Role menu control method and device based on trusted computing, equipment and storage medium

Abstract

The invention discloses a role menu control method and device based on trusted computing, equipment and a storage medium, and belongs to the technical field of computers. The method comprises the following steps: acquiring user information for any operated equipment in distributed equipment; for user information, obtaining a user operation authority based on the intelligent contract of the operated device, and obtaining an initial user menu through the user operation authority and historical operation data of a user in the operated device; the environmental information of the operated equipment is further obtained, and the operated equipment and the environmental information of the operated equipment are subjected to credible measurement in combination with the environmental information of the operated equipment; and adjusting the initial user menu based on the credible measurement result, and removing an uncredible part to obtain a final user menu. In the distributed environment equipment, for the same user, the specific menu is obtained according to the operation characteristics of different users, and the untrusted part in the menu is removed, so that the control safety of the distributed equipment is improved.

Description

Technical Field

[0001] The present invention belongs to the field of trusted technology, and in particular relates to a trusted computing role menu control method, device, equipment and storage medium. Background Art

[0002] In the field of information security and access control, with the expansion of enterprise scale and the increase of system complexity, traditional access control methods such as the Access Control List (ACL) model can no longer meet the requirements of efficiency, flexibility and easy management. The ACL model directly associates users with permissions. Whenever the user's operation permissions change, all access rules involving the user need to be updated one by one. This is not only inefficient, but also prone to errors and omissions, increasing the complexity and cost of system maintenance.

[0003] In order to overcome the limitations of the ACL model, the role-based access control (RBAC) model came into being and quickly became the mainstream role management method in the industry. The RBAC model achieves the logical separation between users and permissions by introducing the middle layer of "roles". Specifically, the RBAC model contains three basic components: users, roles, and permissions. Users: the actual operators in the system, the subjects of access control. Roles: a set of permissions, representing a set of users who perform specific tasks or assume specific responsibilities in the system. Roles are the core of the RBAC model. It abstracts the user's behavior pattern in the system, making permission management more intuitive and efficient. Permissions: the ability to access system resources or operations, is the object of access control.

[0004] In the RBAC model, system administrators no longer directly assign permissions to users, but indirectly control user permissions by defining role permissions and assigning users to corresponding roles. This design greatly simplifies the relationship between users and permissions, making permission management more flexible and scalable. At the same time, since role changes are usually less frequent than changes in user operation permissions, the RBAC model also improves the efficiency and accuracy of permission management.

[0005] However, the RBAC model lacks an automated mechanism for role management and permission adjustment. This means that when the system organizational structure changes, role responsibilities are adjusted, or new security threats need to be addressed, system administrators need to manually update role definitions and permission assignments, which is not only time-consuming and labor-intensive, but also prone to errors. Secondly, the RBAC model does not provide adaptive role assignment and permission adjustment capabilities for different devices. In the current multi-device, multi-platform environment, users may need to access the system on different devices, and traditional RBAC models often cannot automatically adjust user roles and permissions according to different devices. This results in inconsistent menu interfaces and access rights for users on different devices, lacks interfaces that users actually use, and reduces user experience and system security. Summary of the invention

[0006] The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art and provide a trusted computing role menu control method, device, equipment and storage medium to solve the problem that the RBAC model in the prior art is difficult to perform adaptive role allocation and permission adjustment for different devices.

[0007] In order to achieve the above object, the present invention adopts the following technical solutions: The first aspect of the present invention discloses a trusted computing role menu control method, comprising the following steps: S1, the operated device in the distributed device collects user information; S2, based on the user information, the operated device obtains the user operation authority through the smart contract, and obtains the initial user menu through the user operation authority and the user's historical operation data in the operated device; S3, obtaining environmental information of the operated device, where the environmental information of the operated device includes device location, timestamp, device type and device status; S4, combining the environmental information of the operated device, performing a trusted measurement on the operated device; S5, adjusting the initial user menu based on the trusted measurement result, removing untrusted functional modules, and obtaining a final user menu.

[0008] Furthermore, in S2, the user operation permissions include access permissions, execution permissions, modification permissions, management permissions and special permissions.

[0009] Furthermore, the historical operation data includes user browsing history, search history, click behavior, viewing data, viewing interface, dwell time, language preference, operation behavior and user creation time.

[0010] Furthermore, in S4, the specific process of performing a trusted measurement on the operated device in combination with the environmental information of the operated device is as follows: (1) Conduct reliable measurement of the environmental information of the operated equipment; (2) Perform trusted measurements on the hardware of the device being operated.

[0011] Furthermore, the trusted measurement includes TPM verification and secure boot.

[0012] Furthermore, in S5, for different operated devices, the end-user menus of the same user are different.

[0013] Furthermore, a smart contract is preset in the distributed device.

[0014] The second aspect of the present invention discloses a trusted computing role menu control device, comprising: A collection module, used to control the operated devices in the distributed devices to collect user information; An initial menu module is used to obtain the user operation authority through the smart contract based on the user information, and obtain the initial user menu through the user operation authority and the historical operation data of the user in the operated device; An environment module is used to obtain environment information of the operated device, wherein the environment information of the operated device includes device location, timestamp, device type and device status; A trusted measurement module, used to perform trusted measurement on the operated device in combination with the environmental information of the operated device; The final menu module is used to adjust the initial user menu based on the trusted measurement results, remove untrusted functional modules, and obtain the final user menu.

[0015] The third aspect of the present invention discloses a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the above-mentioned trusted computing role-based menu control methods when executing the computer program.

[0016] A fourth aspect of the present invention discloses a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the trusted computing role-based menu control method described in any one of the above is implemented.

[0017] The present invention discloses a role menu control method based on trusted computing, which introduces smart contracts into a role menu control system to achieve automated role management and authority adjustment. Smart contracts can automatically perform operations such as role allocation and authority adjustment according to preset rules and conditions without manual intervention. In the device in a distributed environment of the present invention, for the same user, the menu when logging in with the same account is different, and the purpose of menu adaptive configuration is finally achieved according to the operating characteristics of different users. When generating a menu, combined with trusted computing technology and using environmental perception technology, the system can perceive the environmental state of the operated device in real time, and use the hardware security mechanism provided by the trusted computing platform to ensure the authenticity and integrity of the environmental perception information. Based on trusted environmental information, the system dynamically adjusts the user's role menu to meet the security requirements in different environments; the credibility of the environmental perception information is ensured by the measurement, reporting and verification functions of the trusted computing platform. At the same time, the existing environmental perception technology and algorithm are used to achieve accurate perception of the user environment and dynamic adjustment of the role menu. The method of the present invention also has the following advantages: (1) High degree of automation: Through the automatic execution of smart contracts, the automation of role allocation and authority adjustment is achieved, which reduces manual intervention and improves management efficiency.

[0018] (2) Strong flexibility: The role menu can be dynamically adjusted according to different environmental conditions and user behavior characteristics to meet the security requirements and user experience in different scenarios.

[0019] (3) High security: Combined with the environmental perception information verification mechanism of the trusted computing platform, the authenticity and integrity of environmental perception information is ensured, preventing the risk of tampering and forgery.

[0020] (4) Good scalability: This technical solution is easy to integrate and expand with existing systems and can adapt to distributed environments of different scales and complexities. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A flow chart of a trusted computing role menu control method according to the present invention; Figure 2 A logic diagram of a trusted computing role menu control method of the present invention; Figure 3 This is a diagram of a menu control system based on trusted computing roles according to the present invention. DETAILED DESCRIPTION

[0022] In the following, the terms "first", "second", "third", and "fourth" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, a feature defined as "first", "second", "third", and "fourth" may explicitly or implicitly include one or more of the features.

[0023] The co-shooting method provided in the embodiment of the present application can be applied to terminal devices such as mobile phones, tablet computers, wearable devices, vehicle-mounted devices, augmented reality (AR) / virtual reality (VR) devices, laptop computers, ultra-mobile personal computers (UMPC), netbooks, personal digital assistants (PDA), etc. The embodiment of the present application does not impose any restrictions on the specific type of the terminal device.

[0024] It should be noted that the terms "first", "second", etc. in the specification and drawings of the present invention are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] The current mainstream role management method includes basic components in the RBAC (Role-Based Access Control) model, namely: User, Role, and Permission. RBAC defines the permissions of roles and grants a role to a user to control the user's permissions, achieving the logical separation of users and permissions (different from the ACL model, Access Control List), simplifying the relationship between users and permissions, and making the entire system easy to expand and maintain. However, the RBAC model makes it difficult to perform adaptive role allocation and permission adjustment for different devices and users.

[0026] In order to solve the above problems, the present invention proposes a system and method for dynamically adjusting the role menu in a distributed environment based on smart contracts and trusted computing, aiming to solve the problems of low automation, poor flexibility and difficulty in adapting to complex environmental changes in existing role management and authority configuration. This technical solution realizes the automation and dynamic adjustment of the role menu by integrating smart contracts, environmental perception technology and trusted computing platform, thus improving the security of the system and user experience.

[0027] See also Figure 1 The first aspect of the present invention discloses a menu control method based on trusted computing roles, comprising the following steps: S1, the operated device in the distributed device collects user information; S2, based on the user information, the operated device obtains the user operation authority through the smart contract, and obtains the initial user menu through the user operation authority and the user's historical operation data in the operated device; S3, obtaining environmental information of the operated device, where the environmental information of the operated device includes device location, timestamp, device type and device status; S4, combining the environmental information of the operated device, performing a trusted measurement on the operated device; S5, adjusting the initial user menu based on the trusted measurement result, removing untrusted functional modules, and obtaining a final user menu.

[0028] In some implementation schemes of the present invention, in S1, the operated device is any device in the distributed devices operated by the user; the user information includes the user's username and password. When the user operates the operated device, the user enters the user's username and password, and the operated device obtains the user information based on the user's username and password.

[0029] In some implementation schemes of the present invention, in S2, the menu of the present invention is targeted at distributed devices, and a corresponding smart contract is preset in advance in each operated device, and the smart contract stores the operation permissions of each user.

[0030] In some implementation schemes of the present invention, in S2, the smart contract is provided with role definitions, operation permissions, and dynamic perception indicators corresponding to users in different distributed devices.

[0031] Specifically, the method of obtaining the initial user menu through a smart contract includes the following steps: (1) Obtaining the user's historical operation data on the operated device; the user's historical data includes the user's browsing history, the user's current login times, search history, click behavior, viewing data, viewing interface, dwell time, language preference, operation behavior and user creation time.

[0032] (2) Based on the user's operating permissions, the smart contract generates an initial user menu, sets the functional modules that the user views most frequently in the center of the screen, and sends the initial user menu to the operated device.

[0033] This step enables the generated initial user menu to highlight the operations or parameters that the user is concerned about, and general parameters can be displayed at the edge of the screen to improve user convenience.

[0034] In some implementation schemes of the present invention, in S2, the user's operating authority is the user's access authority, execution authority, modification authority, management authority and special authority on the operated device.

[0035] Access permissions determine whether a user can access a system, software, file, database, or other resource. For example, some users may only have access to their own data, while other users may be able to access the entire database. Execution permissions: Control whether users can perform specific operations or commands. For example, a user may only have the right to read a file, but not the right to modify or delete it. Modification permissions: Allow users to change the state of data or resources, which may include editing documents, changing system settings, and updating database records. Administrative permissions are advanced permissions that allow users to manage users, permissions, and resources in the system. Users with administrative permissions can create new users, allocate resources, and delete resources. Special permissions: Permissions specific to certain applications or systems that may allow users to perform specific advanced operations, such as executing system commands, accessing sensitive data, etc.

[0036] It should be understood that S1 and S2 in the present invention particularly emphasize a certain operated device in the distributed devices. In this step, the smart contract for the device is preset in advance in each distributed device in the distributed environment. When the user enters user information in the operated device, the corresponding user operation authority is obtained according to the smart contract rules, which facilitates the user's operation and obtains relevant information.

[0037] It should be understood that the embodiments of the present invention are aimed at distributed environments, and different distributed devices have different roles and functions, so that the same user has different operating permissions when logging into different distributed devices, and the purposes to be achieved are different, so that the end-user menus are different for targeted operations; further, due to the differences in terminal devices, the distributed devices have different permissions, so that the login menus are different.

[0038] In some implementation schemes of the present invention, for each user on each distributed device, when using it for the first time, a general menu is pre-set for the user according to the operation authority, and then each distributed device obtains the user's historical operation information through a smart contract to facilitate subsequent acquisition.

[0039] Introducing smart contracts into the role menu control system can realize automated role management and permission adjustment. Smart contracts can automatically perform operations such as role allocation and permission adjustment according to preset rules and conditions without manual intervention.

[0040] Combination Figure 2 In some implementations of the present invention, in S3, a variety of environmental perception technologies (such as global positioning system, timestamp acquisition, and device status monitoring, etc.) are combined to perceive the environmental information of distributed devices in real time. The environmental information of distributed devices includes device location, timestamp, device type, and device status. Specifically, the specific location of the distributed device can be obtained through the global positioning system, the timestamp can be obtained through the timestamp acquisition technology, and the device status can be monitored through the device status monitoring software.

[0041] In S4, the specific process of performing trusted measurement on the operated device in combination with the environmental information of the operated device is as follows: (1) Conduct reliable measurement of the environmental information of the operated equipment; (2) Perform trusted measurements on the hardware of the device being operated.

[0042] Specifically, the trusted measurement method can measure, report and verify environmental perception information for TPM (Trusted Platform Module) verification and secure boot, ensure the authenticity and integrity of the information, and prevent tampering and forgery. Trusted operations are performed on device hardware to improve the security of subsequent device operations. Device hardware includes central processing units and memory devices.

[0043] In this step, the initial user menu can be modified through the trusted measurement results. For example, if a functional module in the operated device is no longer trusted, the functional module will be deleted from the menu presented to the user to avoid further impact. For environmental information, such as timestamps, trusted verification can be used to determine whether the data is accurate and ensure the authenticity and integrity of the environmental information provided. Finally, the most suitable menu configuration for the current environment is dynamically generated and presented based on the environmental status and user behavior characteristics.

[0044] In some implementations of the present invention, for different operated devices, the final generated menus will be different due to different control terminals. For example, for a certain operated device being a field control terminal or a mobile phone control terminal, the menus obtained by the user will also be different due to different smart contracts. Smart contracts automatically assign roles and adjust permissions based on user operation characteristics and business needs to ensure that the same account can present targeted menu configurations when logging in on different devices; allowing users to obtain the most suitable access rights and operation interfaces in different environments.

[0045] In a specific embodiment of the present invention, the method enables the control end to have 100 menu functions in the early stage when the user operates the operated device in the distributed device, and actively configure 10 menu functions. Then, based on the user's behavioral habits and the smart contract analyzing the user's behavior, 50 menu functions are converted into 50 menu functions, thereby achieving the purpose of increasing the number of functions in the menu.

[0046] A second aspect of the present invention discloses a trusted computing role menu control device, comprising: A collection module, used to control the operated devices in the distributed devices to collect user information; An initial menu module is used to obtain the user operation authority through the smart contract based on the user information, and obtain the initial user menu through the user operation authority and the historical operation data of the user in the operated device; An environment module is used to obtain environment information of the operated device, wherein the environment information of the operated device includes device location, timestamp, device type and device status; A trusted measurement module, used to perform trusted measurement on the operated device in combination with the environmental information of the operated device; The final menu module is used to adjust the initial user menu based on the trusted measurement results, remove untrusted functional modules, and obtain the final user menu.

[0047] This method combines trusted computing technology with environmental perception technology to perceive the user's environmental status (such as location, time, device status, etc.) in real time, and uses the hardware security mechanism provided by the trusted computing platform to ensure the authenticity and integrity of environmental perception information. Based on this trusted environmental information, the system dynamically adjusts the user's role menu to meet the security requirements in different environments. The credibility of environmental perception information is ensured through the measurement, reporting and verification functions of the trusted computing platform. At the same time, the existing environmental perception technology and algorithms are used to achieve accurate perception of the user's environment and dynamic adjustment of the role menu.

[0048] The third aspect of the present invention discloses a computer device, which includes a processor and a memory, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is used to execute the program instructions stored in the computer storage medium. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, and is specifically suitable for loading and executing one or more instructions so as to Implement the corresponding method flow or the corresponding function; the processor described in this embodiment can be used to implement a role menu control method based on trusted computing, including the following steps: S1, the operated device in the distributed device collects user information; S2, based on the user information, the operated device obtains the user operation authority through the smart contract, and obtains the initial user menu through the user operation authority and the user's historical operation data in the operated device; S3, obtains the environmental information of the operated device, and the environmental information of the operated device includes the device location, timestamp, device type and device status; S4, combined with the environmental information of the operated device, performs trusted measurement on the operated device; S5, adjusts the initial user menu based on the trusted measurement result, removes the untrusted functional modules, and obtains the final user menu.

[0049] The fourth aspect of the present invention discloses a storage medium, specifically a computer-readable storage medium (Memory), which is a memory device in a terminal device for storing programs and data. It can be understood that the computer-readable storage medium here can include both the built-in storage medium in the terminal device and the extended storage medium supported by the terminal device. The computer-readable storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space, and these instructions can be one or more computer programs (including program codes). It should be noted that the computer-readable storage medium here can be a high-speed RAM memory (Random Access Memory) or a non-volatile memory, such as at least one disk memory. The processor can load and execute one or more instructions stored in a computer-readable storage medium to implement the above-mentioned role menu control method based on trusted computing, including the following steps: S1, the operated device in the distributed device collects user information; S2, based on the user information, the operated device obtains the user operation authority through the smart contract, and obtains the initial user menu through the user operation authority and the user's historical operation data in the operated device; S3, obtains the environmental information of the operated device, and the environmental information of the operated device includes the device location, timestamp, device type and device status; S4, combined with the environmental information of the operated device, performs trusted measurement on the operated device; S5, adjusts the initial user menu based on the trusted measurement result, removes untrusted functional modules, and obtains the final user menu.

[0050] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for controlling a role menu based on trusted computing, characterized in that: The following steps are involved: S1, collecting user information based on the operated device in the distributed devices; S2, based on the user information, the operated device obtains the user operation authority through the smart contract, and obtains the initial user menu through the user operation authority and the user's historical operation data in the operated device; S3, obtaining environmental information of the operated device, where the environmental information of the operated device includes device location, timestamp, device type and device status; S4, combining the environmental information of the operated device, performing a trusted measurement on the operated device; S5, adjusting the initial user menu based on the trusted measurement result, removing untrusted functional modules, and obtaining a final user menu.

2. The trusted computing role menu control method according to claim 1, characterized in that: In S2, the user operation permissions include access permissions, execution permissions, modification permissions, management permissions and special permissions.

3. A trusted computing role menu control method according to claim 2, characterized in that: The historical operation data includes user browsing history, search history, click behavior, viewing data, viewing interface, dwell time, language preference, operation behavior and user creation time.

4. The trusted computing role menu control method according to claim 1, characterized in that: In S4, the specific process of performing trusted measurement on the operated device in combination with the environmental information of the operated device is as follows: (1) Conduct reliable measurement of the environmental information of the operated equipment; (2) Perform trusted measurements on the hardware of the device being operated.

5. The trusted computing role menu control method according to claim 1, characterized in that: The trusted measurements include TPM authentication and secure boot.

6. The trusted computing role menu control method according to claim 1, characterized in that: In S5, for different operated devices, the final user menu of the same user is different.

7. The trusted computing role menu control method according to claim 1, characterized in that: A smart contract is preset in the distributed device.

8. A trusted computing role menu control device, characterized in that: include: A collection module, used to control the operated devices in the distributed devices to collect user information; An initial menu module is used to obtain the user operation authority through the smart contract based on the user information, and obtain the initial user menu through the user operation authority and the historical operation data of the user in the operated device; An environment module is used to obtain environment information of the operated device, wherein the environment information of the operated device includes device location, timestamp, device type and device status; A trusted measurement module, used to perform trusted measurement on the operated device in combination with the environmental information of the operated device; The final menu module is used to adjust the initial user menu based on the trusted measurement results, remove untrusted functional modules, and obtain the final user menu.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the trusted computing role menu control method according to any one of claims 1 to 6 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the trusted computing role menu control method according to any one of claims 1 to 6 is implemented.

Images