Method, system and product for traceable access control based on provenance data

Abstract

The invention discloses a traceable access control method, a traceable access control system and a traceable access control product based on provenance data, firstly, a user sends an access request to a strategy execution point, and then a strategy decision point loads a related access strategy from a strategy management point. And then the strategy decision point obtains related attribute information of the request data through the strategy information point, and the provenance data strategy decision point evaluates whether the access request accords with the allowable purpose according to the loaded strategy and data source information. And if a plurality of strategies are involved, the strategy decision point merges the target set by using strategy algebra, and the strategy decision point makes an access decision according to an evaluation result. Then, the strategy decision point sends a decision result to the strategy execution point, the strategy execution point executes an access control decision and allows or rejects a user request, and finally, the block chain records the access request and result of the user, so that whole-course traceability of an access behavior is realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of data security and privacy protection, and relates to a traceable access control method, system and product, in particular to a purpose-oriented traceable fine-grained access control method and system based on lineage data. Background Art

[0002] In the wide application of the industrial Internet, the security and privacy protection of data have become the core concerns. Data lineage, as the key information recording the origin, generation process and transformation history of data, is of great significance for ensuring the traceability and security of data. However, traditional access control policies often only make permission judgments based on the static attributes of data or user identities, and cannot fully consider the dynamic and rich context information contained in data lineage.

[0003] To solve this problem, the industry has begun to explore access control methods based on data lineage. In this method, the access permissions of data not only depend on the static characteristics of the data or user identities, but also closely combine the lineage information of the data. By deeply analyzing the generation, propagation and transformation processes of data, the sensitivity and access risks of data can be judged more accurately, so as to formulate more reasonable access control policies.

[0004] Blockchain was initially favored by technology enthusiasts and the cryptocurrency community, and then attracted much attention with the introduction of smart contracts by Ethereum, and its application prospects have been greatly expanded. Nowadays, blockchain plays an important role in industries such as finance, supply chain management, Internet of Things, and identity authentication, improving transparency and efficiency. Its distributed, immutable, consensus mechanism and decentralized characteristics have attracted the attention of scholars. The access control mechanism combined with blockchain is in the rising stage of research, has been applied in many fields, and still has room for improvement and broad application scenarios. Summary of the Invention

[0005] The purpose of the present invention is to provide a purpose-oriented traceable fine-grained access control method, system and product based on lineage data, which uses a lineage data graph to achieve fine-grained access control, and at the same time uses blockchain to record the access situation to achieve a traceable effect.

[0006] The technical solution adopted by the method of the present invention is: a traceable access control method based on lineage data, characterized by including the following steps:

[0007] Step 1: A user sends a request to access data to a Policy Enforcement Point (PEP), including the data identifier that the requester hopes to access and the access purpose, and the Policy Enforcement Point (PEP) forwards the received access request to a Policy Decision Point (PDP) for processing;

[0008] Step 2: The Policy Decision Point (PDP) loads the relevant access policies from the Policy Administration Point (PAP).

[0009] Step 3: The Policy Decision Point (PDP) collects the attribute information required for policy evaluation from the Policy Information Point (PIP) through the Context Handler (CH), including subject information, environmental information, and lineage partition information.

[0010] Step 4: The Policy Decision Point (PDP) evaluates the access request based on the obtained access policies and the collected attribute information to determine whether the requested access purpose is permitted.

[0011] If there are multiple policies in the system, the Policy Decision Point (PDP) uses policy algebra to merge the purpose sets generated by these policies to determine the ultimately permitted access purposes.

[0012] Step 5: The Policy Decision Point (PDP) generates the final access decision by synthesizing the evaluation results and the purpose set after policy algebra operations; and records the decision and access information on the blockchain.

[0013] Step 6: The Policy Decision Point (PDP) sends the access decision result to the Policy Enforcement Point (PEP) to execute the access control decision and allow or deny the user's access request.

[0014] Preferably, the lineage data in Step 1 is a lineage graph, indicating how an object is derived. Each attribute node V contains an attribute item and an attribute value, and these attribute nodes are divided into proxy-related attributes, process-related attributes, and artifact-related attributes.

[0015] Preferably, the access policy in Step 2 maps attributes to permitted and prohibited purpose sets, and the lineage data records the data generation process in the form of a directed acyclic graph.

[0016] Specifically, it includes the following sub-steps:

[0017] Step 2.1: Initialize the permitted purpose set A allowed,i and the prohibited purpose set A prohibited,i of each policy as empty sets.

[0018] Step 2.2: Traverse each policy p i ∈P, and generate the permitted and prohibited purpose sets A i and A i of policy p allowed,i and A prohibited,i according to policy p

[0019] and the lineage graph G.

[0020] Preferably, in step 3, the lineage partition is a connected subgraph contained in the lineage graph; the lineage partition is represented as {(V type1 , V name1 ), (V type2 , V name2 , a2, f2)...}, where V typei is the vertex type, V namei is the vertex name, a i is the attribute value, f i is the binary predicate, i = 1, 2, 3,..., N, and N is the number of graph nodes.

[0021] Preferably, in step 3, the lineage partition information is retrieved by the context processor CH and sent to the policy decision point PDP for generating the access purpose.

[0022] Preferably, in step 4, the access request is evaluated to check whether the lineage data in the request meets the conditions defined in the policy, including whether certain operations are performed by a specific subject and whether it is generated at a specific time or in a specific environment.

[0023] Preferably, in step 4, the policy decision point PDP uses different operators to merge the high-sensitivity and low-sensitivity purpose sets according to the different sensitivity levels of the purposes.

[0024] Preferably, the purpose is a multi-level purpose, and the purpose sensitivity increases gradually from top to bottom to ensure the fine-grainedness and flexibility of access control; the purposes with different sensitivities are organized in the form of a directed acyclic graph, each node represents an access purpose, and the edge represents the hierarchical relationship between the purposes, and the increase in sensitivity is represented from top to bottom.

[0025] The technical solution adopted by the system of the present invention is: a traceable access control system based on lineage data, including a dynamic management access control module and a lineage data-based purpose-oriented module;

[0026] The dynamic management access control module includes a policy administration point (PAP), a policy decision point (PDP), a policy enforcement point (PEP), a policy information point (PIP), and a context processor (CH). The PAP is used to generate and manage access control policies and send the policies to the PDP. The PIP is used to collect context information related to access requests and send the information to the PDP. The PDP is used to evaluate user access requests based on the policies received from the PAP and the context information obtained from the PIP, determine whether the requested access purpose meets the policy requirements, and generate an access decision. The PEP is used to receive user access requests and forward the requests to the PDP. Based on the PDP's decision, the PEP performs access control operations to allow or deny the user's access request. The CH is used to collect, process, and forward context information related to access requests so that the PDP can make accurate access decisions.

[0027] The purpose-oriented module based on lineage data is used to manage lineage data and formulate access strategies according to the purpose of data use, including a submodule for generating a lineage graph, a submodule for generating a purpose set based on the access strategy submodule and the lineage graph, and a submodule for purpose evaluation.

[0028] The technical solution adopted by the product of the present invention is: a traceable access control product based on lineage data, including computer program instructions. When the computer program instructions are run on a computer, the computer executes the traceable access control method based on lineage data.

[0029] Compared with the prior art, the effective benefits of the present invention include:

[0030] 1. The present invention is based on the purpose-based access control paradigm (PBAC) and incorporates access constraints of provenance data into it. This method makes full use of purpose-based access control and the expressiveness of provenance data, and proposes an innovative dynamic permission access control method based on provenance data. In this method, provenance data is not only used to consider the data generation process and historical operations in access decisions, but also to guide the determination of the access policy that should be followed when accessing data. This not only determines whether the user has the right to access the data, but also ensures that the access purpose is consistent with the preset policy. By using policy algebra, this method can handle different levels of purpose, thereby ensuring the sophistication and accuracy of access decisions.

[0031] 2. This invention combines blockchain with an access control model. Whenever a user initiates an access request, the request and the resulting decision are recorded on the blockchain. This approach not only provides system administrators with convenient query and traceability, but also ensures the authenticity and integrity of the records by leveraging the inherent immutability of blockchain. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The technical solution of the present invention is further illustrated below using embodiments and specific implementation methods. In addition, some drawings are also used in the process of illustrating the technical solution. For those skilled in the art, other drawings and the intention of the present invention can be obtained based on these drawings without making any creative efforts.

[0033] Figure 1 is a flow chart of a method according to an embodiment of the present invention;

[0034] Figure 2 Schematic diagram of the method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0035] In order to facilitate ordinary technicians in this field to understand and implement the present invention, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the implementation examples described herein are only used to illustrate and explain the present invention and are not used to limit the present invention.

[0036] The technologies involved in this embodiment include the following aspects:

[0037] (1) Recording and Representation of Data Lineage: In the Industrial Internet scenario, data lineage is usually represented in the form of a directed acyclic graph (DAG), which records key information such as the source, generation process, and transformation history of the data. This information provides rich context for formulating access control policies.

[0038] (2) Purpose-oriented access policy: Unlike traditional access control policies based on user identity or data attributes, the method proposed in this paper is guided by the purpose of data use and defines a set of permitted or prohibited access purposes. This requires the system to accurately identify the lineage information of the data and determine the access rights of the data based on predefined access policies.

[0039] (3) Application of Data Algebra: To effectively merge and process different access policies, this paper introduces a data algebra approach. By defining a series of basic data algebra operators, operations such as merging, intersection, and union of target sets can be performed to generate the final access control policy.

[0040] (4) Use of blockchain: To further enhance data security and immutability, this invention combines blockchain technology with an access control model. Every time a user initiates an access request, the request and its final decision are recorded on the blockchain. The distributed ledger nature of the blockchain ensures transparency and immutability of the records, providing system administrators with convenient query and traceability methods.

[0041] This embodiment first provides a traceable access control system based on pedigree data, including a dynamic management access control module and a purpose-oriented module based on pedigree data;

[0042] The dynamic management access control module includes a Policy Administration Point (PAP), a Policy Decision Point (PDP), a Policy Enforcement Point (PEP), a Policy Information Point (PIP), and a Context Handler (CH); the PAP is used to generate and manage access control policies and send the policies to the PDP; the PIP is used to collect context information related to the access request, such as user identity, request time, requested resource, etc., and send this information to the PDP; the PDP is used to evaluate the user's access request according to the policy received from the PAP and the context information obtained from the PIP, determine whether the requested access purpose meets the policy requirements, and generate an access decision; the PEP is used to receive the user's access request, forward the request to the PDP, and perform access control operations according to the decision of the PDP, allowing or denying the user's access request; the CH is used to collect, process, and forward context information related to the access request so that the PDP can make an accurate access decision;

[0043] The purpose-oriented module based on pedigree data is used to manage pedigree data and formulate access policies according to the purpose of data use, including a pedigree diagram generation sub-module, a purpose set generation sub-module based on the access policy sub-module and the pedigree diagram, and a purpose evaluation sub-module.

[0044] Based on the above system, see Figure 1 and Figure 2 , this embodiment also provides a traceable access control method based on pedigree data, including the following steps:

[0045] Step 1: The user sends a request to access data to the Policy Enforcement Point (PEP). The request contains the data identifier that the requester hopes to access and the access purpose. The Policy Enforcement Point (PEP) forwards the received access request to the Policy Decision Point (PDP) for processing;

[0046] In one embodiment, the lineage data in step 1 is a lineage graph, which represents how an object is derived. Each attribute node V contains an attribute item and an attribute value. These attribute nodes are divided into agent-related attributes, process-related attributes, and artifact-related attributes.

[0047] Step 2: The Policy Decision Point (PDP) loads relevant access policies from the Policy Administration Point (PAP).

[0048] In one embodiment, the access policy in step 2 maps attributes to sets of allowed and prohibited purposes, and the lineage data records the data generation process in the form of a directed acyclic graph.

[0049] Specifically, it includes the following sub-steps:

[0050] Step 2.1: Initialize the allowed purpose set A allowed,i and the prohibited purpose set A prohibited,i as empty sets;

[0051] Step 2.2: Traverse each policy p i ∈P, and generate the allowed and prohibited purpose sets A i and A i of policy p allowed,i and A prohibited,i according to policy p

[0052] and the lineage graph G;

[0053] In one embodiment, the Open Provenance Model Plus (OPM+) is adopted. OPM+ is a triple structure consisting of a vertex type T, a relationship label L, and a labeled directed acyclic graph G. The vertex type T includes four types: Agent, Artifact, Process, and Attribute. An Agent is the entity that triggers and executes operations; an Artifact represents data or an object; a Process is an operation performed on data; and an Attribute is the attribute information attached to a vertex. The relationship label L is used to describe the relationships between these vertices, including used, wasGeneratedBy, wasControlledBy, wasTriggeredBy, wasDerivedFrom, and hasAttributes. The directed acyclic graph G consists of a vertex set V and an edge set E, and the edge set E defines the allowed relationships between vertices. In G, context information is also attached as attribute nodes, and each attribute node contains an attribute item and an attribute value. These attribute nodes can be classified into agent-related attributes, process-related attributes, and artifact-related attributes.

[0054] In one embodiment, the evaluation results of atomic policies are represented by a four-value set {1p, 0p, ⊥p, ×p} to reflect in detail the matching degree between the source graph and the policy partition. Specifically, when the source graph fully meets all the attributes specified by the policy partition, the evaluation result outputs 1p, indicating a state of complete matching. If the source graph covers all the vertex type names listed in the partition but does not fully match in terms of attribute values, the evaluation result is 0p at this time, meaning partial matching. Further, if the source graph only matches the partition in terms of vertex type but does not match in terms of vertex name and attributes, the evaluation result is ⊥p, reflecting a lower degree of matching. Finally, if the source graph cannot meet the requirements of the policy partition in any aspect, its evaluation result is ×p, indicating complete non-matching.

[0055] The access purpose P represents the purpose for which the data is accessed. The access policy based on purpose defines a set of allowed and / or prohibited access purposes. The purpose set is represented as an allowed purpose (AP) and a prohibited purpose (PP). AP represents the set of purposes that a user can access, and PP represents the set of purposes that a user is not allowed to access. In the present invention, purposes with different sensitivities are organized in the form of a directed acyclic graph (DAG), called a purpose graph (PG). Each node represents a purpose P, and the nodes are hierarchically displayed in the PG and connected by edges. The relationship between ancestor nodes and descendant nodes is generalization and specialization. The hierarchical structure of purposes is based on the levels at which they are displayed. Purposes closer to the root node are more general, while purposes at the leaf nodes are more specific.

[0056] The set of purposes defined in each access policy is a set of purposes in the PG, denoted as PS. The definition of the set of purposes includes:

[0057] Ancestors(P): denoted as P↑, representing all ancestor nodes of P, including P itself.

[0058] Partial Ancestors(P): denoted as P↑α, representing α ancestor nodes of P, including P itself.

[0059] Descendants(P): denoted as P↓, representing all descendant nodes of P, including P itself.

[0060] Partial Descendants(P): denoted as P↓β, representing β descendant nodes of P, including P itself.

[0061] Representing all ancestor and descendant nodes of P, Step 3: The Policy Decision Point PDP collects the attribute information required for evaluating the policy from the Policy Information Point PIP through the Context Handler CH, including subject information, environmental information, and lineage partition information; the lineage partition information is retrieved by the Context Handler CH and sent to the Policy Decision Point PDP for generating access purposes.

[0062] The lineage partition, as a connected subgraph of G, is used to represent one or more operations in the data generation process. To formulate access policies based on purposes, we define a series of atomic conditions: null condition (nullT); vertex condition (V type ,V name ): where V type is the vertex type and V name is the vertex name; attribute condition (V type ,V name ,a,f): where V is a vertex, a is the attribute value, and f is a binary predicate; query attribute condition (V type ,V name ,x,f): where (V type ,V name ) is a vertex, x is the attribute in the query, and f is a binary predicate. The target is a string representing (V type ,V name ) or (V type ,V name ,a,f) or (V type ,V name ,a,f), expressed using XPath. The lineage partition is defined by an XPath expression and is a set of vertices.

[0063] In one embodiment, in step 3, the lineage partition is a connected subgraph that is a part of the lineage graph; the lineage partition is represented as {(V type1 , V name1 ), (V type2 , V name2 , a2, f2)...}, where V typei is the vertex type, V namei is the vertex name, a i is the attribute value, f i is the binary predicate, i = 1, 2, 3,..., N, and N is the number of graph nodes.

[0064] In one embodiment, this embodiment proposes a purpose-based access policy model that maps the attributes in the data source to the sets of allowed and forbidden access purposes. The lineage data records the data generation process in the form of a directed acyclic graph, and the access policy determines the purposes for which the data can be accessed based on whether the lineage data contains a specific lineage partition.

[0065] Policy Type:

[0066] Policy Type 1{Provenance Partitions→AP}: Maps the data source partitions to the set of allowed access purposes.

[0067] Policy Type 2{Provenance Partitions→PP}: Maps the data source partitions to the set of forbidden access purposes.

[0068] Policy Type 3{Provenance Partitions→AP|PP}: Maps the data source partitions to the sets of allowed and forbidden access purposes.

[0069] Policy Type 4{Provenance Partitions|Data Labels→AP&PP}: Maps the data source partitions and data labels to the sets of allowed and forbidden access purposes.

[0070] Step 4: The Policy Decision Point (PDP) evaluates the access request based on the obtained access policy and the collected attribute information. It checks whether the lineage data in the request meets the conditions defined in the policy, such as whether certain operations were performed by a specific subject, whether it was generated at a specific time or in a specific environment, etc., so as to determine whether the requested access purpose is allowed;

[0071] If there are multiple policies in the system, the Policy Decision Point (PDP) uses policy algebra to merge the sets of purposes generated by these policies. According to the different sensitivity levels of the purposes, different operators are used to merge the sets of purposes with high and low sensitivity levels to determine the finally permitted access purposes.

[0072] In one implementation, the purposes are multi-level purposes. The sensitivity of the purposes increases gradually from top to bottom, ensuring the fine-grainedness and flexibility of access control. The purposes with different sensitivities are organized in the form of a directed acyclic graph. Each node represents an access purpose, and the edges represent the hierarchical relationships between the purposes, with the sensitivity increasing from top to bottom. For example, there is an edge from "View Data" to "Edit Data", indicating that "Edit Data" is a more sensitive form of "View Data".

[0073] Step 5: The Policy Decision Point (PDP) comprehensively evaluates the results and the set of purposes after policy algebra operations to generate the final access decision.

[0074] Step 6: The Policy Decision Point (PDP) sends the access decision result to the Policy Enforcement Point (PEP) to execute the access control decision and allow or reject the user's access request.

[0075] This embodiment also provides a traceable access control product based on lineage data, including computer program instructions. When the computer program instructions run on a computer, the computer is caused to execute the traceable access control method based on lineage data.

[0076] The following further elaborates on the present invention through specific experiments.

[0077] In this experiment, a simulated industrial Internet environment was constructed, and a traceable access control system based on the present invention was deployed. The system includes a Policy Administration Point (PAP), a Policy Decision Point (PDP), a Policy Enforcement Point (PEP), a Policy Information Point (PIP), and a Context Handler (CH). At the same time, blockchain technology was integrated into the system to record access requests and decision results, and a lineage data management module was designed and implemented to generate and manage lineage graphs to record the data generation process and historical operations.

[0078] Three scenarios were set up in the experiment: Scenario 1 was data sharing and access control, simulating multiple users requesting access to different types of data, where the data had different sensitivity levels, access purposes, and lineage requirements. For example, User A requested to view Data D1 twice for data analysis, and User B requested to edit Data D2 for data correction; Scenario 2 was data security and privacy protection, simulating malicious users attempting to access sensitive data to verify whether the system could accurately identify and reject illegal access requests. For example, User C attempted to access Data D3 for unauthorized data mining; Scenario 3 was the dynamic adjustment of access policies, simulating system administrators dynamically adjusting access policies according to actual situations to verify whether the system could respond and update access control decisions in a timely manner. For example, the administrator adjusted the access purpose of Data D4 from "view" to "edit".

[0079] The user access request data collected in the experiment included: User A requested to access Data D1, the access purpose was "data analysis", and the request time was 2025-03-15 10:00; User A requested to access Data D1, the access purpose was "data analysis", and the request time was 2025-03-15 10:05; User B requested to edit Data D2, the access purpose was "data correction", and the request time was 2025-03-15 10:05; User C requested to access Data D3, the access purpose was "data mining", and the request time was 2025-03-15 10:10; User D requested to view Data D1, the access purpose was "data analysis", and the request time was 2025-03-15 10:15.

[0080] Regarding the access policy data, the allowed purpose set for Data D1 was {"data analysis"}, the prohibited purpose set was empty, and the lineage subgraph requirement was that the data could only be accessed once; the allowed purpose set for Data D2 was empty, the prohibited purpose set was {"data mining"}, and there was no lineage subgraph requirement; the allowed purpose set for Data D3 was empty, the prohibited purpose set was {"data mining"}, and there was no lineage subgraph requirement; the initial allowed purpose set for Data D4 was {"view"}, the prohibited purpose set was empty, and after adjustment, the allowed purpose set was {"edit"}, the prohibited purpose set was empty, and there was no lineage subgraph requirement.

[0081] The experimental results show that the system performs excellently in terms of access control accuracy. In Scenario 1, User A's first access request was permitted, User A's second access request was permitted, and User B's access request was rejected. The system accurately made the correct access decision based on the access purpose and policy. In Scenario 2, the system successfully identified and rejected User C's illegal access request, verifying the effectiveness of the system in data security and privacy protection. In Scenario 3, after the system administrator dynamically adjusted the access policy for Data D4, the system was able to update the access control decision in a timely manner. User D's access request was rejected until the access purpose was adjusted to "edit" and then it was permitted, demonstrating the good adaptability of the system to dynamic policy adjustment.

[0082] In terms of traceability, all users' access requests and their decision results are accurately recorded on the blockchain, including information such as user identity, access time, access purpose, decision results, etc. With the immutable feature of the blockchain, the system administrator can conveniently query and trace access behaviors, ensuring the full traceability of access behaviors.

[0083] The present invention realizes fine-grained control of data access by defining a multi-level set of purposes and algebraic operations on policies. For example, for Data D4, the system can make different access decisions according to different access purposes ("view" and "edit"), ensuring the flexibility and precision of access control.

[0084] The present invention realizes fine-grained control of data lineage by defining purpose-oriented access policies, ensuring that data is only accessed when it meets specific purposes. This not only enhances data security but also improves data availability and flexibility.

[0085] It should be understood that the described embodiments above are some embodiments of the present invention, not all of them. Additionally, the technical features in each embodiment or individual embodiment provided by the present invention can be combined with each other arbitrarily to form a feasible technical solution. This combination is not restricted by the order of steps and / or the structural composition mode, but must be based on what can be achieved by those of ordinary skill in the art. When the combination of technical solutions results in contradictions or cannot be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the protection scope required by the present invention.

[0086] It should be understood that the above description of the preferred embodiments is relatively detailed and should not be construed as a limitation on the protection scope of the present invention's patent. Those of ordinary skill in the art, under the inspiration of the present invention and without departing from the scope protected by the claims of the present invention, can also make substitutions or modifications, all of which fall within the protection scope of the present invention. The scope of protection requested by the present invention shall be subject to the appended claims.

Claims

1. A traceable access control method based on pedigree data, characterized in that, It includes the following steps: Step 1: The user sends a request to access data to the Policy Enforcement Point (PEP), including the data identifier that the requester hopes to access and the access purpose. The Policy Enforcement Point (PEP) forwards the received access request to the Policy Decision Point (PDP) for processing; Step 2: The Policy Decision Point (PDP) loads relevant access policies from the Policy Administration Point (PAP); Step 3: The Policy Decision Point (PDP) collects the attribute information required for evaluating the policy from the Policy Information Point (PIP) through the Context Handler (CH), including subject information, environmental information, and lineage partition information; Step 4: The Policy Decision Point (PDP) evaluates the access request based on the obtained access policies and the collected attribute information to determine whether the requested access purpose is allowed; If there are multiple policies in the system, the Policy Decision Point (PDP) will use policy algebra to merge the purpose sets generated by these policies to determine the ultimately allowed access purposes; Step 5: The Policy Decision Point (PDP) generates a final access decision based on the evaluation result, or the combined evaluation result and the purpose set after policy algebra operations; and records the decision and access information on the blockchain; Step 6: The Policy Decision Point (PDP) sends the access decision result to the Policy Enforcement Point (PEP) to execute the access control decision and allow or reject the user's access request.

2. The traceable access control method based on pedigree data according to claim 1, wherein: The lineage data described in Step 1 is a lineage graph, which represents how an object is derived. Each attribute node V contains an attribute item and an attribute value, and these attribute nodes are divided into proxy-related attributes, process-related attributes, and artifact-related attributes.

3. The traceable access control method based on pedigree data according to claim 1, wherein: The access policy described in Step 2 maps attributes to sets of allowed and prohibited purposes, and the lineage data records the data generation process in the form of a directed acyclic graph; Specifically, it includes the following sub-steps: Step 2.1: Initialize the allowed destination set A and the prohibited destination set A of each policy as empty sets; allowed,i and the prohibited destination set A prohibited,i as an empty set; Step 2.2: Traverse each policy p i ∈ P, and generate the allowed and forbidden purpose sets A i and A i of policy p allowed,i according to policy p prohibited,i ; Step 2.3: Use policy algebra operations to merge the allowed and prohibited purpose sets of all policies; the policy algebra includes several basic operators and functions based on these operators for processing purpose sets at different levels.

4. The traceable access control method based on pedigree data according to claim 1, characterized in that: In step 3, the lineage partition is a connected subgraph that is part of the lineage graph; the lineage partition is represented as {(V type1 , V name1 ), (V type2 , V name2 , a2, f2)...}, where V typei is the vertex type, V namei is the vertex name, a i is the attribute value, f i is the binary predicate, i = 1, 2, 3,..., N, and N is the number of graph nodes.

5. The traceable access control method based on pedigree data according to claim 1, characterized in that: In Step 3, the lineage partition information is retrieved by the Context Handler (CH) and sent to the Policy Decision Point (PDP) for generating access purposes.

6. The traceable access control method based on pedigree data according to claim 1, characterized in that: In Step 4, when evaluating the access request, it is checked whether the lineage data in the request meets the conditions defined in the policy, including whether certain operations are performed by a specific subject and whether it is generated at a specific time or in a specific environment.

7. The traceable access control method based on pedigree data according to claim 1, characterized in that, In Step 4, when the Policy Decision Point (PDP) uses policy algebra to merge the purpose sets generated by these policies, different operators are used to merge the purpose sets of high and low sensitivity levels according to the different sensitivity levels of the purposes.

8. The traceable access control method based on pedigree data according to claim 6, characterized in that: The purposes are multi-level purposes, and the purpose sensitivity increases gradually from top to bottom to ensure the fine-grainedness and flexibility of access control; purposes with different sensitivities are organized in the form of a directed acyclic graph, each node represents an access purpose, and the edges represent the hierarchical relationship between the purposes, with the sensitivity increasing from top to bottom.

9. A traceable access control system based on pedigree data, characterized in that, It includes a dynamic access control management module and a lineage data-based purpose-oriented module; The dynamic access control management module includes a Policy Administration Point (PAP), a Policy Decision Point (PDP), a Policy Enforcement Point (PEP), a Policy Information Point (PIP), and a Context Handler (CH); The PAP is used to generate and manage access control policies and send the policies to the PDP; The PIP is used to collect context information related to access requests and send this information to the PDP; the PDP is used to evaluate a user's access request based on the policies received from the PAP and the context information obtained from the PIP, determine whether the requested access purpose complies with the policy requirements, and generate an access decision; the PEP is used to receive the user's access request, forward the request to the PDP, and perform access control operations according to the decision of the PDP, allowing or denying the user's access request; the CH is used to collect, process, and forward context information related to access requests so that the PDP can make an accurate access decision; The lineage data-based purpose-oriented module is used to manage lineage data and formulate access policies according to the data usage purpose, including a lineage graph generation sub-module, a purpose set generation sub-module based on the access policy and the lineage graph, and a purpose evaluation sub-module.

10. A traceable access control product based on pedigree data, including computer program instructions, characterized in that: When the computer program instructions run on a computer, the computer is caused to execute the lineage data-based traceable access control method according to any one of claims 1 to 8.

Images