Access permission authorization method and device, electronic equipment and storage medium

Abstract

The invention provides an access permission authorization method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining target information related to an access request, the target information comprising at least one of the following items: a first subject attribute, a first object attribute, an operation and an object corresponding to the operation; the first main body attribute comprises a client attribute and / or an environment attribute, and the client attribute comprises a user and / or a role of the user; and authorizing the authority of the access request based on the target information. Through the selection of the multi-dimensional attributes related to the access request, the accurate authorization of the user access authority can be realized in different industrial control system environments, the safety of the PLC is improved, and the safety of the industrial control system is further improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an access authority authorization method, device, electronic device and storage medium. Background Art

[0002] Industrial Control Systems (ICS) are essential in modern industrial environments, responsible for managing and coordinating the operation of industrial equipment. Traditional ICS rely on physical isolation to ensure system reliability, and are primarily exposed to risks from malicious insiders or operational errors. However, in recent years, ICS have gradually merged with Internet capabilities. Although this trend has enhanced management capabilities, it has also exposed ICS to more complex cyber threats. In ICS, Programmable Logic Controllers (PLCs) are the most commonly used control devices and the main target of cyber attacks. Due to the design characteristics of PLCs, many PLCs lack effective authentication mechanisms, making unauthorized access easy. For example, some PLCs use basic challenge or response authentication, while others only use simple built-in password protection, allowing attackers to easily perform attacks such as value modification and privilege escalation. In addition, industrial control devices usually have limited computing power and require instant response time, and any delay will affect system performance or security.

[0003] Among the related technologies, the Object Linking and Embedding for Process Control-Unified Architecture (OPC-UA) role-based access control (RBAC) model is integrated with the RBAC framework through the OPC-UA protocol, achieving efficient separation of tasks and access rights and simplifying permission management. However, this model is difficult to meet the needs of ICS in an environment where permissions need to be frequently updated. The OPC-Usage Control (UCON) model uses the OPC-UA framework to evaluate authorization by monitoring real-time attribute changes. This method enhances security and improves the adaptability of the system, but the selected attributes are less compatible with the ICS environment, and the time cost of each node is significant, which affects the high real-time requirements of ICS. The Geography (G)-Susceptible Infected Recovered (SIR) access control model introduces geo-social information to deal with internal threats. This model uses the Application Programming Interface (API) from social platforms to evaluate authorization. Programming Interface (API) to assess user trustworthiness through geo-social behavior, but the applicability of this model in ICS is limited due to the limited resources and processing power of industrial equipment and the weak network dynamics in ICS environments.

[0004] Therefore, the existing access control model is insufficient in dealing with the complexity and security requirements unique to ICS, which makes PLC vulnerable to security attacks and results in low security of PLC. Summary of the invention

[0005] The present invention provides an access authority authorization method, device, electronic equipment and storage medium, which are used to solve the problem of low security of PLC.

[0006] The present invention provides an access rights authorization method, comprising: Acquire target information related to the access request, the target information including at least one of the following: a first subject attribute, a first object attribute, an operation, and an object corresponding to the operation; the first subject attribute includes a client attribute and / or an environment attribute, and the client attribute includes a user and / or a role of the user; Based on the target information, the permission of the access request is authorized.

[0007] According to a method for authorizing access rights provided by the present invention, the authorization of the access request rights based on the target information includes: Determine, based on the target information, an attribute set required for the access request, the attribute set comprising a subject attribute set and an object attribute set, the subject attribute set and the object attribute set being respectively related to the role and the object, the subject attribute set comprising a plurality of second subject attributes, and the object attribute set comprising a plurality of second object attributes; Authorizing the access request based on each of the second subject attributes and each of the second object attributes.

[0008] According to an access authority authorization method provided by the present invention, the authorization of the access request authority based on each of the second subject attributes and each of the second object attributes includes: Based on each of the second subject attributes and each of the second object attributes and a plurality of pre-stored policies, a trust value between the subject attribute set and the object attribute set is determined; the policy represents a trust value between a third subject attribute and a third object attribute corresponding to objects of different levels divided based on importance when a user's role accesses them; Authorizing the access request based on the trust value, the first subject attribute, and the first object attribute.

[0009] According to an access right authorization method provided by the present invention, the trust value between the subject attribute set and the object attribute set is determined based on each of the second subject attributes and each of the second object attributes and a plurality of pre-stored policies, including: Determining a trust value between any second subject attribute and any second object attribute in the subject attribute set and the object attribute set based on a plurality of pre-stored policies; The trust values ​​between all the second subject attributes and the second object attributes are summed to obtain the trust value between the subject attribute set and the object attribute set.

[0010] According to an access right authorization method provided by the present invention, the authorization of the access request right based on the trust value, the first subject attribute and the first object attribute includes: respectively determining whether the trust value is greater than the level of the object, whether the second subject attribute and the second object attribute are within the union range of the first subject attribute and the first object attribute, and whether the operation is within the operation range allowed by the object; Authorize the access request when the trust value is greater than the level of the object, the second subject attribute and the second object attribute are within the union range of the first subject attribute and the first object attribute, and the operation is within the operation range allowed by the object.

[0011] According to a method for authorizing access rights provided by the present invention, the method further includes: Based on the authorization result of the permission of the access request, the object is executed, and the execution result is fed back to the client.

[0012] According to an access rights authorization method provided by the present invention, the environmental attributes include at least one of the following: geographic location, access time, MAC address of the access device, operating system version of the access device and software version of the access device; the first object attributes include at least one of the following: geographic information, access frequency, delay information and importance of the object.

[0013] The present invention also provides an access authority authorization device, comprising: an acquisition module, configured to acquire target information related to the access request, the target information including at least one of the following: a first subject attribute, a first object attribute, an operation, and an object corresponding to the operation; the first subject attribute includes a client attribute and / or an environment attribute, and the client attribute includes a user and / or a role of the user; The authorization module is used to authorize the permission of the access request based on the target information.

[0014] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, any of the above-mentioned access authority authorization methods is implemented.

[0015] The present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the access authority authorization X method described above is implemented.

[0016] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned access authority authorization methods.

[0017] The access authorization method, device, electronic device and storage medium provided by the present invention obtain target information related to the access request, and the target information includes at least one of the following: a first subject attribute, a first object attribute, an operation and an object corresponding to the operation; the first subject attribute includes a client attribute and / or an environment attribute, and the client attribute includes a user and / or a role of the user; and then based on the target information, the access request is authorized. By selecting multi-dimensional attributes related to the access request, accurate authorization of user access rights can be achieved in different industrial control system environments, thereby improving the security of the PLC and further improving the security of the industrial control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 It is a flowchart of the access rights authorization method provided by the present invention.

[0020] Figure 2 It is a schematic diagram of the interaction between the client, server and model provided by the present invention.

[0021] Figure 3 It is a structural diagram of the access rights authorization device provided by the present invention.

[0022] Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] In order to facilitate a clearer understanding of the embodiments of the present application, the relevant background knowledge is first introduced as follows.

[0025] In ICS, programmable logic controllers (PLCs) are the most commonly used control devices and are also the main target of cyber attacks. Due to the design characteristics of PLCs, many PLCs lack effective authentication mechanisms, making unauthorized access easy. For example, some PLCs use basic challenge / response authentication, while others only use simple built-in password protection, allowing attackers to easily perform attacks such as value modification and privilege escalation.

[0026] In addition, industrial control devices usually have limited computing power and require instant response time, and any delay will affect system performance or security. However, some existing access control models, such as Osliak's OPC-UCON model, produce significant real-time delays when performing real-time data analysis at each node, affecting the high real-time requirements of ICS.

[0027] As ICS further integrates with the Internet, network behavior and environmental conditions become more complex, increasing the difficulty of accurate authorization assessment. The existing OPC-UA Role-Based Access Control (RBAC) model achieves efficient permission management by separating tasks and access rights from user roles, but its dynamic permission change capability is limited and cannot meet ICS's need for frequent permission updates, which easily leads to role expansion problems.

[0028] Although the existing access control technology has improved the security of industrial control systems (ICS) to a certain extent, there are still many defects and shortcomings in practical applications.

[0029] 1. Insufficient authentication mechanism

[0030] (1) Lack of effective authentication. Many programmable logic controllers (PLCs) lack strong authentication mechanisms and are vulnerable to unauthorized access. For example, some PLCs use simple challenge / response authentication, while others rely on basic built-in password protection. These simple authentication methods do not provide adequate security and can be easily bypassed by attackers.

[0031] (2) Difficult to transform. Due to the long design and deployment cycle of industrial control equipment, many devices were not designed with modern cybersecurity threats in mind, making it difficult to add strong authentication mechanisms to existing systems. Some PLCs do not even have authentication functions at all, allowing attackers to easily modify values ​​and escalate privileges.

[0032] 2. Resource limitations and real-time requirements.

[0033] (1) Limited computing power. Industrial control equipment usually has limited computing resources and cannot support complex security mechanisms. Any overly complex security model will occupy valuable computing resources and affect the normal operation of the equipment.

[0034] (2) High real-time requirements. ICS devices need to respond instantly to ensure the security and efficiency of the system. However, some existing access control models (such as the OPC-UCON model) require real-time data analysis when evaluating authorization, which will cause significant delays and cannot meet the ICS's high real-time requirements. This delay will not only affect system performance, but may also bring security risks.

[0035] 3. Complex network behavior and environmental conditions.

[0036] (1) Complex network behavior. With the further integration of ICS and the Internet, network behavior has become more complex, and existing access control models are difficult to adapt to these changes. For example, although the OPC-UA role-based access control model (RBAC) provides convenience in permission management, its dynamic permission change capability is limited and it is difficult to cope with frequent permission update requirements. This limitation easily leads to role expansion problems and increases the complexity of management.

[0037] (2) Changes in environmental conditions. The network dynamics in the ICS environment are low, but it still needs to cope with changes in various environmental conditions. This makes authorization assessment more complex and difficult, and existing models are difficult to provide accurate authorization in complex network environments.

[0038] 4. Limitations of existing models.

[0039] (1) OPC-UA RBAC model: This model achieves efficient permission management by separating tasks and permissions through roles. However, its dynamic permission change capability is insufficient and it is difficult to adapt to the frequent update requirements of ICS. In addition, the RBAC model is prone to the problem of "role expansion" in permission management, which increases management complexity.

[0040] (2) OPC-UCON model: Although this model uses the OPC-UA framework to monitor real-time attribute changes to evaluate authorization and enhance security, the attributes it selects are less compatible with the ICS environment and the time cost of each node is high, which cannot meet the high real-time requirements of ICS.

[0041] (3) G-SIR model: This model introduces geo-social information and aims to deal with internal threats. However, due to the limited resources and processing capabilities of industrial equipment and the weak network dynamics in the ICS environment, the applicability of this model in ICS is limited.

[0042] 5. The diversity of security threats.

[0043] (1) Denial of service attack (DoS). The attacker sends a large number of invalid requests to the system, causing system resources to be exhausted and the system to be unable to provide normal services. The existing access control model has limited effect in dealing with DoS attacks.

[0044] (2) Eavesdropping attacks. Attackers intercept data packets to obtain sensitive information in the system. Many existing models lack effective encryption protection during data transmission and are easily eavesdropped by attackers.

[0045] (3) Data tampering attack. Attackers tamper with data packets during data transmission and deceive the control system, which may lead to serious consequences. Existing models are still insufficient in data integrity protection.

[0046] In summary, existing access control technologies have many deficiencies in authentication mechanisms, resource limitations, real-time requirements, network behavior complexity, and security threat response. Therefore, a new access control model is urgently needed to meet the specific needs of ICS and provide higher security and flexibility.

[0047] Combine the following Figure 1-Figure 2 The access authority authorization method of the present invention is described.

[0048] Figure 1 is a flow chart of the access authority authorization method provided by the present invention, such as Figure 1 As shown, the method includes the following steps 101-102.

[0049] Step 101: Obtain target information related to the access request, wherein the target information includes at least one of the following: a first subject attribute, a first object attribute, an operation, and an object corresponding to the operation; the first subject attribute includes a client attribute and / or an environment attribute, and the client attribute includes a user and / or a role of the user.

[0050] It should be noted that the access permission authorization method provided by the present invention can be applied to the security protection scenario of industrial control equipment in an industrial control system, for example, the security protection of PLC equipment; the executor of the method can be an access permission authorization device, such as an electronic device, or a control module in the access permission authorization device for executing the access permission authorization method.

[0051] Specifically, the target information related to the access request is obtained, and the target information includes at least one of the following: the first subject attribute (sattr), the first object attribute (oattr), the operation (oper), and the object corresponding to the operation (object, o); the first subject attribute includes the client attribute (CA) and / or the environment attribute (EA), and the client attribute includes the user (User, U) and / or the user's role (Role); the user represents the subject of the access request, which is used to determine the identity of the access entity and its role in the system; the role (Role) represents the set of all roles established in the system. In order to simplify ICS management, the separation of duties principle is followed, that is, different roles correspond to different responsibilities. The object includes at least one of the following: sensors, PLCs, and actuators.

[0052] The environmental attributes include at least one of the following: geographic location (Location, L), access time (Access Time, AT), media access control address (Media Access Control Address, MAC) address of the access device, operating system version (Operating System Version, OSVer) of the access device and software version (Software Version, SwVer) of the access device; the first object attribute includes at least one of the following: geographic information (Geographic Information, GeoInfo), access frequency (Frequency, Fq), delay information (Delay, D) and importance of the object (Importance, Ip).

[0053] Location (L) indicates the geographic location of a specified user. Only subjects in a specific area are allowed to perform certain tasks. Access Time (AT) indicates the user's access time. Time limits are required in ICS to reduce risks. Geographic Information (GeoInfo) indicates historical access events including specified locations, which is used to evaluate credibility. Access Frequency (Fq) is used to identify abnormal patterns. Delay (D) indicates the time consumed during the access process. Device access in ICS is usually stable, and network fluctuations are small. Attacks can be predicted by monitoring delays. Importance of the object (Importance, Ip): Authorization decisions are based on whether the trust value of the subject exceeds the importance of the object. MAC Address (MAC) indicates the MAC address of the access device, which is used to verify the identity of the device. Operating System Version (OSVer) indicates the version of the device operating system. Timely response to vulnerabilities to improve authorization accuracy. Software Version (SwVer) indicates the software version of the device, focusing on the role of software updates in security assessments.

[0054] Step 102: Authorize the access request based on the target information.

[0055] Specifically, based on the target information, the permission of the access request can be accurately authorized.

[0056] The access permission authorization method provided by the present invention obtains target information related to the access request, and the target information includes at least one of the following: a first subject attribute, a first object attribute, an operation, and an object corresponding to the operation; the first subject attribute includes a client attribute and / or an environment attribute, and the client attribute includes a user and / or a role of the user; and then based on the target information, the permission of the access request is authorized. By selecting multi-dimensional attributes related to the access request, accurate authorization of user access rights can be achieved in different industrial control system environments, improving the security of PLCs, and further improving the security of industrial control systems.

[0057] Optionally, a specific implementation of step 102 includes: (1) Based on the target information, determine an attribute set required for the access request, the attribute set comprising a subject attribute set and an object attribute set, the subject attribute set and the object attribute set being respectively related to the role and the object, the subject attribute set comprising a plurality of second subject attributes, and the object attribute set comprising a plurality of second object attributes.

[0058] Specifically, the present invention provides a multidimensional industrial control attribute access control model (MICABAC), which includes a policy administration point (PAP), a policy storage module Policy Store, a policy enforcement point (PEP), a policy decision point (PDP) and a policy information point (PIP).

[0059] The PEP receives the target information in a unified format from the context processor module of the server, and then sends the target information to the PDP, so that the PDP obtains the target information. Based on the target information, the PDP sends an attribute request (RA) to the PIP, and the attribute request carries the role and the object. The attribute request is used to obtain the attribute set required for the access request. Based on the color and object carried in the attribute request, the PIP sends the attribute set required for the access request to the PDP, and the attribute set includes a subject attribute set and an object attribute set, and the subject attribute set and the object attribute set are respectively related to the role and the object. The subject attribute set includes a plurality of second subject attributes, and the second subject attributes include client attributes and / or environmental attributes. The client attributes include users and / or user roles, and the environmental attributes include at least one of the following: geographic location, access time, MAC address of the access device, operating system version of the access device, and software version of the access device. The object attribute set includes a plurality of second object attributes, and the second object attributes include server attributes and / or object attributes. The server attributes include at least one of the following: geographic information, access frequency, and delay information. For example, RA={(x, y)|x∈Role, y∈O}. Different roles accessing different resources require different sets of attributes.

[0060] (2) Authorizing the access request based on the second subject attributes and the second object attributes.

[0061] Specifically, the PDP can accurately authorize the permission of the access request based on each second subject attribute and each second object attribute.

[0062] Optionally, the authorizing the permission of the access request based on each of the second subject attributes and each of the second object attributes includes: (2-1) Based on each of the second subject attributes and each of the second object attributes and a plurality of pre-stored policies, a trust value between the subject attribute set and the object attribute set is determined; the policy represents a trust value between a third subject attribute and a third object attribute corresponding to objects of different levels divided based on importance when a user's role accesses the object.

[0063] Specifically, the policy represents the trust value between the third subject attribute and the third object attribute corresponding to the objects of different levels divided based on importance based on the user's role access. The policy is generated by PAP based on the importance and role of the object.

[0064] Based on each second subject attribute and each second object attribute and multiple policies pre-stored in the policy storage module Policy Store, the PDP can further determine the trust value between the subject attribute set and the object attribute set, that is, the Trust Engine in the PDP calculates the trust value of the subject based on multi-dimensional attributes such as each second subject attribute and each second object attribute. The calculation of the trust value takes into account factors such as the user's geographical location, access time, frequency, and delay to ensure accurate evaluation of each access request.

[0065] (2-2) Authorizing the access request based on the trust value, the first subject attribute, and the first object attribute.

[0066] Specifically, the PDP can further accurately authorize the permission of the access request based on the trust value, the first subject attribute, and the first object attribute.

[0067] Optionally, the determining the trust value between the subject attribute set and the object attribute set based on each of the second subject attributes and each of the second object attributes and a plurality of pre-stored policies includes: (a) Based on a plurality of pre-stored policies, a trust value between any second subject attribute and any second object attribute in the subject attribute set and the object attribute set is determined.

[0068] Specifically, PDP uses Evaluated(attri∈RA(s.Role, o)) to determine the trust value between any second subject attribute and second object attribute in the subject attribute set and the object attribute set based on multiple pre-stored policies, attri belongs to the RA set of the access request, and attr includes the second subject attribute sattri and the second object attribute oattri required for evaluation.

[0069] (b) summing up the trust values ​​between all second subject attributes and second object attributes to obtain the trust value between the subject attribute set and the object attribute set.

[0070] Specifically, by summing up the trust values ​​between all the second subject attributes and the second object attributes, we can get the trust value between the subject attribute set and the object attribute set, that is, TrustEvaluated(sattr, oattr)=Evaluated(attri∈RA(s.Role,o)), where the TrustEvaluated function obtains the trust value by evaluating the attributes of the access request and the accessed subject (s), and only performs trust evaluation on the attributes required for the access request.

[0071] Optionally, the authorizing the permission of the access request based on the trust value, the first subject attribute, and the first object attribute includes: 1) respectively judging whether the trust value is greater than the level of the object, whether the second subject attribute and the second object attribute are within the range of the union of the first subject attribute and the first object attribute, and whether the operation is within the operation range allowed by the object.

[0072] Specifically, determine whether the trust value is greater than the level of the object (TrustEvaluated(sattr, oattr)≥o.Ip), whether the second subject attribute and the second object attribute are within the union of the first subject attribute and the first object attribute (RA(s.Role, o)⊆(s.SA∪o.OA)), and whether the operation is within the operation range allowed by the object (s.oper∈o.Oper).

[0073] 2) Authorizing the permission of the access request when the trust value is greater than the level of the object, the second subject attribute and the second object attribute are within the union range of the first subject attribute and the first object attribute, and the operation is within the operation scope allowed by the object.

[0074] Specifically, when the trust value is greater than the level of the object, the second subject attribute and the second object attribute are within the union of the first subject attribute and the first object attribute, and the operation is within the operation range allowed by the object, that is, Allowed(sattr, oper, oattr) ⇒(RA(s.Role, o) ⊆ (s.SA ∪o.OA)) ∧ (TrustEvaluated(sattr, oattr) ≥ o.Ip) ∧ (s.oper∈o.Oper), if the above conditions are met, the access request contains the necessary subject and object attribute information, the trust engine score exceeds the Ip of the object, and the permission of the requested operation is within the operation range allowed by the object, the permission of the access request is authorized, that is, the access permission is granted.

[0075] Optionally, the method further comprises: Based on the authorization result of the permission of the access request, the object is executed, and the execution result is fed back to the client.

[0076] Specifically, the PDP sends the authorization result of the access request permission to the PEP, so that the PEP executes the object and feeds back the execution result to the client.

[0077] Figure 2 is a schematic diagram of the interaction between the client, server and model provided by the present invention, such as Figure 2As shown, the client (OPC-UA Client) includes an identity request (Identity Requester) module and an access request (Access Requester) module; the server (OPC-UA Server) includes an authentication manager (Identity Authentication Manager) and a context processor (Context Processor); the multi-dimensional industrial control attribute access control model (MICABAC) includes a policy administration point (Policy Administration Point, PAP), a policy storage module Policy Store, a policy enforcement point (Policy Enforcement Point, PEP), a policy decision point (Policy Decision Point, PDP) and a policy information point (Policy Information Point, PIP); objects include sensors (Sensors), PLCs or drives (Actuators).

[0078] Step 1, PAP generates multiple policies based on the importance (Ip) and role (Role) of the object, and stores the multiple policies in the policy storage module. The policy represents the trust value between the third subject attribute and the third object attribute corresponding to the user's role access to objects of different levels divided based on importance.

[0079] Step 2: The user uses the access device to send an identity authentication request to the identity authentication manager through the identity request module. The identity authentication request includes the user's identity information and the first client attribute.

[0080] Step 3: The identity authentication manager receives the identity authentication request and authenticates the user's identity information based on the identity authentication request. If the authentication is successful, the authentication success information is sent to the identity request module.

[0081] In step 4, the authentication manager sends the client attributes to the context processor.

[0082] Step 5: The identity request module sends a verification success message to the access request module.

[0083] Step 6: The access request module sends target information to the context processor, where the target information includes: a first subject attribute (sattr), a first object attribute (oattr), an operation (oper), and an object (o) corresponding to the operation.

[0084] Step 7: The context processor receives the first client attribute, the first subject attribute (sattr), the first object attribute (oattr), the operation (oper), and the object corresponding to the operation (o), and performs standardization. The context processor sends the standardized information of the first client attribute, the first subject attribute (sattr), the first object attribute (oattr), the operation (oper), and the object corresponding to the operation (o) to the PEP.

[0085] Step 8: PEP sends the standardized target information including the first client attribute, the first subject attribute (sattr), the first object attribute (oattr), the operation (oper), and the object (o) corresponding to the operation to PDP.

[0086] Step 9: PDP sends an attribute request (RA) to PIP. The attribute request carries the role and object. The attribute request is used to obtain the attribute set required for the access request.

[0087] Step 10, based on the color and object carried in the attribute request, the PIP sends the attribute set required for the access request to the PDP, where the attribute set includes a subject attribute set and an object attribute set, where the subject attribute set and the object attribute set are respectively related to the role and the object, where the subject attribute set includes multiple second subject attributes, and where the object attribute set includes multiple second object attributes.

[0088] Step 11, PDP calls multiple policies stored in the policy storage module. Based on the pre-stored multiple policies, PDP uses Evaluated(attri∈RA(s.Role, o)) to determine the trust value between the subject attribute set and any second subject attribute and second object attribute in the object attribute set, attri belongs to the RA set of the access request, and attr includes the second subject attribute sattri and the second object attribute oattri required for evaluation. The trust value between the subject attribute set and the object attribute set can be obtained by summing up the trust values ​​between all the second subject attributes and the second object attributes, that is, TrustEvaluated(sattr, oattr)=Evaluated(attri∈RA(s.Role, o)), where the TrustEvaluated function obtains the trust value by evaluating the attributes of the access request and the subject (s) being accessed, and only performs trust evaluation on the attributes required for the access request. When the trust value is greater than the level of the object, the second subject attribute and the second object attribute are within the union of the first subject attribute and the first object attribute, and the operation is within the scope of the operation allowed by the object, that is, Allowed(sattr, oper, oattr) ⇒(RA(s.Role, o) ⊆ (s.SA ∪o.OA)) ∧ (TrustEvaluated(sattr, oattr) ≥ o.Ip) ∧ (s.oper∈o.Oper), if the above conditions are met, the access request contains the necessary subject and object attribute information, the trust engine score exceeds the Ip of the object, and the permission of the requested operation is within the scope of the operation allowed by the object, the permission of the access request is authorized, that is, the access right is granted.

[0089] Step 12: The PDP sends the authorization result of the access request to the PEP.

[0090] Step 13: PEP accesses the object and executes the object.

[0091] Step 14: PEP sends the execution result to the context processor.

[0092] Step 15: The context processor sends the execution result to the verification request module of the client.

[0093] The multi-dimensional industrial control attribute access control model (MICABAC) provided by the present invention can flexibly adapt to different ICS environments and is specifically implemented in the following manner.

[0094] a. Dynamic selection of attributes. The model can dynamically select and evaluate relevant attributes according to different environmental requirements. For example, in high-risk areas, the weight of geographic information (GeoInfo) and MAC addresses can be increased to improve the accuracy of access control.

[0095] b. Dynamic policy generation. PAP generates access control policies that adapt to different environments based on the importance (IP) and role (Role) of the object. These policies can be updated in real time according to environmental changes to ensure that the system can operate effectively in different scenarios.

[0096] c. Multi-protocol support. The MICABAC model can support multiple industrial protocols (such as OPC-UA) and can be expanded and adjusted according to the needs of different PLCs and protocols to ensure the applicability and flexibility of the model.

[0097] The multi-dimensional industrial control attribute access control model (MICABAC) provided by the present invention can also effectively defend against common network attacks by evaluating multi-dimensional attributes.

[0098] a. Denial of service attack (DoS). By monitoring access frequency (Fq) and latency (D), abnormal high-frequency access requests can be identified and restricted or rejected when necessary to prevent system resources from being exhausted.

[0099] b. Eavesdropping attack. Use geographic location (L) and geographic information (GeoInfo) attributes to limit the access area of ​​sensitive data and prevent unauthorized areas from accessing data. At the same time, combine MAC address and operating system version (OSVer) to ensure that only trusted devices and software versions can access data, reducing the risk of data being eavesdropped.

[0100] c. Data tampering attacks. Through strict time limits and trust value calculations, unauthorized users and devices are prevented from tampering with data. Any access request that does not meet the trust value requirements will be rejected to ensure the integrity and security of the data.

[0101] The present invention successfully implemented the MICABAC model in two actual ICS environments, namely the Gas Pipe Network System (GPNS) and the Computer Numerical Control (CNC) machine tool experimental environment. The experiment shows that in terms of system delay, although the MICABAC model reduces the read operation delay of a PLC device by 31.33% and the write operation delay by 19.01% (Siemens S7-300PLC) compared with other models, it reduces the read operation delay of another PLC device by 25.54% and the write operation delay by 20.31%. In terms of security, in GPNS, ​​the MICABAC model has a 97.80% defense success rate against eavesdropping attacks and a 96.49% defense success rate against data tampering attacks; in CNC, the defense success rate against eavesdropping attacks is 95.42% and the defense success rate against data tampering attacks is 94.86%.

[0102] In summary, the MICABAC model achieves precise control and protection of system resources in the ICS environment by combining multi-dimensional attributes and dynamic evaluation mechanisms, significantly improving the security and flexibility of the system.

[0103] It should be noted that network latency refers to the time from the client request to the execution of the operation on the PLC. The results obtained in GPNS are detailed in Table 1, which lists the average latency and standard deviation values ​​of read and write operations of two PLC devices under the MICABAC model, OPC-UA RBAC model and OPC-UCON model. As shown in Table 1, the latency of the MICABAC model increases slightly compared with the OPC-UA RBAC model: for PLC 1, the increase in read operations is 9.06% and the increase in write operations is 3.25%; for PLC 2, the increase in read and write operations is 10.92% and 17.31%, respectively. This difference may be caused by the presence of additional components in MICABAC, such as the evaluation engine. It is worth noting that the latency values ​​of MICABAC are within the acceptable range and comply with the specified maximum latency threshold of 200 milliseconds. In terms of operational efficiency, the MICABAC model has a read operation efficiency of 31.33% and a write operation efficiency of 19.01% on PLC 1 compared to the OPC-UCON model; for PLC 2, the efficiency of read and write operations is 25.54% and 20.31%, respectively. The OPC-UCON model uses a node-per-attribute structure, and each attribute requires a new node, which significantly increases the time overhead. In contrast, the MICABAC model effectively consolidates the nodes related to entity attributes into a single node, resulting in a total of only five nodes: PLC 1 read / write, PLC 2 read / write, and one attribute node.

[0104] Table 1. Average latency and standard deviation of read and write operations of two PLC devices under MICABAC model, OPC-UA RBAC model and OPC-UCON model

[0105] Compared with the existing technology, the MICABAC model achieves precise control of ICS system resources by dynamically selecting and evaluating multi-dimensional attributes, significantly improving system security.

[0106] Experiments show that in the real industrial control environments of GPNS and CNC, the MICABAC model performs well in defending against denial of service attacks, eavesdropping attacks, and tampering attacks. Specifically, the results of MICABAC in GPNS are: for eavesdropping attacks, the accuracy is 97.80%, and the false positive rate (FPR) is 4.23%; for tampering attacks, the accuracy is 96.49%, and the FPR is 6.86%. The results in CNC are: for eavesdropping attacks, the accuracy is 95.42%, and the FPR is 7.53%; for tampering attacks, the accuracy is 94.86%, and the FPR is 8.82%.

[0107] The access permission authorization device provided by the present invention is described below. The access permission authorization device described below and the access permission authorization method described above can be referred to each other.

[0108] Figure 3 Schematic diagram of the structure of the access authority authorization device provided by the present invention. Figure 3 As shown, the access permission authorization device 300 includes an acquisition module 301 and an authorization module 302; wherein,

[0109] The acquisition module 301 is used to acquire target information related to the access request, wherein the target information includes at least one of the following: a first subject attribute, a first object attribute, an operation, and an object corresponding to the operation; the first subject attribute includes a client attribute and / or an environment attribute, and the client attribute includes a user and / or a role of the user; The authorization module 302 is used to authorize the permission of the access request based on the target information.

[0110] The access permission authorization device provided by the present invention obtains target information related to the access request, and the target information includes at least one of the following: a first subject attribute, a first object attribute, an operation, and an object corresponding to the operation; the first subject attribute includes a client attribute and / or an environment attribute, and the client attribute includes a user and / or a role of the user; and then based on the target information, the permission of the access request is authorized. By selecting multi-dimensional attributes related to the access request, accurate authorization of user access permissions can be achieved in different industrial control system environments, thereby improving the security of PLCs and further improving the security of industrial control systems.

[0111] Optionally, the authorization module 302 is specifically configured to: Determine, based on the target information, an attribute set required for the access request, the attribute set comprising a subject attribute set and an object attribute set, the subject attribute set and the object attribute set being respectively related to the role and the object, the subject attribute set comprising a plurality of second subject attributes, and the object attribute set comprising a plurality of second object attributes; Authorizing the access request based on each of the second subject attributes and each of the second object attributes.

[0112] Optionally, the authorization module 302 is further configured to: Based on each of the second subject attributes and each of the second object attributes and a plurality of pre-stored policies, a trust value between the subject attribute set and the object attribute set is determined; the policy represents a trust value between a third subject attribute and a third object attribute corresponding to objects of different levels divided based on importance when a user's role accesses them; Authorizing the access request based on the trust value, the first subject attribute, and the first object attribute.

[0113] Optionally, the authorization module 302 is further configured to: Determining a trust value between any second subject attribute and any second object attribute in the subject attribute set and the object attribute set based on a plurality of pre-stored policies; The trust values ​​between all the second subject attributes and the second object attributes are summed to obtain the trust value between the subject attribute set and the object attribute set.

[0114] Optionally, the authorization module 302 is further configured to: respectively determining whether the trust value is greater than the level of the object, whether the second subject attribute and the second object attribute are within the union range of the first subject attribute and the first object attribute, and whether the operation is within the operation range allowed by the object; The permission for the access request is authorized when the trust value is greater than the level of the object, the second subject attribute and the second object attribute are within the union range of the first subject attribute and the first object attribute, and the operation is within the operation range allowed by the object.

[0115] Optionally, the access authority authorization device 300 further includes: The execution module is used to execute the object based on the authorization result of the permission of the access request, and feed back the execution result to the client.

[0116] Optionally, the environmental attributes include at least one of the following: geographic location, access time, MAC address of the access device, operating system version of the access device and software version of the access device; the first object attributes include at least one of the following: geographic information, access frequency, delay information and importance of the object.

[0117] Figure 4 is a schematic diagram of the physical structure of an electronic device provided by the present invention, such as Figure 4 As shown, the electronic device may include: a processor 410, a communications interface 420, a memory 430 and a communication bus 440, wherein the processor 410, the communications interface 420 and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the access permission authorization method, which includes: obtaining target information related to the access request, the target information including at least one of the following: a first subject attribute, a first object attribute, an operation and an object corresponding to the operation; the first subject attribute includes a client attribute and / or an environment attribute, the client attribute includes a user and / or a role of the user; based on the target information, the permission of the access request is authorized.

[0118] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0119] On the other hand, the present invention also provides a computer program product, which includes a computer program, and the computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the access permission authorization method provided by the above methods, and the method includes: obtaining target information related to the access request, and the target information includes at least one of the following: a first subject attribute, a first object attribute, an operation and an object corresponding to the operation; the first subject attribute includes client attributes and / or environment attributes, and the client attributes include users and / or the role of the user; based on the target information, authorizing the permission of the access request.

[0120] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the access permission authorization method provided by the above-mentioned methods, the method comprising: obtaining target information related to the access request, the target information comprising at least one of the following: a first subject attribute, a first object attribute, an operation and an object corresponding to the operation; the first subject attribute comprises a client attribute and / or an environment attribute, the client attribute comprises a user and / or a role of the user; based on the target information, authorizing the permission of the access request.

[0121] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0122] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0123] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for authorizing access rights, characterized in that: include: Acquire target information related to the access request, the target information including at least one of the following: a first subject attribute, a first object attribute, an operation, and an object corresponding to the operation; the first subject attribute includes a client attribute and / or an environment attribute, and the client attribute includes a user and / or a role of the user; Based on the target information, the permission for the access request is authorized.

2. The access authority authorization method according to claim 1, characterized in that: The authorizing the permission of the access request based on the target information includes: Determine, based on the target information, an attribute set required for the access request, the attribute set comprising a subject attribute set and an object attribute set, the subject attribute set and the object attribute set being respectively related to the role and the object, the subject attribute set comprising a plurality of second subject attributes, and the object attribute set comprising a plurality of second object attributes; Authorizing the access request based on each of the second subject attributes and each of the second object attributes.

3. The access authority authorization method according to claim 2, characterized in that: The authorizing the permission of the access request based on each of the second subject attributes and each of the second object attributes includes: Based on each of the second subject attributes and each of the second object attributes and a plurality of pre-stored policies, a trust value between the subject attribute set and the object attribute set is determined; the policy represents a trust value between a third subject attribute and a third object attribute corresponding to objects of different levels divided based on importance when a user's role accesses them; Authorizing the access request based on the trust value, the first subject attribute, and the first object attribute.

4. The access authority authorization method according to claim 3, characterized in that: The step of determining the trust value between the subject attribute set and the object attribute set based on each of the second subject attributes and each of the second object attributes and a plurality of pre-stored policies includes: Determining a trust value between any second subject attribute and any second object attribute in the subject attribute set and the object attribute set based on a plurality of pre-stored policies; The trust values ​​between all the second subject attributes and the second object attributes are summed to obtain the trust value between the subject attribute set and the object attribute set.

5. The access authority authorization method according to claim 3, characterized in that: The authorizing the permission of the access request based on the trust value, the first subject attribute and the first object attribute includes: respectively determining whether the trust value is greater than the level of the object, whether the second subject attribute and the second object attribute are within the union range of the first subject attribute and the first object attribute, and whether the operation is within the operation range allowed by the object; The permission for the access request is authorized when the trust value is greater than the level of the object, the second subject attribute and the second object attribute are within the union range of the first subject attribute and the first object attribute, and the operation is within the operation range allowed by the object.

6. The access authority authorization method according to any one of claims 1 to 5, characterized in that: The method further comprises: Based on the authorization result of the permission of the access request, the object is executed, and the execution result is fed back to the client.

7. The access authority authorization method according to any one of claims 1 to 5, characterized in that: The environmental attributes include at least one of the following: geographic location, access time, MAC address of the access device, operating system version of the access device and software version of the access device; the first object attributes include at least one of the following: geographic information, access frequency, delay information and importance of the object.

8. An access rights authorization device, characterized in that: include: an acquisition module, configured to acquire target information related to the access request, the target information including at least one of the following: a first subject attribute, a first object attribute, an operation, and an object corresponding to the operation; the first subject attribute includes a client attribute and / or an environment attribute, and the client attribute includes a user and / or a role of the user; The authorization module is used to authorize the permission of the access request based on the target information.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the access permission authorization method according to any one of claims 1 to 6 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the access permission authorization method according to any one of claims 1 to 6 is implemented.

Images