An Access Control Method and System Based on Distributed Decision-Making

Abstract

This invention discloses an access control method and system based on distributed decision-making. The method includes: S1: A subject initiates an access control request to an access control enforcement point to perform a specific operation on a target object; S2: The access control enforcement point forwards the access control request to an access control decision point; S3: The access control decision point queries the access control policy corresponding to the target object; S4: A decision information point returns the required information to the access control decision point; S5: The access control decision point evaluates whether the access control request is allowed; S6: The access control enforcement point initiates a specific operation or returns an error message to the subject; S7: The target object returns the access result to the access control enforcement point; S8: The access control enforcement point returns the access result to the subject based on the decision result. This invention supports multiple access control models and comprehensive decision-making, providing efficient and secure access control capabilities for complex distributed systems.

Description

Technical Field

[0001] This invention relates to the field of distributed access control technology, and specifically to an access control method and system based on distributed decision-making. Background Technology

[0002] The application of distributed access control primarily stems from the widespread adoption of emerging technologies such as cloud computing, the Internet of Things (IoT), and edge computing. The proliferation of these technologies has placed higher demands on traditional access control. In cloud computing environments, resources are distributed across different physical locations, and multiple tenants share the same infrastructure. Access control needs to be able to manage permission isolation between different tenants across domains dynamically, while also supporting tenant-defined access control policies. In IoT and edge computing scenarios, massive amounts of devices and data require flexible, real-time access control solutions, especially in dynamic environments such as device location changes and real-time data stream processing. Traditional static access control models cannot meet the demands of such complex scenarios.

[0003] Existing access control schemes primarily employ a centralized architecture and a single model. In a centralized scheme, all access requests are forwarded through the access control enforcement point to a centralized access control decision point, which then uniformly evaluates the requests and returns the results. However, centralized architectures are prone to single points of failure. Because all access requests must be evaluated through a single decision point, if that decision point fails, the entire system's access control functionality will be interrupted, severely impacting system reliability and availability.

[0004] In terms of models, existing solutions are mostly based on fixed, single access control models, such as Role-Based Access Control (RBAC) or Attribute-Based Access Control (ABAC). RBAC manages access through a static mapping of roles to permissions, suitable for simple permission management scenarios; ABAC makes decisions based on subject, resource, and environment attributes, providing some flexibility, but it is usually difficult to combine flexibly with other models. Existing technologies lack the ability to flexibly combine multiple access control models (such as RBAC, ABAC, and trust-based models), making it difficult to adapt to the complex and ever-changing access needs in modern cloud computing, IoT, and dynamic multi-tenant environments.

[0005] Regarding communication between nodes, existing solutions mostly employ hard-coded communication methods, lacking flexibility. Hard-coded communication in existing distributed access control schemes has several drawbacks. Hard-coding typically means embedding communication policies, node information, or routing rules directly into the code, significantly reducing system flexibility and maintainability. Hard-coding makes the system poorly adaptable to configuration changes and expansions; if node information needs modification or communication policies need adjustment, the code must be directly modified and redeployed, which is particularly inconvenient in dynamically changing distributed environments. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention avoids single points of failure through a distributed architecture and employs a modular design to achieve distributed deployment of access control execution points, decision points, and decision information points. The use of decision information points, as a cloud service, makes it more suitable for cloud scenarios. It supports multiple access control models, including comprehensive decision-making based on roles, attributes, and dynamic trusts, and can flexibly respond to dynamic context changes, providing efficient and secure access control capabilities for complex distributed systems.

[0007] This invention provides an access control method based on distributed decision-making, the method comprising the following steps:

[0008] S1: The subject initiates an access control request to the access control enforcement point to perform a specific type of operation on the target object. Each access control request includes information about the subject, information about the target object, and the type of operation.

[0009] S2: The access control enforcement point forwards the access control request to the access control decision point;

[0010] S3: The access control decision point queries the access control policy of the subject accessing the target object based on the information of the subject and the target object in the access control request, and sends an information query request to the decision information point based on the access control policy of the subject accessing the target object;

[0011] S4: The decision information point returns the information required by the access control policy for the subject to access the target object to the access control decision point according to the information query request;

[0012] S5: The access control decision point evaluates whether the access control request is allowed based on the information returned by the decision information point and the access control policy for the subject to access the target object, obtains a decision result, and returns the decision result to the access control execution point;

[0013] S6: The access control execution point accesses the target object to initiate the specific operation type based on the decision result or returns an error message to the subject;

[0014] S7: After the specific operation type is performed, the target object returns the access result to the access control execution point;

[0015] S8: The access control execution point returns the access result to the subject based on the decision result.

[0016] Preferably, the operation types in step S1 include writing, reading, and deleting.

[0017] Preferably, in step S3, each target object has an access control policy corresponding to different operation types. The access control policy consists of multiple conditions connected by logical AND and OR. Each condition includes three parts: attribute name, the relationship between the attribute name and the attribute value, and the attribute value. The attribute name includes role, identity, trust value, and time. The relationship between the attribute name and the attribute value includes greater than, equal to, and less than.

[0018] Each decision information point manages information for one attribute and configures multiple pieces of information for that attribute. The decision information points include decision information points for managing roles and decision information points for managing trust values.

[0019] The access control decision point initiates a request to the decision information point through load balancing or broadcasting.

[0020] Preferably, the target object includes a first target object, which includes a read access control policy and a write access control policy;

[0021] The access control policy for reading includes:

[0022] Reading condition 1: The subject's role is an administrator; Reading condition 2: The subject's role is a regular user and the subject's trust value is greater than or equal to a first preset value; Reading condition 1 and Reading condition 2 are logically ORed.

[0023] The access control policy for writing includes:

[0024] Write condition 1: The subject's role is a super administrator; Write condition 2: The subject's role is an administrator and the subject's trust value is greater than or equal to a second preset value. The write condition 1 and the write condition 2 are logically ORed.

[0025] Preferably, the subject includes a first subject, and the method by which the first subject requests access to the first target object includes the following steps:

[0026] S100: The first subject initiates a first access control request to the access control enforcement point to read or write the first target object. The first access control request includes information about the first subject, information about the first target object, and the type of read or write operation.

[0027] S200: The access control enforcement point forwards the first access control request to the access control decision point;

[0028] S300: The access control decision point queries the access control policy for the first subject to access the first target object to read or write based on the information of the first subject and the first target object, and sends role query request and trust value query request to the decision information point of the management role and the decision information point of the management trust value, respectively.

[0029] S400: The decision information point of the management role and the decision information point of the management trust value respectively return the role and trust value of the first subject to the access control decision point according to the role query request and the trust value query request.

[0030] S500: The access control decision point evaluates whether the first access control request is allowed based on the role and trust value of the first subject and the access control policy for the first subject to access the first target object to read or write, obtains a first decision result, and returns the first decision result to the access control enforcement point.

[0031] S600: The access control execution point accesses the first target object to initiate a read or write operation based on the first decision result, or returns an error message to the first subject;

[0032] S700: After the first target object is read or written, it returns the first access result to the access control execution point;

[0033] S800: The access control execution point returns the first access result to the first subject based on the first decision result.

[0034] The present invention also provides an access control system based on distributed decision-making, the system comprising: a subject, an access control execution point, an access control decision point, a decision information point, and an object;

[0035] The subject is used to initiate an access control request to the access control enforcement point to perform a specific type of operation on the target object. Each access control request includes information about the subject, information about the target object, and the type of operation.

[0036] The access control enforcement point is used to forward the access control request to the access control decision point;

[0037] The access control decision point is used to query the access control policy of the subject accessing the target object based on the information of the subject and the target object in the access control request, and send an information query request to the decision information point according to the access control policy of the subject accessing the target object;

[0038] The decision information point is used to return the information required by the access control policy for the subject to access the target object to the access control decision point according to the information query request.

[0039] The access control decision point is also used to evaluate whether the access control request is allowed based on the information returned by the decision information point and the access control policy for the subject to access the target object, obtain a decision result, and return the decision result to the access control execution point;

[0040] The access control execution point is also used to access the target object to initiate the specific operation type or return error information to the subject based on the decision result;

[0041] The target object is used to return the access result to the access control enforcement point after the specific operation type is performed;

[0042] The access control enforcement point is also used to return the access result to the subject based on the decision result.

[0043] Preferably, the operation types include writing, reading, and deleting.

[0044] Preferably, each target object has an access control policy corresponding to different operation types. The access control policy consists of multiple conditions connected by logical AND and OR. Each condition includes three parts: attribute name, the relationship between the attribute name and the attribute value, and the attribute value. The attribute name includes role, identity, trust value, and time. The relationship between the attribute name and the attribute value includes greater than, equal to, and less than.

[0045] Each decision information point manages information for one attribute and configures multiple pieces of information for that attribute. The decision information points include decision information points for managing roles and decision information points for managing trust values.

[0046] The access control decision point initiates a request to the decision information point through load balancing or broadcasting.

[0047] Preferably, the target object includes a first target object, which includes a read access control policy and a write access control policy;

[0048] The access control policy for reading includes:

[0049] Reading condition 1: The subject's role is an administrator; Reading condition 2: The subject's role is a regular user and the subject's trust value is greater than or equal to a first preset value; Reading condition 1 and Reading condition 2 are logically ORed.

[0050] The access control policy for writing includes:

[0051] Write condition 1: The subject's role is a super administrator; Write condition 2: The subject's role is an administrator and the subject's trust value is greater than or equal to a second preset value. The write condition 1 and the write condition 2 are logically ORed.

[0052] Preferably, the subject includes a first subject, which, when the first subject requests access to the first target object,

[0053] The first subject is used to initiate a first access control request to the access control enforcement point to read or write the first target object. The first access control request includes information about the first subject, information about the first target object, and the type of read or write operation.

[0054] The access control enforcement point is used to forward the first access control request to the access control decision point;

[0055] The access control decision point is used to query the access control policy for the first subject to access the first target object to read or write based on the information of the first subject and the first target object, and send role query request and trust value query request to the decision information point of the management role and the decision information point of the management trust value respectively.

[0056] The decision information point of the management role and the decision information point of the management trust value are used to return the role and trust value of the first subject to the access control decision point according to the role query request and the trust value query request, respectively.

[0057] The access control decision point is also used to evaluate whether the first access control request is allowed based on the role and trust value of the first subject and the access control policy for the first subject to access the first target object to read or write, to obtain a first decision result and return the first decision result to the access control enforcement point.

[0058] The access control execution point is also used to access the first target object to initiate reading or writing based on the first decision result, or to return error information to the first subject;

[0059] The first target object is used to return the first access result to the access control execution point after being read or written;

[0060] The access control enforcement point is also used to return the first access result to the first subject based on the first decision result.

[0061] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0062] This invention adopts a distributed architecture, which deploys access control execution points, access control decision points, and decision information points in a distributed manner to avoid single points of failure. It breaks through the limitations of the single model in the existing technology, and supports the flexible combination of static permission management and dynamic context decision by integrating role-based, attribute-based, and trust value-based access control models. This enables the system to adapt to complex access scenarios, such as cross-domain resource sharing, dynamic multi-tenant management, and IoT device control. Attached Figure Description

[0063] Figure 1 A flowchart illustrating an access control method based on distributed decision-making provided by the present invention;

[0064] Figure 2 A flowchart illustrating another access control method based on distributed decision-making provided by the present invention;

[0065] Figure 3 A schematic diagram of an access control model framework for an access control method based on distributed decision-making provided by the present invention;

[0066] Figure 4 This is a schematic diagram of the structure of an access control system based on distributed decision-making provided by the present invention. Detailed Implementation

[0067] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0068] The present invention will now be described in further detail with reference to the accompanying drawings.

[0069] like Figure 1 As shown, this embodiment of the invention provides an access control method based on distributed decision-making, including the following steps:

[0070] S1: The subject initiates an access control request to the access control enforcement point to perform a specific type of operation on the target object. Each access control request includes information about the subject, information about the target object, and the type of operation.

[0071] S2: The access control enforcement point forwards the access control request to the access control decision point;

[0072] S3: The access control decision point queries the access control policy of the subject accessing the target object based on the information of the subject and the target object in the access control request, and sends an information query request to the decision information point according to the access control policy of the subject accessing the target object.

[0073] S4: The decision information point returns the information required by the access control policy for the subject to access the target object to the access control decision point according to the information query request.

[0074] S5: The access control decision point evaluates whether the access control request is allowed based on the information returned by the decision information point and the access control policy of the subject accessing the target object, obtains the decision result, and returns the decision result to the access control enforcement point;

[0075] S6: The access control enforcement point accesses the target object to initiate a specific operation type or returns an error message to the subject based on the decision result;

[0076] S7: The target object returns the access result to the access control enforcement point after a specific operation type is performed;

[0077] S8: The access control enforcement point returns the access result to the subject based on the decision result.

[0078] In this embodiment of the invention, the operation types in step S1 include writing, reading, and deleting. In step S3, each target object has an access control policy corresponding to different operation types. The access control policy consists of multiple conditions connected by logical AND and OR. Each condition includes three parts: attribute name, the relationship between the attribute name and the attribute value, and the attribute value. The attribute name includes role, identity, trust value, and time. The relationship between the attribute name and the attribute value includes greater than, equal to, and less than. Each decision information point manages information for one attribute and configures multiple pieces of information for that attribute. Decision information points include decision information points that manage roles and decision information points that manage trust values. The access control decision points initiate requests to the decision information points through load balancing or broadcasting.

[0079] In this embodiment of the invention, a subject, acting as the initiator of an access control request, initiates the request to access a specific target resource (object). The access control enforcement point is responsible for accepting the access control request initiated by the subject, verifying its security, forwarding it to the access control decision point, and executing the request. The access control decision point processes the access control request sent by the access control enforcement point, integrates information from multiple decision information points to make a decision, queries decision information points to obtain auxiliary information such as trust values, roles, and policies, and determines whether to allow the subject to access the target resource based on its stored access control policies. The access control decision point has redundant configurations to avoid single points of failure. The decision information points are responsible for providing the access control decision point with various information required during the decision-making process. Decision information points can provide various information needed for decision-making, including verifying the subject's identity and role, providing trust values, and dynamic environmental conditions (such as time and geographical location). Simultaneously, data redundancy enables fault tolerance and high availability design, and caching and load balancing mechanisms improve query efficiency. An object, as the target resource being accessed, can be accessed by access control execution points (such as performing read and write operations) and the access result of the resource can be returned.

[0080] The target object in this embodiment of the invention includes a first target object, which includes a read access control policy and a write access control policy. The read access control policy includes: read condition one: the subject's role is an administrator, read condition two: the subject's role is a regular user and the subject's trust value is greater than or equal to a first preset value, and read condition one and read condition two are logically ORed. The write access control policy includes: write condition one: the subject's role is a super administrator, write condition two: the subject's role is an administrator and the subject's trust value is greater than or equal to a second preset value, and write condition one and write condition two are logically ORed.

[0081] like Figure 2 As shown, the subject in this embodiment of the invention includes a first subject, and the method by which the first subject requests access to the first target object includes the following steps:

[0082] S100: The first subject initiates a first access control request to the access control enforcement point to read or write the first target object. The first access control request includes information about the first subject, information about the first target object, and the type of read or write operation.

[0083] S200: The access control enforcement point forwards the first access control request to the access control decision point;

[0084] S300: Based on the information of the first subject and the first target object, the access control decision point queries the access control policy for the first subject to access the first target object to read or write, and sends role query request and trust value query request to the decision information point of the management role and the decision information point of the management trust value, respectively.

[0085] S400: The decision information points for managing roles and trust values ​​respectively return the roles and trust values ​​of the first subject to the access control decision points based on the role query request and the trust value query request.

[0086] S500: The access control decision point evaluates whether the first access control request is allowed based on the role and trust value of the first subject and the access control policy for the first subject to access the first target object to read or write, obtains the first decision result, and returns the first decision result to the access control enforcement point.

[0087] S600: The access control execution point accesses the first target object to initiate a read or write operation based on the first decision result, or returns an error message to the first subject;

[0088] S700: After the first target object is read or written, the first access result is returned to the access control execution point;

[0089] S800: The access control enforcement point returns the first access result to the first subject based on the first decision result.

[0090] like Figure 3 The overall framework of the access control model shown in this invention, and the access control method based on distributed decision-making provided in this embodiment of the invention, specifically include the following steps:

[0091] Step 1: The subject sends an access control request, requesting to perform a certain operation (e.g., write, read, delete, etc.) on the target object and sends the access request to the access control enforcement point in the access control system. The access control request information includes the subject, object, and operation type.

[0092] The access request req initiated by subject sub on object obj can be formally represented as:

[0093] req =<sub,obj,op>

[0094] Here, sub represents the subject of the access request; obj represents the object to be requested; and op represents the operation type (such as write, read, delete, etc.).

[0095] Step 2: Forward the access control request to the access control decision point. The access control decision point queries the corresponding access control policy based on the object to be accessed in the access control request.

[0096] Access control policies can connect multiple conditions using logical AND and OR operations. Each condition consists of three parts: the attribute name, the relationship between the attribute name and the attribute value, and the attribute value. The policy is defined as follows:

[0097] Policy obj

[0098] = ( Attr1,Rela1,Value1 ) Logic ( Attr2,Rela2,Value2 ) Logic...Logic(Attr n ,Rela n Value n )

[0099] Among them, Attr i Represents attribute names, such as role, identity, trust value, time, etc.; Rela i This indicates the relationship between the attribute name and the attribute value, such as greater than, equal to, less than, etc.; Value i Represents attribute values; Logic represents the relationship between conditions, whether it is logical AND or logical OR, etc.

[0100] For example, suppose the access control policy is:

[0101]

[0102] Two access control policies for object file1:

[0103] The first is the access control policy for Alice to read file1, which needs to meet one of the following two conditions:

[0104] (1) The main role is that of an administrator;

[0105] (2) The subject is a regular user and the subject's trust value is greater than or equal to 0.8.

[0106] The second is the access control policy for John writing to file1, which needs to meet one of the following two conditions:

[0107] (1) The main character is the super administrator;

[0108] (2) The subject's role is an administrator and the subject's trust value is greater than or equal to 0.5.

[0109] Suppose principal Alice initiates a request to read file1. First, the access control policies for Alice's access to file1 are matched using the principal Alice (the first two). Then, the first access control policy is retrieved using the operation type Read. The first access control policy requires two attributes—the principal's role and trust value—to evaluate whether the principal is allowed to read file1.

[0110] Since each decision information point is only responsible for one type of information, we need to send query requests to the decision information points with management roles and the decision information points with management trust values ​​respectively. Multiple decision information points are configured for each type to avoid single point of failure. Requests are sent to the decision information points through load balancing or broadcasting.

[0111] Step 3: The access control decision point sends query requests to the decision information point for the management role and the decision information point for the management trust value. The decision information point queries the corresponding role and trust value based on the principal Alice. Ultimately, it is found that the principal Alice's role is "user" and her trust value is 0.85.

[0112] Step 4: The decision information points responsible for the role and the trust value return the role "user" and the trust value 0.85 to the access control decision point, respectively. The decision point will then evaluate the access control request initiated by the principal Alice based on the access control policy read from file1.

[0113] The access control policy for reading file1 is:

[0114] (Role="Admin")∨((Role="User")∧(Trust≥0.8))

[0115] Incorporate Alice's role and the subject's trust value into the access control policy:

[0116] Decision(req sub )=("User"="Admin")∨(("User"="User")∧(0.85≥0.8))=False∨(True∧True)

[0117] The final decision is as follows:

[0118] Decision(req sub ) = True

[0119] This means that the subject Alice is allowed to read file1.

[0120] Step 5: The access control decision point returns the decision result to the access control enforcement point. The access control enforcement point performs the corresponding operation based on the decision result returned by the access control decision point. If the decision result is "allow", then steps 6, 7, and 8 are executed sequentially; if the decision result is "deny", then steps 6 and 7 are skipped, and an error message is directly returned to the subject.

[0121] Step 6: The access control execution point initiates a read operation on file1.

[0122] Step 7: file1 returns the content to the access control execution point.

[0123] Step 8: If the decision result is "Allow", the access control execution point returns the content of file1 to the subject; if the decision result is "Deny", an error message is returned directly to the subject.

[0124] like Figure 4 As shown, this embodiment of the invention also provides an access control system based on distributed decision-making, the system including: a subject 100, an access control execution point 200, an access control decision point 300, a decision information point 400, and an object 500;

[0125] Subject 100 is used to initiate an access control request to the access control enforcement point to perform a specific type of operation on the target object. Each access control request includes information about the subject, information about the target object, and the type of operation.

[0126] Access control enforcement point 200 is used to forward access control requests to access control decision points;

[0127] The access control decision point 300 is used to query the access control policy of the subject accessing the target object based on the information of the subject and the target object in the access control request, and send an information query request to the decision information point according to the access control policy of the subject accessing the target object.

[0128] The decision information point 400 is used to return the information required by the access control policy for the subject to access the target object to the access control decision point according to the information query request.

[0129] Access control decision point 300 is also used to evaluate whether the access control request is allowed based on the information returned by the decision information point and the access control policy of the subject accessing the target object, obtain the decision result, and return the decision result to the access control enforcement point;

[0130] Access control enforcement point 200 is also used to initiate specific operation types by accessing the target object based on the decision result or to return error information to the subject;

[0131] The target object 500 is used to return the access result to the access control enforcement point after a specific type of operation has been performed;

[0132] Access control enforcement point 200 is also used to return access results to the subject based on the decision outcome.

[0133] In this embodiment of the invention, the operation types include writing, reading, and deleting.

[0134] In this embodiment of the invention, each target object has an access control policy corresponding to different operation types. The access control policy consists of multiple conditions connected by logical AND and OR. Each condition includes three parts: attribute name, the relationship between the attribute name and the attribute value, and the attribute value. The attribute name includes role, identity, trust value, and time. The relationship between the attribute name and the attribute value includes greater than, equal to, and less than. Each decision information point manages information for one attribute and configures multiple information for that attribute. Decision information points include decision information points that manage roles and decision information points that manage trust values. The access control decision points initiate requests to the decision information points through load balancing or broadcasting.

[0135] In this embodiment of the invention, the target object includes a first target object, which includes a read access control policy and a write access control policy.

[0136] The access control policies for reading include:

[0137] Reading condition 1: The subject's role is an administrator; Reading condition 2: The subject's role is a regular user and the subject's trust value is greater than or equal to the first preset value; Reading condition 1 and Reading condition 2 are logically ORed.

[0138] The write access control policies include:

[0139] Write condition 1: The subject's role is super administrator; Write condition 2: The subject's role is administrator and the subject's trust value is greater than or equal to the second preset value; Write condition 1 and Write condition 2 are logically ORed.

[0140] In this embodiment of the invention, a first subject initiates a first access control request to the access control enforcement point to read or write a first target object. The first access control request includes information about the first subject, information about the first target object, and the type of read or write operation. The access control enforcement point forwards the first access control request to the access control decision point. The access control decision point queries the access control policy for the first subject to access the first target object based on the information of the first subject and the first target object, and sends a role query request and a trust value query request to the decision information point of the management role and the decision information point of the management trust value, respectively. The decision information point of the management role and the decision information point of the management trust value are used to query the role query request and the trust value query request, respectively. The query request returns the role and trust value of the first subject to the access control decision point. The access control decision point is also used to evaluate whether the first access control request is allowed based on the role and trust value of the first subject and the access control policy for the first subject to access the first target object for reading or writing, obtain the first decision result, and return the first decision result to the access control enforcement point. The access control enforcement point is also used to initiate reading or writing to the first target object based on the first decision result, or return an error message to the first subject. The first target object is used to return the first access result to the access control enforcement point after the reading or writing is performed. The access control enforcement point is also used to return the first access result to the first subject based on the first decision result.

[0141] Compared with the prior art, the present invention has the following advantages:

[0142] 1. Unlike existing centralized access control schemes, this invention adopts a distributed architecture, which deploys access control execution points, access control decision points, and decision information points in a distributed manner, and solves the single point of failure problem through load balancing and redundancy backup mechanisms.

[0143] 2. This invention overcomes the limitations of existing technologies that rely on a single model (such as RBAC or ABAC). By integrating role-based access control (RBAC), attribute-based access control (ABAC), and trust value-based access control models, it supports a flexible combination of static permission management and dynamic context-based decision-making. This multi-model integration capability enables the system to adapt to complex access scenarios, such as cross-domain resource sharing, dynamic multi-tenant management, and IoT device control.

[0144] 3. This invention employs both load balancing and broadcast communication schemes, allowing for flexible selection based on actual needs. Combining these two methods fully leverages their respective advantages and optimizes system performance.

[0145] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An access control method based on distributed decision-making, characterized in that, The method includes the following steps: S1: The subject initiates an access control request to the access control enforcement point to perform a specific type of operation on the target object. Each access control request includes information about the subject, information about the target object, and the type of operation. S2: The access control enforcement point forwards the access control request to the access control decision point; S3: The access control decision point queries the access control policy of the subject accessing the target object based on the information of the subject and the target object in the access control request, and sends an information query request to the decision information point based on the access control policy of the subject accessing the target object; S4: The decision information point returns the information required by the access control policy for the subject to access the target object to the access control decision point according to the information query request; S5: The access control decision point evaluates whether the access control request is allowed based on the information returned by the decision information point and the access control policy for the subject to access the target object, obtains a decision result, and returns the decision result to the access control execution point; S6: The access control execution point accesses the target object to initiate the specific operation type based on the decision result or returns an error message to the subject; S7: After the specific operation type is performed, the target object returns the access result to the access control execution point; S8: The access control execution point returns the access result to the subject based on the decision result.

2. The access control method based on distributed decision-making according to claim 1, characterized in that, The operation types described in step S1 include writing, reading, and deleting.

3. The access control method based on distributed decision-making according to claim 2, characterized in that, In step S3, each target object has an access control policy corresponding to different operation types. The access control policy consists of multiple conditions connected by logical AND and OR. Each condition contains three parts: attribute name, the relationship between the attribute name and the attribute value, and the attribute value. The attribute name includes role, identity, trust value, and time. The relationship between the attribute name and the attribute value includes greater than, equal to, and less than. Each decision information point manages information for one attribute and configures multiple pieces of information for that attribute. The decision information points include decision information points for managing roles and decision information points for managing trust values. The access control decision point initiates a request to the decision information point through load balancing or broadcasting.

4. The access control method based on distributed decision-making according to claim 3, characterized in that, The target object includes a first target object, which includes a read access control policy and a write access control policy. The access control policy for reading includes: Reading condition 1: The subject's role is an administrator; Reading condition 2: The subject's role is a regular user and the subject's trust value is greater than or equal to a first preset value; Reading condition 1 and Reading condition 2 are logically ORed. The access control policy for writing includes: Write condition 1: The subject's role is a super administrator; Write condition 2: The subject's role is an administrator and the subject's trust value is greater than or equal to a second preset value. The write condition 1 and the write condition 2 are logically ORed.

5. The access control method based on distributed decision-making according to claim 4, characterized in that, The subject includes a first subject, and the method by which the first subject requests access to the first target object includes the following steps: S100: The first subject initiates a first access control request to the access control enforcement point to read or write the first target object. The first access control request includes information about the first subject, information about the first target object, and the type of read or write operation. S200: The access control enforcement point forwards the first access control request to the access control decision point; S300: The access control decision point queries the access control policy for the first subject to access the first target object to read or write based on the information of the first subject and the first target object, and sends role query request and trust value query request to the decision information point of the management role and the decision information point of the management trust value, respectively. S400: The decision information point of the management role and the decision information point of the management trust value respectively return the role and trust value of the first subject to the access control decision point according to the role query request and the trust value query request. S500: The access control decision point evaluates whether the first access control request is allowed based on the role and trust value of the first subject and the access control policy for the first subject to access the first target object to read or write, obtains a first decision result, and returns the first decision result to the access control enforcement point. S600: The access control execution point accesses the first target object to initiate a read or write operation based on the first decision result, or returns an error message to the first subject; S700: After the first target object is read or written, it returns the first access result to the access control execution point; S800: The access control execution point returns the first access result to the first subject based on the first decision result.

6. An access control system based on distributed decision-making, characterized in that, The system includes: a subject, an access control enforcement point, an access control decision point, a decision information point, and an object; The subject is used to initiate an access control request to the access control enforcement point to perform a specific type of operation on the target object. Each access control request includes information about the subject, information about the target object, and the type of operation. The access control enforcement point is used to forward the access control request to the access control decision point; The access control decision point is used to query the access control policy of the subject accessing the target object based on the information of the subject and the target object in the access control request, and send an information query request to the decision information point according to the access control policy of the subject accessing the target object; The decision information point is used to return the information required by the access control policy for the subject to access the target object to the access control decision point according to the information query request. The access control decision point is also used to evaluate whether the access control request is allowed based on the information returned by the decision information point and the access control policy for the subject to access the target object, obtain a decision result, and return the decision result to the access control execution point; The access control execution point is also used to access the target object to initiate the specific operation type or return error information to the subject based on the decision result; The target object is used to return the access result to the access control enforcement point after the specific operation type is performed; The access control enforcement point is also used to return the access result to the subject based on the decision result.

7. An access control system based on distributed decision-making according to claim 6, characterized in that, The operation types include write, read, and delete.

8. An access control system based on distributed decision-making according to claim 7, characterized in that, Each target object has an access control policy corresponding to different operation types. The access control policy consists of multiple conditions connected by logical AND and OR. Each condition contains three parts: attribute name, the relationship between the attribute name and the attribute value, and the attribute value. The attribute name includes role, identity, trust value, and time. The relationship between the attribute name and the attribute value includes greater than, equal to, and less than. Each decision information point manages information for one attribute and configures multiple pieces of information for that attribute. The decision information points include decision information points for managing roles and decision information points for managing trust values. The access control decision point initiates a request to the decision information point through load balancing or broadcasting.

9. An access control system based on distributed decision-making according to claim 8, characterized in that, The target object includes a first target object, which includes a read access control policy and a write access control policy. The access control policy for reading includes: Reading condition 1: The subject's role is an administrator; Reading condition 2: The subject's role is a regular user and the subject's trust value is greater than or equal to a first preset value; Reading condition 1 and Reading condition 2 are logically ORed. The access control policy for writing includes: Write condition 1: The subject's role is a super administrator; Write condition 2: The subject's role is an administrator and the subject's trust value is greater than or equal to a second preset value. The write condition 1 and the write condition 2 are logically ORed.

10. An access control system based on distributed decision-making according to claim 9, characterized in that, The subject includes a first subject, which requests access to the first target object when the first subject requests access to the target object. The first subject is used to initiate a first access control request to the access control enforcement point to read or write the first target object. The first access control request includes information about the first subject, information about the first target object, and the type of read or write operation. The access control enforcement point is used to forward the first access control request to the access control decision point; The access control decision point is used to query the access control policy for the first subject to access the first target object to read or write based on the information of the first subject and the first target object, and send role query request and trust value query request to the decision information point of the management role and the decision information point of the management trust value respectively. The decision information point of the management role and the decision information point of the management trust value are used to return the role and trust value of the first subject to the access control decision point according to the role query request and the trust value query request, respectively. The access control decision point is also used to evaluate whether the first access control request is allowed based on the role and trust value of the first subject and the access control policy for the first subject to access the first target object to read or write, to obtain a first decision result and return the first decision result to the access control enforcement point. The access control execution point is also used to access the first target object to initiate reading or writing based on the first decision result, or to return error information to the first subject; The first target object is used to return the first access result to the access control execution point after being read or written; The access control enforcement point is also used to return the first access result to the first subject based on the first decision result.

Images