user's permission transfer request, the new network edge node determines the current trust domain status, extracts the user's key feature attribute information, calculates the user attribute value, and sends the permission transfer request information to the old network edge node;

[0069] (2) The old network edge node evaluates the user's permission transfer request, determines whether the permission transfer is legal, and feeds back the user attribute value to the new network edge node;

[0070] (3) The new network edge node configures user access rights to application services;

[0071] (4) The old network edge node updates the local access control policy library and configures user access rights to application services.

[0072] The present invention will be further described below in conjunction with the accompanying drawings.

[0073] Figure 1 It is a low-bandwidth network edge node identity authentication flow chart, which mainly involves the core interaction processes such as inquiry, response and identity authentication between network edge nodes in the same trust domain; Figure 2 This is a low-bandwidth network edge node permission control flow chart, which mainly involves the basic working principles of permission control and permission transfer between different network edge nodes for users in the domain. The specific method includes the following steps:

[0074] 1. The implementation methods of the node identity authentication phase include:

[0075] Take the application scenario where network edge node 4 requests to join trust domain A as an example. Trust domain A already contains trusted network edge nodes 1, 2, and 3. It is assumed that network edge node 3 is the master node of the trust domain. In the initialization phase of the mobile communication network, all network nodes pre-agreed on a fixed operation method, determined the public parameters of the Diffie-Hellman key exchange protocol, and assigned unique codes and root keys to network edge nodes. For a network edge node i, its unique code is preset as ID i , the root key is KR i .

[0076] (1) Network edge node 4 sends a query message to network edge node 3, where the query message includes a unique code ID 4 of network edge node 4;

[0077] (2) Network edge node 3 sends a response message to network edge node 4, where the response message includes a unique code ID3 of network edge node 3;

[0078] (3) Network edge node 4 performs two-way identity authentication with network edge node 3, the steps of which are as follows:

[0079] a. The network edge node 3 performs the Diffie-Hellman key exchange protocol based on its own unique code ID3, the root key KR3, and the unique code ID4 of the network edge node 4 to calculate the session key KT3;

[0080] b. The network edge node 4 executes the Diffie-Hellman key exchange protocol based on its own unique code ID4, the root key KR4, and the unique code ID3 of the network edge node 3 to calculate the session key KT4, satisfying that KT3 and KT4 are encryption and decryption keys for each other;

[0081] c. The network edge node 3 selects a random string m, encrypts it using KT3, and sends it to the network edge node 4;

[0082] d. After receiving the message, the network edge node 4 uses KT4 to decrypt the string m, performs a pre-agreed fixed operation, selects a random string n, concatenates the two (the operation result of the string m and the string n) in order, encrypts the string with KT4, and sends the string to the network edge node 3;

[0083] e. After receiving it, the network edge node 3 uses KT3 to decrypt and obtain the string m * and n, if the result of m after fixed operation is equal to m * If they are equal, the network edge node 4 is determined to be legitimate, otherwise it is determined to be illegal and the authentication fails; if the network edge node 4 is determined to be legitimate, a pre-agreed fixed operation is performed on n, and the identity authentication result P is sequentially concatenated with it (the operation result of the string n), encrypted using KT3, and sent to the network edge node 4;

[0084] f. After receiving it, the network edge node 4 uses KT4 to decrypt and obtain the identity authentication result P and string n * , if the result of n after fixed operation is equal to n * If they are equal, the network edge node 3 is determined to be legitimate, otherwise it is determined to be illegal and the authentication fails; if the network edge node 3 is determined to be legitimate, the identity authentication result P is encrypted using KT4 and sent to the network edge node 3;

[0085] g. The network edge node 3 uses KT3 to decrypt and obtain the authentication result P. The authentication is passed, allowing the network edge node 4 to access the current trust domain;

[0086] (4) Network edge node 4 successfully joins trust domain A.

[0087] 2. The implementation methods of the user authority control stage include:

[0088] exist Figure 2 In a typical application scenario, user X requests access rights to application service ① from network edge node 4 and sends access rights request information through the service interface of network edge node 4.

[0089] (1) The network edge node 4 obtains the characteristic attribute information of user X, calculates the hash value as the attribute value of user X, and sends it to the access controller;

[0090] (2) The access controller consists of three components: the policy execution point, the permission evaluation point, and the access authorization point. Based on the access permission request information, the permission evaluation point obtains the operating environment attributes and access resource attributes, and combines the attribute values ​​of user X to construct the access permission request information with attributes and send it to the decision module;

[0091] (3) After receiving the access permission, the decision module compares the access permission request information with the access control policies in the local access control policy library one by one. If the attribute values ​​match, the access permission is granted according to the corresponding access control policy. Otherwise, the permission request is rejected and the permission control result is returned to the access authorization point of the access controller.

[0092] (4) After the access controller receives the permission control result, the policy execution point releases or blocks user access through the service interface based on the permission control result.

[0093] 3. The implementation methods of the intra-domain authority transfer phase include:

[0094] exist Figure 2 In a typical application scenario, user X in trust domain A currently has access rights to application service ① of network edge node 1 (i.e., old network edge node) and requests to access application service ① of network edge node 4 (i.e., new network edge node). Network edge node 1 and network edge node 4 jointly complete the intra-domain permission transfer operation.

[0095] (1) User X logs in to network edge node 4. If network edge node 4 determines that network edge node 1 is a trusted node in the same trust domain as it, it extracts the key characteristic attributes of user X, encapsulates them into attribute values, and sends permission transfer request information to network edge node 1. Otherwise, it rejects the permission request.

[0096] (2) After receiving the request, the access controller and decision module evaluate the permission transfer request of user X. If the evaluation passes, the attribute value of user X is sent to the network edge node 4. Otherwise, the permission request is rejected.

[0097] (3) After receiving the information, the network edge node 4 configures the access rights of user X to the application service ①;

[0098] (4) Network edge node 1 updates the local access control policy library to allow user X from network edge node 4 to access application service ①.

[0099] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for identity authentication and authority control of low-bandwidth network edge nodes, characterized in that: The method includes three stages: node identity authentication, user authority control, and intra-domain authority transfer. In the node identity authentication stage, the node unique code is used as a credential to realize two-way identity authentication between network edge nodes. Nodes that pass the authentication in the node identity authentication stage can perform user authority control and intra-domain authority transfer operations. In the user authority control stage, an access controller based on characteristic attributes is built to complete the access control policy matching of network edge nodes. In the intra-domain authority transfer stage, key characteristic attributes are extracted to perform an evaluation of user authority transfer within the same trust domain.

2. The method according to claim 1, characterized in that The execution process of the node authentication phase is as follows: (1) A network edge node sends a query message to the trust domain master node, appending the node's unique code; (2) The master node of the trust domain sends a response message to the network edge node to complete the node unique code exchange; (3) The network edge node and the trust domain master node execute the Diffie-Hellman key exchange protocol to generate a session key pair, and perform a two-way interactive identity authentication operation based on a random string to determine the legitimacy of the identities of the network edge node and the trust domain master node. The network edge node returns the identity authentication result to the trust domain master node. If the authentication passes, the next step is executed, otherwise the authentication fails. (4) The network edge node successfully joins the current trust domain, and the node identity authentication process ends.

3. The method according to claim 1, characterized in that The execution process of the user authority control stage is as follows: (1) After the network edge node that has successfully joined the current trust domain receives access permission request information from a user, it obtains the user's characteristic attribute information, calculates the user attribute value, and sends it to the access controller; (2) The access controller constructs access permission request information with attributes based on the operating environment and access resource conditions and sends it to the decision module; (3) The decision module matches the access control policies in the local access control policy library one by one, determines whether the access rights are legal, and feeds back the access control results to the access controller; (4) The access controller allows or blocks user access based on the permission control results.

4. The method according to claim 1, characterized in that The execution process of the intra-domain authority transfer phase is as follows: (1) After receiving a user's permission transfer request, the new network edge node determines the current trust domain status, extracts the user's key feature attribute information, calculates the user attribute value, and sends the permission transfer request information to the old network edge node; (2) The old network edge node evaluates the user's permission transfer request, determines whether the permission transfer is legal, and feeds back the user attribute value to the new network edge node; (3) The new network edge node configures user access rights to application services; (4) The old network edge node updates the local access control policy library and configures user access rights to application services.

5. The method according to claim 2, characterized in that In the node identity authentication stage, assume that network edge node 4 requests to join trust domain A, which already contains trusted network edge nodes 1, 2, and 3. At the same time, assume that network edge node 3 is the master node of the trust domain. In the initialization stage of the mobile communication network, all network nodes pre-agree on a certain fixed operation method, determine the public parameters of the Diffie-Hellman key exchange protocol, and assign unique codes and root keys to network edge nodes. For a certain network edge node i, its unique code is preset as ID i , the root key is KR i ; i represents the node number; then the execution process of the node identity authentication phase is as follows: (1) Network edge node 4 sends a query message to network edge node 3, where the query message includes a unique code ID 4 of network edge node 4; (2) Network edge node 3 sends a response message to network edge node 4, where the response message includes a unique code ID3 of network edge node 3; (3) Network edge node 4 performs two-way identity authentication with network edge node 3, the steps of which are as follows: a. The network edge node 3 performs the Diffie-Hellman key exchange protocol based on its own unique code ID3, the root key KR3, and the unique code ID4 of the network edge node 4 to calculate the session key KT3; b. The network edge node 4 executes the Diffie-Hellman key exchange protocol based on its own unique code ID4, the root key KR4, and the unique code ID3 of the network edge node 3 to calculate the session key KT4, satisfying that KT3 and KT4 are encryption and decryption keys for each other; c. The network edge node 3 selects a random string m, encrypts it using KT3, and sends it to the network edge node 4; d. After receiving the message, the network edge node 4 uses KT4 to decrypt the string m, performs a pre-agreed fixed operation, selects a random string n, concatenates the operation result of the string m with the string n in sequence, encrypts the string with KT4, and sends the string to the network edge node 3; e. After receiving it, the network edge node 3 uses KT3 to decrypt and obtain the string m * and n, if the result of m after fixed operation is equal to m * If they are equal, the network edge node 4 is determined to be legitimate, otherwise it is determined to be illegal and the authentication fails; if the network edge node 4 is determined to be legitimate, a pre-agreed fixed operation is performed on n, the identity authentication result P is sequentially concatenated with the operation result of the string n, encrypted using KT3, and sent to the network edge node 4; f. After receiving it, the network edge node 4 uses KT4 to decrypt and obtain the identity authentication result P and string n * , if the result of n after fixed operation is equal to n * If they are equal, the network edge node 3 is judged to be legitimate, otherwise it is judged to be illegal and the authentication fails; if the network edge node 3 is judged to be legitimate, the identity authentication result P is encrypted using KT4 and sent to the network edge node 3; g. The network edge node 3 uses KT3 to decrypt and obtain the authentication result P. The authentication is passed, allowing the network edge node 4 to access the current trust domain; (4) Network edge node 4 successfully joins trust domain A.

6. The method according to claim 3, characterized in that In the user authority control stage, assume that user X requests access rights to application service ① from network edge node 4 and sends access rights request information through the service interface of network edge node 4. The specific process of the user authority control stage is as follows: (1) The network edge node 4 obtains the characteristic attribute information of user X, calculates the hash value as the attribute value of user X, and sends it to the access controller; (2) The access controller consists of three components: a policy execution point, a permission evaluation point, and an access authorization point. Based on the access permission request information, the permission evaluation point obtains the operating environment attributes and access resource attributes, and combines the attribute values ​​of user X to construct the access permission request information with attributes and send it to the decision module. (3) After receiving the access permission, the decision module compares the access permission request information with the access control policies in the local access control policy library one by one. If the attribute values ​​match, the access permission is granted according to the corresponding access control policy. Otherwise, the permission request is rejected and the permission control result is returned to the access authorization point of the access controller. (4) After the access controller receives the permission control result, the policy execution point releases or blocks user access through the service interface based on the permission control result.

7. The method according to claim 4, characterized in that In the intra-domain permission transfer stage, assume that user X in trust domain A currently has access rights to application service ① of network edge node 1, i.e., the old network edge node, and requests to access application service ① of network edge node 4, i.e., the new network edge node. The intra-domain permission transfer operation is completed by network edge node 1 and network edge node 4 together. The specific process of the intra-domain permission transfer stage is as follows: (1) User X logs in to network edge node 4. If network edge node 4 determines that network edge node 1 is a trusted node in the same trust domain as it, it extracts the key characteristic attributes of user X, encapsulates them into attribute values, and sends permission transfer request information to network edge node 1. Otherwise, it rejects the permission request. (2) After receiving the request, the access controller and decision module evaluate the permission transfer request of user X. If the evaluation passes, the attribute value of user X is sent to the network edge node 4. Otherwise, the permission request is rejected. (3) After receiving the information, the network edge node 4 configures the access rights of user X to the application service ①; (4) Network edge node 1 updates the local access control policy library to allow user X from network edge node 4 to access application service ①.

8. The method according to any one of claims 1 to 7, characterized in that The method is applied in the field of information security technology.

9. A system for implementing the method according to any one of claims 1 to 8.

10. The system according to claim 9, characterized in that: The system is applied in the field of information security technology.

Images