Access control method, apparatus and device

Abstract

This disclosure proposes an access control method, apparatus, and device, comprising: upon detecting that an access object sends a first access request to a target object, determining a first object type of the access object and a second object type of the target object; then, based on the first object type, determining first description information and first identification information of the access object; and based on the second object type, determining second description information of the target object; then, determining third description information of the environment in which the access object is located; then, based on the first identification information, first description information, second description information, and third description information, determining access risk level information; and finally, based on the access risk level information, generating a target access permission level for the access object. Thus, access risk assessment can be performed based on three dimensions: the access object, the target object, and the access environment, thereby enabling more granular access control based on access risk level information.

Description

Technical Field

[0001] This disclosure relates to the field of communication technology, and in particular to an access control method, apparatus and device. Background Technology

[0002] Zero trust refers to verifying any person, thing, or event attempting to access the network and its resources before authorization. In practice, zero trust networks use identity as the basis for network access control, continuously assess trust levels based on multi-source data, and formulate access control policies according to the principle of least privilege, based on the trust assessment of the subject and object and access needs. This includes mandatory identity recognition and authorization, authentication, and channel encryption, thereby achieving controlled and secure access to network resources. Summary of the Invention

[0003] This disclosure presents an access control method, apparatus, electronic device, storage medium, and computer program product, aimed at at least partially addressing technical problems in the related art.

[0004] The first aspect of this disclosure provides an access control method, comprising: upon detecting that an access object sends a first access request to an object to be accessed, determining a first object type of the access object and a second object type of the object to be accessed; determining first description information and first identification information of the access object based on the first object type, and determining second description information of the object to be accessed based on the second object type; determining third description information of the environment in which the access object is located; determining access risk level information based on the first identification information, the first description information, the second description information, and the third description information; and generating a target access permission level for the access object based on the access risk level information.

[0005] A second aspect of this disclosure provides an access control device, comprising: a first determining module, configured to determine a first object type of the accessing object and a second object type of the object to be accessed when a first access request is detected from an accessing object to an object to be accessed; a second determining module, configured to determine first description information and first identification information of the accessing object based on the first object type, and to determine second description information of the object to be accessed based on the second object type; a third determining module, configured to determine third description information of the environment in which the accessing object is located; a fourth determining module, configured to determine access risk level information based on the first identification information, the first description information, the second description information, and the third description information; and a generating module, configured to generate a target access permission level for the accessing object based on the access risk level information.

[0006] A third aspect of this disclosure provides an electronic device, including: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute instructions to implement an access control method.

[0007] A fourth aspect of this disclosure provides a computer-readable storage medium that, when instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to perform an access control method.

[0008] A fifth aspect of this disclosure provides a computer program product, including a computer program, characterized in that the computer program is executed by a processor using an access control method.

[0009] The access control method, device, electronic device, storage medium, and computer program product proposed in this embodiment have at least the following beneficial effects: When a first access request is detected from an access object to a target object, the first object type of the access object and the second object type of the target object are determined. Then, based on the first object type, the first description information and first identification information of the access object are determined. Based on the second object type, the second description information of the target object is determined. Then, the third description information of the environment in which the access object is located is determined. Then, based on the first identification information, the first description information, the second description information, and the third description information, the access risk level information is determined. Finally, based on the access risk level information, the target access permission level of the access object is generated. Thus, access risk assessment can be performed based on three dimensions: the access object, the target object, and the access environment, thereby enabling more granular access control based on the access risk level information.

[0010] Additional aspects and advantages of this disclosure will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this disclosure. Attached Figure Description

[0011] The above and / or additional aspects and advantages of this disclosure will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, in which:

[0012] Figure 1 This is a flowchart illustrating an access control method according to the first embodiment of this disclosure;

[0013] Figure 2 This is a flowchart illustrating an access control method according to a second embodiment of the present disclosure;

[0014] Figure 3 This is a flowchart illustrating an access control method according to a third embodiment of the present disclosure;

[0015] Figure 4A This is a schematic diagram of the process for determining the operational risk level value according to an embodiment of this disclosure;

[0016] Figure 4B This is a schematic diagram illustrating the process for determining the operational risk level value according to another embodiment of this disclosure;

[0017] Figure 4C This is a schematic diagram illustrating the process for determining the operational risk level value according to another embodiment of this disclosure;

[0018] Figure 4D This is a schematic diagram of the process for determining the geographical environment score according to an embodiment of this disclosure;

[0019] Figure 4E This is a schematic diagram of the process for determining the calculation environment score according to an embodiment of this disclosure;

[0020] Figure 4F This is a schematic diagram of the process for determining the network environment score according to an embodiment of this disclosure;

[0021] Figure 5 This is a block diagram of an access control device according to the present disclosure;

[0022] Figure 6 A block diagram of an exemplary electronic device suitable for implementing embodiments of the present disclosure is shown. Detailed Implementation

[0023] Embodiments of this disclosure are described in detail below, with examples of embodiments illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are used only to explain this disclosure, and should not be construed as limiting this disclosure. Rather, embodiments of this disclosure include all variations, modifications, and equivalents falling within the spirit and scope of the appended claims.

[0024] It should be noted that the execution subject of the access control method in this embodiment can be an access control device, which can be implemented by software and / or hardware. The device can be configured in an electronic device, which may include, but is not limited to, a terminal, a server, etc.

[0025] It should be noted that the acquisition, storage, use, and processing of information in this disclosed technical solution comply with the relevant provisions of national laws and regulations and do not violate public order and good morals.

[0026] Figure 1 This is a flowchart illustrating the access control method according to the first embodiment of this disclosure, as shown below. Figure 1 As shown, the method includes:

[0027] S101: If it is detected that the accessed object sends a first access request to the object to be accessed, determine the first object type of the accessed object and the second object type of the object to be accessed.

[0028] The objects to be accessed can be, for example, people or equipment, and there are no restrictions on this.

[0029] The object to be accessed can be, for example, data, interfaces, functions, etc., and there are no restrictions on this.

[0030] The request made by the accessing object at the current moment to request access to the object to be accessed is the first access request, and there are no restrictions on this.

[0031] The access object can be divided into various first object types according to different classification criteria. The first object type can be, for example, device type, personnel type, etc., without any restrictions.

[0032] The object to be accessed can be divided into various second object types according to different criteria. The second object type can be, for example, a data type, an interface type, a function type, etc., without any restrictions.

[0033] S102: Based on the first object type, determine the first description information and first identification information of the accessed object, and based on the second object type, determine the second description information of the object to be accessed.

[0034] The first identification information of the access object can be used to identify a unique access object. Taking the access object as a person as an example, the first identification information can be, for example, the access object's ID card number, phone number, name, etc., without restriction.

[0035] The first description information and the first identification information of the accessed object are different. The first description information can be used to describe other attributes of the accessed object. For example, the first description information can refer to information used to describe the business sensitivity, business type, security, etc. of the accessed object.

[0036] The second descriptive information of the object to be accessed can refer to information used to describe the business type and function of the object to be accessed, and there are no restrictions on this.

[0037] It is understandable that the corresponding identification and description information will be different depending on the object type of the accessed object. For example, when the object type of the accessed object is a person, the first identification information may be, for example, the accessed object's ID card number or phone number. When the object type of the accessed object is a device, the first identification information may be, for example, the device serial number or asset registration certificate number. There are no restrictions on this.

[0038] Therefore, in this embodiment of the present disclosure, after determining the first object type of the accessed object and the second object type of the object to be accessed, the first description information and the first identification information of the accessed object can be determined according to the first object type, and the second description information of the object to be accessed can be determined according to the second object type.

[0039] For example, in this embodiment of the disclosure, if the first object type of the access object is determined to be a personnel type, the first descriptive information of the access object may be determined to be personnel technical rank, position, etc., and the first identification information may be determined to be the access object's ID card number, name, etc. Alternatively, if the first object type of the access object is determined to be a device type, the first descriptive information of the access object may be determined to be device function, device value, etc., and the first identification information of the access object may be determined to be device serial number, device asset registration number, etc. There are no restrictions on this.

[0040] For example, in the disclosed embodiments, if the second object type of the object to be accessed is determined to be a data type, the second description information of the object to be accessed may be determined to be a data type, the department to which the data belongs, etc., without limitation.

[0041] In this embodiment of the disclosure, the first identification information of the access object can also be generated based on multiple pieces of information about the access object. That is, a unique identifier can be generated as the first identification information based on the access object's digital identifier (person's system account, device serial number, etc.) and physical identifier (person's ID card number, phone number, etc.). The composition of the first identification information is shown in Table 1.

[0042]

[0043] S103: Determine the third descriptive information of the environment in which the accessed object is located.

[0044] The third descriptive information can be used to describe the environment in which the accessed object is located. This environment can be, for example, a geographical environment, a network environment, a computing environment, etc. The third descriptive information can be, for example, geographical environment information, network environment information, and computing environment information, etc., without any limitation.

[0045] In this embodiment of the disclosure, the third descriptive information may be based on the environmental information of the environment where the accessed object is located, collected by the camera device, or the network environment information of the accessed device may be read by a third-party tool or command-line tool. There are no restrictions on this.

[0046] S104: Determine the access risk level information based on the first identification information, the first description information, the second description information, and the third description information.

[0047] In this embodiment of the disclosure, after determining the first description information and the first identification information of the object to be accessed based on the first object type, and determining the second description information of the object to be accessed based on the second object type, the access risk level information can be determined based on the first identification information, the first description information, the second description information, and the third description information.

[0048] The access risk level information can be used to describe the risk level of the access process of the object to be accessed. This access risk level information can be, for example, an access risk level, and there is no limitation on it.

[0049] In some embodiments, determining the access risk level information based on the first identification information, the first description information, the second description information, and the third description information may involve obtaining sample data (which includes reference identification information, the first reference description information, the second reference description information, and the third reference description information) and the reference access risk level corresponding to the sample data. An initial access risk level determination model is then trained based on the sample data and the reference access risk level corresponding to the sample object until the initial access risk level determination model converges. Finally, the first identification information, the first description information, the second description information, and the third description information are input into the trained initial access risk level determination model to obtain the access risk level information output by the model. There are no restrictions on this method.

[0050] In other embodiments, the access risk level information is determined based on the first identification information, the first description information, the second description information, and the third description information. Alternatively, it can involve obtaining the identification and description information of the accessed object, the description information of the accessed object, and the description information of the environment in which the accessed object is located during a historical time period. Then, the access risk level determined in the historical access process is determined. The first identification information, the first description information, the second description information, and the third description information are then compared with the identification and description information of the accessed object, the description information of the accessed object, and the description information of the environment in which the accessed object is located during the historical access process. If the comparison result indicates that the information in the current access process matches the information in the historical access process, the access risk level determined in the historical access process is used as the access risk level information. There are no restrictions on this.

[0051] S105: Generate the target access permission level for the accessed object based on the access risk level information.

[0052] The target access permission level describes the extent of access permissions granted to the accessed object during this access process. A higher target access permission level indicates higher permissions for the accessed object during this access process, and vice versa. No restrictions are imposed on this.

[0053] In some embodiments, generating the target access permission level of the accessed object based on the access risk level information may involve pre-obtaining reference access risk level information and the reference access permission level corresponding to the reference access risk level information, comparing the access risk level information with the reference access risk level information, and if the access risk level information and the reference access risk level information are the same, using the reference access permission level corresponding to the reference access risk level information as the target access permission level of the accessed object, without any restrictions.

[0054] In this embodiment of the disclosure, the correspondence between the target access permission level and the specific access policy can be shown in Table 2:

[0055]

[0056] In other words, in this embodiment of the disclosure, the access control policy corresponding to the target access level is determined based on the correspondence between the target access level and the specific access policy, which may be referred to as shown in Table 2 above.

[0057] In this embodiment of the disclosure, when a first access request is detected from an access object to an object to be accessed, the first object type of the access object and the second object type of the object to be accessed are determined. Then, based on the first object type, the first description information and the first identification information of the access object are determined. Based on the second object type, the second description information of the object to be accessed is determined. Then, the third description information of the environment in which the access object is located is determined. Then, based on the first identification information, the first description information, the second description information, and the third description information, the access risk level information is determined. Finally, based on the access risk level information, the target access permission level of the access object is generated. Thus, access risk assessment can be performed based on three dimensions: the access object, the object to be accessed, and the access environment. This enables more granular access control based on the access risk level information.

[0058] Figure 2 This is a flowchart illustrating an access control method according to a second embodiment of the present disclosure, as shown below. Figure 2 As shown, the method includes:

[0059] S201: If it is detected that the accessed object sends a first access request to the object to be accessed, determine the first object type of the accessed object and the second object type of the object to be accessed.

[0060] For a detailed description of S201, please refer to the above embodiments, which will not be repeated here.

[0061] S202: If the first object type is a personnel type, then obtain the job description information and / or technical grade information of the accessed object, and use the job description information and / or technical grade information as the first description information.

[0062] In this embodiment of the disclosure, the first object type includes any one of the following: personnel type; equipment type; business type.

[0063] In this embodiment of the disclosure, the second object type includes any one of the following: data type; function type; interface type.

[0064] The job description information can be, for example, the administrative level of the accessed person, which can be, for example, senior, intermediate, or junior, and there are no restrictions on this.

[0065] Among them, the technical job level information can be, for example, the technical level of the accessed object, and the technical level can be, for example, senior, intermediate, junior, etc., without any restrictions.

[0066] In other words, in this embodiment of the disclosure, when the first object type is a personnel type, the job description information and / or technical rank information of the accessed object can be obtained, and the job description information and / or technical rank information can be used as the first description information.

[0067] S203: If the first object type is a device type, then obtain the functional description information and / or security requirement information of the access object, and use the functional description information and / or security requirement information as the first description information.

[0068] The functional description information can refer to the level of importance of the accessed object's functions. This level of importance can be, for example, high, medium, low, etc., and there are no restrictions on it.

[0069] Among them, security requirement information can refer to the level of security requirements of the access object. This level of security requirement can be, for example, high, medium, low, etc., without any restrictions.

[0070] In other words, in this embodiment of the present disclosure, when the first object type is a device type, the functional description information and / or security requirement information of the access object can be obtained, and the functional description information and / or security requirement information can be used as the first description information.

[0071] S204: If the first object type is a business type, then obtain the sensitivity information and / or business relevance information of the accessed object, and use the sensitivity information and / or business relevance information together as the first description information.

[0072] The sensitivity information of the accessed object can be divided into high-level, medium-level, and low-level according to the level of business sensitivity of the accessed object, without any restrictions.

[0073] The business relevance information of the accessed object can be divided into high-level, medium-level, and low-level according to the degree of business relevance of the accessed object, without any restrictions.

[0074] In other words, in this embodiment of the present disclosure, when the first object type is a business type, the sensitivity information and / or business relevance information of the access object can be obtained, and the sensitivity information and / or business relevance information can be used together as the first description information.

[0075] S205: If the second object is a data type, then obtain the data subtype of the object to be accessed, and use the data subtype as the second description information.

[0076] Data can be divided into various subtypes, such as data from the source, which can be divided into three subtypes: data from this department, data from other departments, and data from other units.

[0077] In other words, in this embodiment of the present disclosure, when the second object is a data type, the data subtype of the object to be accessed can be obtained and the data subtype can be used as the second description information.

[0078] S206: If the second object is a function type, then obtain the function subtype of the object to be accessed, and use the function subtype as the second description information.

[0079] Functions can be divided into various sub-types. For example, functions can be divided into three data sub-types: core, ordinary, and external, based on their weight.

[0080] In other words, in this embodiment of the present disclosure, when the second object is a function type, the function subtype of the object to be accessed can be obtained and the function subtype can be used as the second description information.

[0081] S207: If the second object is an interface type, obtain the interface subtype of the object to be accessed, and use the interface subtype as the second description information.

[0082] Interfaces can be divided into various subtypes, such as core interfaces, ordinary interfaces, and external interfaces, without any restrictions.

[0083] In other words, in this embodiment of the present disclosure, when the second object is an interface type, the interface subtype of the object to be accessed can be obtained and the interface subtype can be used as the second description information.

[0084] S208: Based on the first object type, determine the first description information and first identification information of the accessed object, and based on the second object type, determine the second description information of the object to be accessed.

[0085] S209: Determine the third descriptive information of the environment in which the accessed object is located.

[0086] S210: Determine the access risk level information based on the first identification information, the first description information, the second description information, and the third description information.

[0087] S211: Generate the target access permission level for the accessed object based on the access risk level information.

[0088] For a detailed description of S208-S211, please refer to the above embodiments, which will not be repeated here.

[0089] In this embodiment of the disclosure, upon detecting that an access object sends a first access request to a target object, the first object type of the access object and the second object type of the target object are determined. If the first object type is a personnel type, the job description information and / or technical rank information of the access object are obtained, and this information is used as the first description information. If the first object type is a device type, the functional description information and / or security requirement information of the access object are obtained, and this information is used as the first description information. If the first object type is a business type, the sensitivity information and / or business relevance information of the access object are obtained, and this information is used as the first description information. If the second object type is a data type, the data subtype of the target object is obtained, and the data subtype is used as... The second description information is obtained as follows: when the second object is a function type, the function subtype of the object to be accessed is obtained and used as the second description information; when the second object is an interface type, the interface subtype of the object to be accessed is obtained and used as the second description information. Then, based on the first object type, the first description information and first identification information of the accessed object are determined, and based on the second object type, the second description information of the object to be accessed is determined. Then, the third description information of the environment in which the accessed object is located is determined. Based on the first identification information, the first description information, the second description information, and the third description information, the access risk level information is determined. Based on the access risk level information, the target access permission level of the accessed object is generated. Thus, access risk assessment can be performed based on three dimensions: the accessed object, the object to be accessed, and the access environment, thereby enabling more granular access control based on the access risk level information.

[0090] Figure 3 This is a flowchart illustrating an access control method according to a third embodiment of the present disclosure, as shown below. Figure 3As shown, the method includes:

[0091] S301: If it is detected that the accessed object sends a first access request to the object to be accessed, determine the first object type of the accessed object and the second object type of the object to be accessed.

[0092] S302: Based on the first object type, determine the first description information and the first identification information of the accessed object, and based on the second object type, determine the second description information of the object to be accessed.

[0093] S303: Third description information to determine the environment in which the accessed object is located.

[0094] For detailed descriptions of S301-S303, please refer to the above embodiments, which will not be repeated here.

[0095] S304: Determine the first risk score based on the first identification information and the third description information.

[0096] The first risk score refers to the score initially determined based on the first identification information and the third description information, used to quantitatively assess the risk of the visit to the accessed object.

[0097] In this embodiment of the disclosure, after determining the third description information of the environment in which the accessed object is located, a first risk score can be determined based on the first identification information and the third description information.

[0098] Optionally, in some embodiments, determining the first risk score based on the first identification information and the third description information may involve determining the environmental risk score corresponding to each environmental type based on the third description information corresponding to different environmental types, and then determining the first risk score based on the environmental risk score corresponding to each environmental type and the first identification information.

[0099] In this embodiment of the disclosure, the environment type includes: physical environment type, geographical environment type, computing environment type and network environment type.

[0100] The third descriptive information corresponding to the physical environment type can be, for example, the operation information in the environment (operation subject, operation content, and operation location). This information can include: whether there is personnel operation, whether the personnel are compliant, whether the system self-operation is compliant, whether the screen display content is consistent with the preset value, and the points for judging whether they are consistent include the logo and watermark, whether the image behind the screen is consistent with the preset value, etc. There are no restrictions on this.

[0101] The third descriptive information corresponding to the geographical environment type can be, for example, whether it is in a specified location, whether it is roaming, whether it is connected to a VPN, etc., and there are no restrictions on this.

[0102] The third description information corresponding to the computing environment type can be, for example, whether a legitimate account is logged in, whether a face / fingerprint is matched, or whether a specific software is being operated, and there are no restrictions on this.

[0103] The third descriptive information corresponding to the network environment type can be, for example, whether it is an intranet access, a virtual private network access, or an overseas access, and there are no restrictions on this.

[0104] In other words, in this embodiment of the disclosure, the environmental risk score corresponding to each environmental type can be determined based on the third description information corresponding to different environmental types, and then the first risk score can be determined based on the environmental risk score corresponding to each environmental type and the first identification information.

[0105] Optionally, in some embodiments, an environmental risk score corresponding to each environmental type is determined based on third descriptive information corresponding to different environmental types. This can be achieved by determining an operational risk level value in the environment based on the third descriptive information corresponding to the physical environment type, where the operational risk level value is an environmental risk score used to describe whether the operation in the environment meets the standards; then, a geographical environment score corresponding to the accessed object is determined based on the third descriptive information corresponding to the geographical environment type, where the geographical environment score is an environmental risk score used to describe whether the geographical environment of the accessed object meets the standards; then, a computing environment score corresponding to the accessed object is determined based on the third descriptive information corresponding to the computing environment type, where the computing environment score is an environmental risk score used to describe whether the computing environment of the accessed object meets the standards; and finally, a network environment score corresponding to the accessed object is determined based on the third descriptive information corresponding to the network environment type, where the network environment score is an environmental risk score used to describe whether the network environment of the accessed object meets the standards.

[0106] For example, see Figure 4A , Figure 4A This is a schematic diagram of the process for determining the operational risk level value according to an embodiment of this disclosure. In this embodiment, the operational risk level value in the environment is determined based on the third description information corresponding to the physical environment type. This can be done by determining whether there is personnel operation based on the third description information, and if personnel operation is determined, whether the personnel are compliant. If the personnel are compliant, the operational risk level value is determined to be 0; if the personnel are not compliant, the operational risk level value is determined to be 1. If there is no personnel operation, the equipment self-operation is determined to be compliant. If the equipment self-operation is not compliant, the operational risk level value is determined to be 2; if the equipment self-operation is compliant, the operational risk level value is determined to be 0. There are no restrictions on this process.

[0107] Among them, an operational risk level value of 0 represents low risk, an operational risk level value of 1 represents local risk, and an operational risk level value of 2 represents global risk.

[0108] For example, see Figure 4B , Figure 4B This is a schematic diagram of the process for determining the operational risk level value proposed in another embodiment of this disclosure. In this embodiment, the operational risk level value in the environment is determined based on the third description information corresponding to the physical environment type. Alternatively, the third description information can be used to determine whether the logo is correct. If the logo is incorrect, the operational risk level value is determined to be 2. If the logo is correct, the watermark is determined to be correct. If the watermark is correct, the operational risk level value is determined to be 0. If the watermark is incorrect, the operational risk level value is determined to be 1. There are no limitations on this.

[0109] For example, see Figure 4C , Figure 4C This is a schematic diagram of the process for determining the operational risk level value according to another embodiment of this disclosure. In this embodiment, the operational risk level value in the environment is determined based on the third description information corresponding to the physical environment type. Alternatively, the operational background can be determined based on the third description information. If the operational background is determined to be incorrect, the operational risk level value is determined to be 2. If the operational background is determined to be correct, the operational background can be determined to be dynamically changing. If the operational background is determined to be dynamically changing, the operational risk level value is determined to be 0. If the operational background is determined to be not dynamically changing, the operational risk level value is determined to be 1. There are no restrictions on this.

[0110] For example, see Figure 4D , Figure 4D This is a schematic diagram of the process for determining the geographic environment score according to an embodiment of this disclosure. In this embodiment, the geographic environment score is determined based on the third description information corresponding to the geographic environment type. This can be done by determining whether the access object is in a specified location. If the access object is in a specified location, the MAC address is further determined to be compliant. If the MAC address is compliant, the geographic environment score is determined to be 0. If the MAC address is non-compliant, the geographic environment score is determined to be 1. If the access object is not in a specified location, the roaming is further determined. If no roaming occurs, the geographic environment score is determined to be 2. If roaming occurs, the VPN is randomly selected to determine whether to access the VPN. If a VPN is accessed, the geographic environment score is determined to be 0. If no VPN is accessed, the geographic environment score is determined to be 1. There are no restrictions on this.

[0111] For example, see Figure 4E , Figure 4EThis is a schematic diagram of the process for determining the computing environment score according to an embodiment of this disclosure. In this embodiment, the computing environment score is determined based on the third description information corresponding to the computing environment type. This can be done by determining whether the access object is logged into a legitimate account. If the access object is not logged into a legitimate account, the computing environment score is determined to be 1. If the access object is logged into a legitimate account, the process continues to determine whether a face / fingerprint match is found. If a face / fingerprint match is found, the computing environment score is determined to be 2. If a face / fingerprint match is found, the process continues to determine whether a specified software is operated. If the specified software is operated, the computing environment score is determined to be 1. If the specified software is not operated, the computing environment score is determined to be 1. There are no restrictions on this process.

[0112] For example, participate Figure 4F , Figure 4F This is a schematic diagram of the process for determining the network environment score according to an embodiment of this disclosure. In this embodiment, the network environment score is determined based on the third description information corresponding to the network environment type. This can be done by determining whether the access object is connected to an intranet. If the access object is connected to an intranet, the network environment score is determined to be 0. If the access object is not connected to an intranet, the process continues to determine whether it is connected to a virtual private network (VPN). If it is connected to a VPN, the network environment score is determined to be 0. If it is not connected to a VPN, the process continues to determine whether it is connected to an overseas network. If it is connected to an overseas network, the network environment score is determined to be 2. If it is not connected to an overseas network, the network environment score is determined to be 1. No restrictions are imposed on this process.

[0113] In this embodiment of the disclosure, an environmental risk score corresponding to each environmental type is determined based on the third description information corresponding to different environmental types, and then a first risk score is determined based on the environmental risk score corresponding to each environmental type and the first identification information.

[0114] Optionally, in some embodiments, determining the first risk score based on the environmental risk score corresponding to each environmental type and the first identification information may involve pooling the environmental risk score corresponding to each environmental type to obtain a first matrix, then pooling the first identification information to obtain a second matrix, then determining the modular multiplication value of the first matrix and the second matrix, and then processing the first matrix and the second matrix based on a convolutional neural network to obtain a convolutional feature map output by the convolutional neural network, determining the ratio between the modular multiplication value and the volume of the convolutional feature map, and using the ratio as the first risk score.

[0115] In this embodiment of the disclosure, the environmental risk score corresponding to each environmental type may be pooled to obtain a first matrix. The rows of the first matrix may be the environmental risk score corresponding to each environmental type. Then, the first identification information may be pooled, that is, the physical tag, digital tag, timestamp and check value in the first identification information may be filled into the access object identification matrix, and the end may be filled with 0 to obtain a second matrix.

[0116] In this preferred embodiment, the environmental risk score corresponding to each environmental type is pooled to obtain a first matrix, and then the first identification information is pooled to obtain a second matrix. After that, the modular multiplication value M of the first matrix and the second matrix can be determined. This determination process can be expressed as follows:

[0117] ;

[0118] Where X, Y, and Z are the first identifier information corresponding to different access objects, the subscripts 0, 1, 2, and 3 are the values ​​of each segment of the identifier, A, B, C, and D are the environmental risk scores corresponding to different environmental types, the subscripts 0, 1, and 2 are the variable values, and the modulus R is the control parameter, with a recommended value of 100.

[0119] In this embodiment of the disclosure, the first matrix and the second matrix can be further processed based on the convolutional neural network to obtain the convolutional feature map output by the convolutional neural network, and the volume N of the convolutional feature map can be determined. This determination process can be expressed as follows:

[0120] ;

[0121] In this system, the size of the second matrix is ​​set to a×b, the number of layers used for padding before convolution is c, the environment boundary is used as the kernel scale as d, and the stride is e.

[0122] In this embodiment of the disclosure, after pooling the environmental risk scores corresponding to each environmental type to obtain a first matrix, pooling the first identification information to obtain a second matrix, determining the modular multiplication value of the first matrix and the second matrix, and then processing the first matrix and the second matrix based on a convolutional neural network to obtain the convolutional feature map output by the convolutional neural network, the ratio S=M / N between the modular multiplication value and the volume of the convolutional feature map can be used as the first risk score.

[0123] S305: Determine the access risk level information based on the first risk score, the first description information, and the second description information.

[0124] In this embodiment of the disclosure, after determining the first risk score based on the first identification information and the third description information, the access risk level information can be determined based on the first risk score, the first description information, and the second description information.

[0125] In the embodiments of the present disclosure, when the first risk value 0 < S < 1, it can be considered normal; when 1 ≤ S < 10, it is suspicious; when S ≥ 10, it is malicious. When a service is repeatedly executed, the risk analysis of the behavior will be superimposed, and the result of the previous time is used as the input of the next time. The formula is as follows:

[0126] ；

[0127] That is, the first behavior risk value of the i-th behavior is the current calculated value and the average value of the cumulative values of the previous i - 1 times.

[0128] Optionally, in some embodiments, according to the first risk score, the first description information, and the second description information, the access risk degree information is determined. It can be that when it is monitored that the access object sends a second access request to the object to be accessed, the sending interval time between the first access request and the second access request is determined, and then according to the sending interval time, the first risk score, the first description information, and the second description information, the second risk score is determined, and the second risk score is used as the access risk degree information.

[0129] In the embodiments of the present disclosure, to determine the second risk score according to the sending interval time, the first risk score, the first description information, and the second description information, it can be to determine the corresponding score according to the first description information, and then determine the corresponding score according to the second description information. For example, when the degree level indicated by the description information is high, the corresponding score is determined to be 100; when the degree level indicated by the description information is medium, the corresponding score is determined to be 60; when the degree level indicated by the description information is low, the corresponding score is determined to be 30.

[0130] S306: Generate the target access permission level of the access object according to the access risk degree information.

[0131] In the embodiments of the present disclosure, after determining the access risk degree information according to the first risk score, the first description information, and the second description information, the target access permission level of the access object can be generated according to the access risk degree information.

[0132] Optionally, in some embodiments, to generate the target access permission level of the access object according to the access risk degree information, it can be to obtain multiple score intervals, where each score interval has a corresponding candidate access permission level, and then when the second risk score falls into the score interval, the candidate access permission level corresponding to the score interval is used as the target access permission level.

[0133] In the embodiments of the present disclosure, the corresponding relationship between the score interval and the candidate access permission level is shown in Table 3:

[0134]

[0135] The higher the candidate access permission level, the lower the access permission level.

[0136] In other words, in this embodiment of the disclosure, after determining the second risk score, the candidate access permission level corresponding to the second risk score can be determined according to Table 3 above.

[0137] In this embodiment of the disclosure, when a first access request is detected from an access object to an object to be accessed, the first object type of the access object and the second object type of the object to be accessed are determined. Then, based on the first object type, the first description information and the first identification information of the access object are determined. Based on the second object type, the second description information of the object to be accessed is determined. The third description information of the environment in which the access object is located is determined. Then, based on the first identification information and the third description information, the first risk score is determined. Then, based on the first risk score, the first description information, and the second description information, the access risk level information is determined. Finally, based on the access risk level information, the target access permission level of the access object is generated. Thus, a more granular access control mechanism can be realized based on fine-grained information about personnel, equipment, and environment, thereby improving the accuracy of zero-trust access control.

[0138] Figure 5 This is a block diagram of an access control device disclosed herein, such as Figure 5 As shown, the access control device 50 includes:

[0139] The first determining module 501 is used to determine the first object type of the access object and the second object type of the object to be accessed when it is detected that the access object sends a first access request to the object to be accessed.

[0140] The second determining module 502 is used to determine the first description information and the first identification information of the access object according to the first object type, and to determine the second description information of the object to be accessed according to the second object type.

[0141] The third determination module 503 is used to determine the third description information of the environment in which the accessed object is located;

[0142] The fourth determination module 504 is used to determine the access risk level information based on the first identification information, the first description information, the second description information, and the third description information;

[0143] The generation module 505 is used to generate the target access permission level for the accessed object based on the access risk level information.

[0144] In some embodiments of this disclosure, the first object type includes any of the following:

[0145] Personnel type;

[0146] Equipment type;

[0147] Business type;

[0148] The second object type includes any of the following:

[0149] Data type;

[0150] Function type;

[0151] Interface type.

[0152] In some embodiments of this disclosure, the second temperature influencing factor includes at least one of the following:

[0153] First equipment model;

[0154] First rated power consumption;

[0155] First installation location.

[0156] In some embodiments of this disclosure, the second determining module 502 is further configured to:

[0157] If the first object type is a personnel type, then obtain the job description information and / or technical grade information of the accessed object, and use the job description information and / or technical grade information as the first description information;

[0158] If the first object type is a device type, then obtain the functional description information and / or security requirement information of the access object, and use the functional description information and / or security requirement information as the first description information;

[0159] If the first object type is a business type, then obtain the sensitivity information and / or business relevance information of the accessed object, and use the sensitivity information and / or business relevance information together as the first description information.

[0160] In some embodiments of this disclosure, the second determining module 502 is further configured to:

[0161] If the second object is a data type, then obtain the data subtype of the object to be accessed, and use the data subtype as the second description information;

[0162] If the second object is a function type, then obtain the function subtype of the object to be accessed, and use the function subtype as the second description information;

[0163] If the second object is an interface type, then obtain the interface subtype of the object to be accessed, and use the interface subtype as the second description information.

[0164] In some embodiments of this disclosure, the third determining module 504 is further configured to:

[0165] The first risk score is determined based on the first identification information and the third description information;

[0166] The access risk level is determined based on the first risk score, the first descriptive information, and the second descriptive information.

[0167] In some embodiments of this disclosure, the third description information includes: third description information corresponding to different environment types;

[0168] The third determining module 504 is also used for:

[0169] Based on the third descriptive information corresponding to different environmental types, the environmental risk score corresponding to each environmental type is determined;

[0170] The first risk score is determined based on the environmental risk score corresponding to each environmental type and the first identification information.

[0171] In some embodiments of this disclosure, the environment type includes: physical environment type, geographical environment type, computing environment type, and network environment type;

[0172] The third determining module 504 is also used for:

[0173] Based on the third descriptive information corresponding to the physical environment type, the operational risk level value in the environment is determined. The operational risk level value is an environmental risk score and is used to describe whether the operation in the environment meets the standards.

[0174] Based on the third descriptive information corresponding to the geographical environment type, the geographical environment score corresponding to the access object is determined. The geographical environment score is an environmental risk score and is used to describe whether the geographical environment of the access object meets the standards.

[0175] Based on the third description information corresponding to the computing environment type, the computing environment score corresponding to the access object is determined. The computing environment score is an environmental risk score, which is used to describe whether the computing environment of the access object meets the standards.

[0176] Based on the third description information corresponding to the network environment type, the network environment score corresponding to the access object is determined. The network environment score is an environmental risk score, which is used to describe whether the network environment of the access object meets the standards.

[0177] In some embodiments of this disclosure, the third determining module 504 is further configured to:

[0178] The environmental risk scores corresponding to each environmental type are pooled to obtain the first matrix;

[0179] The first identifier information is pooled to obtain the second matrix;

[0180] Determine the modular multiplication value of the first and second matrices;

[0181] The first and second matrices are processed by a convolutional neural network to obtain the convolutional feature map output by the convolutional neural network.

[0182] Determine the ratio between the modular multiplication value and the volume of the convolutional feature map, and use this ratio as the first risk score.

[0183] In some embodiments of this disclosure, the generation module 505 is further configured to:

[0184] Obtain multiple score ranges, where each score range has a corresponding candidate access permission level;

[0185] If the second risk score falls within the score range, the candidate access level corresponding to the score range will be used as the target access level.

[0186] In this embodiment, when a first access request is detected from an access object to a target object, the first object type of the access object and the second object type of the target object are determined. Then, based on the first object type, the first description information and the first identification information of the access object are determined. Based on the second object type, the second description information of the target object is determined. Then, the third description information of the environment in which the access object is located is determined. Then, based on the first identification information, the first description information, the second description information, and the third description information, the access risk level information is determined. Finally, based on the access risk level information, the target access permission level of the access object is generated. Thus, access risk assessment can be performed based on three dimensions: the access object, the target object, and the access environment, thereby enabling more granular access control based on the access risk level information.

[0187] According to embodiments of this disclosure, this disclosure also provides an electronic device, a computer-readable storage medium, and a computer program product.

[0188] Figure 6 A block diagram of an exemplary electronic device suitable for implementing embodiments of the present disclosure is shown.

[0189] Figure 6 The electronic device 12 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0190] like Figure 6As shown, the electronic device 12 is represented in the form of a general-purpose computing device. The components of the electronic device 12 may include, but are not limited to: one or more processors or processing units 16, memory 28, and bus 18 connecting different system components (including memory 28 and processing unit 16).

[0191] Bus 18 represents one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any of the various bus architectures. Examples of these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0192] Electronic device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by electronic device 12, including volatile and non-volatile media, removable and non-removable media.

[0193] Memory 28 may include computer system readable media in the form of volatile memory, such as Random Access Memory (RAM) 30 and / or cache memory 32. Electronic device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 34 may be used to read and write non-removable, non-volatile magnetic media (… Figure 6 Not shown; usually referred to as a "hard drive".

[0194] although Figure 6As not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk") and an optical disc drive for reading and writing to a removable non-volatile optical disc (e.g., a compact disc read-only memory (CD-ROM), a digital video disc read-only memory (DVD-ROM), or other optical media) may be provided. In these cases, each drive may be connected to bus 18 via one or more data media interfaces. Memory 28 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of the embodiments of this disclosure.

[0195] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in memory 28. Such program modules 42 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment. Program modules 42 typically perform the functions and / or methods described in the embodiments of this disclosure.

[0196] Electronic device 12 can also communicate with one or more external devices 14 (e.g., keyboard, pointing device, display 24, etc.), and with one or more devices that enable human interaction with electronic device 12, and / or with any device that enables electronic device 12 to communicate with one or more other computing devices (e.g., network card, modem, etc.). This communication can be performed via input / output (I / O) interface 22. Furthermore, electronic device 12 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 20. As shown, network adapter 20 communicates with other modules of electronic device 12 via bus 18. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0197] The processing unit 16 executes various functional applications and parameter information determination by running programs stored in the memory 28, such as implementing the business data storage method mentioned in the foregoing embodiments, or implementing the business data acquisition method mentioned in the foregoing embodiments.

[0198] It should be noted that in the description of this disclosure, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this disclosure, unless otherwise stated, "a plurality of" means two or more.

[0199] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of preferred embodiments of this disclosure includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the function involved, as will be understood by those skilled in the art to which embodiments of this disclosure pertain.

[0200] It should be understood that various parts of this disclosure can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0201] Those skilled in the art will understand that all or part of the steps of the methods described in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0202] Furthermore, the functional units in the various embodiments of this disclosure can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0203] The storage media mentioned above can be read-only memory, disk, or optical disk, etc.

[0204] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this disclosure. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0205] Although embodiments of the present disclosure have been shown and described above, it is to be understood that the above embodiments are exemplary and should not be construed as limiting the present disclosure. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present disclosure.

Claims

1. An access control method, characterized in that, The method includes: If it is detected that the access object sends a first access request to the object to be accessed, determine the first object type of the access object and the second object type of the object to be accessed; Based on the first object type, determine the first description information and the first identification information of the accessed object, and based on the second object type, determine the second description information of the object to be accessed; The third descriptive information of the environment in which the accessed object is located is determined; Based on the first identification information, the first description information, the second description information, and the third description information, the access risk level information is determined; Based on the access risk level information, a target access permission level for the accessed object is generated; The step of determining the access risk level information based on the first identification information, the first description information, the second description information, and the third description information includes: Based on the first identification information and the third description information, a first risk score is determined, which includes: determining an environmental risk score corresponding to each environmental type based on the third description information corresponding to different environmental types respectively; performing pooling processing on the environmental risk scores corresponding to each environmental type to obtain a first matrix; performing pooling processing on the first identification information to obtain a second matrix; determining the modular multiplication value of the first matrix and the second matrix; processing the first matrix and the second matrix based on a convolutional neural network to obtain a convolutional feature map output by the convolutional neural network; determining the ratio between the modular multiplication value and the volume of the convolutional feature map; and using the ratio as the first risk score. Based on the first risk score, the first description information, and the second description information, the access risk level information is determined.

2. The method as described in claim 1, characterized in that, The first object type includes any of the following: Personnel type; Equipment type; Business type; The second object type includes any of the following: Data type; Function type; Interface type.

3. The method as described in claim 2, characterized in that, Determining the first description information of the accessed object based on the first object type includes: If the first object type is the personnel type, then obtain the job description information and / or technical grade information of the accessed object, and use the job description information and / or the technical grade information as the first description information; If the first object type is the device type, then obtain the functional description information and / or security requirement information of the access object, and use the functional description information and / or security requirement information as the first description information; If the first object type is the business type, then obtain the sensitivity information and / or business relevance information of the accessed object, and use the sensitivity information and / or the business relevance information together as the first description information.

4. The method as described in claim 2, characterized in that, The step of determining the second description information of the object to be accessed based on the second object type includes: If the second object is the data type, then obtain the data subtype of the object to be accessed, and use the data subtype as the second description information; If the second object is the function type, then obtain the function subtype of the object to be accessed, and use the function subtype as the second description information; If the second object is the interface type, then obtain the interface subtype of the object to be accessed, and use the interface subtype as the second description information.

5. The method as described in claim 1, characterized in that, The third descriptive information includes: third descriptive information corresponding to different environment types; The step of determining the first risk score based on the first identification information and the third description information includes: Based on the third descriptive information corresponding to different environment types, an environmental risk score is determined for each of the aforementioned environment types. The first risk score is determined based on the environmental risk score corresponding to each of the environmental types and the first identification information.

6. The method as described in claim 5, characterized in that, The environment types include: physical environment type, geographical environment type, computing environment type, and network environment type; The step of determining the environmental risk score corresponding to each environmental type based on the third descriptive information corresponding to different environmental types includes: Based on the third descriptive information corresponding to the physical environment type, an operational risk level value in the environment is determined, wherein the operational risk level value belongs to the environmental risk score, and the operational risk level value is used to describe whether the operation in the environment meets the standard. Based on the third descriptive information corresponding to the geographical environment type, the geographical environment score corresponding to the access object is determined, wherein the geographical environment score belongs to the environmental risk score, and the geographical environment score is used to describe whether the geographical environment of the access object meets the standards. Based on the third description information corresponding to the computing environment type, the computing environment score corresponding to the access object is determined, wherein the computing environment score belongs to the environment risk score, and the computing environment score is used to describe whether the computing environment of the access object meets the standards; Based on the third description information corresponding to the network environment type, the network environment score corresponding to the access object is determined, wherein the network environment score belongs to the environment risk score, and the network environment score is used to describe whether the network environment of the access object meets the standard.

7. An access control device, characterized in that, The device includes: The first determining module is used to determine the first object type of the access object and the second object type of the object to be accessed when it is detected that the access object sends a first access request to the object to be accessed. The second determining module is used to determine the first description information and the first identification information of the accessed object according to the first object type, and to determine the second description information of the object to be accessed according to the second object type. The third determining module is used to determine the third description information of the environment in which the accessed object is located; The fourth determining module is used to determine the access risk level information based on the first identification information, the first description information, the second description information, and the third description information; The generation module is used to generate the target access permission level of the access object based on the access risk level information; The fourth determining module is further configured to determine the access risk level information based on the first identification information, the first description information, the second description information, and the third description information, including: Based on the first identification information and the third description information, a first risk score is determined, which includes: determining an environmental risk score corresponding to each environmental type based on the third description information corresponding to different environmental types respectively; performing pooling processing on the environmental risk scores corresponding to each environmental type to obtain a first matrix; performing pooling processing on the first identification information to obtain a second matrix; determining the modular multiplication value of the first matrix and the second matrix; processing the first matrix and the second matrix based on a convolutional neural network to obtain a convolutional feature map output by the convolutional neural network; determining the ratio between the modular multiplication value and the volume of the convolutional feature map; and using the ratio as the first risk score. Based on the first risk score, the first description information, and the second description information, the access risk level information is determined.

8. An electronic device, characterized in that, include: processor; Memory used to store the processor's executable instructions; The processor is configured to execute the instructions to implement the method as described in any one of claims 1-6.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-6.

Images