Access control strategy construction method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an access control strategy construction method and device, electronic equipment and a storage medium. The access control strategy construction method comprises the following steps: determining access control elements and attributes thereof of an application based on an acquired resource access scene; based on the access control elements and the attributes thereof, an access control strategy template is created according to different access control scenes, and the access control strategy template comprises preset access control elements and attributes; selecting the access strategy template based on a service demand and assigning a value to the attribute to create a corresponding access control strategy; and performing matching calculation on the access control strategy and the intercepted resource access request based on a strategy calculation engine, and if matching succeeds, executing a corresponding strategy action. Through the steps, access control configuration is more convenient and easier to understand, and access control is more flexible.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an access control strategy construction method, device, electronic device and storage medium. Background Art

[0002] With the rapid development of information technology, the Internet has been widely used in various fields. From enterprise information management to personal daily Internet activities, the Internet has become an indispensable part of modern society. In this context, network security issues have become increasingly prominent, and access control, as a key technology to ensure network security, has become increasingly important. Access control is an important means of controlling permissions and ensuring security in network access. It is used to limit specific subjects to access specific resources under specific conditions. Access control policy is the core and foundation for implementing access control.

[0003] At present, in the field of access control policies, role-based access control (RBAC) policies are widely used. RBAC implements the allocation and access control of access rights by building a many-to-many mapping relationship between users and roles, and roles and resource permissions. This method simplifies permission management to a certain extent and has certain convenience. However, RBAC policies have obvious limitations. It is mainly based on user authentication status and menu permissions for control, and implements the allocation and access control of access rights through many-to-many mapping between users and roles, and roles and resource permissions. This access control policy is relatively simple, and is basically a static policy based on user authentication status and menu permissions. It does not support other more complex and dynamic access control judgment factors, such as users, devices, and network link security status. It cannot meet the access control needs in complex and dynamic scenarios, and the configuration rules are complex and difficult to understand and use. In today's complex and changing network environment, network attack methods are becoming increasingly diverse and intelligent, and user access scenarios are no longer limited to simple authentication and fixed menu operations. For example, in a mobile office scenario, users may access enterprise resources in different network environments (such as corporate intranets and public Wi-Fi networks) through devices with different security levels (such as personal mobile phones or corporate tablets); or in a cloud computing environment, the distribution of resources and access requirements will change with the dynamic changes in business volume. Due to the lack of consideration of these dynamic factors, RBAC policies cannot effectively respond to access control requirements in such complex and dynamic scenarios, and it is difficult to ensure the security of network resources and the rationality of access, which can easily lead to security vulnerabilities and expose network systems to security risks such as data leakage and malicious attacks.

[0004] In summary, the existing RBAC access control strategy can no longer meet the increasingly complex network security needs. There is an urgent need for a more powerful, flexible, easy-to-understand and configure access control strategy construction method to improve the level of network security protection and ensure safe and reliable access to network resources. Summary of the invention

[0005] Based on the above problems, the embodiments of the present application provide an access control policy construction method, device, electronic device and storage medium to solve the above problems in the prior art.

[0006] A first aspect of the implementation manner of the present application provides a method for constructing an access control policy, which includes: Based on the obtained resource access scenario, determine the access control elements and their attributes of the application; Based on the access control elements and their attributes, creating access control policy templates according to different access control scenarios, wherein the access control policy templates include preset access control elements and attributes; Select the access policy template based on business requirements and assign values ​​to the attributes to create a corresponding access control policy; A matching calculation is performed on the access control policy and the intercepted resource access request based on the policy calculation engine, and if the match is successful, the corresponding policy action is executed.

[0007] Optionally, the application access control elements include: access subject, access object, access environment, and execution action; The access subject element attributes include: user identification, user department, user role, user position; the user identification includes: user name, user ID; The access object element attributes include: application, menu, server; The access environment factor attributes include: time, IP address, link status, terminal status; The execution action element attributes include: release, blocking, supplementary factor authentication, alarm, and log recording.

[0008] Optionally, determining the access control elements and attributes of the application based on the acquired resource access scenario includes: Obtain resource access scenarios and access request information; Determine the access subject element according to the interactive subject in the resource access scenario; obtain the access subject element attribute specifically includes: obtain the user identification attribute according to the login information of the access request, and obtain the user department, user role, and user position attribute associated with the user identification; Determine the access object element according to the access target in the resource access scenario; obtain the access object element attribute specifically includes: obtain the target resource information according to the access request target address, and determine the application, menu, and server attributes according to the target resource information; Determine the access environment elements according to the access request information; obtain the attributes of the access environment elements specifically including: obtain the timestamp based on the policy calculation engine to obtain the time attribute; obtain the IP address attribute according to the network connection information in the access request; monitor the network link related data according to the third-party network monitoring tool to obtain the link status attribute; obtain the terminal status attribute based on the third-party terminal management tool.

[0009] Determine the execution action element according to the access control requirements of the resource access scenario; obtain the execution action element attributes specifically including: determine one or a combination of release, blocking, supplementary factor authentication, alarm, and log attribute action type attributes based on business rules and trigger actions.

[0010] Optionally, the method further includes creating a system access control attribute dictionary based on the attribute, wherein the system access control attribute dictionary is used for sharing and reusing the attribute by the access control policy template and the access control policy.

[0011] Optionally, creating an access control policy template based on the access control elements and their attributes according to different access control scenarios comprises the steps of: Classify different access control scenarios based on the access control elements and their attributes to obtain access control scenario classification information; Create access control template information according to the access control scenario classification information, wherein the template information includes a template ID, a template name, a template version number and a template description; Preset access control elements and attributes are selected based on the template information to create an access control policy template.

[0012] Optionally, the selecting the access policy template based on business requirements and assigning values ​​to the attributes to create a corresponding access control policy specifically includes the following steps: Based on the acquired business rules, determine access control requirement information, the access control requirement information including the resources to be accessed, the user groups involved, the time and environmental conditions of the access, and the control actions to be triggered; Based on the access control requirement information, matching with the policy template attributes, selecting an access policy template; assigning values ​​to the attributes based on the access policy template and the access control requirement information to create a corresponding access control policy.

[0013] Optionally, the attribute assignment supports single values, set values ​​and logical operations.

[0014] Optionally, the policy-based calculation engine performs a matching calculation on the access control policy and the obtained resource access request, and if the match is successful, executes a corresponding policy action, including the following steps: The policy calculation engine obtains and analyzes the resource access request to obtain access information, wherein the access attribute information includes user identification, terminal IP, and client tool; Formatting the access attribute information to be consistent with the attribute format in the policy; Traverse the access control policies, and for each policy, match and calculate the attribute information in the request with the attribute value of the policy; If the match is successful, the action execution module performs the corresponding operation according to the execution action attributes of the policy; The execution action is completed and the resource request access processing is completed.

[0015] Optionally, the access control policy construction method further includes a matching calculation exception handling step: If an exception occurs during the matching calculation process, the detailed exception information will be recorded; Different handling methods can be adopted according to the severity of the exception: for E1-level exceptions, other policies can be matched; for E0-level exceptions, the request is processed according to the preset default action, and an error prompt message is sent to the administrator; The E1 level exception includes the failure of some attribute parsing but does not affect the overall matching; The E0 level exception includes an exception that causes the entire matching calculation to be unable to proceed.

[0016] Optionally, priority management of the strategy is also included, including: Set a priority value for each policy based on the policy priority list configuration. A lower priority value indicates a higher priority. When traversing the policies, first check the policies in order of priority. The high-priority policies are matched first. When none of the high-priority policies match or there is no high-priority policy, check the low-priority policies.

[0017] Optionally, after assigning values ​​to the attributes to create corresponding access control policies, the attribute values ​​may be changed according to changes in business requirements.

[0018] In a second aspect of the implementation manner of the present application, an access control policy construction device is provided, which is applied to implement the access control policy construction method described in any one of the first aspects of the implementation manner of the present application, and includes: The access control element and attribute management module is used to maintain the access control elements and their attributes of the application based on the obtained resource access scenario; An access control policy template creation module, used to create an access control policy template according to different access control scenarios based on the access control elements and their attributes, wherein the access control policy template includes preset access control elements and attributes; An access control policy creation module, used to select the access policy template based on business requirements and assign values ​​to the attributes to create a corresponding access control policy; The access control policy checking and executing module is used to perform matching calculation on the access control policy and the intercepted resource access request based on the policy calculating engine, and execute the corresponding policy action if the matching is successful.

[0019] In a third aspect of the implementation manner of the present application, an electronic device is provided, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the access control policy construction method described in any one of the embodiments of the present application.

[0020] In a fourth aspect of the embodiments of the present application, a computer storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the access control policy construction method described in any one of the embodiments of the present application is implemented.

[0021] The present application provides an access control policy construction method, device, electronic device and storage medium, which have the following beneficial effects: This application builds access control policies based on attributes, breaking through the limitations of traditional role-based access control (RBAC). In addition to the common user login status and menu access rights, it can also use multiple security factors such as user / device security status, network link status, access time period, etc. as access control judgment conditions, greatly enriching the dimensions of access control and adapting to complex and diverse network environments and application scenarios. In addition, in addition to basic blocking and release operations, it also supports any customized access control actions such as supplementary authentication, URL redirection, alarm reminders, and logging, making access control more flexible and better meeting security needs and management requirements in different business scenarios. At the same time, the target resources of access control are not limited to web applications and menus, but also cover any describable resources such as servers, further expanding the scope of control. Furthermore, this application defines access control policies based on the elements of network communication (subject, object, environment, action). This method is more in line with people's language description habits, vivid and easy to understand, reducing the complexity and difficulty of policy configuration, and enabling administrators or related personnel to design and manage access control policies more easily. At the same time, the use of templated configuration inherits the advantages of attribute-based access control (ABAC) that are flexible and easy to expand, while ensuring the convenience of configuration. By creating different access control policy templates, for different access control scenarios, the attributes included in the policy are agreed upon. When creating a policy, you only need to select the template and assign values, which greatly improves the efficiency of policy creation. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0023] Figure 1 A schematic diagram of a method for constructing an access control strategy according to an embodiment of the present application; Figure 2 A schematic diagram of an access control strategy construction device according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] The implementation of any technical solution of the embodiments of the present application does not necessarily require achieving all of the above advantages at the same time.

[0025] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] Figure 1 This is a flow chart of a method for constructing an access control strategy according to an embodiment of the present application. Figure 1 As shown, it includes: A method for constructing an access control policy, comprising: Based on the obtained resource access scenario, determine the access control elements and their attributes of the application; Based on the access control elements and their attributes, creating access control policy templates according to different access control scenarios, wherein the access control policy templates include preset access control elements and attributes; Select the access policy template based on business requirements and assign values ​​to the attributes to create a corresponding access control policy; A matching calculation is performed on the access control policy and the intercepted resource access request based on the policy calculation engine, and if the match is successful, the corresponding policy action is executed.

[0027] In this embodiment, first, the elements and attributes are determined according to the resource access scenario, which can accurately grasp the characteristics of the specific scenario, comprehensively cover the key access information, and avoid omissions. Next, a template with preset attributes is created according to the element attributes to provide an efficient basis for policy construction and ensure policy consistency and standardization. Then, the template assignment is selected as needed to create a policy, which can be customized to meet business needs and can flexibly respond to business changes. Finally, with the help of the policy calculation engine to match access requests and policies, real-time and accurate control can be achieved, access behaviors can be dynamically responded to, illegal access can be effectively prevented, and various policy actions can be executed according to the situation. At the same time, resource utilization and performance are optimized, network resource security is guaranteed, and efficient system operation is maintained.

[0028] Optionally, the application access control elements include: access subject, access object, access environment, and execution action; The access subject element attributes include: user identification, user department, user role, user position; the user identification includes: user name, user ID; The access object element attributes include: application, menu, server; The access environment factor attributes include: time, IP address, link status, terminal status; The execution action element attributes include: release, blocking, supplementary factor authentication, alarm, and log recording.

[0029] In this embodiment, extremely accurate identification of the access subject can be achieved through multi-dimensional user identification (user name, user ID) and attributes such as the user's department, role, position and security level. This helps to finely divide access rights according to the status, responsibilities and security status of different users in the organization. For example, users with senior positions and high security levels in the finance department can be granted access to key functions of a specific financial system, while other ordinary position users are restricted, thereby effectively preventing unauthorized access and ensuring data security. In addition, under the complex organizational structure and multi-level security strategy of large enterprises, the rich access subject attributes can be flexibly adapted. Whether it is department-based resource isolation, role-based and position-based functional access restrictions, or hierarchical access control of sensitive resources based on security levels, these attributes can be easily implemented, which improves the applicability and effectiveness of access control strategies in complex enterprise environments.

[0030] In addition, this embodiment covers the access object attributes of applications, menus, servers, etc., and can manage network resources comprehensively and meticulously. Access rules can be formulated for different applications, specific menu functions within applications, and servers that host resources. For example, for key data update menus for core business applications of an enterprise, strict access restrictions can be set to allow only specific personnel to access in specific environments to ensure the security and integrity of key business resources. This clear way of defining access object attributes is conducive to quickly sorting out and adjusting access control policies during enterprise resource integration and system expansion. When adding new applications or server resources, appropriate access control rules can be quickly determined based on their attributes, seamlessly integrated into the existing access control system, and the consistency and scalability of the overall network security architecture can be ensured.

[0031] This embodiment achieves dynamic environment adaptation and risk prevention by controlling access environment elements and attributes. Specifically, through access environment attributes such as time, IP address, link status and terminal status, access control can dynamically adapt to different network environments and time conditions. For example, access outside working hours or from non-enterprise internal network IP addresses can be restricted to effectively prevent external illegal intrusion; when the link status is unstable or there are security risks in the terminal device (such as not installing the latest security patch), the access rights can be adjusted to reduce the security risks caused by environmental factors. And multi-dimensional security monitoring and early warning are realized. Based on the monitoring of these access environment attributes, potential security issues can be discovered from multiple dimensions and the corresponding execution actions can be triggered in time. For example, abnormal IP address access can trigger blocking and alarming, unstable link status can be logged for subsequent analysis, and abnormal terminal status can require additional factor authentication, thereby building a comprehensive security monitoring and early warning system to enhance the initiative and timeliness of network security protection.

[0032] The embodiments of the present application realize flexible and diverse access control means through execution action elements and attributes, and provide flexible and diverse means for access control through rich execution action attributes such as release, blocking, supplementary factor authentication, alarm, and log recording. According to different access scenarios and security requirements, a suitable combination of execution actions can be selected. For example, for low-risk routine access, it can be directly released and logged; for suspected abnormal access, supplementary factor authentication can be performed first, and if the authentication fails, it will be blocked and alarmed, so as to realize the flexible deployment of access control strategies according to the risk level and business needs, and improve the refinement level of network security management. It also realizes complete access behavior auditing and tracing. The execution action attribute of logging ensures the complete record of all access behaviors, which is convenient for post-audit and tracing. Whether it is a normal access operation or a blocked illegal access attempt, detailed information can be found in the log, which is of great significance for analyzing security incidents, troubleshooting and meeting compliance requirements, and helps to improve the overall security management level and compliance capabilities of the enterprise.

[0033] Optionally, determining the access control elements and attributes of the application based on the acquired resource access scenario includes: Obtain resource access scenarios and access request information; Determine the access subject element according to the interactive subject in the resource access scenario; obtain the access subject element attribute specifically includes: obtain the user identification attribute according to the login information of the access request, and obtain the user department, user role, and user position attribute associated with the user identification; Determine the access object element according to the access target in the resource access scenario; obtain the access object element attribute specifically includes: obtain the target resource information according to the access request target address, and determine the application, menu, and server attributes according to the target resource information; Determine the access environment elements according to the access request information; obtain the attributes of the access environment elements specifically including: obtain the timestamp based on the policy calculation engine to obtain the time attribute; obtain the IP address attribute according to the network connection information in the access request; monitor the network link related data according to the third-party network monitoring tool to obtain the link status attribute; obtain the terminal status attribute based on the third-party terminal management tool.

[0034] Determine the execution action element according to the access control requirements of the resource access scenario; obtain the execution action element attributes specifically including: determine one or a combination of release, blocking, supplementary factor authentication, alarm, and log attribute action type attributes based on business rules and trigger actions.

[0035] In this embodiment, from the perspective of determining the access subject elements, the multi-dimensional attributes are determined based on the login information and related information, which can achieve accurate user positioning and authority definition. Enterprises can customize personalized access rights for different users based on attributes such as departments, roles, positions and security levels, effectively preventing internal personnel from overstepping their authority and ensuring data confidentiality and integrity. For example, core personnel in the R&D department can be granted high-level access rights to specific R&D resources, while ordinary employees in other departments are restricted, thereby maintaining the security of the company's core business information. In addition, for the determination of access object elements, the attributes of applications, menus, servers, etc. can be clarified with the help of the request target address, so that network resources can be managed in a refined manner. Access rules can be set for different applications, menu functions and servers, such as restricting ordinary users' access to key business system servers, and only allowing authorized personnel to operate sensitive menus of specific applications, thereby improving resource security and the accuracy of access control. Furthermore, by determining the access environment elements through various channels, based on the attributes such as the operating system timestamp, network connection information, acquisition time of third-party monitoring tools, IP address, link status and terminal status, it can dynamically adapt to different network environments and time conditions, and can restrict access during non-working hours or abnormal network environments (such as from unfamiliar IP addresses, unstable links, and terminal security risks), effectively preventing external illegal intrusions and security risks caused by environmental factors, and enhancing the adaptability and initiative of network security. Finally, according to business rules and triggering actions, the execution action elements are determined. The various execution action attributes such as release, blocking, supplementary factor authentication, alarm, and log recording can flexibly respond to different access scenarios. According to the degree of risk, normal access is released and recorded, and suspicious access is supplemented with authentication or blocked and alarmed, which not only ensures the smoothness of legal access, but also can promptly discover and handle illegal access, build a comprehensive and flexible access control mechanism, meet the diverse network security management needs and assist in compliance audits.

[0036] Optionally, the method further includes creating a system access control attribute dictionary based on the attribute, wherein the system access control attribute dictionary is used for sharing and reusing the attribute by the access control policy template and the access control policy.

[0037] In this embodiment, by establishing an access control attribute dictionary, in the process of creating an access control policy template, there is no need to repeatedly define the same attribute. Whether creating an access control policy template or a specific access control policy, the required attribute can be directly obtained from the attribute dictionary. For example, in multiple similar access scenarios, if the attribute "user security level" is involved, it can be quickly referenced through the attribute dictionary, reducing the workload of repeated input and definition, and greatly improving the efficiency of policy creation. In addition, the understanding and application of attributes are unified, so that the definition and use of attributes in the entire access control system are consistent. When different policy templates and access control policies reference the attributes in the attribute dictionary, their meanings and rules are unified, which avoids contradictions or errors that may be caused by differences in the understanding of attributes by different personnel when creating policies. For example, for the attribute "user department", all related policies have the same format and content standards, ensuring the accuracy and stability of the access control policy. In addition, attribute changes can be centrally managed. When a certain attribute needs to be modified or updated, it only needs to be operated in the attribute dictionary. Since all access control policy templates and access control policies share these attributes, modifying one place can affect the whole. For example, if an enterprise adjusts the user security level classification standard, it only needs to modify the relevant content of the "user security level" attribute in the attribute dictionary, and all policies using this attribute will be updated accordingly, greatly reducing maintenance costs and the possibility of errors, and facilitating long-term maintenance and management of the system. Finally, support for system expansion is conducive to the integration of new policies. With the development of business and changes in security requirements, it may be necessary to create new access control policies. The attribute dictionary provides rich attribute resources for new policies, and new policies can be easily built using existing attributes. At the same time, new attributes can also be added to the dictionary for use by future policies, making the entire access control system more scalable and adaptable.

[0038] Optionally, creating an access control policy template based on the access control elements and their attributes according to different access control scenarios comprises the steps of: Classify different access control scenarios based on the access control elements and their attributes to obtain access control scenario classification information; Create access control template information according to the access control scenario classification information, wherein the template information includes a template ID, a template name, a template version number and a template description; Preset access control elements and attributes are selected based on the template information to create an access control policy template.

[0039] In this embodiment, the scene classification processing based on elements and attributes is the basis for accurate customization of policies. By deeply analyzing the access control elements and their attributes to classify different access control scenarios, the unique characteristics and requirements of various scenarios can be accurately identified. For example, the scenarios are subdivided according to factors such as the different roles of the access subject, the resource importance level of the access object, and the differences in the access environment (such as internal network and external network), thereby providing an accurate basis for the subsequent creation of highly adapted policy templates, avoiding the disadvantage that the general template cannot meet the needs of specific scenarios, so that each scenario can be targeted and secured. Furthermore, creating a template containing multiple information helps to enhance the convenience of template identification and management. The setting of information such as template ID, name, version number and description greatly facilitates the identification, retrieval and management of the template in the entire access control system. When selecting and using templates, different departments or security administrators can quickly locate the template that meets the requirements based on the template name and description; and the version number helps to track the update history of the template, ensuring that the evolution of the template can be clearly understood during the policy adjustment and system upgrade process, facilitating rollback or comparison of differences between different versions, and effectively improving the convenience and controllability of template management. It can also promote team collaboration and communication. Clear and rich template information helps team members collaborate and communicate with each other. When formulating, reviewing and implementing access control policies, security teams can communicate based on unified template information standards to reduce misunderstandings or erroneous operations caused by information asymmetry. For example, when developers write access control-related codes, they can accurately understand their application scenarios and expected functions based on template instructions, improve development efficiency and code quality, and ensure the smooth construction and operation of the entire access control system. At the same time, creating templates by selecting preset access control elements and attributes based on template information ensures the standardization of policies. Creating access control policy templates by selecting preset access control elements and attributes based on template information ensures that policies are highly standardized in different access control scenarios. All policies created based on specific templates follow the same rule attribute selection settings and the same security rule framework, which reduces the risk of security vulnerabilities caused by human factors or configuration differences, improves the stability and reliability of the entire access control system, and makes the execution of access control policies more predictable and controllable. Finally, this design accelerates policy building and deployment. This templated creation method greatly speeds up the construction and deployment process of access control policies. When faced with new access control scenario requirements, security administrators only need to select appropriate templates based on scenario classification and fine-tune preset properties based on actual conditions. There is no need to design and configure the entire policy from scratch, which significantly shortens the cycle from policy planning to implementation, enables quick response to business changes and security threats, and enhances the system's dynamic adaptability.In this embodiment, preset access control elements and attributes are selected based on the template information to create an access control policy template. The access control elements selected here include one or a combination of access subject elements, access object elements, access environment elements, and execution action elements; the selected attributes include one or a combination of access subject element attributes, access object element attributes, access environment element attributes, and execution action element attributes. Of course, other access control elements and attributes may also be included to make the created access control policy template suitable for different access control scenario requirements.

[0040] Optionally, the selecting the access policy template based on business requirements and assigning values ​​to the attributes to create a corresponding access control policy specifically includes the following steps: Based on the acquired business rules, determine access control requirement information, the access control requirement information including the resources to be accessed, the user groups involved, the time and environmental conditions of the access, and the control actions to be triggered; Based on the access control requirement information, matching with the policy template attributes, selecting an access policy template; assigning values ​​to the attributes based on the access policy template and the access control requirement information to create a corresponding access control policy.

[0041] In this embodiment, determining the access control requirement information based on business rules is more in line with the actual business. Determining the access control requirement information based on business rules can ensure that the access control strategy is closely centered on the business. For example, the access control requirements of financial services at specific transaction times and for specific high-risk resources (such as large-amount transfer functions) can be accurately included in the access control requirement information, so that the access control strategy can truly serve the business security, avoid the problem of the security strategy being out of touch with the business, and can comprehensively cover the elements: consider the accessed resources, user groups, time, environmental conditions, and control actions in detail, and comprehensively cover all aspects that may affect access security. For multiple resource access scenarios in complex business processes, whether it is the use of various applications by different departments within the enterprise, or the access requirements in different time periods and different network environments, they can be accurately grasped, providing sufficient basis for subsequent accurate matching templates and assignments. In addition, in this embodiment, selecting a template based on matching the access control requirement information with the policy template attributes is helpful for the selection of accurate templates. By matching the access control requirement information with the policy template attributes, the template that best suits the business scenario can be quickly found, which avoids blind selection among many templates and improves the accuracy of template selection. For example, if a specific user group needs to be restricted from accessing sensitive resources during non-working hours, a template with corresponding time and user attribute restrictions can be quickly matched, saving time and effort in policy construction. Finally, by assigning attributes based on templates and access control requirement information to create policies, customized policies can be quickly generated. By assigning attributes based on templates and access control requirement information, access control policies that fully meet business-specific requirements can be created. For each unique business scenario, such as the special requirements of e-commerce platforms for server resource access during promotions, corresponding attribute values ​​can be accurately assigned (such as adding server access rights to specific operation and maintenance personnel), achieving highly customized access control policies and enhancing targeted protection of business resources. And it can flexibly respond to changes: when business needs change, attribute values ​​can be easily adjusted to update policies. For example, when an enterprise expands new business, adds new user groups, or adjusts working hours, it only needs to modify the corresponding attribute assignments without redesigning the entire access control architecture, so that access control policies can quickly adapt to dynamic changes in business and ensure business continuity and security.

[0042] Optionally, the attribute assignment supports single values, set values ​​and logical operations.

[0043] In this embodiment, the use of a single value assignment can achieve accurate definition of the access control policy. For example, for the user identification attribute, specifying a single user name or user ID can clearly set access rights for a specific user. This is very useful when it is necessary to grant special permissions to a key user (such as a system administrator) or restrict access to a specific user, which can avoid excessive or mis-authorization of permissions and ensure the security of the system and the confidentiality of data. In some simple and clear access control scenarios, the single value assignment method is simple and easy to understand, configure and manage. For example, for the access time attribute, setting it to a specific time point can clearly define the access rules at that moment, reducing complexity and reducing the possibility of errors caused by complex configuration. In addition, the set value assignment allows access control to be set for multiple attributes at the same time and access rules to be set uniformly, which facilitates centralized access control of these business-related resources and helps to achieve security management based on business logic. The logical operation assignment in this embodiment can cope with complex scenarios, and the logical operation (such as AND, OR, NOT) assignment can cope with complex access control scenarios and diversified business rules. For example, in the access control policy, you can set a logical condition such as (user role is "manager" and user security level is "high"), which means that only users who meet both conditions can access specific resources, thereby achieving more refined access control that is more in line with actual business logic. This method can handle the complex relationship between multiple attributes and meet the access control needs under complex organizational structures and multi-dimensional security requirements. Furthermore, through logical operations, the access control policy can be dynamically adjusted according to different conditions. For example, for the access time and IP address attributes, you can set the logical relationship of ((time is "working hours") or (IP address is the enterprise internal network address)), that is, you can access it by meeting one of the two conditions of working hours or using the enterprise internal network. This dynamic policy adjustment can better adapt to the flexible and changeable working mode and network environment changes of the enterprise, and improve the adaptability and practicality of the access control policy.

[0044] Optionally, the policy-based calculation engine performs a matching calculation on the access control policy and the obtained resource access request, and if the match is successful, executes a corresponding policy action, including the following steps: The policy calculation engine obtains and analyzes the resource access request to obtain access information, wherein the access attribute information includes user identification, terminal IP, and client tool; Formatting the access attribute information to be consistent with the attribute format in the policy; Traverse the access control policies, and for each policy, match and calculate the attribute information in the request with the attribute value of the policy; If the match is successful, the action execution module performs the corresponding operation according to the execution action attributes of the policy; The execution action is completed and the resource request access processing is completed.

[0045] In this embodiment, the policy calculation engine can collect key access information including user identification, terminal IP, client tools, etc. by acquiring and parsing resource access requests. This ensures a comprehensive understanding of access requests and provides a rich data foundation for subsequent accurate matching. For example, the identity of the visitor can be determined by the user identification, and the legitimacy of the access source can be determined by the terminal IP, thereby providing an accurate basis for the entire access control process. In addition, it can adapt to diverse request sources. In a modern network environment, access requests may come from many different types of terminals and clients. This acquisition and parsing mechanism can effectively handle various forms of requests, whether from desktop computers, mobile devices or other types of clients, and can accurately extract relevant information, thereby enhancing the adaptability of the access control system to a diverse network environment and ensuring the accuracy of access control in complex network scenarios. In addition, formatting the access attribute information can ensure the accuracy of the match, and formatting the access attribute information to be consistent with the attribute format in the policy eliminates matching errors that may be caused by inconsistent formats. Different policies may have specific format requirements when defining attributes, such as date format, IP address representation, etc. Through formatting, the uniformity of the request information and policy attributes in format is ensured, the accuracy of matching calculations is improved, and misjudgments due to data format problems are avoided, so that access control policies can be correctly applied to corresponding access requests. Furthermore, this formatting process establishes a standardized process, so that the entire access control system follows unified rules when processing access requests from different sources, which is not only conducive to the stable operation of the system, but also convenient for administrators to maintain and manage the system. All access requests go through the same formatting steps, ensuring consistency and predictability in subsequent matching calculations and policy execution processes.

[0046] In this embodiment, the access control policies are traversed and matched. Comprehensive policy coverage can ensure that each request can be compared with all relevant policies in the system without missing any applicable rules. In a complex access control system, there may be multiple policies of different levels and types. Through this traversal mechanism, the impact of various policies on access requests can be fully considered to ensure the integrity of access control. For example, for an access request within an enterprise, it may be constrained by department-level policies, user role-level policies, and resource-specific policies at the same time. The traversal process can accurately find all matching policies. The attribute information in the request is matched and calculated with the attribute value of the policy, and it can accurately determine whether to allow access according to the pre-set access control policy. This attribute-based matching method can handle various complex conditions and rules and realize fine-grained control of access requests. For example, based on the user's identity, access time, terminal device status, and other factors, it is comprehensively judged whether the access conditions are met, so as to make accurate access decisions, effectively prevent unauthorized access, and protect the security of system resources. At the same time, the corresponding policy actions are executed according to the matching results, so that the system has a variety of response capabilities. When the match is successful, the action execution module executes the corresponding operation according to the execution action attributes of the policy. This mechanism provides a variety of response methods. It can be to release the access request to meet the normal access needs of legitimate users to resources; it can also be to block access to prevent illegal or unauthorized access; it can also perform operations such as supplementary factor authentication, alarm or log recording, and respond flexibly according to different security policies and access scenarios. For example, for access requests for high-risk operations, you can first require supplementary factor authentication. If the authentication fails, the access is blocked and the log is recorded, realizing multi-level management of access behavior. In addition, by executing the corresponding policy actions, while ensuring the security of the system, the normal operation requirements of the business can be met. The release of legitimate access ensures the smooth progress of the business process, while the blocking and alarming of abnormal access protect the system from potential security threats. This balance enables the access control system to effectively protect resource security without causing unnecessary interference to the normal business activities of legitimate users, thereby improving the availability and security of the system. After the execution is completed, the resource request access processing is completed, forming a clear and efficient processing flow. This clear processing flow can quickly process a large number of access requests, avoiding the request staying in the system for a long time or causing confusion. Each access request can be processed in a timely and orderly manner, improving the overall performance and response speed of the system, ensuring user experience while maintaining the stability and security of the system. This process also provides users and administrators with clear feedback on processing results.Users can know whether their access requests are allowed, and administrators can understand the operation of the access control system and the access decision results through logs and other means, which facilitates auditing and troubleshooting, and further optimizes access control policies and system performance.

[0047] Optionally, the access control policy construction method further includes a matching calculation exception handling step: If an exception occurs during the matching calculation process, the detailed exception information will be recorded; Different handling methods can be adopted according to the severity of the exception: for E1-level exceptions, other policies can be matched; for E0-level exceptions, the request is processed according to the preset default action, and an error prompt message is sent to the administrator; The E1 level exception includes the failure of some attribute parsing but does not affect the overall matching; The E0 level exception includes an exception that causes the entire matching calculation to be unable to proceed.

[0048] In this embodiment, detailed exception information is recorded during the matching calculation process, which provides a key basis for subsequent troubleshooting and system optimization. When an access control problem occurs, the administrator can quickly locate the problem by viewing the exception information and understand which factors cause the exception, such as the parsing problem of a specific attribute or the compatibility problem of the system configuration. This helps to quickly solve the problem, reduce system downtime, and improve the reliability and availability of the system. The exception information helps developers to deeply understand the weak links of the system. By analyzing a large number of exception records, it is possible to find design defects or potential loopholes that may exist in the system, so as to improve and optimize the access control policy construction method or related system modules in a targeted manner, improve the overall performance and stability of the system, and enhance the adaptability to various complex situations. In addition, different processing methods are adopted according to the severity of the exception. For E1 level exceptions (partial attribute parsing fails but does not affect the overall matching), other policies are allowed to continue to match, which maximizes the continuity of the business. In a complex network environment, occasional minor problems in the parsing of some attributes will not cause the entire access request to be completely blocked, and legitimate users still have the opportunity to obtain access rights, thereby reducing unnecessary interference to the business process caused by minor problems and improving user experience and business efficiency. For E0 level exceptions (causing the entire matching calculation to be unable to proceed), the request is processed according to the preset default action and an error prompt message is sent to the administrator. While ensuring the security of the system, the administrator is notified in time to intervene. This method can prevent security vulnerabilities that may be caused by serious exceptions, such as unauthorized access, and enable administrators to quickly know and deal with key issues, ensuring that the system is in a safe and controllable state, maintaining the stability and security of the entire access control system.

[0049] Furthermore, you can also configure flexible exception level division and extended processing methods. The exception level division is not limited to E1 and E0, and there can be multiple exception levels and processing methods. This enables the system to flexibly adapt to complex and changeable network environments and business needs. With the development of the system and the expansion of application scenarios, new types of abnormal situations may arise. Through the extensible exception handling mechanism, you can easily add new exception levels and corresponding processing strategies to ensure that the access control system can make reasonable responses when facing various unknown situations, and has good scalability and adaptability.

[0050] Optionally, priority management of the strategy is also included, including: Set a priority value for each policy based on the policy priority list configuration. A lower priority value indicates a higher priority. When traversing the policies, first check the policies in order of priority. The high-priority policies are matched first. When none of the high-priority policies match or there is no high-priority policy, check the low-priority policies.

[0051] In this embodiment, the policy is managed with priority. By setting the priority for the policy, the access control policy for protecting key business resources can be given a high priority. For example, the access policy for the core database of the enterprise is set to a high priority. When processing the access request, a matching calculation will be performed first, which ensures that the key business resources are strictly protected at the first time to prevent unauthorized access and ensure the normal operation of the core business of the enterprise and data security. And meet compliance and regulatory requirements. In many industries, there are strict compliance and regulatory requirements that stipulate the protection level for specific sensitive information or key business processes. Priority management helps to meet these requirements, so that the access control policy complies with relevant laws, regulations and industry standards, and avoids legal risks and reputation losses due to violations. In addition, unnecessary matching calculations are reduced, and policies are checked in order of priority, and high-priority policies are processed first, avoiding indiscriminate traversal of all policies. In a complex access control system, there may be a large number of access control policies. If all policies are matched and calculated every time, a large amount of system resources and time will be consumed. Priority management can enable the system to process high-risk or important access requests faster and improve the efficiency of overall access control. Furthermore, high-priority policies are matched and calculated first to make access control more targeted. For access requests in some emergency situations or special scenarios, high-priority policies can be used to respond quickly, while for low-priority regular access requests, they will be processed if the high-priority policy does not match. This layered processing method can better adapt to diverse access scenarios.

[0052] In addition, in complex business scenarios, the importance and security requirements of different business operations may change over time and business conditions. Priority management allows the priority value of the policy to be flexibly adjusted according to business changes. Finally, when there are multiple related access control policies, priority management can coordinate the relationship between them. By setting priorities reasonably, it can ensure that different policies play a role at the right time, achieve the collaborative work of multiple policies, avoid conflicts and contradictions between policies, and make the entire access control system more stable and reliable.

[0053] Optionally, after assigning values ​​to the attributes to create corresponding access control policies, the attribute values ​​may be changed according to changes in business requirements.

[0054] In this embodiment, after creating an access control policy for attribute values, the attribute values ​​can be changed according to changes in business needs, which can enhance business adaptability and dynamically match business development. With the development of the enterprise's business, such as expanding new markets, launching new products, or adjusting business processes, its requirements for access control will also change accordingly. The attribute values ​​can be changed so that the access control policy can dynamically match business needs. For example, when an enterprise develops a new business and introduces a new user role, the access rights can be quickly adjusted by modifying the attribute values ​​related to the user role to ensure that the new business can be carried out in a secure access control environment. In addition, it can also cope with organizational structure adjustments. Changes in the organizational structure of an enterprise (such as department mergers, personnel transfers, etc.) may affect the access control policy. By changing the attribute values, the access rights corresponding to the attributes such as the user's department and position can be easily updated to ensure that the access control policy is consistent with the new organizational structure, avoid confusion in access rights caused by organizational changes, and maintain the security management order of internal information of the enterprise. In addition, security policies can be optimized to cope with new security threats. The network security threat situation is constantly changing, and new attack methods and vulnerabilities are constantly emerging. By adjusting attribute values ​​according to changes in business needs, security policies can be optimized to cope with new security challenges. For example, when a security threat targeting a specific terminal state (such as a certain operating system version) is found, the values ​​related to the terminal state attributes can be modified to strengthen access restrictions on such terminals and improve the security of the overall system. The access control granularity can also be flexibly adjusted. By flexibly adjusting attribute values ​​according to changes in business needs, the access control granularity can be optimized. If the business is more sensitive to a certain type of resource, the relevant attribute values ​​(such as time, IP address, etc.) can be refined to strengthen restrictions on access to the resource; conversely, if the business requires a more relaxed access environment, the attribute value range can be appropriately relaxed to balance the access control policy between security and business efficiency. Finally, cost-effectiveness is improved and reconstruction of the policy system is avoided. If the attribute value cannot be changed, when business needs change, the entire access control policy system may need to be rebuilt, which will consume a lot of manpower, material resources and time costs. The feature of changeable attribute values ​​only requires adjustment of related attributes to meet new needs, which greatly reduces costs, improves resource utilization efficiency, and also reduces new risks that may be introduced due to policy reconstruction.

[0055] Figure 2 A schematic diagram of an access control strategy construction device according to an embodiment of the present application is shown in FIG. Figure 2 As shown, in another embodiment, an access control policy construction device is provided, comprising: The access control element and attribute management module is used to maintain the access control elements and their attributes of the application based on the obtained resource access scenario; An access control policy template creation module, used to create an access control policy template according to different access control scenarios based on the access control elements and their attributes, wherein the access control policy template includes preset access control elements and attributes; An access control policy creation module, used to select the access policy template based on business requirements and assign values ​​to the attributes to create a corresponding access control policy; The access control policy checking and executing module is used to perform matching calculation on the access control policy and the intercepted resource access request based on the policy calculating engine, and execute the corresponding policy action if the matching is successful.

[0056] The access control device of the embodiment of the present application can be used to implement any access control policy construction method of the embodiment of the present application.

[0057] In another embodiment of the present application, an electronic device is also provided, including: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute operations corresponding to any access control policy construction method of the embodiments of the present application.

[0058] In another embodiment of the present application, a computer storage medium is provided, on which a computer executable program is stored. When the program is executed by a processor, any access control policy construction method of the embodiments of the present application is implemented.

[0059] The above-mentioned method according to the embodiment of the present application can be implemented in hardware, firmware, or implemented as software or computer code that can be stored in a recording medium (such as a CD, ROM, RAM, floppy disk, hard disk or magneto-optical disk), or implemented as a computer code originally stored in a remote recording medium or a non-temporary machine-readable medium downloaded through a network and to be stored in a local recording medium, so that the method described herein can be stored in such software processing on a recording medium using a general-purpose computer, a dedicated processor or programmable or dedicated hardware (such as an ASIC or FPGA). It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component (e.g., RAM, ROM, flash memory, etc.) that can store or receive software or computer code, and when the software or computer code is accessed and executed by a computer, a processor or hardware, an access control policy construction method is implemented.

[0060] It should be noted that the same and similar parts between the various embodiments in this specification can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments. The device and system embodiments described above are merely schematic, wherein the modules described as separate components may or may not be physically separated, and the components indicated as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. A person of ordinary skill in the art can understand and implement it without paying creative labor.

[0061] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for constructing an access control strategy, characterized in that: include: Based on the obtained resource access scenario, determine the access control elements and their attributes of the application; Based on the access control elements and their attributes, creating access control policy templates according to different access control scenarios, wherein the access control policy templates include preset access control elements and attributes; Select the access policy template based on business requirements and assign values ​​to the attributes to create a corresponding access control policy; A matching calculation is performed on the access control policy and the intercepted resource access request based on the policy calculation engine, and if the match is successful, the corresponding policy action is executed.

2. The access control strategy construction method according to claim 1, characterized in that: The application access control elements include: access subject, access object, access environment, and execution action; The access subject element attributes include: user identification, user department, user role, user position; the user identification includes: user name, user ID; The access object element attributes include: application, menu, server; The access environment factor attributes include: time, IP address, link status, terminal status; The execution action element attributes include: release, blocking, supplementary factor authentication, alarm, and log recording.

3. The access control strategy construction method according to claim 2 is characterized in that: Determining the access control elements and their attributes of the application based on the acquired resource access scenario includes: Obtain resource access scenarios and access request information; Determine the access subject element according to the interactive subject in the resource access scenario; obtain the access subject element attribute specifically includes: obtain the user identification attribute according to the login information of the access request, and obtain the user department, user role, and user position attribute associated with the user identification; Determine the access object element according to the access target in the resource access scenario; obtain the access object element attribute specifically includes: obtain the target resource information according to the access request target address, and determine the application, menu, and server attributes according to the target resource information; Determine the access environment factor according to the access request information; obtain the access environment factor attribute specifically including: obtain the timestamp based on the system to which the policy calculation engine belongs to obtain the time attribute; obtain the IP address attribute according to the network connection information in the access request; monitor the network link related data according to the third-party network monitoring tool to obtain the link status attribute; obtain the terminal status attribute based on the third-party terminal management tool; Determine the execution action element according to the access control requirements of the resource access scenario; obtain the execution action element attributes specifically including: determine one or a combination of release, blocking, supplementary factor authentication, alarm, and log attribute action type attributes based on business rules and trigger actions.

4. The access control strategy construction method according to claim 1, characterized in that: The method also includes creating a system access control attribute dictionary based on the attribute, wherein the system access control attribute dictionary is used for sharing and reusing the attribute by the access control policy template and the access control policy.

5. The access control strategy construction method according to claim 1, characterized in that: The method of creating an access control policy template based on the access control elements and their attributes according to different access control scenarios comprises the following steps: Classify different access control scenarios based on the access control elements and their attributes to obtain access control scenario classification information; Create access control template information according to the access control scenario classification information, wherein the template information includes a template ID, a template name, a template version number and a template description; Preset access control elements and attributes are selected based on the template information to create an access control policy template.

6. The access control strategy construction method according to claim 1, characterized in that: The step of selecting the access policy template based on business requirements and assigning values ​​to the attributes to create a corresponding access control policy specifically includes the following steps: Based on the acquired business rules, determine access control requirement information, the access control requirement information including the resources to be accessed, the user groups involved, the time and environmental conditions of the access, and the control actions to be triggered; Based on the access control requirement information, matching with the policy template attributes, selecting an access policy template; The attributes are assigned values ​​based on the access policy template and the access control requirement information to create a corresponding access control policy.

7. The access control strategy construction method according to claim 1, characterized in that: The policy-based calculation engine performs matching calculation on the access control policy and the obtained resource access request, and executes the corresponding policy action if the match is successful, including the following steps: The policy calculation engine obtains and analyzes the resource access request to obtain access information, wherein the access attribute information includes user identification, terminal IP, and client tool; Formatting the access attribute information to be consistent with the attribute format in the policy; Traverse the access control policies, and for each policy, match and calculate the attribute information in the request with the attribute value of the policy; If the match is successful, the action execution module performs the corresponding operation according to the execution action attributes of the policy; The execution action is completed and the resource request access processing is completed.

8. An access control policy construction device, characterized in that: include, The access control element and attribute management module is used to maintain the access control elements and their attributes of the application based on the obtained resource access scenario; An access control policy template creation module, used to create an access control policy template based on the access control elements and their attributes according to different access control scenarios, wherein the access control policy template includes preset access control elements and attributes; An access control policy creation module, used to select the access policy template based on business requirements and assign values ​​to the attributes to create a corresponding access control policy; The access control policy checking and executing module is used to perform matching calculation on the access control policy and the intercepted resource access request based on the policy calculating engine, and execute the corresponding policy action if the matching is successful.

9. An electronic device, characterized in that: include: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform an operation corresponding to the method according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images