Access control method and system, electronic equipment and storage medium

Abstract

The invention provides an access control method and system, electronic equipment and a storage medium, and relates to the technical field of access control, and the access control method comprises the following steps: obtaining an access request; wherein the access request comprises user identity information and resource security information; distributing user roles according to the user identity information; performing corresponding role permission allocation according to the user role to obtain a first control list; performing corresponding mandatory access permission allocation according to the resource security information to obtain a second control list; performing corresponding permission combination on the first control list and the second control list to obtain a third control list; verifying the access request through the first control list and the third control list to obtain a verification result; and performing access control on the access request according to the verification result. According to the method, the system, the electronic equipment and the storage medium provided by the invention, unauthorized access and permission abuse are limited through the mandatory access strategy defined by the system on the basis of role management.

Description

Technical Field

[0001] The present invention relates to the field of access control technology, and in particular to an access control method, system, electronic equipment and storage medium. Background Art

[0002] In information systems, access control is one of the core technologies to ensure the security of system resources. There are three main traditional access control models: Discretionary Access Control (DAC): allows resource owners to independently determine access rights. Mandatory Access Control (MAC): performs access control based on the system's predefined security policies, and does not allow users to change permission settings at will. Role-Based Access Control (RBAC) assigns permissions through roles and then maps users to roles, achieving a balance between flexibility and security.

[0003] The existing access control process lacks mandatory protection for highly sensitive resources, making it difficult to prevent malicious internal users from abusing permissions. Once permissions are configured, dynamic adaptability is poor, and the modification process is cumbersome, error-prone, and inflexible. It lacks comprehensive behavioral auditing and real-time anomaly detection capabilities, can only record basic access logs, and does not support advanced security event analysis and tracing. Summary of the invention

[0004] In view of the shortcomings of the prior art described above, the purpose of the present invention is to provide an access control method, system, electronic device and storage medium, which are used to solve the problem that it is difficult to prevent malicious internal users from abusing permissions during the access control process in the prior art. Once the permissions are configured, the dynamic adaptability is poor, and the modification process is cumbersome, prone to errors, and lacks flexibility. There is a lack of comprehensive behavioral auditing and real-time anomaly detection capabilities, and only basic access logs can be recorded, and advanced security event analysis and tracing are not supported.

[0005] To achieve the above-mentioned purpose and other related purposes, the present invention provides an access control method, including: obtaining an access request; wherein the access request includes user identity information and resource security information; assigning a user role according to the user identity information; performing corresponding role authority assignment according to the user role to obtain a first control list; performing corresponding mandatory access authority assignment according to the resource security information to obtain a second control list; combining the first control list and the second control list with corresponding permissions to obtain a third control list; verifying the access request through the first control list and the third control list to obtain a verification result; and performing access control on the access request according to the verification result.

[0006] In one embodiment of the present invention, before obtaining the access request, the method further includes: dynamically adjusting the role authority corresponding to the user identity information and the mandatory access authority corresponding to the resource security information by adjusting the policy.

[0007] In one embodiment of the present invention, user roles are assigned according to user identity information, including: verifying the legitimacy of the user identity through the user identity information; when the legitimacy of the user identity is verified, mapping the user identity to a corresponding user role to assign the user role.

[0008] In one embodiment of the present invention, corresponding mandatory access rights are allocated according to resource security information and mandatory access policies to obtain a second control list, including: obtaining a corresponding resource security level according to target resource information in the resource security information; obtaining a corresponding operation sensitivity according to expected operation information in the resource security information; and obtaining a second control list according to mandatory access policies corresponding to resource security levels, operation sensitivities and mandatory access rights.

[0009] In one embodiment of the present invention, an access request is verified through a first control list and a third control list to obtain a verification result, including: comparing the operation request permission corresponding to the access request with the first control list; when the operation request permission corresponding to the access request exists within the permitted scope of the first control list, comparing the operation request permission corresponding to the access request with the third control list, and when the operation request permission corresponding to the access request exists within the permitted scope of the third control list, obtaining a verification result indicates that the access request is passed.

[0010] In one embodiment of the present invention, access control is performed on the access request according to the verification result, including: when the verification result is that the access request is passed, access is allowed; when the verification result is that the access request is not passed, access is denied.

[0011] In one embodiment of the present invention, when the verification result is that the access request fails, after the access is denied, it also includes: obtaining all access requests corresponding to the verification result that the access request fails; monitoring abnormal behavior for each access request; and when an access request is abnormal, issuing a control alarm.

[0012] To achieve the above-mentioned purpose and other related purposes, the present invention also provides an access control system, including: an acquisition unit, used to obtain an access request; wherein the access request includes user identity information and resource security information; a role assignment unit, used to assign user roles according to the user identity information; a first list assignment unit, used to perform corresponding role authority assignments according to the user role to obtain a first control list; a second list assignment unit, used to perform corresponding mandatory access authority assignments according to the resource security information to obtain a second control list; a third list assignment unit, used to combine the first control list and the second control list with corresponding permissions to obtain a third control list; a verification unit, used to verify the access request through the first control list and the third control list to obtain a verification result; and a control unit, used to perform access control on the access request according to the verification result.

[0013] To achieve the above-mentioned purpose and other related purposes, the present invention further provides an electronic device, which includes: one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by one or more processors, the electronic device implements the aforementioned access control method.

[0014] To achieve the above-mentioned purpose and other related purposes, the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor of a computer, enables the computer to execute the aforementioned access control method.

[0015] As described above, an access control method, system, electronic device and storage medium of the present invention have the following beneficial effects: through a role-based mandatory access control model, a combination of role permissions and mandatory access policies is adopted, and mandatory access policies are added on the basis of role allocation permissions, forming a "role-mandatory policy" two-level filtering mechanism, which effectively prevents unauthorized access and abuse of permissions. By adopting a multi-dimensional access decision-making mechanism in the decision-making process of access requests, multi-dimensional factors such as user identity, role permissions, resource security level and operation sensitivity are comprehensively considered, that is, in the access request verification process, a complete decision-making process design that integrates user identity authentication, role permission verification, mandatory policy evaluation and operation legitimacy analysis is designed to ensure the accuracy and security of access control. The policy generation rules based on resource security level, operation sensitivity and user behavior history, as well as the algorithm design of dynamic policy updates, can flexibly respond to complex business scenarios and sudden security threats. In addition, by recording all access requests and operation behaviors, real-time monitoring, historical data backtracking and abnormal behavior analysis are supported, providing a basis for post-event accountability and system optimization. The access control process of the present invention is suitable for specific high-security scenarios (such as nuclear power DCS systems), especially the implementation process of role allocation, resource classification and policy refinement. It also supports standardized interfaces, facilitates integration with other systems, and has good adaptability and scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A schematic diagram of a flow chart of an access control method provided by an embodiment of the present invention.

[0017] Figure 2 Shown is a structural block diagram of an access control system provided by an embodiment of the present invention.

[0018] Figure 3 Shown is a structural schematic diagram of an electronic device according to an embodiment of the present invention.

[0019] Component number description

[0020] Electronic device 1; access control system 11; memory 12; processor 13; acquisition unit 111; role allocation unit 112; first list allocation unit 113; second list allocation unit 114; third list allocation unit 115; verification unit 116; control unit 117. DETAILED DESCRIPTION

[0021] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0022] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0023] In the following description, numerous details are discussed to provide a more thorough explanation of the embodiments of the present invention. However, it is obvious to those skilled in the art that the embodiments of the present invention can be implemented without these specific details. In other embodiments, well-known structures and devices are shown in the form of block diagrams rather than in detail to avoid making the embodiments of the present invention difficult to understand.

[0024] Discretionary Access Control (DAC): Allows resource owners to independently determine access rights. This method lacks an effective constraint mechanism for permission abuse and cannot ensure the high security of key resources. DAC allows resource owners to independently determine permission configuration, which is highly flexible, but is vulnerable to malicious users abusing permissions or virus propagation. Especially in a complex multi-user environment, permission management may lead to uncontrollable access behavior.

[0025] Mandatory Access Control (MAC): Access control is performed based on the system's predefined security policies, and users are not allowed to change permission settings at will. This method cannot adapt to real-time adjustment needs, has high management costs, and poor user experience. MAC manages all resources in a unified manner based on predefined security policies. Although it has high security, it lacks flexibility and is difficult to meet dynamic business needs.

[0026] Role-Based Access Control (RBAC) achieves a balance between flexibility and security by assigning permissions to roles and then mapping users to roles. However, this method relies on the correctness of role assignment and cannot enforce constraints on unauthorized access or sensitive operations. Improper role permissions configuration may lead to permission abuse or data leakage, especially in scenarios involving high-security resources, which lack stronger protection mechanisms.

[0027] The access control method provided by the present invention can effectively resolve the contradiction between flexibility and security, and overcome the problems of authority abuse, insufficient dynamic adaptability and lack of comprehensive auditing capability.

[0028] See also Figure 1 The present invention provides an access control method, comprising:

[0029] Step S10: Obtaining an access request; wherein the access request includes user identity information and resource security information;

[0030] Step S20: assigning user roles according to user identity information;

[0031] Step S30: assigning corresponding role permissions according to the user role to obtain a first control list;

[0032] Step S40: performing corresponding mandatory access rights allocation according to the resource security information to obtain a second control list;

[0033] Step S50: combining the first control list and the second control list with corresponding permissions to obtain a third control list;

[0034] Step S60: verifying the access request through the first control list and the third control list to obtain a verification result;

[0035] Step S70: Perform access control on the access request according to the verification result.

[0036] It is not difficult to find through the above steps that in the access control method of the present invention, when the user submits an access request to the system through a unified interface, the access request also includes user identity information and resource security information. The user role can be determined by the user identity information, and the first control list based on the role authority allocation can be further obtained according to the user role. At the same time, the second control list can be obtained based on the allocation of mandatory access rights through resource security information. It is worth noting that the first control list is a user autonomous access list, and the second control list is a mandatory access control list under the management of a security administrator. After obtaining the first control list and the second control list, the third control list is obtained by combining the first control list and the second control list for authority, and the access request is verified by using the first control list and the third control list to obtain a verification result, that is, to determine whether the access request can be passed, and then the access request is access controlled using the corresponding verification result. Through the above-mentioned secondary filtering mechanism combining role authority and mandatory access rights, the problem of unauthorized access and abuse of authority can be effectively prevented. It solves the problem that due to improper configuration of role authority in the role-based access control (RBAC) process, authority abuse or data leakage may be caused, especially in the scenario involving high-security level resources, the problem of lack of stronger protection mechanism. At the same time, it also solves the problem that mandatory access control (MAC) cannot adapt to real-time adjustment needs, has high management costs and poor user experience; and the problem that MAC manages all resources in a unified manner based on predefined security policies, which has high security but lacks flexibility and is difficult to meet dynamic business needs.

[0037] It is worth noting that the access control design of the present invention can be designed for high-security scenarios (such as nuclear power DCS, financial core systems), supporting complex role and resource management requirements. It also supports standardized interfaces and seamlessly integrates with existing systems (such as industrial control systems, enterprise security management platforms) for easy expansion.

[0038] Figure 1 A flowchart of an access control method in an exemplary embodiment of the present application is shown, including steps S10 to S70. Figure 1 The technical solution of this application will be described in detail.

[0039] First, step S10 is executed to obtain an access request; wherein the access request includes user identity information and resource security information.

[0040] When a user submits an access request to the system through the unified interface, the access request includes user identity information and resource security information. Then, the first control list can be determined by the user identity information, and the second control list can be confirmed by the resource security information, so as to implement access control on the access request by combining the first control list and the second control list with the third control list generated by combining the first control list and the second control list.

[0041] In this embodiment, when a user initiates an access request, the user may include a human user and a device user, wherein the human user includes an operator, an administrator, etc., and the device user includes an industrial control device, an engineer station, etc.

[0042] Before step S10, that is, before obtaining the access request, the following steps are also included:

[0043] Dynamically adjust the role permissions corresponding to user identity information and the mandatory access permissions corresponding to resource security information by adjusting the policy.

[0044] In this embodiment, the resource security level or operation sensitivity can be temporarily adjusted according to the business scenario requirements (such as in an emergency state). Specifically, based on the resource security level, the sensitivity of the operation, and the user's behavior history, the role permissions corresponding to the user identity information and the mandatory access permissions corresponding to the resource security information can be dynamically adjusted through adjustment policies, so that complex business scenarios and sudden security threats can be flexibly responded to.

[0045] It is worth noting that the dynamic adjustment mechanism of the present invention can support dynamic adjustment of role permissions and mandatory access policies according to business needs, real-time security threats and user behaviors, so that the system can quickly adapt to environmental changes. By combining the flexibility of RBAC (role-based access control) and the mandatory nature of MAC (mandatory access control), fine-grained permission management based on resources, roles and operations can be provided.

[0046] Next, step S20 is executed to assign a user role according to the user identity information.

[0047] When an access request is received, the user's identity information is used for identity verification to obtain the user role. After the user role is determined, the access request is further initiated.

[0048] In step S20, user roles are assigned according to user identity information, including:

[0049] Step S201: verify the legitimacy of the user identity through the user identity information;

[0050] Step S202: When the legitimacy of the user identity is verified, the user identity is mapped to a corresponding user role to assign the user role.

[0051] In this embodiment, when assigning a user role according to the user identity information corresponding to the access request, the user identity is firstly verified for legitimacy according to the user identity information, and after the legitimacy verification is passed, the corresponding user role is assigned to the user identity according to the mapping relationship between the user identity and the user role.

[0052] Next, step S30 is executed to allocate corresponding role permissions according to the user role to obtain a first control list.

[0053] After assigning a corresponding user role to the user identity according to the mapping relationship between the user identity and the user role, the corresponding role permission configuration can be performed according to the mapped user role, so as to generate a first control list by matching the role permission assignment of the user role. In this embodiment, a system administrator can define multiple user roles according to business needs, and assign corresponding operation permissions, such as read, write, and execute, to each user role.

[0054] Next, step S40 is executed to perform corresponding mandatory access rights allocation according to the resource security information to obtain a second control list.

[0055] When an access request is obtained, mandatory access rights are allocated according to the resource security information, so as to generate a second control list through the allocated mandatory access rights.

[0056] In step S40, corresponding mandatory access rights are allocated according to the resource security information and the mandatory access policy to obtain a second control list, including:

[0057] Step S401: Obtaining a corresponding resource security level according to target resource information in resource security information;

[0058] Step S402: Obtain corresponding operation sensitivity according to the expected operation information in the resource security information;

[0059] Step S402: According to the resource security level, operation sensitivity and the mandatory access policy corresponding to the mandatory access rights, corresponding mandatory access rights are allocated to obtain a second control list.

[0060] In this embodiment, when controlling access requests, it is necessary to comprehensively consider resource security levels, operation sensitivity, and user behavior. In the process of mandatory policy evaluation, the resource security information of the access request includes target resource information and expected operation information. The corresponding resource security level can be determined through the target resource information, and the corresponding operation sensitivity can be determined through the expected operation information, so as to limit the mandatory access policy through the resource security level and operation sensitivity, that is, to allocate mandatory access rights, obtain the corresponding mandatory access rights, and generate the second control list.

[0061] Specifically, the resource security level is the importance of the marked resource (such as high, medium, and low); the operation sensitivity is a measure of the potential impact of the operation on system security.

[0062] Next, step S50 and step S60 are executed to combine the first control list and the second control list with corresponding permissions to obtain a third control list; the access request is verified through the first control list and the third control list to obtain a verification result.

[0063] After obtaining the first control list through role authority allocation and the second control list through mandatory access authority allocation, the third control list is obtained by combining the first control list of role authority and the second control list of mandatory access authority, thereby realizing joint verification of the access request with the first control list to determine whether the access request is given a passed verification result.

[0064] In step S60, the access request is verified by the first control list and the third control list to obtain a verification result, including:

[0065] Step S601: Compare the operation request authority corresponding to the access request with the first control list;

[0066] Step S602: When the operation request permission corresponding to the access request exists within the permitted scope of the first control list, the operation request permission corresponding to the access request is compared with the third control list, and when the operation request permission corresponding to the access request exists within the permitted scope of the third control list, the verification result is that the access request is passed.

[0067] In this embodiment, in the process of verifying the access request, a multi-dimensional verification mechanism can be used to comprehensively consider multi-dimensional factors such as user identity, role authority, resource security level, and operation sensitivity to ensure the accuracy and security of access control. Specifically, the operation request authority of the access request is first compared and verified by the first control list obtained by the role authority allocation determined by the user identity. When the operation request authority of the access request exists within the permitted range of the first control list, it means that the verification in the first control list is passed. After the verification in the first control list is passed, the operation request authority of the access request is compared and verified by the third control list that combines the first control list and the second control list. When the operation request authority corresponding to the access request exists within the permitted range of the third control list, the verification result is that the access request is passed.

[0068] In one embodiment of the present invention, during the process of verifying an access request, when the operation request permission corresponding to the access request exists within the permitted range of the first control list but does not exist within the permitted range of the third control list, the verification result is that the access request is not passed. When the operation request permission corresponding to the access request does not exist within the permitted range of the first control list but exists within the permitted range of the third control list, the verification result is also that the access request is not passed. Similarly, when the operation request permission corresponding to the access request exists neither within the permitted range of the first control list nor within the permitted range of the third control list, the verification result is also that the access request is not passed.

[0069] It is worth noting that the third control list is generated by adding a mandatory access policy on the basis of RBAC. Further, when performing access verification, the access request can be verified and access controlled according to the access control matrix generated based on the resource security level, user role and operation sensitivity.

[0070] By introducing a mandatory access policy, that is, combining resource security level and operation sensitivity, a layer of mandatory control is added to ensure that high-security resources will not be exposed due to role configuration errors. In addition, based on role permissions, multi-dimensional access decisions are used to further verify the security of requests to prevent illegal access and abuse of permissions. In order to solve the problem of abuse of permissions, by adding a mandatory access policy, unauthorized access behaviors are restricted by using dimensions such as resource security level and operation sensitivity to avoid resource leakage or destruction caused by improper permission configuration.

[0071] Next, step S70 is executed to perform access control on the access request according to the verification result.

[0072] After obtaining the verification results, access control will be further performed on the access request based on the verification results to effectively prevent unauthorized access and abuse of authority.

[0073] In step S70, access control is performed on the access request according to the verification result, including:

[0074] Step S701: When the verification result is that the access request is passed, access is allowed;

[0075] Step S702: When the verification result is that the access request is not passed, the access is denied.

[0076] In this embodiment, the access result includes two types, one is that the access request is passed; the other is that the access request is not passed. When the access request is passed, the access is allowed, that is, the system access can be performed according to the access request. If the access request is not passed, the access is denied, that is, the access request does not support system access.

[0077] In step S702, when the verification result is that the access request is not passed, after denying the access, the following steps are further included:

[0078] Step S7021: Obtain all access requests corresponding to the access request failure verification result;

[0079] Step S7022: Monitor each access request for abnormal behavior;

[0080] Step S7023: When an access request is abnormal, a control alarm is issued.

[0081] In this embodiment, when access control is performed on access requests based on the verification results, all access requests will also be recorded and analyzed to obtain access logs. When the verification result is obtained for all access requests corresponding to the access request that failed, abnormal behavior monitoring will be performed on each access request. When the user behavior pattern is abnormal (such as frequent access to highly sensitive resources), permissions are dynamically tightened or alarms are triggered. For example, when the verification results corresponding to the same access request are all access requests that failed, and there are abnormal behaviors such as multiple illegal access attempts and multiple failed operations, the security alarm mechanism will be triggered to control the alarm and notify the administrator to identify potential security threats, with good advanced security event analysis and tracing capabilities.

[0082] Specifically, when recording access logs, comprehensive auditing can be used to record all access behaviors, including user identity, access resources, time, operation type, and decision verification results, etc. This can enhance the audit function and record all user behaviors and resource access operations, facilitating post-event tracing and security incident analysis. Through log analysis and behavioral pattern recognition, abnormal behaviors (such as multiple illegal access attempts, etc.) can be detected in real time and alarms can be triggered to prevent potential threats.

[0083] It is worth noting that the resource layer of the access resource corresponding to the access request can manage the protected system resources (such as data files, application services, etc.), store them according to security levels, and apply mandatory policies.

[0084] Please refer to 2. The present invention also provides an access control system 11, including: an acquisition unit 111, used to acquire an access request; wherein the access request includes user identity information and resource security information; a role assignment unit 112, used to assign user roles according to the user identity information; a first list assignment unit 113, used to perform corresponding role authority assignment according to the user role, and obtain a first control list; a second list assignment unit 114, used to perform corresponding mandatory access authority assignment according to the resource security information, and obtain a second control list; a third list assignment unit 115, used to combine the first control list and the second control list with corresponding permissions, and obtain a third control list; a verification unit 116, used to verify the access request through the first control list and the third control list, and obtain a verification result; and a control unit 117, used to perform access control on the access request according to the verification result.

[0085] It should be noted that the access control system 11 provided in the above embodiment and the access control method provided in the above embodiment belong to the same concept, wherein the specific manner in which each module and unit performs operations has been described in detail in the method embodiment, and will not be repeated here. In practical applications, the access control system 11 provided in the above embodiment can allocate the above functions to different functional modules as needed, that is, divide the internal structure of the device into different functional modules to complete all or part of the functions described above, and this is not limited here.

[0086] See also Figure 3 The electronic device 1 may include a memory 12, a processor 13 and a bus, and may also include a computer program stored in the memory 12 and executable on the processor 13, such as an access control program.

[0087] Among them, the memory 12 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, mobile hard disk, multimedia card, card-type memory (for example: SD or DX memory, etc.), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 12 can be an internal storage unit of the electronic device 1, such as a mobile hard disk of the electronic device 1. In other embodiments, the memory 12 can also be an external storage device of the electronic device 1, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device 1. Further, the memory 12 can also include both an internal storage unit of the electronic device 1 and an external storage device. The memory 12 can not only be used to store application software and various types of data installed in the electronic device 1, such as access control codes, etc., but also can be used to temporarily store data that has been output or is to be output.

[0088] In some embodiments, the processor 13 may be composed of an integrated circuit, for example, a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and combinations of various control chips. The processor 13 is the control core (Control Unit) of the electronic device 1, and uses various interfaces and lines to connect various components of the entire electronic device 1, and executes or executes programs or modules (such as access control programs, etc.) stored in the memory 12, and calls data stored in the memory 12 to execute various functions of the electronic device 1 and process data.

[0089] The processor 13 executes the operating system and various installed applications of the electronic device 1. The processor 13 executes the applications to implement the steps in the above access control method.

[0090] Exemplarily, the computer program may be divided into one or more modules, which are stored in the memory 12 and executed by the processor 13 to complete the present application. The one or more modules may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the electronic device 1. For example, the computer program may be divided into an acquisition unit 111, a role allocation unit 112, a first list allocation unit 113, a second list allocation unit 114, a third list allocation unit 115, a verification unit 116, and a control unit 117.

[0091] The above-mentioned integrated unit implemented in the form of a software function module can be stored in a computer-readable storage medium, and the computer-readable storage medium can be non-volatile or volatile. The above-mentioned software function module is stored in a storage medium, including several instructions for enabling a computer device (which can be a personal computer, a computer device, or a network device, etc.) or a processor to perform part of the functions of the access control method described in each embodiment of the present application.

[0092] In summary, the present invention discloses an access control method, system, electronic device and storage medium. Through a role-based mandatory access control model, the mandatory access policy is added on the basis of the role allocation authority by combining the role authority and the mandatory access policy, forming a "role-mandatory policy" two-level filtering mechanism, which effectively prevents unauthorized access and abuse of authority. By adopting a multi-dimensional access decision-making mechanism in the decision-making process of access requests, multi-dimensional factors such as user identity, role authority, resource security level and operation sensitivity are comprehensively considered, that is, in the access request verification process, a complete decision-making process design integrating user identity authentication, role authority verification, mandatory policy evaluation and operation legitimacy analysis is designed to ensure the accuracy and security of access control. The policy generation rules based on resource security level, operation sensitivity and user behavior history, as well as the algorithm design of dynamic policy update, can flexibly respond to complex business scenarios and sudden security threats. In addition, by recording all access requests and operation behaviors, real-time monitoring, historical data backtracking and abnormal behavior analysis are supported, providing a basis for post-event accountability and system optimization. The access control process of the present invention is applicable to specific high-security scenarios (such as nuclear power DCS systems), especially the implementation process of role allocation, resource classification and policy refinement, and supports standardized interfaces, which is convenient for integration with other systems and has good adaptability and scalability. Therefore, the present invention effectively overcomes various shortcomings in the prior art and has high industrial utilization value.

[0093] The above embodiments are merely illustrative of the principles and effects of the present invention, and are not intended to limit the present invention. Anyone familiar with the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by a person of ordinary skill in the art without departing from the spirit and technical concept disclosed by the present invention shall still be covered by the claims of the present invention.

Claims

1. An access control method, characterized in that: include: Obtaining an access request; wherein the access request includes user identity information and resource security information; assigning a user role according to the user identity information; According to the user role, corresponding role authority allocation is performed to obtain a first control list; Perform corresponding mandatory access rights allocation according to the resource security information to obtain a second control list; Combining the first control list and the second control list according to corresponding permissions to obtain a third control list; Verify the access request using the first control list and the third control list to obtain a verification result; Access control is performed on the access request according to the verification result.

2. The access control method according to claim 1, characterized in that: Before obtaining the access request, the method further includes: The role authority corresponding to the user identity information and the mandatory access authority corresponding to the resource security information are dynamically adjusted by adjusting the strategy.

3. The access control method according to claim 1, characterized in that: According to the user identity information, a user role is assigned, including: Verify the legitimacy of the user's identity through the user's identity information; When the legitimacy of the user identity is verified, the user identity is mapped to the corresponding user role to assign the user role.

4. The access control method according to claim 1, characterized in that: According to the resource security information and the mandatory access policy, corresponding mandatory access rights are allocated to obtain a second control list, including: Obtaining a corresponding resource security level according to the target resource information in the resource security information; Obtaining corresponding operation sensitivity according to the expected operation information in the resource security information; According to the resource security level, the operation sensitivity and the mandatory access policy corresponding to the mandatory access right, corresponding mandatory access right allocation is performed to obtain the second control list.

5. The access control method according to claim 1, characterized in that: The access request is verified by using the first control list and the third control list to obtain a verification result, including: Compare the operation request permission corresponding to the access request with the first control list; When the operation request permission corresponding to the access request exists within the permitted scope of the first control list, the operation request permission corresponding to the access request is compared with the third control list, and when the operation request permission corresponding to the access request exists within the permitted scope of the third control list, the verification result is that the access request is passed.

6. The access control method according to claim 1, characterized in that: Performing access control on the access request according to the verification result, including: When the verification result is that the access request is passed, access is allowed; When the verification result is that the access request fails, the access is denied.

7. The access control method according to claim 6, characterized in that: When the verification result is that the access request is not passed, after the access is denied, the following further includes: Obtain all the access requests corresponding to the verification result that the access request fails; Monitor each access request for abnormal behavior; When an abnormality occurs in the access request, a control alarm is issued.

8. An access control system, characterized in that: include: An acquisition unit, configured to acquire an access request; wherein the access request includes user identity information and resource security information; A role assignment unit, configured to assign a user role according to the user identity information; A first list allocation unit, configured to allocate corresponding role permissions according to the user role to obtain a first control list; A second list allocation unit, configured to allocate corresponding mandatory access rights according to the resource security information to obtain a second control list; A third list allocation unit, configured to combine the first control list and the second control list with corresponding permissions to obtain a third control list; a verification unit, configured to verify the access request through the first control list and the third control list to obtain a verification result; and A control unit is used to perform access control on the access request according to the verification result.

9. An electronic device, characterized in that: The electronic device comprises: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the electronic device to implement the access control method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor of a computer, the computer is caused to execute the access control method according to any one of claims 1 to 7.

Images