System authority management method based on composite authority access control model

Abstract

The invention relates to the technical field of authority management, in particular to a system authority management method based on a composite authority access control model, and the method comprises the steps: obtaining user information, dynamically allocating roles for users, and dynamically allocating authorities for the roles; establishing association between the operation corresponding to the authority and the object; adding tasks and tense constraints in the association of the operation and the object; according to the system function and the user environment, the length of a permission chain is controlled by selecting a matrix so as to associate the system permission, and the permission chain comprises one or more of a user, a role, a task, an operation and an object. Establishing a data storage strategy matched with the composite permission access control model, and constructing a corresponding database according to the data storage strategy to store user, role, object, operation and permission data; setting a data sharing strategy; in the data transmission process, sensitive data in a database is encrypted, and an access control strategy, an auditing and monitoring strategy and an emergency response strategy are set.

Description

Technical Field

[0001] The present invention relates to the technical field of authority management, and in particular to a system authority management method based on a composite authority access control model. Background Art

[0002] In today's digital age, as information systems become increasingly complex and large, the role of permission management systems becomes increasingly prominent. In various permission management systems, the frequently used permission access modules present diverse characteristics, each of which has its own unique principles and application scenarios.

[0003] The ACL model (Access Control List) is a basic and common permission management method. The DAC model (Discretionary Access Control) gives resource owners the right to autonomously control their access rights. The MAC model (Mandatory Access Control) is a more stringent permission management method. According to the sensitivity of the information and the security level of the user, the access of users of different levels to various types of confidential information can be strictly restricted to ensure that the information is not leaked. The ABAC model (Attribute-Based Access Control) makes access control decisions based on the attributes of the subject and the object. For example, in a medical information system, the attributes of the doctor's title, professional field, etc. are combined with the attributes of the patient's medical record information to determine whether the doctor has the right to access the medical records of a specific patient. The RBAC model (Role-Based Access Control) is one of the most widely used permission management models. It separates users from permissions, defines different roles, assigns corresponding permissions to each role, and then assigns users to specific roles to achieve user access control to resources. The TBAC model (Task-Based Access Control) focuses on assigning permissions based on the tasks performed by users. The OBAC model (Object-Based Access Control) takes objects as the core and determines access rights based on the attributes of the object and the context of the visitor. The UCON model (Usage Control) is a more comprehensive access control model that takes into account multiple factors such as subject, object, environment, etc., and implements control over resource access through a series of usage rules and policies. In large systems, due to the complexity and diversity of the business, multiple access control models are usually used at the same time. The existence of multiple models requires coordinated and collaborative management of the system, which undoubtedly increases the complexity and difficulty of management. In the process of multi-model collaboration, security vulnerabilities are prone to occur. For example, unclear permission boundaries and permission conflicts between different models affect the security of the system and the confidentiality of data.

[0004] To this end, we propose a system permission management method to comprehensively manage system permissions through a model. Summary of the invention

[0005] The present invention dynamically manages system permissions according to system functions and access requirements of each node through a composite permission access control model.

[0006] The technical solution proposed by the present invention is: a system authority management method based on a composite authority access control model, the method comprising:

[0007] Establish the association between tasks, objects, users, roles and permissions based on the composite permission access control model;

[0008] Establish a data storage strategy that matches the composite permission access control model, and build a corresponding database based on the data storage strategy to store user, role, object, operation and permission data;

[0009] Set up data sharing strategies to achieve the transmission of data in the database between various nodes in the system. The data sharing strategies include role-based data sharing strategies and object-based fine-grained sharing strategies. During the data transmission process, the sensitive data in the database is encrypted, and access control strategies, audit and monitoring strategies, and emergency response strategies are set up.

[0010] The association between task and object attributes and permissions based on the composite permission access control model includes the following steps:

[0011] Obtain user information and dynamically assign roles to users, and dynamically assign permissions to roles;

[0012] Establish the association between the operations and objects corresponding to the permissions;

[0013] Adding task and temporal constraints in the association of operations with objects;

[0014] According to the system function and user environment, the length of the permission chain is controlled by selecting a matrix to associate system permissions. The permission chain includes one or more of users, roles, tasks, operations, and objects.

[0015] Preferably, a user table is constructed, wherein the user table includes a user ID, a user name, a user password hash value, and user related information;

[0016] Constructing a role table, wherein the role table includes role ID, role name and role description information;

[0017] Constructing an object table, wherein the object table includes object ID, object name, object type, object attributes, object creation time, object owner, and allowed access permission ID;

[0018] Constructing an operation table, wherein the operation table includes multiple operation IDs, operation names, and operation descriptions;

[0019] Constructing a permission table, wherein the permission table includes multiple permission IDs, multiple role IDs, multiple object IDs, multiple operation IDs, multiple permission start times, and multiple permission end times; associating the role table through the role ID, and associating the operation table through the object ID;

[0020] A user role allocation table, wherein the user role allocation table includes: multiple user IDs, multiple role IDs, multiple role start times and multiple role end times, and the user table is associated with the user ID, and the role table is associated with the role ID.

[0021] Preferably, the data sharing strategy is set to realize the transmission of data in the database between various nodes of the system. The data sharing strategy includes a role-based data sharing strategy and an object-based fine-grained sharing strategy, including:

[0022] Determine the scope of data that users can access and share based on their roles;

[0023] Determine whether the role has the access rights to the corresponding object. If so, proceed to the next step; otherwise, return to the previous step.

[0024] In the process of sharing data, verify the source and integrity of the data, and encrypt the transmission of the shared data;

[0025] For specific objects, different access levels and sharing policies are set according to object attributes and business rules to achieve object-based fine-grained sharing.

[0026] Preferably, during the data transmission process, the sensitive data in the database is encrypted, and access control strategies, audit and monitoring strategies, and emergency response strategies are set, including:

[0027] During data transmission, the SSL / TLS protocol is used to encrypt data transmission to ensure the security of data during network transmission;

[0028] For sensitive data, use the database's own encryption function or a third-party encryption library to implement data storage encryption;

[0029] Use multi-factor authentication to ensure the authenticity of the user's identity;

[0030] Authorize user access requests based on their roles and permissions;

[0031] Follow the principle of least privilege and avoid granting users multiple permissions;

[0032] Regularly back up the data in the database and transfer the backup data to other storage locations;

[0033] When a security incident occurs, we divide responsibilities according to the emergency response process and take actions such as blocking the system, prohibiting access, and repairing vulnerabilities.

[0034] Preferably, the obtaining of user information and dynamically assigning roles to users includes:

[0035] According to the obtained user information, obtain the user ID from the user table and assign it to the corresponding user;

[0036] Get multiple role IDs from the role table, and assign multiple role IDs to the user ID according to the user's work requirements;

[0037] The user information includes one or more of a system node name, a system node IP address, and a system node description.

[0038] Preferably, the association between the operation corresponding to the authority and the object includes:

[0039] Get multiple operation IDs, operation names and operation descriptions from the operation table;

[0040] Get the operation ID associated with the corresponding permission ID from the permission table, and associate the operation table with the operation ID;

[0041] Get the object ID associated with the permission ID from the permission table, and associate the object table with the object ID.

[0042] Preferably, adding task and temporal constraints in the association between the operation and the object includes:

[0043] Constructing a task table, the task table includes a task ID, a task name, a task description, multiple operation IDs, a user ID and a role ID, a task start time and a task end time;

[0044] Associate the operation table with the operation ID to obtain the operations that can be performed on the corresponding task;

[0045] At the task start time, adjust the permission acquisition priority of the task so that it is the same as the permission acquisition priority of the role;

[0046] The task start time and task end time are used to constrain the time length of the task acquisition operation. After the task end time is reached, the permission acquisition priority of the task is adjusted so that the permission acquisition priority of the task is lower than the permission acquisition priority of the role, and the task can no longer obtain permissions.

[0047] Preferably, the controlling the length of the permission chain by selecting a matrix according to the system function and the user environment to associate the system permissions includes:

[0048] Constructing the selection matrix ,in, The value is 0 or 1; , Indicates the total number of nodes or tasks in the system;

[0049] The permissions of the corresponding nodes are controlled by selecting the row vector of each row of the matrix;

[0050] The specific steps include:

[0051] Set up The permission chain of each node is user-role-task-operation-object. This chain means that after the user obtains the permission, the permission is assigned to the role, the role assigns the permission to the task, and the task assigns the permission to the operation, and the operation allowed by the permission is performed on the corresponding object;

[0052] Set up The row vector of a node is ;

[0053] If, The system function of a node has changed and the access rights need to be set based on the task. The value of is set to 0, The value of is set to 1, that is:

[0054] , then it means The permission chain of each node is reorganized into user-task-operation-object. At this time, after obtaining permission, the user no longer assigns the permission to the role, but directly assigns the permission to the task.

[0055] Preferably, after obtaining the permission, the user no longer assigns the permission to the role, but directly assigns the permission to the task, including:

[0056] Composite permission access control model access task table;

[0057] The role ID information is blocked so that the task list cannot be associated with the role ID;

[0058] Returns the blocked role ID information;

[0059] Cyclic Reading When When the value of is restored to 1, the character ID is unblocked.

[0060] The present invention also provides an electronic device, which is used to execute the system authority management method based on the composite authority access control model.

[0061] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the system authority management method based on a composite authority access control model.

[0062] Beneficial effects of the present invention:

[0063] 1. The present invention manages the permission transfer process, adjusts the source of permissions, and establishes permission chains of different lengths (the permission transfer process) through a composite permission access control model. It can dynamically adjust the access control strategy of the entire system or system nodes and realize the functions of multiple permission models.

[0064] 2. The present invention sets a selection matrix, and each row of the selection matrix represents the rights chain of a node, that is, the authority flow process of the node, and each element corresponds to an authority flow point. By adjusting the value of the element in each row vector (a row vector corresponds to a system node) in the selection matrix to 0 or 1, the change in the authority flow of the node is represented. For example, if a node in the network requires role-based access control, the association between the task table and the user table is shielded. At this time, the second element value in the row vector is set to 0, and the remaining elements are set to 1. The direction of authority flow is user-role-operation-object, that is, setting authority based on role is realized. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 The present invention is a flow chart of a system authority management method based on a composite authority access control model. DETAILED DESCRIPTION

[0066] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art can think of other obvious variations. The basic principles of the present invention defined in the following description can be applied to other embodiments, variations, improvements, equivalents, and other technical solutions that do not deviate from the spirit and scope of the present invention.

[0067] It is to be understood that the term "one" should be understood as "at least one" or "one or more", that is, in one embodiment, the number of an element may be one, while in another embodiment, the number of the element may be multiple, and the term "one" should not be understood as a limitation on the quantity.

[0068] refer to Figure 1 The technical solution provided by the present invention is: a system authority management method based on a composite authority access control model, comprising the following steps:

[0069] Before establishing the association between tasks, objects, users, roles and permissions, it is necessary to import a composite permission access control model. The composite permission access control model in this embodiment includes the following modules:

[0070] User-role assignment module, through which a user can have multiple roles, and a role can be assigned to multiple users. This assignment relationship can change dynamically over time, for example, according to the user's work needs or project cycle.

[0071] Role-permission allocation module, through which each role is assigned a set of permissions, which determine which operations the role can perform on which objects. Similarly, this allocation relationship can also be dynamically adjusted according to business rules and security policies.

[0072] The object-operation association module defines the types of operations allowed for each object, ensuring that only authorized operations can be performed on the object.

[0073] Temporal constraint module, through which time dimension constraints are added to the role-permission assignment and user-role assignment modules. For example, a role may only have certain permissions within a specific time period, or a user may only have certain roles within a certain time period.

[0074] The task constraint module generates a task list and operates the items in the task list, including shielding and restoring the items in the task list, thereby associating or stopping associating the role list, operation list, etc.

[0075] A context-aware module that considers the user's environmental information (such as device type, geographic location, network environment, etc.) as a decision factor for access control, further enhancing security;

[0076] The selection matrix generation module generates a selection matrix according to different system network functions and access policies, and assigns values ​​to the elements in the selection matrix, thereby controlling the association between different modules (establishing associations and temporarily terminating associations) and managing system permissions.

[0077] Then, after obtaining the composite permission access control model, the association between tasks, objects, users, roles and permissions is established based on the composite permission access control model. This process includes the following steps:

[0078] Obtain user information and dynamically assign roles to users, and dynamically assign permissions to roles;

[0079] Establish the association between the operations and objects corresponding to the permissions;

[0080] Adding task and temporal constraints in the association of operations with objects;

[0081] According to the system function and user environment, the length of the permission chain is controlled by selecting a matrix to associate system permissions. The permission chain includes one or more of users, roles, tasks, operations, and objects.

[0082] Then, a data storage strategy matching the composite permission access control model is established, and a corresponding database is constructed according to the data storage strategy to store user, role, object, operation and permission data, including the following steps:

[0083] Construct a user table, which includes user ID, user name, user password hash value, and user related information;

[0084] Constructing a role table, wherein the role table includes role ID, role name and role description information;

[0085] Constructing an object table, wherein the object table includes object ID, object name, object type, object attributes, object creation time, object owner, and allowed access permission ID;

[0086] Constructing an operation table, wherein the operation table includes multiple operation IDs, operation names, and operation descriptions;

[0087] Constructing a permission table, wherein the permission table includes multiple permission IDs, multiple role IDs, multiple object IDs, multiple operation IDs, multiple permission start times, and multiple permission end times; associating the role table through the role ID, and associating the operation table through the object ID;

[0088] A user role allocation table, wherein the user role allocation table includes: multiple user IDs, multiple role IDs, multiple role start times and multiple role end times, and the user table is associated with the user ID, and the role table is associated with the role ID.

[0089] After completing the data construction, you need to set up a data sharing strategy, including role data sharing of each node and granular sharing strategy of objects, including the following steps:

[0090] First, define the user's roles and permissions. Each role has different access levels and sharing policies.

[0091] Determine the scope of data that the user can access and share based on the user's role. This can be achieved by querying the database or configuration file. Specifically: Use the dictionary roles to define different roles and their corresponding permissions. Use the dictionary users to store user information, including username, role, and password. Use the dictionary objects to store object information, including object name, owner, allowed access permission ID, access level, and data content.

[0092] Determine whether the role has the access permission for the corresponding object. If the user does not have the permission, return to the previous step.

[0093] When sharing data, verify the origin and integrity of the data. This can be done by checking the hash value of the data or other verification methods.

[0094] At the same time, the shared data is encrypted for transmission. Symmetric encryption algorithms (such as AES) or asymmetric encryption algorithms (such as RSA) can be used to protect the security of data transmission.

[0095] For specific objects, set different access levels and sharing policies based on object attributes and business rules. For example, some objects may only be accessible to users with specific roles, while other objects may require higher permissions to access.

[0096] Implements fine-grained object-based sharing, which means different users can have different access rights to the same object.

[0097] When data is shared and transmitted between various nodes in the system, it is necessary to ensure the security, integrity and availability of the data. The following steps are included:

[0098] Use SSL / TLS protocol for encrypted transmission. SSL / TLS protocol uses public key encryption technology (such as RSA) and symmetric encryption technology (such as AES) to protect the security of data transmission.

[0099] The client and server negotiate the encryption suite through the handshake process and generate a session key for subsequent data encryption transmission.

[0100] Use the database's built-in encryption function or a third-party encryption library (such as OpenSSL) to encrypt sensitive data stored in the database. Common encryption algorithms include AES, DES, etc.

[0101] Use password + OTP (one-time password) or other forms of two-factor authentication (such as SMS verification code, biometrics, etc.). Users need to provide multiple credentials when logging in to increase the security of identity authentication.

[0102] Authorize user access requests based on their roles and permissions. Each role has a specific set of permissions, and users can only perform operations allowed by their roles.

[0103] Avoid giving users too many permissions and grant them only the minimum permissions required to complete their work. This can be achieved through fine-grained permission management.

[0104] The data in the database is backed up regularly and transferred to other storage locations (such as off-site data centers). In the event of data loss or damage, the data can be quickly restored.

[0105] When a security incident occurs, respond according to the pre-established emergency response process. Responsibilities are clearly divided, and actions such as blocking systems, prohibiting access, and repairing vulnerabilities are taken.

[0106] In some preferred embodiments, obtaining user information and dynamically assigning roles to users includes the following steps:

[0107] According to the obtained user information, obtain the user ID from the user table and assign it to the corresponding user;

[0108] Get multiple role IDs from the role table, and assign multiple role IDs to the user ID according to the user's work requirements;

[0109] The user information includes one or more of a system node name, a system node IP address, and a system node description.

[0110] In some preferred embodiments, establishing an association between an operation corresponding to a permission and an object includes the following steps:

[0111] Get multiple operation IDs, operation names and operation descriptions from the operation table;

[0112] Get the operation ID associated with the corresponding permission ID from the permission table, and associate the operation table with the operation ID;

[0113] Get the object ID associated with the permission ID from the permission table, and associate the object table with the object ID;

[0114] In some preferred embodiments, adding task and temporal constraints in the association between the operation and the object includes:

[0115] Constructing a task table, the task table includes a task ID, a task name, a task description, multiple operation IDs, a user ID and a role ID, a task start time and a task end time;

[0116] Associate the operation table with the operation ID to obtain the operations that can be performed on the corresponding task;

[0117] At the task start time, adjust the permission acquisition priority of the task so that it is the same as the permission acquisition priority of the role;

[0118] The task start time and task end time are used to constrain the time length of the task acquisition operation. After the task end time is reached, the permission acquisition priority of the task is adjusted so that the permission acquisition priority of the task is lower than the permission acquisition priority of the role, and the task can no longer obtain permissions.

[0119] In some preferred embodiments, the control of the length of the permission chain by selecting a matrix according to the system function and the user environment to associate the system permissions includes the following steps:

[0120] Constructing the selection matrix ,in, The value is 0 or 1; , Indicates the total number of nodes or tasks in the system;

[0121] The permissions of the corresponding nodes are controlled by selecting the row vector of each row of the matrix;

[0122] The specific steps include:

[0123] Set up The permission chain of each node is user-role-task-operation-object. This chain means that after the user obtains the permission, the permission is assigned to the role, the role assigns the permission to the task, and the task assigns the permission to the operation, and the operation allowed by the permission is performed on the corresponding object;

[0124] Set up The row vector of a node is ;

[0125] If, The system function of a node has changed and the access rights need to be set based on the task. The value of is set to 0, The value of is set to 1, that is:

[0126] , then it means The permission chain of each node is reorganized into user-task-operation-object. At this time, after obtaining the permission, the user no longer assigns the permission to the role, but directly assigns the permission to the task. That is, the association between the user table and the task table is terminated, which includes the following steps: accessing the task table through the composite permission access control model; shielding the role ID information so that the task table cannot be associated with the role ID; returning the shielded role ID information; looping reading When When the value of is restored to 1, the character ID is unblocked.

[0127] If, Each node needs to set access rights based on the user. In this case, The value of is 0, is 1;

[0128] No. The row vector of a node is At this time, after the user obtains the permission, it will no longer be passed to any or role, but directly execute the operations allowed by the permission on the corresponding object. That is, the association between the user table and the task table and role table is shielded.

[0129] If, Nodes need to set access permissions based on tasks and roles, then the row vector is:

[0130] .

[0131] The present invention also provides an electronic device, which is used to execute the system authority management method based on the composite authority access control model.

[0132] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the system authority management method based on a composite authority access control model.

[0133] In the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. The embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part, and / or installed from a removable medium. When the computer program is executed by the central processing unit (CPU), the above functions defined in the method of the present application are executed. It should be noted that the computer-readable medium mentioned above in the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection with one or more wire segments, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, electrical wire, optical cable, RF, etc., or any suitable combination of the foregoing.

[0134] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the boxes can also occur in a different order than the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0135] Those skilled in the art should understand that the embodiments of the present invention described above and shown in the accompanying drawings are only examples and do not limit the present invention. The objectives of the present invention have been fully and effectively achieved. The functions and structural principles of the present invention have been demonstrated and explained in the embodiments. Without departing from the principles, the implementation methods of the present invention may be subject to any changes or modifications.

Claims

1. A system authority management method based on a composite authority access control model, characterized in that: The method comprises: Establish the association between tasks, objects, users, roles and permissions based on the composite permission access control model; Establish a data storage strategy that matches the composite permission access control model, and build a corresponding database based on the data storage strategy to store user, role, object, operation and permission data; Setting data sharing strategies to achieve the transmission of data in the database between various nodes in the system, the data sharing strategies include role-based data sharing strategies and object-based fine-grained sharing strategies; During data transmission, sensitive data in the database is encrypted, and access control policies, audit and monitoring policies, and emergency response policies are set; The association between task and object attributes and permissions based on the composite permission access control model includes the following steps: Obtain user information and dynamically assign roles to users, and dynamically assign permissions to roles; Establish the association between the operations and objects corresponding to the permissions; Adding task and temporal constraints in the association of operations with objects; According to the system function and user environment, the length of the permission chain is controlled by selecting a matrix to associate system permissions. The permission chain includes one or more of users, roles, tasks, operations, and objects.

2. According to the system authority management method based on the composite authority access control model of claim 1, it is characterized in that: The corresponding database is constructed according to the data storage strategy to store user, role, object, operation and permission data, including: Construct a user table, which includes user ID, user name, user password hash value, and user related information; Constructing a role table, wherein the role table includes role ID, role name and role description information; Constructing an object table, wherein the object table includes object ID, object name, object type, object attributes, object creation time, object owner, and allowed access permission ID; Constructing an operation table, wherein the operation table includes multiple operation IDs, operation names, and operation descriptions; Constructing a permission table, wherein the permission table includes multiple permission IDs, multiple role IDs, multiple object IDs, multiple operation IDs, multiple permission start times, and multiple permission end times; associating the role table through the role ID, and associating the operation table through the object ID; User role allocation table, the user role allocation table includes: multiple user IDs, multiple role IDs, multiple role start times and multiple role end times, the user table is associated with the user ID, and the role table is associated with the role ID.

3. A system authority management method based on a composite authority access control model according to claim 2, characterized in that: The data sharing strategy is set to realize the transmission of data in the database between various nodes in the system. The data sharing strategy includes a role-based data sharing strategy and an object-based fine-grained sharing strategy, including: Determine the scope of data that users can access and share based on their roles; Determine whether the role has the access rights to the corresponding object. If so, proceed to the next step; otherwise, return to the previous step. In the process of sharing data, verify the source and integrity of the data, and encrypt the transmission of the shared data; For specific objects, different access levels and sharing policies are set according to object attributes and business rules to achieve object-based fine-grained sharing.

4. A system authority management method based on a composite authority access control model according to claim 3, characterized in that: During the data transmission process, the sensitive data in the database is encrypted, and access control strategies, audit and monitoring strategies, and emergency response strategies are set, including: During data transmission, the SSL / TLS protocol is used to encrypt data transmission to ensure the security of data during network transmission; For sensitive data, use the database's own encryption function or a third-party encryption library to implement data storage encryption; Use multi-factor authentication to ensure the authenticity of the user's identity; Authorize user access requests based on their roles and permissions; Follow the principle of least privilege and avoid granting users multiple permissions; Regularly back up the data in the database and transfer the backup data to other storage locations; When a security incident occurs, we divide responsibilities according to the emergency response process and take actions such as blocking the system, prohibiting access, and repairing vulnerabilities.

5. A system authority management method based on a composite authority access control model according to claim 4, characterized in that: The obtaining of user information and dynamically assigning roles to users includes: According to the obtained user information, obtain the user ID from the user table and assign it to the corresponding user; Get multiple role IDs from the role table, and assign multiple role IDs to the user ID according to the user's work requirements; The user information includes one or more of a system node name, a system node IP address, and a system node description.

6. A system authority management method based on a composite authority access control model according to claim 5, characterized in that: The association between the operation corresponding to the establishment of the permission and the object includes: Get multiple operation IDs, operation names and operation descriptions from the operation table; Get the operation ID associated with the corresponding permission ID from the permission table, and associate the operation table with the operation ID; Get the object ID associated with the permission ID from the permission table, and associate the object table with the object ID; The adding of task and temporal constraints in the association between the operation and the object includes: Constructing a task table, the task table includes a task ID, a task name, a task description, multiple operation IDs, a user ID and a role ID, a task start time and a task end time; Associate the operation table with the operation ID to obtain the operations that can be performed on the corresponding task; At the task start time, adjust the permission acquisition priority of the task so that it is the same as the permission acquisition priority of the role; The task start time and task end time are used to constrain the time length of the task acquisition operation. After the task end time is reached, the permission acquisition priority of the task is adjusted so that the permission acquisition priority of the task is lower than the permission acquisition priority of the role, and the task can no longer obtain permissions.

7. A system authority management method based on a composite authority access control model according to claim 6, characterized in that: According to the system function and user environment, the length of the permission chain is controlled by selecting a matrix to associate system permissions, including: Constructing the selection matrix ,in, The value is 0 or 1; , Indicates the total number of nodes or tasks in the system; The permissions of the corresponding nodes are controlled by selecting the row vector of each row of the matrix; The specific steps include: Set up The permission chain of each node is user-role-task-operation-object. This chain means that after the user obtains the permission, the permission is assigned to the role, the role assigns the permission to the task, and the task assigns the permission to the operation, and the operation allowed by the permission is performed on the corresponding object; Set up The row vector of a node is ; If, The system function of a node has changed and the access rights need to be set based on the task. The value of is set to 0, The value of is set to 1, that is: , then it means The permission chain of each node is reorganized into user-task-operation-object. At this time, after obtaining permission, the user no longer assigns the permission to the role, but directly assigns the permission to the task.

8. A system authority management method based on a composite authority access control model according to claim 7, characterized in that: After obtaining permissions, the user no longer assigns permissions to roles, but directly assigns permissions to tasks, including: Composite permission access control model access task table; The role ID information is blocked so that the task list cannot be associated with the role ID; Returns the blocked role ID information; Cyclic Reading When When the value of is restored to 1, the character ID is unblocked.

9. An electronic device, characterized in that: The electronic device is used to execute a system authority management method based on a composite authority access control model as described in any one of claims 1 to 8 above.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement a system permission management method based on a composite permission access control model as described in any one of claims 1 to 8.

Images