Authorization verification method, system and device, computer device and storage medium

Abstract

The application relates to the technical field of data access control and discloses an authorization verification method, system and device, computer equipment and a storage medium. First, in the case that a target operation performed on target data is received, an authorization operation credential is queried based on a target metadata authorization service item corresponding to the target operation, and it is verified whether there is a valid authorization record. Then, in the case that the authorization operation credential is found to have a target metadata operation authorization item matching the target metadata authorization service item, authorization verification is performed on a target metadata authorization operation verification key corresponding to the authorization operation credential and the target metadata authorization service item, an authorization verification result is obtained, and it is indicated whether the operation request is approved. Finally, in the case that the authorization verification result indicates that the authorization verification is passed, the target data is allowed to be operated based on the target operation, fine-grained operation authorization control of the data is effectively managed, and the control of data access and operation permission is ensured.

Description

Technical Field

[0001] This invention relates to the field of data access control technology, and in particular to an authorization verification method, system, device, computer equipment, and storage medium. Background Technology

[0002] Access control, as a fundamental element in the security field, is primarily used to define under what conditions specific subjects are allowed to access relevant data, applications, and resources.

[0003] In related technologies, role-based access control methods grant or restrict system access permissions based on an individual's role within the organizational structure. However, role-based access control methods have certain limitations in precisely controlling every operation on every metadata item. Summary of the Invention

[0004] The embodiments described in this specification aim to at least partially solve one of the technical problems in the related art. To this end, the embodiments described in this specification propose an authorization verification method, system, apparatus, computer device, and storage medium.

[0005] This specification provides an authorization verification method, the method comprising: Upon receiving a target operation to be performed on the target data, the authorization operation credential is queried based on the target metadata authorization service item corresponding to the target operation; If a target metadata operation authorization item matching the target metadata authorization service item is found in the query, authorization verification is performed based on the authorization operation credential and the target metadata authorization operation verification key corresponding to the target metadata authorization service item to obtain the authorization verification result; If the authorization verification result indicates that the authorization verification is successful, then operations on the target data are permitted based on the target operation.

[0006] In one implementation, the authorization operation credential further includes a hash identifier and an encrypted identity. The authorization verification based on the authorization operation credential and the target metadata authorization operation verification key corresponding to the target metadata authorization service item, to obtain the authorization verification result, includes: Based on the target metadata authorization operation verification key and the target metadata operation authorization item, the information to be verified is determined; Based on the encrypted identity and the information to be verified, the identity to be verified is determined; Based on the identity to be verified and the random parameters, determine the hash identifier to be verified; The authorization verification result is obtained by comparing the hash identifier to be verified with the hash identifier.

[0007] In one implementation, comparing the hash identifier to be verified with the hash identifier to obtain the authorization verification result includes: If the hash identifier to be verified is equal to the hash identifier, the authorization verification result indicating that the authorization verification has passed is obtained; If the hash identifier to be verified is not equal to the hash identifier, the authorization verification result indicating that the authorization verification failed is obtained.

[0008] In one implementation, the method further includes, before performing the target operation on the target data: Upon receiving a user authentication operation, the system receives the user's unique identifier and the metadata authorization service item corresponding to the user's operable metadata, which allows the execution of data operations, and determines random parameters. The authorization operation credential is generated based on the user's unique identifier, the metadata authorization service item, the random parameters, and the initialization data.

[0009] In one implementation, the initialization data is determined in the following manner: Based on the metadata and the metadata authorization service items to which the metadata applies, determine the privacy parameter and the feature value corresponding to each applicable metadata authorization service item for each metadata. Based on the private parameters and the corresponding feature values ​​of each applicable metadata authorization service item for each metadata, determine the metadata authorization operation verification key corresponding to the non-private parameters and each applicable metadata authorization service item for each metadata; The initialization data is determined based on the private parameters, the feature value corresponding to each applicable metadata authorization service item for each metadata, the non-private parameters, and the metadata authorization operation verification key corresponding to each applicable metadata authorization service item for each metadata.

[0010] In one implementation, the authorization operation credential further includes an authorized access frequency, and the step of allowing operation on the target data based on the target operation when the authorization verification result indicates that the authorization verification is successful includes: If the authorization verification result indicates that the authorization verification is successful, the target data is allowed to be operated on based on the target operation, with the authorized access frequency as a constraint.

[0011] This specification provides an authorization verification system, which includes an authorization access control center and a key generation center, and implements the steps of the method described in any of the above-mentioned embodiments.

[0012] This specification provides an authorization verification device, the device comprising: The authorization operation credential query module is used to query the authorization operation credential based on the target metadata authorization service item corresponding to the target operation when a target operation is received for the target data. The target operation authorization verification module is used to perform authorization verification based on the authorization operation credential and the target metadata authorization operation verification key corresponding to the target metadata authorization service item when the authorization operation credential is found to match the target metadata authorization service item, and to obtain the authorization verification result. The permission authorization control module is used to allow operations on the target metadata based on the target operation if the authorization verification result indicates that the authorization verification is successful.

[0013] This specification provides a computer device comprising: a memory, and one or more processors communicatively connected to the memory; the memory stores instructions executable by the one or more processors, the instructions being executed by the one or more processors to cause the one or more processors to perform the steps of the method described in any of the above embodiments.

[0014] This specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any of the above embodiments.

[0015] This specification provides a computer program product that includes instructions that, when executed by a processor of a computer device, enable the computer device to perform the steps of the method described in any of the above embodiments.

[0016] In the above-described implementation, firstly, upon receiving a target operation to be performed on target data, the authorization operation credential is queried based on the target metadata authorization service item corresponding to the target operation to verify the existence of a valid authorization record. Then, if a target metadata operation authorization item matching the target metadata authorization service item is found, authorization verification is performed based on the authorization operation credential and the target metadata authorization operation verification key corresponding to the target metadata authorization service item, obtaining an authorization verification result indicating whether the operation request has been legally authorized. Finally, if the authorization verification result indicates that the authorization verification has passed, operation on the target data based on the target operation is permitted. This mechanism ensures that an operation can only be executed when the target operation matches the corresponding metadata operation authorization item and passes verification, thereby effectively managing fine-grained operation authorization control of data, ensuring strict control over data access and operation permissions, and reducing potential security risks. Attached Figure Description

[0017] Figure 1 A flowchart illustrating the authorization verification method provided in the embodiments of this specification; Figure 2 A flowchart illustrating the process of obtaining authorization verification results provided for the implementation of this specification; Figure 3 A flowchart illustrating the process of generating an authorization operation credential provided for the implementation of this specification; Figure 4 A flowchart illustrating the determination of initialization data provided for embodiments of this specification; Figure 5 A schematic diagram of the authorization verification device provided for the embodiments of this specification; Figure 6 An internal structural diagram of a computer device provided for embodiments of this specification. Detailed Implementation

[0018] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0019] Access control is a fundamental element in the field of information security. It refers to the methods and mechanisms for authorizing and controlling access to resource objects. An accessor, also known as a subject, is typically a user, process, or application, while a resource object, or object, is the object being accessed, which can include files, application services, data, etc. The core objective of access control is to ensure that only authorized users can access protected resources, while unauthorized users are prevented from accessing them.

[0020] It's important to note that authorization refers to the methods by which a user can access a resource object, such as reading, writing, deleting, and appending files, or receiving and sending emails. In the field of information security, authorization refers to the resource owner granting a specific subject (executor) the permission to perform specific operations on a resource object; the scope and method of authorization are determined by the resource owner. Access control mechanisms, on the other hand, are used to monitor and restrict the behavior of users and make corresponding decisions upon receiving access requests, such as denying access, granting permission, or prohibiting certain operations.

[0021] There are generally four main access control models, each with its own unique way of managing access to sensitive information: 1. Custom Access Control (DAC) In the DAC model, each object in the system has an owner, who grants access permissions to other users based on their own judgment and needs. DAC provides a flexible control method, allowing resource access permissions to be adjusted according to specific circumstances.

[0022] 2. Mandatory Access Control (MAC) In the MAC model, access permissions are not determined by the resource owner, but are controlled by a central authorized authority according to predetermined security policies. Users can only access certain resources after review and approval.

[0023] 3. Role-Based Access Control (RBAC) RBAC grants access permissions based on a user's role within the organization. Each role is associated with specific permissions, and users gain access to resources according to their roles. RBAC typically manages access to resources such as database tables, columns, and cells, and works closely with Access Control Lists (ACLs).

[0024] 4. Attribute-based access control (ABAC) ABAC relies on various attributes of users, resources, operations, and the environment to determine whether to grant access permissions. Unlike RBAC, ABAC considers more dimensions of attributes than just the user's role.

[0025] However, the aforementioned access control model still has certain limitations when it comes to precisely controlling metadata operations. In particular, it cannot meet more precise access requirements when granular control is needed down to each operation level.

[0026] Due to the sheer volume of data, setting different management strategies for each data field would result in a management workload far exceeding the storage of the data itself. Metadata management can provide a solution.

[0027] Metadata management is a core component of big data, encompassing not only the description and organization of the data itself but also the tasks of tracking data changes, ensuring data quality, and improving data usability. Metadata is descriptive information about data; essentially, it's "data" about the data itself—an abstract description of the data's attributes, structure, and relationships. Metadata can be understood as the smallest unit of data. Through metadata, we can understand and manage data elements (e.g., name, size, data type), structure (e.g., fields, data columns), and related information (e.g., location, owner).

[0028] For example, metadata in a library is similar to a book catalog. Libraries manage their collections through catalogs containing information such as book name, number, author, subject, description, and location, helping librarians manage and quickly find books. Metadata plays a similar role in data management as a library catalog, helping data administrators manage and query data. Metadata permeates the entire data flow process in a big data platform and mainly includes data source metadata, data processing metadata, data warehouse or data subject repository metadata, data application layer metadata, and data interface service metadata.

[0029] Based on different application areas and functions, metadata can be divided into three main categories: business metadata, technical metadata, and management metadata.

[0030] Business metadata describes the business meaning and rules of the data. Clear business metadata helps business personnel understand the actual application scenarios of the data and improves data usability.

[0031] Technical metadata describes the structure, storage method, and transmission rules of data, facilitating the identification, storage, transmission, and exchange of data by computers or databases. Technical metadata provides developers with detailed information about data structure and storage, supporting application development and system integration. Simultaneously, technical metadata can also help business personnel quickly find the data they need.

[0032] Management metadata refers to the management attributes of data, including data owner, data governance responsibilities, and data security level. Clearly defining management metadata helps clarify the responsible parties and departments for data management, thus ensuring data security.

[0033] Metadata connects data, data warehouses, and data applications, recording the entire process of data from its generation to its consumption. Metadata provides detailed information about data assets, helping users discover, identify, understand, organize, retrieve, and effectively use data.

[0034] Attribute-Based Encryption (ABE) can be seen as an extension of Identity-Based Encryption (IBE). In Identity-Based Encryption systems, a user's identity is represented by a unique identifier. Attribute-Based Encryption, on the other hand, uses a set of attributes to represent a user's identity, expanding the representation from a single identifier to multiple attributes. Furthermore, attribute-based encryption embeds access control structures into the attribute set, thus enabling public-key cryptography to have access control capabilities for specific attributes and attribute sets. Attribute-Based Encryption (ABE) is an encryption model that achieves encryption and decryption operations by associating ciphertext and a key with a user's attribute set and access control policies. Unlike public-key encryption, ABE ensures that ciphertext can be successfully decrypted only if the user's attribute set satisfies a specific access control policy.

[0035] Based on the above analysis, this specification provides an authorization verification method. First, upon receiving a target operation to be performed on target data, the authorization operation credential is queried based on the target metadata authorization service item corresponding to the target operation to verify the existence of a valid authorization record. Then, if a target metadata operation authorization item matching the target metadata authorization service item is found, authorization verification is performed based on the authorization operation credential and the target metadata authorization operation verification key corresponding to the target metadata authorization service item, obtaining an authorization verification result indicating whether the operation request has been legally authorized. Finally, if the authorization verification result indicates that the authorization verification is successful, operation on the target data based on the target operation is permitted. This mechanism ensures that an operation can only be executed when the target operation matches the corresponding metadata operation authorization item and the verification is successful, thereby effectively managing fine-grained operation authorization control of data, ensuring strict control over data access and operation permissions, and reducing potential security risks.

[0036] This specification provides an embodiment of an authorization verification method. It selects key data attributes and category information from metadata as key metadata and combines this with a set of data operations (including basic operations such as add, delete, modify, and query, as well as processing procedures such as data processing, data anonymization, data watermarking, and data circulation) to form fine-grained data operation access authorization control. Specifically, independent access authorization controls can be set for each operation (such as add, delete, modify, and query) of each key metadata, or centralized authorization management can be implemented for combined operations of multiple key metadata. Each key operation can be equipped with a dedicated authorization verification key, thereby achieving refined data authorization management.

[0037] To ensure system security, the authorization control system incorporates necessary cryptographic techniques. This not only enables fine-grained access control but also ensures the security and effectiveness of the authorization management system. Furthermore, the result of each authorized access is recorded and output to an auditing system or blockchain-based evidence storage platform. This process ensures the immutability and traceability of data operations, thereby further enhancing the transparency and security of data operations.

[0038] This specification provides an authorization verification method. Please refer to [link / reference]. Figure 1 The authorization verification method may include the following steps: S110. Upon receiving a target operation to be performed on the target data, query the authorization operation credential based on the target metadata authorization service item corresponding to the target operation.

[0039] S120. If an authorization operation credential is found to match a target metadata operation authorization item, authorization verification is performed based on the authorization operation credential and the target metadata authorization operation verification key corresponding to the target metadata authorization service item to obtain the authorization verification result.

[0040] S130. If the authorization verification result indicates that the authorization verification is successful, it is permissible to perform operations on the target data based on the target operation.

[0041] Specifically, users are bound to authorized operation credentials. Upon receiving a target operation to be performed on target data, the authorization access control center determines the metadata corresponding to the target data based on the target data to be operated on. Then, based on the target metadata authorization service item associated with the target operation of that metadata, it queries the existing authorized operation credentials on the user side to determine if there is a metadata operation authorization item that matches the target metadata authorization service item. If the query result indicates that there is a metadata operation authorization item in the authorized operation credentials that matches the target authorization service item, that metadata operation authorization item is used as the target metadata operation authorization item, indicating that the user has the corresponding permission to perform the target operation on the target data. However, this permission has security risks, such as possible unauthorized authorization on the user side. Therefore, when a target metadata operation authorization item is found, the legality of the operation authorization needs to be further verified. Authorization verification is performed based on the authorized operation credentials and the target metadata authorization operation verification key corresponding to the target metadata authorization service item to determine whether the operation request has been legally authorized, thereby obtaining the authorization verification result. Only when the authorization verification result indicates that the authorization verification has passed will the operation permission restriction be lifted, allowing the corresponding operation behavior to be performed on the target data according to the specific instructions and requirements of the target operation. This ensures that the entire operation process is carried out safely and orderly within the framework of legal authorization, effectively protects the security and integrity of system data, and prevents unauthorized illegal operations from causing potential damage or leakage risks to the data.

[0042] Conversely, if no matching target metadata operation authorization item is found in the authorization operation credentials, it means that the user does not have the corresponding permission to perform the target operation on the target data, and the user will be prohibited from performing the target operation on the target data.

[0043] It should be noted that when the authorization verification result indicates that the authorization verification has passed, the user's operation on the target data according to the target operation will be recorded in the log or integrated with the audit system to enable traceability and review of the operation behavior. Moreover, when the target operation on the target data triggers the generation of new metadata, such as adding new database tables, it will be updated in a timely manner, and corresponding metadata authorization operation verification keys will be assigned to the possible new metadata and metadata authorization service items to ensure that the authorization management of the entire system is always in an effective and complete state.

[0044] In the above implementation, firstly, upon receiving a target operation to be performed on target data, the authorization operation credential is queried based on the target metadata authorization service item corresponding to the target operation to verify the existence of a valid authorization record. Then, if a target metadata operation authorization item matching the target metadata authorization service item is found, authorization verification is performed based on the authorization operation credential and the target metadata authorization operation verification key corresponding to the target metadata authorization service item, obtaining an authorization verification result indicating whether the operation request has been legally authorized. Finally, if the authorization verification result indicates that the authorization verification has passed, operation on the target data based on the target operation is permitted. This mechanism ensures that an operation can only be executed when the target operation matches the corresponding metadata operation authorization item and passes verification, thereby effectively managing fine-grained operation authorization control of data, ensuring strict control over data access and operation permissions, and reducing potential security risks.

[0045] In some implementations, please refer to Figure 2 The authorization operation credential also includes a hash identifier and an encrypted identity. Authorization verification is performed based on the authorization operation credential and the target metadata authorization operation verification key corresponding to the target metadata authorization service item to obtain the authorization verification result, which may include the following steps: S210. Based on the target metadata authorization operation verification key and the target metadata operation authorization item, determine the information to be verified.

[0046] S220. Determine the identity to be verified based on the encrypted identity and the information to be verified.

[0047] S230. Based on the identity to be verified and random parameters, determine the hash identifier to be verified.

[0048] S240. Compare the hash identifier to be verified with the hash identifier to obtain the authorization verification result.

[0049] Specifically, the authorized access control center maintains a metadata authorization operation verification key corresponding to each applicable metadata authorization service item for each metadata. Therefore, based on the target data of the target operation, the authorized access control center determines the metadata corresponding to that target data, and then, based on the target metadata authorization service item corresponding to the target operation of that metadata, finds and determines the corresponding target metadata authorization operation verification key. Next, based on established mathematical relationships and encryption algorithm principles, the authorized access control center performs a decryption operation using the target metadata authorization operation verification key and the target metadata operation authorization item to obtain the information to be verified. Subsequently, the encrypted identity is divided by the obtained information to be verified to calculate the identity to be verified. Then, the identity to be verified and a pre-set random parameter are used as input to perform a hash operation using a hash function to generate a hash identifier to be verified. Since the hash identifier to be verified is calculated based on information provided by the user, and this information may be forged, the calculated hash identifier to be verified is compared with a hash identifier provided by a trusted source. Based on whether the two match, the final authorization verification result is obtained to determine whether the target operation has passed authorization verification and can be executed.

[0050] For example, target metadata authorization service item There is a corresponding target metadata authorization operation verification key. Authorize operation verification key based on target metadata. and target metadata operation authorization items Calculations are performed to obtain the information to be verified. = = ,in, Use a random number. Encrypt identity. With the obtained information to be verified Perform a division operation to calculate the identity to be verified. Next, the identity to be verified... With preset random parameters As input, a hash operation is performed using a specific one-way hash function to generate a hash identifier to be verified. .

[0051] In the above implementation, the information to be verified is determined based on the target metadata authorization operation verification key and the target metadata operation authorization item; the identity to be verified is determined based on the encrypted identity and the information to be verified; the hash identifier to be verified is determined based on the identity to be verified and random parameters; and the hash identifier to be verified is compared with the hash identifier to obtain the authorization verification result, thereby improving the reliability of the verification.

[0052] In some implementations, comparing the hash identifier to be verified with the hash identifier to obtain the authorization verification result may include: if the hash identifier to be verified is equal to the hash identifier, obtaining an authorization verification result indicating that the authorization verification has passed.

[0053] In some cases, during the authorization verification process, the hash identifier in the authorization credential is calculated based on legitimate and valid information, and therefore has reliability. The hash identifier to be verified, however, is calculated based on information provided by the user. Given that the information provided by the user may be forged, altered, or invalid, it is necessary to determine the legitimacy of the information provided by the user.

[0054] Specifically, the access control center compares the hash identifier to be verified with the hash identifier. When the hash identifier to be verified and the hash identifier are equal, it indicates that the authorization information they are based on is the same and has not been tampered with. This clearly proves that the target metadata operation authorization item in the authorization operation credential was generated through a legitimate process and that its content conforms to the established authorization specifications, thus possessing legitimacy. Based on this, an authorization verification result indicating that the authorization verification has passed can be obtained, thereby allowing the execution of the corresponding authorization operation.

[0055] For example, if the hash identifier to be verified Hash identifier This will give you an authorization verification result indicating that the authorization verification has passed.

[0056] In the above implementation, when the hash identifier to be verified is equal to the hash identifier, an authorization verification result indicating that the authorization verification has passed is obtained, thereby improving the security of the system.

[0057] In some implementations, comparing the hash identifier to be verified with the hash identifier to obtain the authorization verification result may include: if the hash identifier to be verified is not equal to the hash identifier, obtaining an authorization verification result indicating that the authorization verification has failed.

[0058] Specifically, the access control center compares the hash identifier to be verified with the hash identifier. When the hash identifier to be verified and the hash identifier are not equal, it indicates that there is a difference in the authorization information corresponding to the two. That is, the target metadata operation authorization item in the authorization operation credential was not generated by a legitimate authorization process, and its content does not conform to the pre-set authorization specifications. Therefore, the target metadata operation authorization item can be determined to be illegal. Based on this, an authorization verification result indicating that the authorization verification has failed can be obtained, thus disallowing the execution of the corresponding authorization operation.

[0059] For example, if the hash identifier to be verified Hash identifier This will give you an authorization verification result indicating that the authorization verification has passed.

[0060] In the above implementation, if the hash identifier to be verified is not equal to the hash identifier, an authorization verification result indicating that the authorization verification has failed is obtained, which effectively prevents the execution of illegal operations and ensures the security and stability of the system.

[0061] In some implementations, please refer to Figure 3 Before performing the target operation on the target data, the method may further include the following steps: S310. Upon receiving a user authentication operation, receive the user's unique identifier and the metadata authorization service item corresponding to the user's operable metadata, which allows the execution of data operations, and determine the random parameters.

[0062] S320: Generate an authorization operation credential based on the user's unique identifier, metadata authorization service items, random parameters, and initialization data.

[0063] Specifically, each user has a unique identifier to clearly confirm their specific identity, as well as metadata authorization service items corresponding to the user's operable metadata, allowing them to perform data operations. These define the scope of specific operation permissions the user can perform on the metadata, identifying the types of data operations the user can perform on the metadata, such as read, modify, and delete. Upon receiving a user authentication request, the key generation center first receives the user's unique identifier and the metadata authorization service items corresponding to the user's operable metadata as input. Simultaneously, the key generation center randomly selects data within a pre-defined range and uses this data as a random parameter to enhance the security and reliability of subsequent encryption processes. Next, using the user's unique identifier and random parameters as input elements, a hash function is used to perform a hash operation to generate a hash identifier. Using the user's unique identifier, random parameters, and initialization data as input for the encryption operation, an encryption algorithm is used to encrypt the data, generating an encrypted identity. Based on the metadata authorization service items, using the random parameters and initialization data, a corresponding metadata operation authorization item is generated using an appropriate algorithm. Finally, the key generation center integrates the generated hash identifier, encrypted identity, and metadata operation authorization items to form an authorization operation credential, which is then sent to the user. In addition, the key generation center also sends the user's unique identifier and random parameters to the authorization access control center. It should be noted that the random parameters are not fixed; they are regenerated each time a user authentication operation is initiated. There can be multiple random parameters or just one. The values ​​of the random parameters are only known to the key generation center and the authorization access control center, effectively preventing users from using known parameter information to forge authorization operation credentials.

[0064] For example, taking the dynamic provision of authorization credentials as an example, assuming the user's unique identifier is... The user's unique identifier can be a string or a number, and the user's access permission policy can only perform one type of data operation on a single piece of data. The metadata authorization service item is the first... Item operation. In Random parameters are extracted from the domain and random parameters The authorization operation certificate is calculated using the following formula:

[0065] in, For hash identifier, To encrypt identity, Authorization items for metadata operations, For metadata authorization service items, , To initialize data, It is a one-way function. This is a connector.

[0066] Assuming the user's unique identifier is The user's access permission policy has several sets of operations for different metadata items, and the metadata authorization service items are set {1, 3, 7}. Random parameters are extracted from the domain and random parameters The authorization operation certificate is calculated using the following formula:

[0067] It should be noted that dynamically providing users with authorization credentials for data operations based on their access permission policies is a flexible and secure approach, suitable for scenarios requiring fine-grained access control based on user attributes, operating environment, and resource attributes. Alternatively, authorization credentials for data operations can be provided statically. The static approach is suitable for scenarios where user identities and data operations are relatively fixed and remain unchanged over a long period.

[0068] In the above implementation, upon receiving a user authentication operation, the system receives the user's unique identifier and the metadata authorization service item corresponding to the user's operable metadata, which allows the execution of data operations, and determines random parameters. Based on the user's unique identifier, the metadata authorization service item, the random parameters, and the initialization data, an authorization operation credential is generated to improve security.

[0069] In some implementations, please refer to Figure 4 The initialization data can be determined in the following ways: S410. Based on the metadata and the metadata authorization service items applicable to the metadata, determine the privacy parameter and the feature value corresponding to each applicable metadata authorization service item for each metadata.

[0070] S420. Based on the private parameters and the corresponding feature values ​​of each applicable metadata authorization service item for each metadata, determine the metadata authorization operation verification key corresponding to the non-private parameters and each applicable metadata authorization service item for each metadata.

[0071] S430. Based on the private parameter, the feature value corresponding to each applicable metadata authorization service item for each metadata, the non-private parameter, and the metadata authorization operation verification key corresponding to each applicable metadata authorization service item for each metadata, determine the initialization data.

[0072] Among them, metadata authorization service items can be various data operation items used to digitally represent metadata. Data operation items can include not only add, delete, modify, and query operations, but also data processing, data desensitization, data watermarking, data circulation, etc.

[0073] Specifically, data attribute information and category information are used as metadata, and the allowed data operations for each metadata are clearly defined. These data operations are then represented digitally to obtain each applicable metadata authorization service item for each metadata. The key generation center maps the metadata to its applicable metadata authorization service items, determining the characteristic value corresponding to each applicable metadata authorization service item for each metadata. This allows for fine-grained data operation access control, precise control over different operation permissions for different metadata. The key generation center randomly selects data within a pre-defined range, using this data as a basis for determining privacy parameters. Based on the determined privacy parameters and the corresponding characteristic values ​​for each applicable metadata authorization service item for each metadata, an independent metadata authorization operation verification key is further determined for each applicable metadata authorization service item for each metadata. This ensures the uniqueness and independence of each metadata authorization operation verification key, guaranteeing the security and accuracy of data operations. Furthermore, non-private parameters are determined based on the privacy parameters and the corresponding characteristic values ​​for each applicable metadata authorization service item for each metadata.

[0074] The private parameters, the feature value corresponding to each applicable metadata authorization service item for each metadata element, the non-private parameters, and the metadata authorization operation verification key corresponding to each applicable metadata authorization service item for each metadata element are integrated to form the initialization data, which is used for subsequent data operation authorization and verification processes. It should be noted that the private parameters remain fixed after they are determined.

[0075] In some implementations, the metadata authorization operation verification key can be sent to the authorization access control center or distributed to multiple authorization management units, each responsible for different categories of metadata. This enables fine-grained access authorization management for data operations on each piece of metadata, or flexible access authorization management for single data operations or combinations of operations.

[0076] For example, first, select metadata (assuming...) (item), count all data operation items (assuming) (Several operations). Since some metadata is not applicable to all data operations in practice, theoretically, a maximum of [number] operations can be formed. This involves using matrix combinations to correspond to the relationships between these metadata and data operations. Randomization algorithms can be employed to... The matrix can be randomized or directly input into the key generation center to be mapped into metadata authorization service items.

[0077] After randomization Matrix mapping to Within the domain, obtain Integers in the field As 1 eigenvalue, and satisfy ,in Each corresponds to a specific applicable metadata authorization service item for each piece of metadata. Randomly select an integer from the domain This is used as a private parameter.

[0078] Secondly, let A prime number of order The bilinear group, let for The generator. Furthermore, let This represents a bilinear mapping.

[0079] Then, based on the above settings and elements, the following calculations are obtained: , ... , As a non-private parameter.

[0080] The metadata authorization operation verification key for each applicable metadata authorization service item for each metadata is as follows: , ... .

[0081] In the above implementation, based on metadata and the applicable metadata authorization service items, the feature values ​​corresponding to the private parameters and each applicable metadata authorization service item for each metadata are determined. Based on the feature values ​​corresponding to the private parameters and each applicable metadata authorization service item for each metadata, the metadata authorization operation verification key corresponding to the non-private parameters and each applicable metadata authorization service item for each metadata is determined. Based on the private parameters, the feature values ​​corresponding to each applicable metadata authorization service item for each metadata, the non-private parameters, and the metadata authorization operation verification key corresponding to each applicable metadata authorization service item for each metadata, the initialization data is determined, thereby realizing refined data operation authorization management and effectively achieving fine-grained operation authorization management of data assets.

[0082] In some implementations, the authorization operation credential also includes an authorized access frequency. If the authorization verification result indicates that the authorization verification is successful, operations on the target data based on the target operation are allowed. This may include: if the authorization verification result indicates that the authorization verification is successful, operations on the target data based on the target operation are allowed with the authorized access frequency as a constraint.

[0083] Specifically, the authorization operation credentials also include the authorized access frequency. The main function of this authorized access frequency is to limit the number of times a user can perform a target operation on the target data, thereby achieving fine-grained access control. When the authorization verification result indicates successful authorization, the authorized access frequency will implement corresponding constraint control mechanisms on the user's operation behavior based on pre-set specific rules and parameters. Each time a user performs an operation on the target data based on the target operation, it will be checked in real time whether the number of operations already performed has reached the threshold set by the authorized access frequency. As long as the cumulative number of operations has not yet met the limit of the authorized access frequency, the user can perform the corresponding operation normally. However, if the number of times the user performs the target operation on the target data reaches the limit specified by the authorized access frequency, the user will be automatically prohibited from continuing to operate on the target data based on that target operation. If the user still needs to perform the corresponding target operation on the target data in the future, the authorization operation verification process must be re-initiated.

[0084] For example, when generating an authorization credential that uniquely identifies a user as an ID, it is necessary to... Randomly select integers from the domain If the authorized access frequency is 1, the authorized access frequency ( , , ), by setting This constraint limits the number of times target data can be manipulated based on the target operation. This model aligns with the zero-trust concept, which requires separate authorization verification for each operation to ensure the legality and security of each operation. Similar to a one-time password high-security mechanism, it can effectively prevent unauthorized multiple accesses or operations, and protect the security and stability of data and systems.

[0085] In addition, the validity of authorized operation credentials can be controlled by maintaining a usage cycle, i.e., constructing ( , , ), by setting The specific value determines the validity period of the authorization credential. Within this period, the user can operate on the target data based on the target operation. Once the validity period expires... The set time range requires re-authorization verification to ensure fine-grained management and control of user operation permissions over time, thereby further enhancing the system's security and reliability.

[0086] When the authorized access frequency is 1, the authorized operation credential can be represented as:

[0087] in, It is a one-way function. For random parameters, That is, in the authorization certificate The specific value.

[0088] In the above implementation, when the authorization verification result indicates that the authorization verification is successful, the target data is allowed to be operated on based on the target operation with the authorization access frequency as a constraint. By setting the authorization access frequency, security is improved.

[0089] This specification provides an authorization verification system, which includes an authorization access control center and a key generation center, and implements the steps of any of the above methods.

[0090] This specification provides an authorization verification device 500. Please refer to [link / reference]. Figure 5 The authorization verification device 500 includes: an authorization operation credential query module 510, a target operation authorization verification module 520, and a permission authorization control module 530.

[0091] The authorization operation credential query module 510 is used to query the authorization operation credential based on the target metadata authorization service item corresponding to the target operation when a target operation is received for the target data. The target operation authorization verification module 520 is used to perform authorization verification based on the authorization operation credential and the target metadata authorization operation verification key corresponding to the target metadata authorization service item when the authorization operation credential is found to have a target metadata operation authorization item that matches the target metadata authorization service item, and to obtain the authorization verification result. The permission authorization control module 530 is used to allow operations on the target data based on the target operation when the authorization verification result indicates that the authorization verification is successful.

[0092] For a detailed description of the authorization verification device, please refer to the description of the authorization verification method above, which will not be repeated here.

[0093] In some embodiments, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 6 As shown, the computer device includes a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements an authorization verification method. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0094] Those skilled in the art will understand that Figure 6 The structures shown are merely block diagrams of some structures related to the solutions disclosed in this specification, and do not constitute a limitation on the computer device to which the solutions disclosed in this specification are applied. Specifically, the computer device may include more or fewer components than shown in the figures, or combine certain components, or have different component arrangements.

[0095] In some embodiments, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method steps described above.

[0096] This specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method in any of the above embodiments.

[0097] One embodiment of this specification provides a computer program product including instructions that, when executed by a processor of a computer device, enable the computer device to perform the steps of the method described in any of the above embodiments.

[0098] It should be noted that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

Claims

1. An authorization verification method, characterized in that, The method includes: When the key generation center receives a user data operation authentication request, it receives the user's unique identifier and the metadata authorization service item corresponding to the user's operable metadata, which allows the execution of data operations, and determines random parameters. The key generation center will obtain data by random sampling within a pre-set range and use it as random parameters. The key generation center will then send the user's unique identifier and the random parameters to the authorized access control center. The key generation center determines the privacy parameter and the feature value corresponding to each applicable metadata authorization service item for each metadata based on the metadata and the metadata authorization service item to which the metadata is applicable; The key generation center determines the metadata authorization operation verification key corresponding to the non-private parameters and each applicable metadata authorization service item of each metadata based on the corresponding feature value of the private parameters and each applicable metadata authorization service item of each metadata. The key generation center determines the initialization data based on the private parameters, the feature value corresponding to each applicable metadata authorization service item of each metadata, the non-private parameters, and the metadata authorization operation verification key corresponding to each applicable metadata authorization service item of each metadata. The key generation center generates an authorization operation credential based on the user's unique identifier, the metadata authorization service item, the random parameter, and the initialization data, and sends the authorization operation credential to the user side. The authorization operation credential includes a hash identifier, an encrypted identity, and a metadata operation authorization item. When the authorized access control center receives a target operation to be performed on the target data, it queries the authorized operation credentials that already exist on the user side based on the target metadata authorization service item corresponding to the target operation. When the authorized access control center finds that the authorized operation credential matches the target metadata operation authorization service item, it determines that the user has the permission to perform the target operation on the target data, and further verifies the legality of the operation authorization, including: The authorized access control center determines the information to be verified based on the target metadata authorization operation verification key corresponding to the target metadata authorization service item and the target metadata operation authorization item. The metadata authorization operation verification key is sent to the authorized access control center through the management unit. The authorized access control center determines the identity to be verified based on the encrypted identity and the information to be verified. The authorized access control center determines the hash identifier to be verified based on the identity to be verified and the random parameters. The authorized access control center compares the hash identifier to be verified with the hash identifier to obtain the authorization verification result; If the authorization verification result indicates that the authorization verification is successful, the target operation is determined to be authorized, and operation on the target data is permitted based on the target operation.

2. The method according to claim 1, wherein comparing the hash identifier to be verified with the hash identifier to obtain the authorization verification result includes: If the hash identifier to be verified is equal to the hash identifier, the authorization verification result indicating that the authorization verification has passed is obtained; If the hash identifier to be verified is not equal to the hash identifier, the authorization verification result indicating that the authorization verification failed is obtained.

3. The method according to claim 1, characterized in that, The authorization operation credential also includes an authorized access frequency. The step of allowing operations on the target data based on the target operation when the authorization verification result indicates that the authorization verification is successful includes: If the authorization verification result indicates that the authorization verification is successful, the target data is allowed to be operated on based on the target operation, with the authorized access frequency as a constraint.

4. An authorization verification system, characterized in that, The authorization verification system includes an authorization access control center and a key generation center, and the authorization verification system implements the steps of the method according to any one of claims 1 to 3.

5. An authorization verification device, characterized in that, The device is used by a key generation center to receive a user's unique identifier and metadata authorization service items corresponding to the user's operable metadata, allowing data operations, and determine random parameters when a user authentication operation is received. Specifically, the key generation center obtains data through random sampling within a pre-defined range and uses it as the random parameter. The key generation center then sends the user's unique identifier and the random parameter to the authorized access control center. Based on the metadata and the applicable metadata authorization service items, the key generation center determines a private parameter and a feature value corresponding to each applicable metadata authorization service item for each metadata element. The key generation center then determines the private parameter and the feature value corresponding to each applicable metadata authorization service item for each metadata element. The device comprises: determining the corresponding feature value, and determining the metadata authorization operation verification key corresponding to the non-private parameter and each applicable metadata authorization service item for each metadata; the key generation center determines the initialization data based on the private parameter, the feature value corresponding to each applicable metadata authorization service item for each metadata, the non-private parameter, and the metadata authorization operation verification key corresponding to each applicable metadata authorization service item for each metadata; the key generation center generates an authorization operation credential based on the user's unique identifier, the metadata authorization service item, the random parameter, and the initialization data, and sends the authorization operation credential to the user side, wherein the authorization operation credential includes a hash identifier, an encrypted identity, and a metadata operation authorization item; the device includes: The authorization operation credential query module is used by the authorization access control center to query the existing authorization operation credential on the user side based on the target metadata authorization service item corresponding to the target operation when it receives a target operation to be performed on the target data. The target operation authorization verification module is used by the authorization access control center to determine that the user has the authority to perform a target operation on target data when the authorization operation credential matches the target metadata authorization service item, and further verify the legality of the operation authorization. This includes: the authorization access control center determining the information to be verified based on the target metadata authorization operation verification key corresponding to the target metadata authorization service item and the target metadata operation authorization item, wherein the metadata authorization operation verification key is sent to the authorization access control center through the management unit; the authorization access control center determining the identity to be verified based on the encrypted identity and the information to be verified; the authorization access control center determining the hash identifier to be verified based on the identity to be verified and random parameters; and the authorization access control center comparing the hash identifier to be verified with the hash identifier to obtain the authorization verification result. The permission authorization control module is used to allow operations on the target data based on the target operation if the authorization verification result indicates that the authorization verification is successful.

6. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 3.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 3.

Images