Access control method and system based on distributed decision

Abstract

The invention discloses an access control method and system based on distributed decision making. The method comprises the steps that S1, a subject initiates an access control request for executing a specific operation type on a target object to an access control execution point; s2, the access control execution point forwards the access control request to an access control decision point; s3, the access control decision point queries an access control strategy corresponding to the target object; s4, the decision information point returns the required information to the access control decision point; s5, the access control decision point evaluates whether the access control request is allowed or not; s6, the access control execution point initiates a specific operation type or returns error information to the main body; s7, the target object returns the access result to the access control execution point; and S8, the access control execution point returns the access result to the subject according to the decision result. The method supports various access control models, supports comprehensive decision, and can provide efficient and safe access control capability for a complex distributed system.

Description

Technical Field

[0001] The present invention relates to the technical field of distributed access control, and in particular to an access control method and system based on distributed decision-making. Background Art

[0002] The application background of distributed access control mainly stems from the widespread application of emerging technologies such as cloud computing, the Internet of Things, and edge computing. The popularization of these technologies has put forward higher requirements for traditional access control. In a cloud computing environment, resources are distributed in different physical locations, and multiple tenants share the same infrastructure. Access control needs to be able to dynamically manage the isolation of permissions between different tenants across domains, while supporting tenant-defined access control policies. In the Internet of Things and edge computing scenarios, a large number of devices and data require flexible and real-time access control solutions, especially in dynamic environments, such as changes in device location and real-time data stream processing. Traditional static access control models cannot meet the needs of such complex scenarios.

[0003] Existing access control solutions are mainly designed with a centralized architecture and a single model. In a centralized solution, all access requests are forwarded to a centralized access control decision point through an access control execution point, which uniformly evaluates the access requests and returns the results. However, centralized architectures are prone to single point failures. Since all access requests need to be evaluated through a single decision point, when a decision point fails, the access control function of the entire system will be interrupted, seriously affecting the reliability and availability of the system.

[0004] In terms of models, existing solutions are mostly based on a fixed single access control model, such as role-based access control (RBAC) or attribute-based access control (ABAC). RBAC manages through the mapping of static roles to permissions, which is suitable for simple permission management scenarios; ABAC makes decisions through subject, resource and environment attributes, providing a certain degree of flexibility, but it is usually difficult to flexibly combine with other models. Existing technologies lack the ability to flexibly combine multiple access control models (such as RBAC, ABAC and trust-based models), making it difficult to adapt to the complex and changing access requirements in modern cloud computing, the Internet of Things and dynamic multi-tenant environments.

[0005] In terms of communication between nodes, existing solutions mostly use hard-coded communication methods, which lack certain flexibility. The hard-coded communication methods in existing distributed access control solutions have multiple disadvantages. Hard coding usually means embedding communication strategies, node information, or routing rules directly into the code, which greatly reduces the flexibility and maintainability of the system. Hard coding makes the system less adaptable to configuration changes and expansions. Once the node information needs to be modified or the communication strategy needs to be adjusted, the code must be directly modified and redeployed, which is particularly inconvenient in a dynamically changing distributed environment. Summary of the invention

[0006] In view of the deficiencies in the prior art, the present invention avoids single point failures through a distributed architecture and adopts a modular design to achieve distributed deployment of access control execution points, decision points, and decision information points. By adopting decision information points, it is more suitable for cloud scenarios as a cloud service. It supports multiple access control models, supports comprehensive decisions based on roles, attributes, and dynamic trust, can flexibly respond to dynamic context changes, and provides efficient and secure access control capabilities for complex distributed systems.

[0007] The present invention provides an access control method based on distributed decision-making, the method comprising the following steps:

[0008] S1: The subject initiates an access control request to the access control execution point to perform a specific operation type on the target object. Each access control request includes the subject's information, the target object's information and the operation type.

[0009] S2: The access control execution point forwards the access control request to the access control decision point;

[0010] S3: The access control decision point queries the access control policy for the subject to access the target object according to the information of the subject and the target object in the access control request, and sends an information query request to the decision information point according to the access control policy for the subject to access the target object;

[0011] S4: the decision information point returns the information required by the subject for accessing the target object to the access control decision point according to the information query request;

[0012] S5: The access control decision point evaluates whether the access control request is allowed according to the information returned by the decision information point and the access control policy for the subject to access the target object, obtains a decision result and returns the decision result to the access control execution point;

[0013] S6: the access control execution point accesses the target object to initiate the specific operation type or returns error information to the subject according to the decision result;

[0014] S7: After the specific operation type is executed, the target object returns the access result to the access control execution point;

[0015] S8: The access control execution point returns the access result to the subject according to the decision result.

[0016] Preferably, the operation types in step S1 include writing, reading and deleting.

[0017] Preferably, in step S3, each target object has an access control policy corresponding to different operation types, and the access control policy is composed of multiple conditions connected by logical AND and OR, and each condition includes three parts: attribute name, relationship between attribute name and attribute value, and attribute value; the attribute name includes role, identity, trust value, and time, and the relationship between the attribute name and attribute value includes greater than, equal to, and less than;

[0018] Each decision information point manages information of one attribute and configures multiple information of the attribute, wherein the decision information point includes a decision information point for managing roles and a decision information point for managing trust values;

[0019] The access control decision point initiates a request to the decision information point by means of load balancing or broadcasting.

[0020] Preferably, the target object includes a first target object, and the first target object includes a read access control policy and a write access control policy;

[0021] The access control policy read includes:

[0022] Reading condition one: the subject's role is an administrator, reading condition two: the subject's role is an ordinary user and the subject's trust value is greater than or equal to a first preset value, and the reading condition one and the reading condition two are in a logical OR relationship;

[0023] The access control policy written includes:

[0024] Writing condition one: the role of the subject is a super administrator, writing condition two: the role of the subject is an administrator and the trust value of the subject is greater than or equal to a second preset value, and there is a logical OR relationship between the writing condition one and the writing condition two.

[0025] Preferably, the subject includes a first subject, and the method for the first subject to request access to the first target object includes the following steps:

[0026] S100: The first subject initiates a first access control request for reading or writing the first target object to the access control execution point, where the first access control request includes information about the first subject, information about the first target object, and a read or write operation type;

[0027] S200: The access control enforcement point forwards the first access control request to the access control decision point;

[0028] S300: The access control decision point queries the access control policy for reading or writing of the first subject to the first target object according to the information of the first subject and the first target object, and sends a role query request and a trust value query request to the decision information point for managing roles and the decision information point for managing trust values ​​respectively;

[0029] S400: The decision information point for managing roles and the decision information point for managing trust values ​​return the queried role and trust value of the first subject to the access control decision point according to the role query request and the trust value query request respectively;

[0030] S500: The access control decision point evaluates whether the first access control request is allowed according to the role and trust value of the first subject and the access control policy for reading or writing of the first subject to the first target object, obtains a first decision result and returns the first decision result to the access control execution point;

[0031] S600: The access control execution point accesses the first target object to initiate reading or writing according to the first decision result, or returns error information to the first subject;

[0032] S700: After being read or written, the first target object returns a first access result to the access control execution point;

[0033] S800: The access control execution point returns the first access result to the first subject according to the first decision result.

[0034] The present invention also provides an access control system based on distributed decision-making, the system comprising: a subject, an access control execution point, an access control decision point, a decision information point and an object;

[0035] The subject is used to initiate an access control request to the access control execution point to perform a specific operation type on the target object, and each access control request includes information of the subject, information of the target object and the operation type;

[0036] The access control enforcement point is used to forward the access control request to the access control decision point;

[0037] The access control decision point is used to query the access control policy for the subject to access the target object according to the information of the subject and the target object in the access control request, and send an information query request to the decision information point according to the access control policy for the subject to access the target object;

[0038] The decision information point is used to return the information required by the subject to access the access control policy of the target object to the access control decision point according to the information query request;

[0039] The access control decision point is also used to evaluate whether the access control request is allowed according to the information returned by the decision information point and the access control policy of the subject accessing the target object, obtain a decision result and return the decision result to the access control execution point;

[0040] The access control execution point is further used to access the target object to initiate the specific operation type or return error information to the subject according to the decision result;

[0041] The target object is used to return an access result to the access control execution point after executing the specific operation type;

[0042] The access control execution point is further configured to return the access result to the subject according to the decision result.

[0043] Preferably, the operation types include writing, reading and deleting.

[0044] Preferably, each target object has an access control policy corresponding to different operation types, and the access control policy is composed of multiple conditions connected by logical AND and OR, and each condition includes three parts: attribute name, relationship between attribute name and attribute value, and attribute value; the attribute name includes role, identity, trust value, and time, and the relationship between attribute name and attribute value includes greater than, equal to, and less than;

[0045] Each decision information point manages information of one attribute and configures multiple information of the attribute, wherein the decision information point includes a decision information point for managing roles and a decision information point for managing trust values;

[0046] The access control decision point initiates a request to the decision information point by means of load balancing or broadcasting.

[0047] Preferably, the target object includes a first target object, and the first target object includes a read access control policy and a write access control policy;

[0048] The access control policy read includes:

[0049] Reading condition one: the subject's role is an administrator, reading condition two: the subject's role is an ordinary user and the subject's trust value is greater than or equal to a first preset value, and the reading condition one and the reading condition two are in a logical OR relationship;

[0050] The access control policy written includes:

[0051] Writing condition one: the role of the subject is a super administrator, writing condition two: the role of the subject is an administrator and the trust value of the subject is greater than or equal to a second preset value, and there is a logical OR relationship between the writing condition one and the writing condition two.

[0052] Preferably, the subject includes a first subject, and when the first subject requests to access the first target object,

[0053] The first subject is used to initiate a first access control request for reading or writing the first target object to the access control execution point, wherein the first access control request includes information of the first subject, information of the first target object, and a read or write operation type;

[0054] The access control enforcement point is used to forward the first access control request to the access control decision point;

[0055] The access control decision point is used to query the access control policy for the first subject to access the first target object for reading or writing based on the information of the first subject and the first target object, and send a role query request and a trust value query request to the decision information point for managing roles and the decision information point for managing trust values ​​respectively;

[0056] The decision information point for managing roles and the decision information point for managing trust values ​​are used to return the queried role and trust value of the first subject to the access control decision point according to the role query request and the trust value query request respectively;

[0057] The access control decision point is further used to evaluate whether the first access control request is allowed according to the role and trust value of the first subject and the access control policy for reading or writing of the first subject to the first target object, obtain a first decision result and return the first decision result to the access control execution point;

[0058] The access control execution point is further used to access the first target object to initiate reading or writing according to the first decision result, or return error information to the first subject;

[0059] The first target object is used to return a first access result to the access control execution point after being read or written;

[0060] The access control execution point is further configured to return the first access result to the first subject according to the first decision result.

[0061] Compared with the prior art, the present invention has the following beneficial effects:

[0062] The present invention adopts a distributed architecture to deploy access control execution points, access control decision points and decision information points in a distributed manner to avoid single point failures; it breaks through the limitations of the single model in the prior art, and by integrating role-based, attribute-based and trust-value-based access control models, it supports the flexible combination of static permission management and dynamic contextual decision-making, enabling the system to adapt to complex access scenarios such as cross-domain resource sharing, dynamic multi-tenant management and IoT device control. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 A schematic diagram of a flow chart of an access control method based on distributed decision-making provided by the present invention;

[0064] Figure 2 A flowchart of another access control method based on distributed decision-making provided by the present invention;

[0065] Figure 3 A schematic diagram of an access control model framework of an access control method based on distributed decision-making provided by the present invention;

[0066] Figure 4 A schematic diagram of the structure of an access control system based on distributed decision-making provided by the present invention. DETAILED DESCRIPTION

[0067] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0068] The present invention is further described in detail below in conjunction with the accompanying drawings.

[0069] like Figure 1 As shown, an embodiment of the present invention provides an access control method based on distributed decision-making, comprising the following steps:

[0070] S1: The subject initiates an access control request to the access control execution point to perform a specific operation type on the target object. Each access control request includes the subject's information, the target object's information and the operation type.

[0071] S2: The access control execution point forwards the access control request to the access control decision point;

[0072] S3: The access control decision point queries the access control policy for the subject to access the target object according to the information of the subject and the target object in the access control request, and sends an information query request to the decision information point according to the access control policy for the subject to access the target object;

[0073] S4: The decision information point returns the information required by the subject to access the target object's access control policy to the access control decision point according to the information query request;

[0074] S5: The access control decision point evaluates whether the access control request is allowed based on the information returned by the decision information point and the access control policy of the subject's access to the target object, obtains the decision result and returns the decision result to the access control execution point;

[0075] S6: The access control execution point accesses the target object to initiate a specific operation type or returns an error message to the subject based on the decision result;

[0076] S7: After executing a specific operation type, the target object returns the access result to the access control execution point;

[0077] S8: The access control execution point returns the access result to the subject based on the decision result.

[0078] In the embodiment of the present invention, the operation types in step S1 include writing, reading and deleting. In step S3, each target object has an access control policy corresponding to different operation types, and the access control policy is composed of multiple conditions connected by logic and or, and each condition includes three parts: attribute name, relationship between attribute name and attribute value, and attribute value; attribute name includes role, identity, trust value, time, and relationship between attribute name and attribute value includes greater than, equal to, less than; each decision information point manages information of one attribute and configures multiple information of the attribute, and decision information points include decision information points for managing roles and decision information points for managing trust values; access control decision points initiate requests to decision information points through load balancing or broadcasting.

[0079] In the embodiment of the present invention, the subject, as the initiator of the access control request, initiates the access control request to access a specific target resource (object). The access control execution point is responsible for accepting the access control request initiated by the subject, verifying the security of the access control request, forwarding the access control request to the access control decision point, and executing the access control request. The access control decision point is responsible for processing the access control request sent by the access control execution point, making decisions based on the information provided by multiple decision information points, querying the decision information point, obtaining auxiliary information such as trust value, role, and policy, and judging whether to allow the subject to access the target resource according to the access control policy stored therein; the access control decision point is provided with redundant configuration to avoid single point failure problems. The decision information point is responsible for providing the access control decision point with various information required in the decision-making process. The decision information point can provide a variety of information required for decision-making, including verifying the identity and role of the subject, providing trust value and dynamic conditions of the environment (such as time, geographical location, etc.). At the same time, through data redundancy, it has fault tolerance and high availability design, and improves query efficiency through mechanisms such as caching and load balancing. As the target resource to be accessed, the object can be accessed by the access control execution point (such as performing read and write operations) and return the access result of the resource.

[0080] The target object in the embodiment of the present invention includes a first target object, and the first target object includes a read access control policy and a write access control policy; the read access control policy includes: read condition one: the role of the subject is an administrator, read condition two: the role of the subject is an ordinary user and the trust value of the subject is greater than or equal to a first preset value, and the read condition one and the read condition two are in a logical or relationship; the write access control policy includes: write condition one: the role of the subject is a super administrator, write condition two: the role of the subject is an administrator and the trust value of the subject is greater than or equal to a second preset value, and the write condition one and the write condition two are in a logical or relationship.

[0081] like Figure 2 As shown, the subject in the embodiment of the present invention includes a first subject, and the method for the first subject to request access to a first target object includes the following steps:

[0082] S100: A first subject initiates a first access control request to read or write a first target object to an access control execution point, where the first access control request includes information about the first subject, information about the first target object, and a read or write operation type;

[0083] S200: The access control execution point forwards the first access control request to the access control decision point;

[0084] S300: The access control decision point queries the access control policy for reading or writing of the first subject to the first target object according to the information of the first subject and the first target object, and sends a role query request and a trust value query request to the decision information point for managing roles and the decision information point for managing trust values ​​respectively;

[0085] S400: The decision information point for managing roles and the decision information point for managing trust values ​​return the queried role and trust value of the first subject to the access control decision point according to the role query request and the trust value query request respectively;

[0086] S500: The access control decision point evaluates whether the first access control request is allowed according to the role and trust value of the first subject and the access control policy for reading or writing of the first subject to access the first target object, obtains a first decision result and returns the first decision result to the access control execution point;

[0087] S600: The access control execution point accesses the first target object to initiate reading or writing according to the first decision result, or returns error information to the first subject;

[0088] S700: After being read or written, the first target object returns a first access result to the access control execution point;

[0089] S800: The access control execution point returns a first access result to the first subject according to the first decision result.

[0090] like Figure 3 The overall framework structure of the access control model shown in the figure, an access control method based on distributed decision-making provided by an embodiment of the present invention specifically includes the following steps:

[0091] Step 1: The subject issues an access control request, requesting to perform a certain operation (e.g., write, read, delete, etc.) on the target object and sends the access request to the access control execution point in the access control system. The access control request information includes the subject, object, and operation type.

[0092] The access request req initiated by the subject sub to the object obj can be formally expressed as:

[0093] req=<sub,obj,op>

[0094] Among them, sub represents the subject of the access request; obj represents the object to be requested; op represents the operation type (such as write, read, delete, etc.).

[0095] Step 2: forward the access control request to the access control decision point, which queries the corresponding access control policy Policy based on the object to be accessed in the access control request.

[0096] Access control policy can use logical AND and OR to connect multiple conditions. Each condition consists of three parts: attribute name, the relationship between attribute name and attribute value, and attribute value. Policy is defined as follows:

[0097] Policy obj

[0098] = ( Attr1,Rela1,Value1 ) Logic ( Attr2,Rela2,Value2 ) Logic...Logic(Attr n ,Rela n ,Value n )

[0099] Among them, Attr i Represents the name of an attribute, such as role, identity, trust value, time, etc. i Indicates the direct relationship between the attribute name and the attribute value, such as greater than, equal to, less than, etc.; Value i Represents the attribute value; Logic represents the relationship between conditions, such as logical AND or logical OR.

[0100] For example, assume that the access control policy is:

[0101]

[0102] Represents two access control policies for object file1:

[0103] The first is the access control policy for subject Alice to read file1, which needs to meet one of the following two conditions:

[0104] (1) The subject’s role is administrator;

[0105] (2) The subject’s role is a common user and the subject’s trust value is greater than or equal to 0.8.

[0106] The second is the access control policy for subject John to write file1, which needs to meet one of the following two conditions:

[0107] (1) The subject’s role is super administrator;

[0108] (2) The subject’s role is administrator and the subject’s trust value is greater than or equal to 0.5.

[0109] Assume that subject Alice initiates a request to read file1. First, the access control policy for Alice to access file1 (the first two) is matched through subject Alice, and then the first access control policy is queried through the operation type Read. The first access control policy requires two attributes, the subject's role and trust value, to evaluate whether the subject is allowed to read file1.

[0110] Since a decision information point is only responsible for one type of information, we need to send query requests to the decision information point of the management role and the decision information point of the management trust value respectively. Multiple decision information points are configured for each type to avoid single point failure problems, and requests are initiated to the decision information points through load balancing or broadcasting.

[0111] Step 3: The access control decision point sends a query request to the decision information point for managing roles and the decision information point for managing trust values. The decision information point queries the corresponding role and trust value based on the subject Alice. Finally, it is found that the role of the subject Alice is user and the trust value of the subject Alice is 0.85.

[0112] Step 4: The decision information point responsible for roles and the decision information point responsible for trust values ​​return the role user and the trust value 0.85 to the access control decision point respectively. The decision point will evaluate the access control request initiated by the subject Alice based on the access control policy of reading file1.

[0113] The access control policy for reading file1 is:

[0114] (Role="Admin")∨((Role="User")∧(Trust≥0.8))

[0115] Substitute the role of subject Alice and the subject's trust value into the access control policy:

[0116] Decision(req sub )=("User"="Admin")∨(("User"="User")∧(0.85≥0.8))=False∨(True∧True)

[0117] The final decision is:

[0118] Decision(req sub )=True

[0119] That is, the subject Alice is allowed to read file1.

[0120] Step 5: The access control decision point returns the decision result to the access control execution point. The access control execution point performs corresponding operations based on the decision result returned by the access control decision point. If the decision result is "allow", steps 6, 7, and 8 are executed in sequence; if the decision result is "deny", steps 6 and 7 are skipped and the error information is directly returned to the subject.

[0121] Step 6: The access control execution point initiates a read operation on file1.

[0122] Step 7: file1 returns the content to the access control enforcement point.

[0123] Step 8: If the decision result is "allow", the access control execution point returns the content of file1 to the subject. If the decision result is "deny", the error message is directly returned to the subject.

[0124] like Figure 4 As shown, an embodiment of the present invention further provides an access control system based on distributed decision-making, the system comprising: a subject 100, an access control execution point 200, an access control decision point 300, a decision information point 400 and an object 500;

[0125] The subject 100 is used to initiate an access control request to the access control execution point to perform a specific operation type on the target object. Each access control request includes the subject information, the target object information and the operation type.

[0126] The access control enforcement point 200 is used to forward the access control request to the access control decision point;

[0127] The access control decision point 300 is used to query the access control policy of the subject accessing the target object according to the information of the subject and the target object in the access control request, and send an information query request to the decision information point according to the access control policy of the subject accessing the target object;

[0128] The decision information point 400 is used to return the information required by the subject to access the target object's access control policy to the access control decision point according to the information query request;

[0129] The access control decision point 300 is also used to evaluate whether the access control request is allowed according to the information returned by the decision information point and the access control policy of the subject's access to the target object, obtain a decision result and return the decision result to the access control execution point;

[0130] The access control execution point 200 is also used to access the target object to initiate a specific operation type or return error information to the subject according to the decision result;

[0131] The target object 500 is used to return the access result to the access control execution point after executing a specific operation type;

[0132] The access control enforcement point 200 is also used to return the access result to the subject according to the decision result.

[0133] In the embodiment of the present invention, the operation types include writing, reading and deleting.

[0134] In an embodiment of the present invention, there is an access control policy for each target object corresponding to different operation types. The access control policy is composed of multiple conditions connected by logical AND and OR. Each condition includes three parts: attribute name, relationship between attribute name and attribute value, and attribute value; attribute name includes role, identity, trust value, time, and relationship between attribute name and attribute value includes greater than, equal to, and less than; each decision information point manages information of one attribute and configures multiple information of the attribute, and decision information points include decision information points for managing roles and decision information points for managing trust values; access control decision points initiate requests to decision information points through load balancing or broadcasting.

[0135] In an embodiment of the present invention, the target object includes a first target object, and the first target object includes a read access control policy and a write access control policy;

[0136] The access control policies that are read include:

[0137] Reading condition one: the subject's role is an administrator, reading condition two: the subject's role is a common user and the subject's trust value is greater than or equal to a first preset value, and there is a logical OR relationship between reading condition one and reading condition two;

[0138] The access control policies written include:

[0139] Write condition one: the subject's role is a super administrator, write condition two: the subject's role is an administrator and the subject's trust value is greater than or equal to a second preset value, and there is a logical OR relationship between write condition one and write condition two.

[0140] In an embodiment of the present invention, a first subject is used to initiate a first access control request for reading or writing a first target object to an access control execution point, wherein the first access control request includes information of the first subject, information of the first target object, and a read or write operation type; the access control execution point is used to forward the first access control request to an access control decision point; the access control decision point is used to query the access control policy for reading or writing of the first subject's access to the first target object based on the information of the first subject and the first target object, and send a role query request and a trust value query request to a decision information point for managing roles and a decision information point for managing trust values, respectively; the decision information point for managing roles and the decision information point for managing trust values ​​are ... the role query request and the trust value query request to the decision information point for managing roles and the decision information point for managing trust values, respectively. The value query request returns the queried role and trust value of the first subject to the access control decision point; the access control decision point is also used to evaluate whether the first access control request is allowed according to the role and trust value of the first subject and the access control policy for the first subject to access the first target object for reading or writing, obtain a first decision result and return the first decision result to the access control execution point; the access control execution point is also used to access the first target object to initiate reading or writing according to the first decision result, or return an error message to the first subject; the first target object is used to return the first access result to the access control execution point after being read or written; the access control execution point is also used to return the first access result to the first subject according to the first decision result.

[0141] Compared with the prior art, the present invention has the following advantages:

[0142] 1. Different from the existing centralized access control solutions, the present invention adopts a distributed architecture to deploy access control execution points, access control decision points and decision information points in a distributed manner, and solves the single point failure problem through load balancing and redundant backup mechanisms.

[0143] 2. The present invention breaks through the limitation of a single model (such as RBAC or ABAC) in the prior art, and supports the flexible combination of static permission management and dynamic context decision-making by integrating role-based (RBAC), attribute-based (ABAC) and trust-based access control models. This multi-model combination capability enables the system to adapt to complex access scenarios, such as cross-domain resource sharing, dynamic multi-tenant management and IoT device control.

[0144] 3. The present invention adopts two communication schemes, load balancing and broadcasting, which can be flexibly selected according to actual needs. The combination of the two gives full play to their respective advantages and optimizes the performance of the system.

[0145] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An access control method based on distributed decision making, characterized in that: The method comprises the following steps: S1: The subject initiates an access control request to the access control execution point to perform a specific operation type on the target object. Each access control request includes the subject's information, the target object's information and the operation type. S2: The access control execution point forwards the access control request to the access control decision point; S3: The access control decision point queries the access control policy for the subject to access the target object according to the information of the subject and the target object in the access control request, and sends an information query request to the decision information point according to the access control policy for the subject to access the target object; S4: the decision information point returns the information required by the subject for accessing the target object to the access control decision point according to the information query request; S5: The access control decision point evaluates whether the access control request is allowed according to the information returned by the decision information point and the access control policy for the subject to access the target object, obtains a decision result and returns the decision result to the access control execution point; S6: the access control execution point accesses the target object to initiate the specific operation type or returns error information to the subject according to the decision result; S7: After the specific operation type is executed, the target object returns the access result to the access control execution point; S8: The access control execution point returns the access result to the subject according to the decision result.

2. The access control method based on distributed decision-making according to claim 1, characterized in that: The operation types in step S1 include writing, reading and deleting.

3. The access control method based on distributed decision-making according to claim 2 is characterized in that: In step S3, each target object has an access control policy corresponding to different operation types, and the access control policy is composed of multiple conditions connected by logical AND and OR, and each condition includes three parts: attribute name, relationship between attribute name and attribute value, and attribute value; the attribute name includes role, identity, trust value, and time, and the relationship between the attribute name and attribute value includes greater than, equal to, and less than; Each decision information point manages information of one attribute and configures multiple information of the attribute, wherein the decision information point includes a decision information point for managing roles and a decision information point for managing trust values; The access control decision point initiates a request to the decision information point by means of load balancing or broadcasting.

4. The access control method based on distributed decision-making according to claim 3 is characterized in that: The target object includes a first target object, and the first target object includes a read access control policy and a write access control policy; The access control policy read includes: Reading condition one: the subject's role is an administrator, reading condition two: the subject's role is an ordinary user and the subject's trust value is greater than or equal to a first preset value, and the reading condition one and the reading condition two are in a logical OR relationship; The access control policy written includes: Writing condition one: the role of the subject is a super administrator, writing condition two: the role of the subject is an administrator and the trust value of the subject is greater than or equal to a second preset value, and there is a logical OR relationship between the writing condition one and the writing condition two.

5. The access control method based on distributed decision-making according to claim 4 is characterized in that: The subject includes a first subject, and the method for the first subject to request access to the first target object includes the following steps: S100: The first subject initiates a first access control request to the access control execution point for reading or writing the first target object, where the first access control request includes information about the first subject, information about the first target object, and a read or write operation type; S200: The access control enforcement point forwards the first access control request to the access control decision point; S300: The access control decision point queries the access control policy for reading or writing of the first subject to the first target object according to the information of the first subject and the first target object, and sends a role query request and a trust value query request to the decision information point for managing roles and the decision information point for managing trust values ​​respectively; S400: The decision information point for managing roles and the decision information point for managing trust values ​​return the queried role and trust value of the first subject to the access control decision point according to the role query request and the trust value query request respectively; S500: The access control decision point evaluates whether the first access control request is allowed according to the role and trust value of the first subject and the access control policy for reading or writing of the first subject to the first target object, obtains a first decision result and returns the first decision result to the access control execution point; S600: The access control execution point accesses the first target object to initiate reading or writing according to the first decision result, or returns error information to the first subject; S700: After being read or written, the first target object returns a first access result to the access control execution point; S800: The access control execution point returns the first access result to the first subject according to the first decision result.

6. An access control system based on distributed decision making, characterized in that: The system comprises: a subject, an access control execution point, an access control decision point, a decision information point and an object; The subject is used to initiate an access control request to the access control execution point to perform a specific operation type on the target object, and each access control request includes information about the subject, information about the target object and the operation type; The access control enforcement point is used to forward the access control request to the access control decision point; The access control decision point is used to query the access control policy for the subject to access the target object according to the information of the subject and the target object in the access control request, and send an information query request to the decision information point according to the access control policy for the subject to access the target object; The decision information point is used to return the information required by the subject to access the access control policy of the target object to the access control decision point according to the information query request; The access control decision point is also used to evaluate whether the access control request is allowed according to the information returned by the decision information point and the access control policy of the subject accessing the target object, obtain a decision result and return the decision result to the access control execution point; The access control execution point is further used to access the target object to initiate the specific operation type or return error information to the subject according to the decision result; The target object is used to return the access result to the access control execution point after the specific operation type is executed; The access control execution point is further configured to return the access result to the subject according to the decision result.

7. The access control system based on distributed decision making according to claim 6, characterized in that: The operation types include write, read, and delete.

8. The access control system based on distributed decision making according to claim 7, characterized in that: Each target object has an access control policy corresponding to different operation types. The access control policy consists of multiple conditions connected by logical AND and OR. Each condition contains three parts: attribute name, relationship between attribute name and attribute value, and attribute value. The attribute name includes role, identity, trust value, and time. The relationship between attribute name and attribute value includes greater than, equal to, and less than. Each decision information point manages information of one attribute and configures multiple information of the attribute, wherein the decision information point includes a decision information point for managing roles and a decision information point for managing trust values; The access control decision point initiates a request to the decision information point by means of load balancing or broadcasting.

9. The access control system based on distributed decision making according to claim 8, characterized in that: The target object includes a first target object, and the first target object includes a read access control policy and a write access control policy; The access control policy read includes: Reading condition one: the subject's role is an administrator, reading condition two: the subject's role is an ordinary user and the subject's trust value is greater than or equal to a first preset value, and the reading condition one and the reading condition two are in a logical OR relationship; The access control policy written includes: Writing condition one: the role of the subject is a super administrator, writing condition two: the role of the subject is an administrator and the trust value of the subject is greater than or equal to a second preset value, and there is a logical OR relationship between the writing condition one and the writing condition two.

10. The access control system based on distributed decision-making according to claim 9, characterized in that: The subject includes a first subject. When the first subject requests to access the first target object, The first subject is used to initiate a first access control request for reading or writing the first target object to the access control execution point, wherein the first access control request includes information of the first subject, information of the first target object, and a read or write operation type; The access control enforcement point is used to forward the first access control request to the access control decision point; The access control decision point is used to query the access control policy for the first subject to access the first target object for reading or writing based on the information of the first subject and the first target object, and send a role query request and a trust value query request to the decision information point for managing roles and the decision information point for managing trust values ​​respectively; The decision information point for managing roles and the decision information point for managing trust values ​​are used to return the queried role and trust value of the first subject to the access control decision point according to the role query request and the trust value query request respectively; The access control decision point is further used to evaluate whether the first access control request is allowed according to the role and trust value of the first subject and the access control policy for reading or writing of the first subject to the first target object, obtain a first decision result and return the first decision result to the access control execution point; The access control execution point is further used to access the first target object to initiate reading or writing according to the first decision result, or return error information to the first subject; The first target object is used to return a first access result to the access control execution point after being read or written; The access control execution point is further configured to return the first access result to the first subject according to the first decision result.

Images