Access control system integrating multiple mechanisms

Abstract

The invention discloses an access control system fusing multiple mechanisms. The access control system is characterized in that a main body initiates an access request to an access control execution node; the access control execution node forwards the access request to an access control decision node; the access control decision node queries a certificate type combination required by the access request from a policy storage library; the access control decision node initiates certificate requests to a plurality of decision attribute issuing nodes in parallel according to a fusion mode of certificates in the certificate type combination or initiates certificate requests to different decision attribute issuing nodes in sequence according to a certificate dependency sequence; the access control decision node performs parallel verification or hierarchical verification according to the fusion mode of the certificates in the certificate type combination to obtain an access decision result; and the access control execution node executes the access request according to the access decision result. According to the invention, a new control model can be flexibly expanded according to different business requirements and scenes.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to an access control system integrating multiple mechanisms. Background Art

[0002] Information is the most important asset of any organization and must be kept safe. The security of information can be ensured through confidentiality, integrity and availability. In addition, the information of an organization can be protected through different methods or technologies such as intrusion detection, steganography, cryptography and access control. These methods are used according to the purpose and objectives of the information and the organization. Among them, access control is one of the best methods used to protect information from internal and external attacks of the organization and to make decisions on granting and revoking access rights to any user. With the development of network technology and the increase of network threats, access control has become one of the core means to protect the security of information systems and data.

[0003] Traditional access control is divided into four types, namely, discretionary access control model (MAC), mandatory access control model (DAC), role-based access control model (RBAC) and attribute-based access control model (ABAC). Some fields have also introduced new access control models such as trust-based access control models. In DAC, the owner of the object determines the access rights granting or revoking policy of the subject or user, which is highly flexible and the authorization process is simple and direct. MAC works based on security labels, which can be regarded as a hierarchical structure model. It controls the access rights of users or processes to system resources. Users are assigned to different security levels, while objects are assigned to security labels, and access control rights are strictly controlled by administrators. RBAC is based on five different entities: objects, operations, permissions, roles, and users. It centrally manages permissions through roles, making authorization management relatively simple, reducing redundant policy configuration, and facilitating division of labor and hierarchical management. ABAC dynamically decides access rights through multi-dimensional factors such as user attributes, resource attributes, and environmental attributes. Compared with RBAC, ABAC can achieve fine-grained and dynamic control, and better adapt to changing access scenarios. Based on the trust access model, the trust value is calculated according to the subject's trust, historical behavior, contextual factors, etc., and incorporated into the access decision process. It can comprehensively consider the user's dynamic behavior and adapt to the highly open and dynamically changing network environment.

[0004] DAC is overly dependent on the judgment of resource owners, which can easily cause security risks. MAC is not flexible enough and is difficult to cope with changing business environments. When RBAC requires fine-grained authorization, role definitions are prone to "explosion", resulting in a significant increase in management complexity. In addition, the role system requires a large amount of role maintenance when the user scale and permission requirements change frequently, and lacks direct support for real-time attributes or context information. In high-concurrency or complex scenarios, ABAC policy evaluation consumes a lot of system resources, and it is difficult to synchronize attributes in real time. The trust calculation based on the trust access model is time-consuming and can easily cause access delays in high-concurrency environments. In addition, the above access control model can only select specific types of authorization factors, making it increasingly difficult to make fast and secure access decisions for a large number of distributed subject users. It cannot fully meet the needs of open dynamic networks, and the scalability of the access control model and the compatibility analysis of multiple authorization factors are seriously insufficient. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention provides an access control system that integrates multiple mechanisms. It ensures the integrity and validity of authorization attributes by using certificates, dynamically integrates multiple access control models in the access control decision-making process through decision points, supports multiple authorization factors, and solves the problems of traditional models in terms of insufficient flexibility and scalability. It can flexibly expand new control models according to different business needs and scenarios.

[0006] The present invention provides an access control system integrating multiple mechanisms, the system comprising: a subject, an object, an access control execution node, an access control decision node, a decision attribute issuance node, a policy repository, a certificate repository and a certificate revocation list; The subject initiates an access request to the access control execution node, wherein the access request includes: information of the subject, information of the object to be accessed, and an operation type; After receiving the access request, the access control execution node forwards the access request to the access control decision node; The access control decision node queries the policy repository for a combination of certificate types required for the access request; The access control decision node initiates certificate requests to multiple decision attribute issuing nodes in parallel according to the fusion mode of the certificates in the certificate type combination, or initiates certificate requests to different decision attribute issuing nodes in sequence according to the certificate dependency order, and each decision attribute issuing node queries the corresponding certificate from the certificate repository according to the received certificate request and returns it to the access control decision node; The access control decision node checks whether the certificates in the certificate type combination are invalid from the certificate revocation list. If not, parallel verification or hierarchical verification is performed according to the fusion mode of the certificates in the certificate type combination. After the verification is completed, the successfully verified certificate information, the object information and the environment information are matched with the access control policy rules in the policy repository to obtain the access decision result and return it to the access control execution node; The access control execution node executes the access request according to the access decision result.

[0007] Preferably, the subject is the initiator of the access request; the object is the resource created by the resource owner and published to the network; the decision attribute issuance node is a trusted decision point, which is used to issue a certificate containing access rights to the subject according to the access control policy, and different access control models correspond to different decision attribute issuance nodes, and each decision attribute issuance node issues different types of certificates according to the corresponding access control model; the certificate types include trust certificates, role certificates and security level certificates, and the certificate includes the certificate issuer, authorization content, validity period of the certificate, signature algorithm and signature.

[0008] Preferably, the policy repository is used to store access control policy rules; assuming that the access control policy rules are expressed as R = (s, o, p, op, d), wherein s, o, op, and p respectively represent the subject, the object that the subject needs to access, the type of operation performed by the subject on the object, and the permission required for the subject to operate on the object. The access control policy rules are used to specify that the operation op performed by the subject s on a set of objects o when the permission p is satisfied is granted by the decision d of the rule R, and the decision d includes authorized access, denied authorization, and delayed authorization. The permission p is a logical expression composed of one or more conditions connected by logical operators, and each condition is the relationship between a condition variable of a specific access control model and a decision value obtained by the access control for the variable.

[0009] Preferably, the access control decision node is specifically used for: S31, the access control decision node receives the access request, the access request is expressed as (s req , o req , op req ), s req Indicates the information of the subject, o req Information indicating the object, op req Indicates the operation type; S32, based on o req Obtaining the access control policy rule R for the object from the policy repository req ), if R (o req) does not exist, access is denied. req ) exists, execute step S33; S33, based on s req From R(o req ) to obtain the req The access control policy rule R (s req , o req ), if R(s req , o req ) does not exist, access is denied. If R (s req , o req ) exists, execute step S34; S34, based on op req From R (s req , o req ) to obtain the access control policy rule R (s req , o req , op req ), such as R (s req , o req , op req ) does not exist, access is denied, such as R (s req , o req , op req ) exists, execute step S35; S35, from the access control policy rule R (s req , o req , op req ), and determine the certificate type combination required for the access request according to the specific access control model condition variable in the permission p.

[0010] Preferably, the access control decision node is specifically used for: If at least two certificates in the certificate type combination are in a horizontal integration mode, the access control decision node initiates certificate requests to multiple decision attribute issuance nodes in parallel, and each decision attribute issuance node independently processes the corresponding certificate generation logic; If the certificates in the certificate type combination are vertically integrated, the access control decision node will initiate certificate requests to different decision attribute issuance nodes in sequence according to the certificate dependency order. After the certificate of the preceding decision attribute issuance node is verified, its output will be used as the input parameter for certificate generation of the subsequent decision attribute issuance node; Each decision attribute issuing node queries the corresponding certificate from the certificate repository according to the received certificate request, and returns it to the access control decision node if it exists. If not, it issues the corresponding certificate to the subject based on the identity of the subject or other types of certificates as input and returns it to the access control decision node.

[0011] Preferably, the access control decision node is specifically used for: The access control decision node checks whether the certificate in the certificate type combination exists in the certificate revocation list. If not, it means that the certificate is not invalid, and the certificate verification is performed. If the certificate verification fails, it means that the attribute information contained in the certificate is invalid. The access control decision node will adopt different processing strategies according to the fusion mode of the certificate; If at least two certificates in the certificate type combination are in a horizontal integration mode, the access control decision node performs parallel verification, and if the verification of one certificate fails, the verification of other certificates will not be interrupted; If the certificates in the certificate type combination are vertically integrated, the access control decision node performs hierarchical verification. If the verification of a certificate fails, the verification process of other certificates that rely on the certificate will be interrupted; After all certificates are verified, the attribute information of the authorization content field in the successfully verified certificate, the information of the object and the environment information are matched with the access control policy rules in the policy repository, and the access decision result is returned to the access control execution node. The access decision result includes: allowing access, denying access or delaying authorized access.

[0012] Preferably, the access control execution node is specifically used for: The access control execution node performs corresponding operations according to the access decision result; If the access decision result is to allow access, the access control execution node performs a corresponding operation on the object; If the access decision result is access denial, blocking access and notifying the subject of the required certificate type combination and corresponding access conditions; If the access decision result is delayed authorization of access, the subject will obtain access rights after a predetermined time.

[0013] Preferably, the decision attribute issuing node is further used for: During the entire access process, the validity of the certificates in the certificate type combination is monitored. If it is found that the certificate of the subject is no longer valid, the original certificate is added to the certificate revocation list, and the latest certificate is generated and stored in the certificate repository.

[0014] Compared with the prior art, the present invention has the following beneficial effects: 1. Reduce repeated calculations of decision attribute issuance nodes through the certificate storage center, and ensure the validity of certificates by combining the monitoring center and revocation list.

[0015] 2. By issuing nodes with different types of decision attributes as certificate issuing centers, it is possible to flexibly integrate multiple access control models and provide strong support for security management in complex scenarios.

[0016] 3. Issue different types of authorization certificates through issuing nodes with different decision attributes, such as user identity attributes, trust, etc., so as to achieve fine-grained security protection of information, resources and services.

[0017] 4. When the system needs to expand other access control models, it only needs to add relevant decision attribute issuance nodes and integrate them into the system without affecting the overall operation of the system.

[0018] 5. Adopt the "horizontal integration + vertical integration" approach to support dynamic combination authorization of multi-model rules. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 This is a schematic diagram of the structure of the access control system integrating multiple mechanisms provided by the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] The present invention is further described in detail below in conjunction with the accompanying drawings.

[0022] like Figure 1 As shown, an embodiment of the present invention proposes an access control system integrating multiple mechanisms, including: a subject, an object, an access control execution node, an access control decision node, a decision attribute issuance node, a policy repository, a certificate repository and a certificate revocation list; The subject initiates an access request to the access control execution node. The access request includes: information about the subject, information about the object to be accessed, and the type of operation; After receiving the access request, the access control execution node forwards the access request to the access control decision node; The access control decision node queries the policy repository for the combination of certificate types required for the access request; The access control decision node initiates certificate requests to multiple decision attribute issuing nodes in parallel according to the fusion mode of the certificates in the certificate type combination, or initiates certificate requests to different decision attribute issuing nodes in sequence according to the certificate dependency order. The decision attribute issuing node queries the corresponding certificate from the certificate repository according to the received certificate request and returns it to the access control decision node; The access control decision node checks whether the certificates in the certificate type combination are invalid from the certificate revocation list. If they are not invalid, parallel verification or hierarchical verification is performed according to the fusion method of the certificates in the certificate type combination. After the verification is completed, the successfully verified certificate information, object information and environment information are matched with the access control policy rules in the policy repository to obtain the access decision result and return it to the access control execution node; The access control execution node executes the access request according to the access decision result.

[0023] In the embodiment of the present invention, the subject is the initiator of the access request; the object is the resource created and published to the network by the resource owner.

[0024] In the embodiment of the present invention, the decision attribute issuance node is a trusted decision point, which is used to issue a certificate containing access rights to the subject according to the access control policy. Different access control models correspond to different decision attribute issuance nodes, and each decision attribute issuance node issues different types of certificates according to the corresponding access control model. These certificates may contain different authorization information, such as the identity, role, trust or other attributes of the subject, so as to support the dynamic combination and decision of multiple access control policies.

[0025] In the embodiment of the present invention, the certificate revocation list is used to store certificates that are invalid due to various reasons (such as active certificate revocation, invalid subject identity, risk or abnormal behavior detection, etc.). Specifically, when the decision attribute issuing node determines that a certificate no longer has legal access rights, it will record it in the certificate revocation list, and provide the list to the access control system for inspection when accepting access requests later.

[0026] In the embodiment of the present invention, the policy repository is used to store access control policy rules; assuming that the access control policy rules are expressed as R = (s, o, p, op, d), where s, o, op, and p represent the subject, the object that the subject needs to access, the type of operation of the subject on the object, and the authority required for the subject to operate on the object, respectively. The access control policy rules are used to specify that the operation op performed by the subject s on a set of objects o when the authority p is satisfied is granted by the decision d of the rule R, and the decision d includes authorized access, denied authorization, and delayed authorization. The authority p is a logical expression composed of one or more conditions connected by logical operators, and each condition is the relationship between a specific access control model condition variable and a decision value obtained by the access control for the variable. Specifically, p is a combination of one or more conditions C1, C2, ..., C z A logical expression is formed by connecting logical operators {∧,∨, ¬,⊕, ...}, and each condition C i It can be expressed as V i {=,≠,>,<,≥,≤,∈,…}Z i , where V i is a condition variable for a specific access control model, Z i is the decision value resulting from access control for this variable.

[0027] In the embodiment of the present invention, the access control decision node is specifically used for: S31, the access control decision node receives an access request, the access request is expressed as (s req , o req , op req ), s req Indicates the subject's information, o req Information about the object, op req Indicates the operation type; S32, based on o req Get the access control policy rules R for the object from the policy repository req ), if R(o req ) does not exist, access is denied. req ) exists, execute step S33; S33, based on s req From R(o req ) to obtain the req The access control policy rule R (s req , o req ), if R(s req , o req ) does not exist, access is denied. If R (s req , o req ) exists, execute step S34; S34, based on op req From R (s req , o req ) to obtain the access control policy rule R (s req , o req , op req ), such as R (s req , o req , op req ) does not exist, access is denied, such as R (s req , o req , op req ) exists, execute step S35; S35, from the access control policy rule R (s req , o req , op req ) to obtain permission p, and determine the certificate type combination required for the access request based on the specific access control model condition variables in permission p.

[0028] In the embodiment of the present invention, the access control decision node is specifically used for: If at least two certificates in the certificate type combination are in horizontal fusion mode, the access control decision node initiates certificate requests to multiple decision attribute issuance nodes in parallel, and each decision attribute issuance node independently processes the corresponding certificate generation logic; If the certificates in the certificate type combination are vertically integrated, the access control decision node will initiate certificate requests to different decision attribute issuance nodes in the order of certificate dependency. After the certificate of the preceding decision attribute issuance node is verified, its output will be used as the input parameter for certificate generation of the subsequent decision attribute issuance node. Each decision attribute issuance node queries the corresponding certificate from the certificate repository based on the received certificate request. If the certificate exists, it is returned to the access control decision node. If not, it issues the corresponding certificate to the subject based on the subject's identity or other types of certificates as input and returns it to the access control decision node.

[0029] Specifically, the decision node determines the certificate conditions required for the subject's access from the policy rules based on the subject's access request, and then requests the corresponding decision attribute issuance node to issue these certificates. For horizontal fusion scenarios, the decision node initiates certificate requests to multiple decision attribute issuance nodes in parallel, and each decision attribute issuance node independently processes the certificate generation logic of the corresponding model; for vertical fusion scenarios, the decision nodes initiate requests to the decision attribute issuance nodes in sequence according to the model dependency order. After the certificate verification of the preceding decision attribute issuance node is passed, its output will be used as the input parameter for the certificate generation of the subsequent decision attribute issuance node. After receiving the certificate application, each decision attribute issuance node queries the certificate storage center. If it exists, it returns it. If it does not exist, it issues the corresponding certificate to the subject based on the subject's identity or other types of certificates as input (the certificate authorization content field contains attribute information) and returns the result.

[0030] In the embodiment of the present invention, the access control decision node is specifically used for: The access control decision node checks whether the certificate in the certificate type combination exists in the certificate revocation list. If not, it means that the certificate is not invalid, and the certificate verification is performed. If the certificate verification fails, it means that the attribute information contained in the certificate is invalid. The access control decision node will adopt different processing strategies according to the certificate fusion method; If at least two certificates in the certificate type combination are in horizontal integration mode, the access control decision node performs parallel verification. If the verification of one certificate fails, the verification of other certificates will not be interrupted; If the certificates in the certificate type combination are vertically integrated, the access control decision node performs hierarchical verification. If the verification of a certificate fails, the verification process of other certificates that rely on the certificate will be interrupted; After all certificates are verified, the attribute information, object information and environment information of the authorization content field in the successfully verified certificate are matched with the access control policy rules in the policy repository, and the access decision results are returned to the access control execution node. The access decision results include: allowing access, denying access or delaying authorized access.

[0031] Specifically, the decision node first determines whether the certificate exists in the certificate revocation list. If not, it means that the certificate is not expired. The certificate is verified. If the certificate verification fails, it means that the attribute information contained in the certificate has expired. The decision node will adopt different processing strategies according to the certificate integration method. In horizontal integration, the verification of multiple certificates is carried out independently. If the verification of a certificate fails, it will not interrupt the verification of other certificates. The verification results of other certificates can still affect the access decision, allowing continued authorization of access in some cases. In vertical integration, certificates have a nested relationship. If the verification of a certificate fails, the subsequent processes of other certificates that rely on the certificate will be interrupted. When all certificates are verified, the attribute information of the authorization content field in the successfully verified certificate is obtained and matched with the object, environment and other contents and the access control policy to make a decision on the access request. This process may involve matching multiple policy rules, merging the decisions returned by multiple matching rule subsets (such as using the logic of "allow first, deny first"), and the decision node will pass the final access decision result (allow, deny or delay authorization, etc.) back to the execution node.

[0032] For example, suppose there are the following two rules for accessing file A. There are three different types of decision-making attribute issuing nodes that issue trust, role certificates, and security level certificates respectively. The trust certificate requires a role certificate as input.

[0033] Rule R1: r.obj.Name == 'A' r.Permissions.Role==Teacher&&r.Permissions.Security Level==High&&r.Permissions.Time=='weekday' read allow The rule R1 requires that the visitor must be a teacher with a high security level certificate and can perform A read operations on weekdays.

[0034] Rule R2: r.obj.Name == 'A' r.Permissions.Trust level>80&&r.Permissions.Time=='weekday' read allow Rule R2 requires that the visitor's trust level is greater than 80 and that the file can be read on weekdays.

[0035] The embodiment of integration: Horizontal integration: Multiple access control models work in parallel, the system verifies the validity of different certificates, and ultimately decides whether to allow access through rule matching. For rule R1, the decision basis for accessing file A is "role" and "security level". The system will obtain the role and security level certificates in parallel and perform validity checks. Then the decision node will match the obtained certificate information with the object, environment, and other content, and the access control policy to make a decision.

[0036] Vertical integration: There is a nested relationship between different access control models. In this example, the generation of the trust certificate depends on the role certificate as input, that is, the certificate of a certain model depends on the certificate of another model as input, forming a hierarchical structure. For rule R2, the decision basis for accessing file A is "trust", and the issuance of the trust certificate requires the role certificate as input. In this case, the decision node needs to obtain and verify the role certificate of the subject first, and then further apply for the trust certificate and perform validity verification, and then match the obtained trust certificate information with the object, environment, and other content, and the access control policy for decision making.

[0037] For horizontal integration: When the subject initiates an access request, the system obtains the role certificate and security level certificate at the same time. If both certificates are valid, they are matched through the rule set. If the subject's role certificate at this time meets Role==Teacher, the security level certificate Security Level==High, and the date is a working day, then when R1 is matched and returns allow, access to file A is allowed. This is horizontal integration, because the role certificate and security level certificate are verified in parallel, and R1 jointly decides whether to allow access.

[0038] For vertical integration: when the subject initiates an access request, the decision node will obtain the predecessor certificate of the trust certificate, that is, the role certificate, as input. That is, first obtain and verify the subject's role certificate, and then use it as input to further apply for a trust certificate and verify its validity. Then match the obtained certificate information with the object, environment and other content and the rule set. If the subject's trust certificate Trust level==90 at this time, and the date is a working day, then when matching R2, it returns allow, and access to file A is allowed. This is vertical integration. Here, vertical integration is reflected in the fact that the application for a trust certificate depends on verifying the role certificate first, that is, a certificate of a certain access control model affects the certificate application of another model.

[0039] The present invention adopts the method of "horizontal fusion + vertical fusion" to support dynamic combination authorization of multi-model rules.

[0040] In the embodiment of the present invention, the access control execution node is specifically used for: The access control execution node performs corresponding operations according to the access decision results; If the access decision result is to allow access, the access control execution node performs the corresponding operation on the object; If the access decision result is access denied, access is blocked and the subject is notified of the required combination of certificate types and the corresponding access conditions; If the access decision result is delayed authorization of access, the subject will obtain access rights after a predetermined time.

[0041] In the embodiment of the present invention, the decision attribute issuing node is further used for: During the entire access process, the decision attribute issuance node monitors the validity of the certificates in the certificate type combination. If it is found that the subject's certificate is no longer valid, the original certificate is added to the certificate revocation list and the latest certificate is generated and stored in the certificate repository.

[0042] During the entire access process, the validity of the certificate is monitored by the decision attribute issuance node. Once it is found that the subject's certificate is no longer valid (such as identity information, trust changes, abnormal behavior, etc.), the decision attribute issuance node will add the original certificate to the revocation list and generate the latest certificate to store in the certificate library. Every time an access request is made, the access control system will check whether the certificate is in the revocation list to ensure that only valid certificates can make authorization decisions.

[0043] Compared with the prior art, the advantages of the present invention are: By using different types of decision attribute issuance nodes as the certificate issuance center, multiple access control models can be flexibly integrated to provide strong support for security management in complex scenarios. Different decision attribute issuance nodes can issue different types of authorization certificates, such as user identity attributes, trust, etc., to achieve fine-grained security protection for information, resources, and services. When the system needs to expand other access control models, it only needs to add relevant decision attribute issuance nodes and integrate them into the system without affecting the overall operation of the system.

[0044] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An access control system integrating multiple mechanisms, the system comprising: Subject, object, access control execution node, access control decision node, decision attribute issuance node, policy repository, certificate repository and certificate revocation list; The subject initiates an access request to the access control execution node, wherein the access request includes: information of the subject, information of the object to be accessed, and an operation type; After receiving the access request, the access control execution node forwards the access request to the access control decision node; The access control decision node queries the policy repository for a combination of certificate types required for the access request; The access control decision node initiates certificate requests to multiple decision attribute issuing nodes in parallel according to the fusion mode of the certificates in the certificate type combination, or initiates certificate requests to different decision attribute issuing nodes in sequence according to the certificate dependency order, and each decision attribute issuing node queries the corresponding certificate from the certificate repository according to the received certificate request and returns it to the access control decision node; The access control decision node checks whether the certificates in the certificate type combination are invalid from the certificate revocation list. If not, parallel verification or hierarchical verification is performed according to the fusion mode of the certificates in the certificate type combination. After the verification is completed, the successfully verified certificate information, the object information and the environment information are matched with the access control policy rules in the policy repository to obtain the access decision result and return it to the access control execution node; The access control execution node executes the access request according to the access decision result.

2. The system according to claim 1, characterized in that The subject is the initiator of the access request; the object is the resource created and published to the network by the resource owner; the decision attribute issuance node is a trusted decision point, which is used to issue a certificate containing access rights to the subject according to the access control policy. Different access control models correspond to different decision attribute issuance nodes. Each decision attribute issuance node issues different types of certificates according to the corresponding access control model; the certificate types include trust certificates, role certificates and security level certificates, and the certificate includes the certificate issuer, authorization content, validity period of the certificate, signature algorithm and signature.

3. The system according to claim 1, characterized in that The policy repository is used to store access control policy rules; assuming that the access control policy rules are expressed as R = (s, o, p, op, d), where s, o, op, and p represent the subject, the object that the subject needs to access, the type of operation performed by the subject on the object, and the permission required for the subject to operate on the object, respectively. The access control policy rules are used to specify that the operation op performed by the subject s on a set of objects o when the permission p is satisfied is granted by the decision d of the rule R, and the decision d includes authorized access, denied authorization, and delayed authorization. The permission p is a logical expression composed of one or more conditions connected by logical operators, and each condition is the relationship between a condition variable of a specific access control model and a decision value obtained by access control for the variable.

4. The system according to claim 3, characterized in that The access control decision node is specifically used for: S31, the access control decision node receives the access request, the access request is expressed as (s req , o req , op req ), s req Indicates the information of the subject, o req Information indicating the object, op req Indicates the operation type; S32, based on o req Obtain access control policy rules R for the object from the policy repository. req ), if R (o req ) does not exist, access is denied. req ) exists, execute step S33; S33, based on s req From R(o req ) to obtain the req The access control policy rule R (s req , o req ), if R (s req , o req ) does not exist, access is denied. If R (s req , o req ) exists, execute step S34; S34, based on op req From R (s req , o req ) to obtain the access control policy rule R (s req , o req , op req ), such as R (s req , o req , op req ) does not exist, access is denied, such as R (s req , o req , op req ) exists, execute step S35; S35, from the access control policy rule R (s req , o req , op req ), and determine the certificate type combination required for the access request according to the specific access control model condition variable in the permission p.

5. The system according to claim 1, characterized in that The access control decision node is specifically used for: If at least two certificates in the certificate type combination are in a horizontal integration mode, the access control decision node initiates certificate requests to multiple decision attribute issuance nodes in parallel, and each decision attribute issuance node independently processes the corresponding certificate generation logic; If the certificates in the certificate type combination are vertically integrated, the access control decision node will initiate certificate requests to different decision attribute issuance nodes in sequence according to the certificate dependency order. After the certificate of the preceding decision attribute issuance node is verified, its output will be used as the input parameter for certificate generation of the subsequent decision attribute issuance node; Each decision attribute issuing node queries the corresponding certificate from the certificate repository according to the received certificate request, and returns it to the access control decision node if it exists. If not, it issues the corresponding certificate to the subject based on the identity of the subject or other types of certificates as input and returns it to the access control decision node.

6. The system according to claim 1, characterized in that The access control decision node is specifically used for: The access control decision node checks whether the certificate in the certificate type combination exists in the certificate revocation list. If not, it means that the certificate is not invalid, and the certificate verification is performed. If the certificate verification fails, it means that the attribute information contained in the certificate is invalid. The access control decision node will adopt different processing strategies according to the fusion mode of the certificate; If at least two certificates in the certificate type combination are in a horizontal integration mode, the access control decision node performs parallel verification, and if the verification of one certificate fails, the verification of other certificates will not be interrupted; If the certificates in the certificate type combination are vertically integrated, the access control decision node performs hierarchical verification. If the verification of a certificate fails, the verification process of other certificates that rely on the certificate will be interrupted; After all certificates are verified, the attribute information of the authorization content field in the successfully verified certificate, the information of the object and the environment information are matched with the access control policy rules in the policy repository, and the access decision result is returned to the access control execution node. The access decision result includes: allowing access, denying access or delaying authorized access.

7. The system according to claim 1, characterized in that The access control execution node is specifically used for: The access control execution node performs corresponding operations according to the access decision result; If the access decision result is to allow access, the access control execution node performs a corresponding operation on the object; If the access decision result is access denial, blocking access and notifying the subject of the required certificate type combination and corresponding access conditions; If the access decision result is delayed authorization of access, the subject will obtain access rights after a predetermined time.

8. The system according to claim 1, characterized in that The decision attribute issuing node is also used for: During the entire access process, the validity of the certificates in the certificate type combination is monitored. If it is found that the certificate of the subject is no longer valid, the original certificate is added to the certificate revocation list, and the latest certificate is generated and stored in the certificate repository.

Images