Attribute-based access control policy extraction method, system, equipment and medium

Abstract

The invention relates to the technical field of access control, and discloses an attribute-based access control strategy extraction method, system and device and a medium. The method comprises the following steps: acquiring a plurality of policy statements which are described by a natural language and are used for access control; identifying the strategy statement by adopting a spaCy model so as to determine the strategy type of the strategy statement according to the sentence structure of the strategy statement, extracting a plurality of basic elements in the strategy statement according to the semantic features of the strategy statement, and determining the relationship among the plurality of basic elements in the strategy statement according to the grammar dependency of the strategy statement; generating a plurality of policy rules described by an ABAC mechanism by combining the policy type of each policy statement, the plurality of basic elements in the policy statement and the relationship among the plurality of basic elements, and establishing an ABAC policy model containing the plurality of policy rules; and the policy rule for access control is extracted from the access request, so that the method is suitable for various types of policies, and the expansibility is relatively high.

Description

Technical Field

[0001] The present invention relates to the field of access control technology, and in particular to an attribute-based access control policy extraction method, system, device and medium. Background Art

[0002] Access control policies are used to protect resources from being accessed by unauthorized users and to prevent abuse of power due to excessive user permissions, so as to ensure that legitimate users can correctly access system resources. For example, role-based access control (RBAC) mechanism and attribute-based access control (ABAC). Among them, the RBAC mechanism relies on entity identity, lacks flexibility and scalability, and cannot meet the fine-grained and dynamic functional requirements in actual application scenarios. The ABAC mechanism has high flexibility and expressibility, especially in large-scale distributed collaborative work environments. It can meet fine-grained and dynamically changing access authorization requirements. Therefore, the ABAC mechanism is widely used in the Internet of Things, blockchain, and industrial information integration systems.

[0003] In order to successfully implement the ABAC mechanism, it is particularly important to determine a suitable policy rule set and build a good ABAC policy engineering system. The access control system and authorization policies of the deployment organization are usually embedded in natural language documents, which describe what attributes the users and resources have, and which users can access which resources under what conditions.

[0004] However, traditional top-down strategy engineering technology is too simple and general when identifying and extracting strategy rules. It cannot be adapted to various types of strategies and has poor scalability. Summary of the invention

[0005] The purpose of the present invention is to provide an attribute-based access control policy extraction method, system, device and medium, which are suitable for various types of policies and have high scalability.

[0006] To solve the above technical problems, an embodiment of the present invention provides an attribute-based access control policy extraction method, comprising the following steps:

[0007] Obtaining a number of policy statements for access control described in natural language;

[0008] The spaCy model is used to identify the policy statement, so as to determine the policy type of the policy statement according to the sentence structure of the policy statement, extract multiple basic elements in the policy statement according to the semantic features of the policy statement, and determine the relationship between the multiple basic elements in the policy statement according to the grammatical dependency of the policy statement;

[0009] The policy types include positive policies, negative policies and conditional policies; the multiple basic elements include subjects, subject attributes, objects, object attributes and operations; the relationships between the multiple basic elements include assignment relationships between subjects and subject attributes, assignment relationships between objects and object attributes, inheritance relationships between subject attributes and subject attributes, and inheritance relationships between object attributes and object attributes;

[0010] Combining the policy type of each policy statement, multiple basic elements in the policy statement, and the relationship between the multiple basic elements, multiple policy rules described by the ABAC mechanism are generated to establish an ABAC policy model including multiple policy rules;

[0011] The policy rules for performing access control are extracted from the ABAC policy model according to the access request.

[0012] In some optional embodiments, extracting a policy rule for performing access control from the ABAC policy model according to the access request includes:

[0013] If there are multiple policy rules extracted from the ABAC policy model according to the access request, the conflict probability between the multiple policy rules is determined according to the semantic similarity between the multiple policy rules;

[0014] When the conflict probability between multiple policy rules is less than or equal to a preset threshold, multiple policy rules are used to perform access control.

[0015] In some optional embodiments, determining the conflict probability between the multiple policy rules according to the semantic similarity between the multiple policy rules includes:

[0016] The Jaccard coefficient is used to calculate the semantic similarity between multiple policy rules to determine the conflict probability between multiple policy rules.

[0017] In some optional embodiments, before extracting the policy rules for access control from the ABAC policy model according to the access request, the method further includes:

[0018] The ABAC policy model is converted into a Neo4j graph model using the Neo4j graph database, so that the basic elements of the ABAC policy model are represented by the nodes of the Neo4j graph model, and the relationships between multiple basic elements and policy types are represented by directed edges connecting different nodes.

[0019] In some optional embodiments, the nodes and directed edges are described using Cypher language.

[0020] In some optional embodiments, determining the policy type of the policy statement according to the sentence structure of the policy statement includes:

[0021] If the policy statement contains a negative word, the policy type of the policy statement is a negative policy;

[0022] If the strategy sentence contains an adverbial clause, the strategy type of the strategy sentence is a conditional strategy;

[0023] If the policy type of the policy statement is not a negative policy and is not a conditional policy, the policy type of the policy statement is a positive policy.

[0024] In some optional embodiments, the policy rules are described using XACML language.

[0025] An embodiment of the present invention further provides an attribute-based access control policy extraction system, comprising:

[0026] A statement acquisition module, used to acquire a number of policy statements for access control described in natural language;

[0027] A sentence recognition module, for recognizing a policy sentence using a spaCy model, so as to determine a policy type of the policy sentence according to a sentence structure of the policy sentence, extract a plurality of basic elements in the policy sentence according to a semantic feature of the policy sentence, and determine a relationship between the plurality of basic elements in the policy sentence according to a grammatical dependency of the policy sentence;

[0028] The policy types include positive policies, negative policies and conditional policies; the multiple basic elements include subjects, subject attributes, objects, object attributes and operations; the relationships between the multiple basic elements include assignment relationships between subjects and subject attributes, assignment relationships between objects and object attributes, inheritance relationships between subject attributes and subject attributes, and inheritance relationships between object attributes and object attributes;

[0029] A model building module, used to generate a plurality of policy rules described by the ABAC mechanism by combining the policy type of each policy statement, a plurality of basic elements in the policy statement, and the relationship between the plurality of basic elements, so as to establish an ABAC policy model including the plurality of policy rules;

[0030] The rule extraction module is used to extract policy rules for access control from the ABAC policy model according to the access request.

[0031] An embodiment of the present invention also provides a computer device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the above-mentioned attribute-based access control policy extraction method.

[0032] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program, wherein the computer program implements the above-mentioned attribute-based access control policy extraction method when executed by a processor.

[0033] The attribute-based access control policy extraction method provided by the present invention has at least the following beneficial effects:

[0034] The present invention uses the spaCy model to identify policy statements described in natural language, identifies the policy type described by the given policy description, the multiple basic elements contained therein, and the relationship between the multiple basic elements, and uses the policy type described by the given policy description, the multiple basic elements contained therein, and the relationship between the multiple basic elements to reconvert the policy description into a policy rule described by the ABAC mechanism, thereby constructing an ABAC policy model with good usability and strong scalability using multiple policy descriptions in a natural language policy database. The ABAC policy model takes into account the policy types of different policy descriptions, can support multiple different policy types such as positive, negative, and conditional, and takes into account the basic elements and their relationships in each policy description, and takes into account comprehensively when identifying and extracting policy rules, so as to adapt to the dynamic change requirements of the policy, and has high scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] One or more embodiments are exemplarily described by the pictures in the corresponding drawings, and these exemplary descriptions do not constitute limitations on the embodiments.

[0036] Figure 1 is a flow chart of an attribute-based access control policy extraction method provided according to an embodiment of the present invention;

[0037] Figure 2 is a schematic diagram of an ABAC policy model provided according to an embodiment of the present invention;

[0038] Figure 3 is a schematic diagram of a Neo4j graph model provided according to an embodiment of the present invention;

[0039] Figure 4 is a schematic diagram of an attribute-based access control policy extraction system provided according to an embodiment of the present invention;

[0040] Figure 5 It is a structural schematic diagram of a computer device provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical scheme and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the embodiments of the present invention, many technical details are proposed in order to enable the reader to better understand the present invention. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present invention can be implemented. The division of the following embodiments is for the convenience of description and should not constitute any limitation on the specific implementation of the present invention. The various embodiments can be combined and referenced with each other without contradiction.

[0042] An embodiment of the present invention relates to an attribute-based access control policy extraction method. The implementation details of the attribute-based access control policy extraction method of this embodiment are specifically described below. The following content is only the implementation details provided for the convenience of understanding and is not necessary for implementing this solution.

[0043] The specific process of the attribute-based access control policy extraction method of this embodiment can be as follows: Figure 1 As shown, including:

[0044] Step 101: Obtain several policy statements described in natural language for access control.

[0045] Specifically, a plurality of independent access control policy (Access Control Policy, ACP) statements, ie, policy statements, are decomposed from a pre-acquired natural language policy document.

[0046] Step 102, using the spaCy model to identify the policy statement, so as to determine the policy type of the policy statement according to the sentence structure of the policy statement, extract multiple basic elements in the policy statement according to the semantic features of the policy statement, and determine the relationship between the multiple basic elements in the policy statement according to the grammatical dependencies of the policy statement; wherein the policy type includes affirmative policy, negative policy and conditional policy; the multiple basic elements include subject, subject attribute, object, object attribute and operation; the relationship between the multiple basic elements includes the assignment relationship between the subject and the subject attribute, the assignment relationship between the object and the object attribute, the inheritance relationship between the subject attribute and the subject attribute, and the inheritance relationship between the object attribute and the object attribute.

[0047] Specifically, firstly, the components of the ABAC policy model including the basic element set, policy set and relationship set are defined. Among them, the basic element set E includes the subject (or user) set S, the subject attribute set SA, the object (or resource) set O, the object attribute set OA, and the operation set OP. The policy set P includes three types: positive, negative and conditional. The positive type indicates that a user with a certain attribute is allowed to access a resource with attribute characteristics in a certain operation mode; the negative type is a negative form of the positive policy; the conditional type is based on conditional events, and the corresponding operation mode is triggered when the event occurs, which is very practical in dynamic scenarios. The relationship set R includes the assignment relationship and the inheritance relationship. Assignment refers to the association relationship between an entity and the corresponding entity attribute, and the association relationship between an entity attribute and a policy class; inheritance refers to a partial order relationship between entity attributes of the same type and entity attributes. Among them, entities include users and resources.

[0048] Then, the spaCy model based on the NLP library is used to extract the semantic features of each ACP sentence, and it is repeatedly executed to iterate all ACP sentences. Each sentence marked with semantic features is then passed to the next step to determine the policy type. The spaCy model provides a variety of feature recognition extraction techniques, including word tagging, lexical prototypes, part-of-speech recognition, grammatical dependency parsing, and named entity recognition. Among them, word tagging is to divide the text into multiple tokens, part-of-speech recognition is to label each token as a noun, verb, adjective or adverb; lexical prototype is to convert a word into its prototype form. For example, the prototype of the word "prohibiting" is "prohibit"; grammatical dependency parsing builds a syntactic dependency relationship for each sentence, which is regarded as a navigation tree; named entity recognition is used to identify various named and numeric entities, such as companies, locations, organizations, products, etc. Then, these semantic features are used to extract triples of the form (subject, predicate, object), and the relationship between entities is identified based on the syntactic dependency tree.

[0049] Among them, the strategy type of the strategy statement is determined according to the sentence structure of the strategy statement, specifically including: if the strategy statement contains a negative word, the strategy type of the strategy statement is a negative strategy; if the strategy statement contains an adverbial clause, the strategy type of the strategy statement is a conditional strategy; if the strategy type of the strategy statement is neither a negative strategy nor a conditional strategy, the strategy type of the strategy statement is an affirmative strategy.

[0050] In the specific implementation, if the sentence structure contains negative forms such as "not, cannot", it is called a negative strategy. If no negative pattern is found, and other negative words are used, such as "prohibit, deny, disallow, prohibit, prevent, inhibit", it is also called a negative type, expressed as follows: Denied (SA'-OP'-OA'). If the sentence structure contains an adverbial clause, the ACP sentence is marked into two parts: event and response. One part of the independent clause represents the response, and the other part of the conditional clause corresponds to the event. Such a sentence structure is called a conditional strategy, which is a dynamic mechanism in the extended model that can modify the strategy structure, expressed as follows: Condition (Event: (SA'-OP'-OA') → Response (OP"-O')). If the sentence structure is neither conditional nor negative, it is called a positive strategy, expressed as follows: Positive (SA'-OP'-OA').

[0051] At the same time, multiple basic elements in the policy statement are extracted according to the semantic features of the policy statement, that is, model relations and elements are extracted from the ACP sentence, and the relations are added to the set to which they belong. For example, the sentence "auser cannot edit hisaccount number" can be marked as denied(user–{edit}–account number). At the same time, entity elements are extracted and associated with the corresponding attributes. If the entity element does not belong to any attribute, a new attribute is created to associate it with it.

[0052] Specifically, an ACP sentence containing a part-of-speech identification tag, a grammatical dependency tree or a subtree and has been marked is taken as input, and each marked item in the sentence is iterated repeatedly to extract the model elements such as users, resources, actions, etc. contained therein. If the part-of-speech identification tag is "verb", it means that the tag points to the verb of the sentence, and it is taken as the predicate part "predicate". If the tag token is "subj", the tag represents the pronoun "pron" or the noun "noun", which means that the tag points to the user, and it is extracted and added to the user table column, where nouns contain two types: proper nouns and common nouns, corresponding to specific users and user attributes, respectively. If the ACP sentence contains one or more subjects and only contains one "predicate" predicate, then these subjects are merged into one entity element. Similarly, if the token tag is "obj" and the part-of-speech identification tag is "pron" or "noun", then the tag points to the resource, which is extracted and added to the resource table column. When all tags have been iteratively checked, a set of triples of (subject, predicate, object) is returned. Next, it is assumed that an ACP sentence contains only a single subject and a single object. If the subject is a proper noun, then create a user-user attribute assignment relationship (S-SA) and add it to the assignment relationship set Assignment; if the object is also a specific noun, then create a resource-resource attribute assignment relationship (O-OA) and add it to the assignment relationship set Assignment. In addition, if the entity is a common noun, then create a SA-SA or OA-OA attribute hierarchy Hierarchy.

[0053] Step 103, combining the policy type of each policy statement, multiple basic elements in the policy statement, and the relationship between the multiple basic elements, generate multiple policy rules described by the ABAC mechanism to establish an ABAC policy model including multiple policy rules.

[0054] For example, the ABAC element set that extracts entities from the ACP policy document and populates the model is described as follows:

[0055] S={Alice, Bob}, O={Resource, Contract}, SA={Staff, HR, Company}, OA={HR-Docs, Files}, OP={read, write}. Figure 2 The corresponding ABAC policy model is given, in which nodes represent entities and entity attributes, and the relationships and policy rules include 4 assignment relationships and 3 inheritance relationships (represented by solid lines), as well as 2 policy rules (represented by dotted lines).

[0056] Step 104: extracting policy rules for access control from the ABAC policy model according to the access request.

[0057] In one example, before extracting policy rules for access control from an ABAC policy model according to an access request, the ABAC policy model is first converted into a Neo4j graph model using a Neo4j graph database, so that the basic elements of the ABAC policy model are represented by nodes of the Neo4j graph model, and the relationship between multiple basic elements and the policy type are represented by directed edges connecting different nodes. The nodes and directed edges are both described in Cypher language.

[0058] Specifically, we first use the Neo4j graph database to convert the components in the extended ABAC model into nodes and edges of the graph: Neo4j is an efficient, freely accessible graph storage warehouse. It organizes data into nodes, relationships, and property features. In the Neo4j graph model, a node is an independent entity with a set of properties; a relationship is a directed edge connecting two nodes with properties; a property is a tuple of the form (keyword, value) that represents a node or edge. Then, use Cypher to create policies or relationships: Cypher is a declarative query language similar to SQL, designed specifically for Neo4j. It has rich reserved word functions such as match, create, delete, return, etc. For example, the sentence "assigning the user attribute HCP to the userAlice" requires three Cypher reserved word functions. The first two Cyphers are used to create the user node s and the attribute node sa. The third Cypher is used to create an assignment type edge e (marked as assigned_to) and connect it to the nodes s and sa:

[0059] create(s: S), (sa, SA) where s.name="Alice" and sa.name="HCP";

[0060] match(s–create(e:Assignment(assigning: “assigned_to”))–sa).

[0061] In one example, after converting the ABAC policy model into a Neo4j graph model, it is tested. The testing process regards the subjects and subject attributes in the model as nodes, and uses assignment relationships, inheritance relationships, positive strategies, and negative strategies to establish connections between nodes, thereby forming a complete Neo4j graph model and extracting test cases.

[0062] Specifically, the ACP sentences shown in Table 1 are selected for testing and verification. Among them, there is a conflict between sentences 1 and 2 and sentence 4, and sentence 4 gives a sentence constructed using negative words. Sentences 5, 6, 7, and 8 respectively represent the hierarchical relationship between affirmative strategies, conditional strategies, and user attributes. In addition, sentences 9, 10, and 11 give the assignment relationship between users and user attributes, and sentences 12 and 13 give the assignment relationship between resources and resource attributes.

[0063] Table 1

[0064]

[0065] Figure 3 The graph model of the 13 statements in Table 1 converted into Neo4j is given. It can be seen that the graph contains 3 user nodes, 4 user attribute nodes, 2 resource attribute nodes, and 2 resource nodes; there are 5 assignment relationships between entities and entity attributes, connected by edges marked with "assigned_to"; there are 5 positive and 1 negative policies (indicated by dotted lines) between user attributes and resource attributes, connected by edges marked with "update, view, change, denied[create]" respectively. In addition, there are 2 inheritance relationships between user attributes and user attributes, connected by edges marked with "inheriting".

[0066] Next, create a path from the user node to the resource node in the Neo4j graph model to correctly match the ACP sentence. Specifically, use the match declarative statement, a reserved word in Cypher, to create all possible paths from the user attribute node to the resource attribute node, indicating that by executing different types of authorization policies, user nodes with attribute assignment and attribute inheritance relationships can obtain access operations to resource nodes. For example, the test case path corresponding to sentence 5 "Doctors can update the patient's record" is as follows:

[0067] [{name: "doctor"}, {ars: "update"}, {name: "record"}]

[0068] The test process first loads the path, and then converts the test script into a Python code instance. The policy script editor extracts the user from the first node, the access rights from the middle node, and the object from the last node, that is, the noun "doctor" as the user attribute node, the verb "update" as the access rights, and the noun "record" as the resource attribute node. Thus, the general expression is constructed as follows:

[0069] “.*doctor.*update.*record”, where “*” is a wildcard.

[0070] This process automatically loads the test path and executes the generated test cases to ensure that all ACP sentences in the model can be correctly extracted. If the test case cannot satisfy the sentence, then add new recognition rules and execute the process again.

[0071] In one example, when extracting policy rules for access control from an ABAC policy model according to an access request, if there are multiple policy rules extracted from the ABAC policy model according to the access request, the probability of conflict between the multiple policy rules is determined according to the similarity between the multiple policy rules, and then when the probability of conflict between the multiple policy rules is less than or equal to a preset threshold, the multiple policy rules are used for access control. Specifically, the Jaccard coefficient is used to calculate the similarity between the multiple policy rules to determine the probability of conflict between the multiple policy rules. The policy rules are described in the XACML language.

[0072] First, we give a description of the relevant concepts involved in the rule conflict problem:

[0073] (1) An attribute expression is represented by a triple of the form ap = (att, op, value), where att, op, and value represent the attribute name, action behavior, and attribute value, respectively.

[0074] (2) Use a form like The four-tuple of S represents the authorization rule. Among them, opi represents the operation behavior on the object, di represents the access decision and can only take the value of "permitted" or "denied". i ap and They represent attribute condition expressions containing several subjects and objects respectively. The set of all rules constitutes the ABAC policy, denoted as P = {ar1,ar2,…,arn}.

[0075] (3) Use a form like The triplet of indicates that the subject requests to perform the operation op on the object req .

[0077] (4) For policy rules ari and arj that simultaneously satisfy the access request req, if the intersection of the attribute conditions of the two rules has the same attribute value, the operation values ​​overlap but the decisions are different, then ari and arj are said to conflict with each other.

[0078] Secondly, according to the possibility of conflict between rules, the policy rules are divided into two categories: rules that may conflict and rules that do not conflict, and the identification conditions for whether the conflict occurs or not are given.

[0079] (1) Possible conflict conditions:

[0080]

[0081] d(ar)≠d(ar').

[0082]

[0083] att=att'.

[0084]

[0085] (2) No conflict conditions:

[0086] d(ar)=d(ar').

[0087]

[0088] Next, for the two conflicting rules ari, arj, it is assumed that there are common attributes att1, att2, ..., attn between them. If the access request is uncertain, the calculation of the conflict probability Prob(ari, arj) between the two rules is first given as follows:

[0089]

[0090] in, api, apj represent the attribute conditions of the common attributes respectively. Then, the similarity sim(api, apj) between the rules is calculated using the Jaccard coefficient in statistics.

[0091] Furthermore, the general policy engineering method is used to extract the initial policy rules and use them as input. According to the conflict rule classification, conflict detection is given and the conflict probability is calculated. The process is shown in Algorithm 1.

[0092]

[0093] In this embodiment, the spaCy model is used to identify policy statements described in natural language, and the policy type described, the multiple basic elements contained therein, and the relationship between the multiple basic elements are identified from a given policy description. The policy type described, the multiple basic elements contained therein, and the relationship between the multiple basic elements are used to reconvert the policy description into a policy rule described by the ABAC mechanism, thereby constructing an ABAC policy model with good usability and strong scalability using multiple policy descriptions in a natural language policy database. The ABAC policy model takes into account the policy types of different policy descriptions, and can support multiple different policy types such as positive, negative, and conditional. It also takes into account the basic elements and their relationships in each policy description, and takes into account all aspects when identifying and extracting policy rules, so that it can adapt to the dynamic changes in policies and has high scalability.

[0094] The step division of the various methods above is only for clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the protection scope of the present invention. Adding insignificant modifications or introducing insignificant designs to the algorithm or process without changing the core design of the algorithm and process are all within the protection scope of the invention.

[0095] Another embodiment of the present invention relates to an attribute-based access control policy extraction system. The implementation details of the ABAC-based policy extraction system of this embodiment are specifically described below. The following content is only for the convenience of understanding the implementation details provided, and is not necessary for the implementation of this solution. The schematic diagram of the ABAC-based policy extraction system of this embodiment can be as follows: Figure 4 As shown, it includes: a sentence acquisition module 401, a sentence recognition module 402, a model building module 403 and a rule extraction module 404.

[0096] Specifically, the statement acquisition module 401 is used to acquire a number of policy statements for access control described in natural language.

[0097] A statement recognition module 402, for recognizing a policy statement using a spaCy model, to determine a policy type of the policy statement according to a sentence structure of the policy statement, to extract a plurality of basic elements in the policy statement according to a semantic feature of the policy statement, and to determine a relationship between the plurality of basic elements in the policy statement according to a grammatical dependency of the policy statement;

[0098] Among them, the policy types include affirmative policies, negative policies and conditional policies; the multiple basic elements include subjects, subject attributes, objects, object attributes and operations; the relationships between the multiple basic elements include the assignment relationship between subjects and subject attributes, the assignment relationship between objects and object attributes, the inheritance relationship between subject attributes and subject attributes, and the inheritance relationship between object attributes and object attributes.

[0099] The model building module 403 is used to generate multiple policy rules described by the ABAC mechanism by combining the policy type of each policy statement, multiple basic elements in the policy statement, and the relationship between the multiple basic elements, so as to establish an ABAC policy model including multiple policy rules.

[0100] The rule extraction module 404 is used to extract policy rules for access control from the ABAC policy model according to the access request.

[0101] It is not difficult to find that this embodiment is a system embodiment corresponding to the above method embodiment, and this embodiment can be implemented in conjunction with the above method embodiment. The relevant technical details and technical effects mentioned in the above embodiment are still valid in this embodiment, and in order to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied in the above embodiment.

[0102] It is worth mentioning that all modules involved in this embodiment are logic modules. In practical applications, a logic unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. In addition, in order to highlight the innovative part of the present invention, this embodiment does not introduce units that are not closely related to solving the technical problem proposed by the present invention, but this does not mean that there are no other units in this embodiment.

[0103] Another embodiment of the present invention relates to a computer device, such as Figure 5 As shown, it includes: at least one processor 501; and a memory 502 that is communicatively connected to the at least one processor 501; wherein the memory 502 stores instructions that can be executed by the at least one processor 501, and the instructions are executed by the at least one processor 501 so that the at least one processor 501 can execute the attribute-based access control policy extraction method in the above-mentioned embodiments.

[0104] Among them, the memory and the processor are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors and memories together. The bus can also connect various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor is transmitted on a wireless medium via an antenna, and further, the antenna also receives data and transmits the data to the processor.

[0105] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

[0106] Another embodiment of the present invention relates to a computer-readable storage medium storing a computer program, which implements the above method embodiment when executed by a processor.

[0107] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including a number of instructions for a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as: ROM), random access memory (Random Access Memory, referred to as: RAM), disk or optical disk and other media that can store program codes.

[0108] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present invention, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present invention.

Claims

1. A method for extracting access control policies based on attributes, characterized in that: include: Obtaining a number of policy statements for access control described in natural language; The spaCy model is used to identify the policy statement, so as to determine the policy type of the policy statement according to the sentence structure of the policy statement, extract multiple basic elements in the policy statement according to the semantic features of the policy statement, and determine the relationship between the multiple basic elements in the policy statement according to the grammatical dependency of the policy statement; The policy types include positive policies, negative policies and conditional policies; the multiple basic elements include subjects, subject attributes, objects, object attributes and operations; the relationships between the multiple basic elements include assignment relationships between subjects and subject attributes, assignment relationships between objects and object attributes, inheritance relationships between subject attributes and subject attributes, and inheritance relationships between object attributes and object attributes; Combining the policy type of each policy statement, multiple basic elements in the policy statement, and the relationship between the multiple basic elements, multiple policy rules described by the ABAC mechanism are generated to establish an ABAC policy model including multiple policy rules; Policy rules for access control are extracted from the ABAC policy model according to the access request.

2. The attribute-based access control policy extraction method according to claim 1, characterized in that: The extracting of policy rules for performing access control from the ABAC policy model according to the access request includes: If there are multiple policy rules extracted from the ABAC policy model according to the access request, the conflict probability between the multiple policy rules is determined according to the semantic similarity between the multiple policy rules; When the conflict probability between multiple policy rules is less than or equal to a preset threshold, multiple policy rules are used to perform access control.

3. The attribute-based access control policy extraction method according to claim 2, characterized in that: The determining the conflict probability between the multiple policy rules according to the semantic similarity between the multiple policy rules includes: The Jaccard coefficient is used to calculate the semantic similarity between multiple policy rules to determine the conflict probability between multiple policy rules.

4. The attribute-based access control policy extraction method according to claim 1, characterized in that: Before extracting the policy rules for access control from the ABAC policy model according to the access request, the method further includes: The ABAC policy model is converted into a Neo4j graph model using the Neo4j graph database, so that the basic elements of the ABAC policy model are represented by the nodes of the Neo4j graph model, and the relationships between multiple basic elements and policy types are represented by directed edges connecting different nodes.

5. The attribute-based access control policy extraction method according to claim 4, characterized in that: The nodes and directed edges are described using Cypher language.

6. The attribute-based access control policy extraction method according to claim 1, characterized in that: The determining the policy type of the policy statement according to the sentence structure of the policy statement includes: If the policy statement contains a negative word, the policy type of the policy statement is a negative policy; If the strategy sentence contains an adverbial clause, the strategy type of the strategy sentence is a conditional strategy; If the policy type of the policy statement is not a negative policy and is not a conditional policy, the policy type of the policy statement is a positive policy.

7. The attribute-based access control policy extraction method according to claim 1, characterized in that: The policy rules are described in XACML language.

8. An attribute-based access control policy extraction system, characterized in that: The system comprises: A statement acquisition module, used to acquire a number of policy statements for access control described in natural language; A sentence recognition module, for recognizing a policy sentence using a spaCy model, so as to determine a policy type of the policy sentence according to a sentence structure of the policy sentence, extract a plurality of basic elements in the policy sentence according to a semantic feature of the policy sentence, and determine a relationship between the plurality of basic elements in the policy sentence according to a grammatical dependency of the policy sentence; The policy types include positive policies, negative policies and conditional policies; the multiple basic elements include subjects, subject attributes, objects, object attributes and operations; the relationships between the multiple basic elements include assignment relationships between subjects and subject attributes, assignment relationships between objects and object attributes, inheritance relationships between subject attributes and subject attributes, and inheritance relationships between object attributes and object attributes; A model building module, used to generate a plurality of policy rules described by the ABAC mechanism by combining the policy type of each policy statement, a plurality of basic elements in the policy statement, and the relationship between the plurality of basic elements, so as to establish an ABAC policy model including the plurality of policy rules; The rule extraction module is used to extract policy rules for access control from the ABAC policy model according to the access request.

9. A computer device, characterized in that: include: at least one processor; And, a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the attribute-based access control policy extraction method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the attribute-based access control policy extraction method according to any one of claims 1 to 7 is implemented.

Images