Data space security access control method based on dynamic attribute configuration service

Abstract

The invention belongs to the technical field of access control, and discloses a dynamic attribute configuration service-based data space security access control method, which remarkably improves the security of a data space through a series of rigorous steps and mechanisms. The security problems of unauthorized access, data leakage, malicious tampering and the like can be effectively prevented, reliable protection is provided for data and resources of a user, trust of the user to a system is enhanced, and wide application and development of data space are facilitated; according to the method, the access control efficiency and flexibility are improved; according to the invention, the method can quickly adapt to business requirements and environment changes, reduces time waste caused by tedious authentication and authorization processes, improves the response speed and service quality of the system, and provides more convenient and efficient access experience for users.

Description

Technical Field

[0001] The present application relates to the field of access control technology, and more specifically, to a data space security access control method based on dynamic attribute configuration service. Background Art

[0002] In modern data exchange environments, it is crucial to ensure the identity authentication of participants and secure access to resources. In traditional access control mechanisms, static certificate mechanisms are usually used for permission management.

[0003] When the attributes of a user or entity change, such as position adjustment or change in authority scope, it is necessary to frequently revoke the old certificate and reissue a new one. This process is not only inefficient, but also consumes a lot of time and resource costs.

[0004] In terms of access control strategies, traditional methods are not flexible and sophisticated enough to adapt to rapidly changing business needs and complex technical environments. When faced with ever-changing access requests, the system is unable to make accurate decisions in a timely and effective manner, resulting in slow response and poor service quality.

[0005] Due to the cumbersome operation of the static certificate mechanism in attribute updating, the workload of operation and maintenance has increased significantly, the maintenance cost remains high, and it also brings certain hidden dangers to the overall security of the system.

[0006] To this end, the present application proposes a data space security access control method based on dynamic attribute configuration service to solve the above-mentioned problems.

[0007] Application Contents

[0008] In order to solve the above problems, the present application provides a data space security access control method based on dynamic attribute configuration service.

[0009] The present application provides a data space security access control method based on dynamic attribute configuration service, which adopts the following technical solution:

[0010] A data space security access control method based on dynamic attribute configuration service, the method comprising the following steps:

[0011] Step 1: Initialization phase, the participant obtains necessary authentication and deploys digital certificates to its components. After success, it registers with the dynamic attribute configuration service and obtains the initial attribute set;

[0012] Step 2: In the attribute update phase, when new attributes need to be added or existing attributes change, the dynamic attribute configuration service receives notifications and generates corresponding dynamic attribute tokens;

[0013] Step 3: During the continuous monitoring phase, dynamic trust monitoring periodically checks the status of all data space components and feeds the results back to the dynamic attribute configuration service;

[0014] Step 4: Access request processing stage, when a participant tries to access a resource, an encrypted communication channel is first established, and then a tunnel under the protocol is established using the same digital certificate, and remote authentication and metadata exchange are performed on this basis, and then the attribute is verified on the CA according to the specified verification policy;

[0015] Step 5: Finally, an access request is sent to the policy decision point with a dynamic attribute token, and the policy decision point makes the final decision based on the preset policy.

[0016] Furthermore, the digital certificate deployed in the initialization process in step 1 is an X.509 certificate.

[0017] Through the above technical solutions, X.509 certificates have wide recognition and high security. They can provide reliable identity authentication for participants and ensure that only legitimate users can enter the system. Their standardized formats and encryption mechanisms facilitate interaction and verification between different systems and platforms, enhancing the compatibility and interoperability of the system, thereby improving the security and stability of the entire access control system.

[0018] Furthermore, the dynamic attribute token generated in step 2 and the X.509 certificate are used as credentials in subsequent identity authentication and authorization.

[0019] Through the above technical solutions, this combination greatly enhances the flexibility and accuracy of authentication and authorization; dynamic attribute tokens can reflect attribute changes in a timely manner, while X.509 certificates provide a stable basic authentication framework; the combination of the two can not only adapt to rapidly changing business needs, but also ensure the authority and credibility of authentication, effectively prevent illegal access and abuse of authority, and improve system security and service quality.

[0020] Furthermore, the encrypted communication channel in step 4 complies with strict encryption standards including TLS.

[0021] The above technical solutions provide a high degree of confidentiality and integrity protection for data transmission. The TLS encryption standard can effectively prevent data from being stolen, tampered with or forged during transmission, ensuring that communications between participants are secure and reliable; even in complex network environments, it can protect sensitive information from being leaked, enhance user trust in the system, and provide solid technical support for secure access control.

[0022] Furthermore, in step three, when dynamic trust monitoring finds abnormal activities or potential risks, relevant parties are immediately notified and further security measures are triggered.

[0023] Through the above technical solution, when dynamic trust monitoring detects abnormal activities or potential risks, it can immediately notify the relevant parties and trigger further security measures, which greatly improves the system's risk response capabilities; it can take action as soon as the problem occurs, control potential security threats in the bud, and effectively reduce losses caused by security vulnerabilities; at the same time, timely notification and response mechanisms also help relevant parties to take remedial measures quickly, enhancing the stability and security of the system.

[0024] Furthermore, in step 4, an access request is sent to a PDP (Policy Decision Point) with a DAT and / or AT (Access Token), and the PDP makes a final decision based on a preset XACML policy.

[0025] The above technical solutions make access decisions more precise and flexible. XACML policies can perform fine-grained access control based on rich attributes and conditions, while DAT and / or AT provide real-time and accurate access credentials; the two work together to quickly and accurately determine whether to allow access based on different scenarios and needs, improving the efficiency and accuracy of access control and ensuring the safe and reasonable use of system resources.

[0026] In summary, the present application includes at least one of the following beneficial technical effects:

[0027] (1) The traditional static certificate mechanism is inefficient and costly when modifying attributes. The present invention reduces the need for frequent revocation and re-issuance of certificates due to attribute changes by introducing DAPS.

[0028] (2) Enhanced access control flexibility: By combining dynamic attributes with XACML policies, more sophisticated and flexible access control methods are provided, enabling the system to quickly respond to changing business needs and technical environments;

[0029] (3) Improve system response speed and service quality: Utilize the real-time attribute information provided by DAPS to optimize the speed and accuracy of access decisions and improve user experience;

[0030] (4) Reduce operation and maintenance costs: It reduces the extra workload caused by attribute updates, reduces maintenance costs, and also enhances overall security. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 This is a flowchart of the steps of this application. DETAILED DESCRIPTION

[0032] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application; obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments, and all other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application without making creative work are within the scope of protection of the present application.

[0033] Example:

[0034] The following is combined with Figure 1 This application is described in further detail.

[0035] The present application discloses a data space security access control method based on dynamic attribute configuration service, the method comprising the following steps:

[0036] Step 1: Initialization phase, the participant obtains necessary authentication and deploys digital certificates to its components. After success, it registers with the dynamic attribute configuration service and obtains the initial attribute set;

[0037] Step 2: In the attribute update phase, when new attributes need to be added or existing attributes change, the dynamic attribute configuration service receives notifications and generates corresponding dynamic attribute tokens;

[0038] Step 3: During the continuous monitoring phase, dynamic trust monitoring periodically checks the status of all data space components and feeds the results back to the dynamic attribute configuration service;

[0039] Step 4: Access request processing stage, when a participant tries to access a resource, an encrypted communication channel is first established, and then a tunnel under the protocol is established using the same digital certificate, and remote authentication and metadata exchange are performed on this basis, and then the attribute is verified on the CA according to the specified verification policy;

[0040] Step 5: Finally, an access request is sent to the policy decision point with a dynamic attribute token, and the policy decision point makes the final decision based on the preset policy.

[0041] See also Figure 1 ,The digital certificate deployed in the initialization process in step 1 is an X.509 certificate; ,X.509 certificate is widely recognized and highly secure. It can provide reliable identity authentication for ,participants, ensuring that only legitimate users can enter the system; its standardized format and ,encryption mechanism facilitate interaction and verification between different systems and ,platforms, enhancing the compatibility and interoperability of the system, thereby improving the ,security and stability of the entire access control system.

[0042] See also Figure 1The dynamic attribute token generated in step 2 and the X.509 certificate are used as credentials in subsequent identity authentication and authorization. This combination greatly enhances the flexibility and accuracy of authentication and authorization. The dynamic attribute token can reflect attribute changes in a timely manner, while the X.509 certificate provides a stable basic authentication framework. The combination of the two can not only adapt to rapidly changing business needs, but also ensure the authority and credibility of authentication, effectively prevent illegal access and abuse of authority, and improve system security and service quality.

[0043] See also Figure 1 The encrypted communication channel in step 4 follows strict encryption standards including TLS, which provides a high degree of confidentiality and integrity protection for data transmission. The TLS encryption standard can effectively prevent data from being stolen, tampered with or forged during transmission, ensuring that communications between participants are secure and reliable. Even in a complex network environment, it can protect sensitive information from being leaked, enhance user trust in the system, and provide solid technical support for secure access control.

[0044] See also Figure 1 In step three, when dynamic trust monitoring finds abnormal activities or potential risks, it immediately notifies the relevant parties and triggers further security measures; when dynamic trust monitoring finds abnormal activities or potential risks, it can immediately notify the relevant parties and trigger further security measures, which greatly improves the system's risk response capabilities; it can take action as soon as the problem occurs, control potential security threats in the bud, and effectively reduce losses caused by security vulnerabilities; at the same time, timely notification and response mechanisms also help relevant parties to take remedial measures quickly, enhancing the stability and security of the system.

[0045] See also Figure 1 In step 4, an access request is sent to the PDP (PolicyDecisionPoint) with DAT and / or AT (AccessToken), and the PDP makes the final decision based on the preset XACML policy, making the access decision more accurate and flexible. XACML policy can perform fine-grained access control based on rich attributes and conditions, while DAT and / or AT provide real-time and accurate access credentials; the two work together to quickly and accurately determine whether to allow access based on different scenarios and needs, improving the efficiency and accuracy of access control and ensuring the safe and reasonable use of system resources.

[0046] The implementation principle of a data space security access control method based on dynamic attribute configuration service in the embodiment of the present application is as follows:

[0047] The present invention first establishes the legal identity and initial attributes for the participants in the initialization phase, and then generates dynamic attribute tokens in response to attribute changes in a timely manner in the attribute update phase. The continuous monitoring phase periodically checks and feedbacks the status of the data space components. In the access request processing phase, encrypted communication establishment, tunnel establishment, remote authentication and metadata exchange, and attribute verification are carried out in sequence, and finally the policy decision point makes a decision based on the preset policy.

[0048] The entire process achieves secure and efficient access control to the data space through dynamic attribute configuration services, strict encryption standards and precise policy decisions.

[0049] During the initialization phase, participants not only need to complete the necessary authentication steps, but also need to fill in a series of identity and authority-related information in detail. This information will undergo a strict review and verification process to ensure its authenticity and legitimacy. For example, participants may need to provide scanned copies of identity documents, relevant authorization documents, etc. During the deployment of digital certificates to components, the system will automatically detect the compatibility and security of the components. If any potential risks or incompatibility issues are found, an alarm will be issued in a timely manner and corresponding solutions will be provided.

[0050] The implementation of the attribute update phase relies on an efficient notification mechanism and a fast token generation algorithm. When a new attribute needs to be added, the relevant business department or management system will send a detailed change request to the dynamic attribute configuration service, including information such as the attribute type, value, and applicable scope. After receiving the request, the dynamic attribute configuration service will immediately start the internal processing flow, using advanced encryption technology and data processing algorithms to generate accurate dynamic attribute tokens in a very short time and ensure their secure transmission to the corresponding participants.

[0051] Advanced monitoring technology and intelligent analysis algorithms are used in the continuous monitoring stage. The dynamic trust monitoring system collects status information from various components of the data space in real time, including but not limited to the operating status of the components, network connectivity, resource usage, etc. This information will be continuously transmitted to the central monitoring server, where it will be analyzed and processed through complex algorithms. Once any abnormal activity or potential risk is found, the system will immediately trigger the early warning mechanism and send emergency notifications to relevant administrators and security personnel.

[0052] At the same time, the system will automatically launch a series of preset security measures, such as temporarily restricting certain suspicious access requests, isolating affected components, etc., to minimize potential security threats.

[0053] During the establishment of the encrypted communication channel in the access request processing phase, the system will first re-verify the identity of the participants to ensure that both parties in the communication are legal and authorized. In the process of establishing the tunnel, multiple encryption and authentication technologies are used to prevent the communication data from being stolen or tampered with; in the remote authentication and metadata exchange link, the exchanged data will be strictly formatted and verified to ensure the integrity and accuracy of the data.

[0054] When verifying attributes on a CA according to the specified verification policy, multiple authoritative databases and verification services are called to obtain the most accurate and up-to-date verification results.

[0055] Finally, when an access request is sent to the policy decision point, detailed access context information and dynamic attribute tokens are attached so that the policy decision point can make the most accurate decision.

[0056] The method of the present invention significantly improves the security of data space through a series of rigorous steps and mechanisms; it can effectively prevent security issues such as unauthorized access, data leakage and malicious tampering, provide reliable protection for user data and resources, enhance user trust in the system, and help promote the widespread application and development of data space; the method improves the efficiency and flexibility of access control. It can quickly adapt to changes in business needs and environment, reduce time waste caused by cumbersome authentication and authorization processes, improve the system's response speed and service quality, and provide users with a more convenient and efficient access experience.

[0057] The above are all preferred embodiments of the present application, and the protection scope of the present application is not limited thereto. Therefore, any equivalent changes made according to the structure, shape, and principle of the present application should be included in the protection scope of the present application.

Claims

1. A data space security access control method based on dynamic attribute configuration service, characterized in that: The method comprises the following steps: Step 1: Initialization phase, the participant obtains necessary authentication and deploys digital certificates to its components. After success, it registers with the dynamic attribute configuration service and obtains the initial attribute set; Step 2: In the attribute update phase, when new attributes need to be added or existing attributes change, the dynamic attribute configuration service receives notifications and generates corresponding dynamic attribute tokens; Step 3: During the continuous monitoring phase, dynamic trust monitoring periodically checks the status of all data space components and feeds the results back to the dynamic attribute configuration service; Step 4: Access request processing stage, when a participant tries to access a resource, an encrypted communication channel is first established, and then a tunnel under the protocol is established using the same digital certificate, and remote authentication and metadata exchange are performed on this basis, and then the attribute is verified on the CA according to the specified verification policy; Step 5: Finally, an access request is sent to the policy decision point with a dynamic attribute token, and the policy decision point makes the final decision based on the preset policy.

2. According to claim 1, a data space security access control method based on dynamic attribute configuration service is characterized in that: The digital certificate deployed by the initialization process in step 1 is an X.509 certificate.

3. According to claim 2, a data space security access control method based on dynamic attribute configuration service is characterized in that: The dynamic attribute token generated in step 2 and the X.509 certificate are used as credentials in subsequent identity authentication and authorization.

4. According to claim 1, a data space security access control method based on dynamic attribute configuration service is characterized in that: The encrypted communication channel in step 4 complies with strict encryption standards including TLS.

5. According to claim 1, a data space security access control method based on dynamic attribute configuration service is characterized in that: In step three, when dynamic trust monitoring finds abnormal activities or potential risks, relevant parties are immediately notified and further security measures are triggered.

6. The data space security access control method based on dynamic attribute configuration service according to claim 1 is characterized by: In the step 4, an access request is sent to the PDP, with the DAT and / or AT attached, and the PDP makes a final decision according to a preset XACML policy.

Images