Resource access method and device, equipment and storage medium

Abstract

The invention discloses a resource access method and device, equipment and a storage medium, and relates to the technical field of information security, and the method comprises the steps: creating each access control strategy based on the input information of a system administrator in a target system; when a resource access request sent by a target user is received, extracting user attribute information and resource attribute information from the resource access request to determine corresponding target attribute information, and matching the target attribute information with each access control strategy to obtain a matching result; if the matching result shows that the target user has the corresponding resource access authority, generating a corresponding access authorization certificate for the target user; and when the target user performs resource access by using the access authorization certificate, determining a corresponding target resource, and encrypting and transmitting the target resource to the target user side based on a preset encryption algorithm and an HTTPS transmission protocol. Therefore, the flexibility and the security in the resource access process can be improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a resource access method, device, equipment and storage medium. Background Art

[0002] In the wave of digital economy, trusted data space has become the core of secure data circulation, while the drawbacks of traditional resource access technology have seriously restricted the release of data value.

[0003] Currently, traditional resource access control mechanisms and encryption technologies struggle to meet the stringent requirements of trusted data spaces. For example, role-based access control (RBAC) relies on static role definitions and permission allocations. This makes it difficult to flexibly adjust permission policies in complex and ever-changing business scenarios, making it difficult to meet diverse user needs and dynamically changing business logic. Regarding data encryption, traditional methods often compromise. For example, conventional encryption algorithms struggle to protect against advanced persistent threats (APTs), failing to fully guarantee data security.

[0004] Therefore, how to improve the flexibility and security of resource access is a technical problem that needs to be solved urgently. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide a resource access method, apparatus, device, and storage medium that can improve the flexibility and security of resource access. The specific solution is as follows:

[0006] In a first aspect, the present application provides a resource access method, comprising:

[0007] In the target system, create access control policies based on the system administrator's input information;

[0008] When receiving a resource access request sent by a target user, extracting user attribute information and resource attribute information from the resource access request to determine corresponding target attribute information, and matching the target attribute information with each of the access control policies to obtain a matching result;

[0009] If the matching result indicates that the target user has the corresponding resource access rights, a corresponding access authorization credential is generated for the target user;

[0010] When the target user uses the access authorization certificate to access resources, the corresponding target resource is determined, and the target resource is encrypted and transmitted to the target user terminal based on a preset encryption algorithm and HTTPS transmission protocol.

[0011] Optionally, creating each access control policy based on input information from a system administrator includes:

[0012] Determining each user's information as subject information and determining the resources in the target system as object information;

[0013] Determine the context information in the resource access request as condition information, and determine the resource access scope and data operation mode as action information;

[0014] determining the subject information, the object information, the condition information, and the action information as a policy structure;

[0015] Obtaining the policy name, policy description, applicable object attributes, resource attributes, and resource access permissions of the access control policy entered by the system administrator through a preset graphical interface or configuration file to determine the corresponding policy information;

[0016] Access control policies are created based on the policy structure and the policy information.

[0017] Optionally, after creating each access control policy based on the input information of the system administrator, the method further includes:

[0018] After the access control policy is modified, real-time detection of the logical relationship between the modified policy and access control policies other than the modified policy;

[0019] If there is a conflict in the logical relationship, corresponding alarm prompt information is generated based on the modified policy and the policy that conflicts with the modified policy.

[0020] Optionally, matching the target attribute information with each of the access control policies includes:

[0021] Collecting historical user data and resources in the target system, and using the historical user data and the resources to train a preset machine learning model to obtain a target machine learning model;

[0022] Matching the user attribute information in the target attribute information with each of the access control policies using the target machine learning model;

[0023] The target machine learning model is used to match the resource attribute information in the target attribute information with each of the access control policies.

[0024] Optionally, generating a corresponding access authorization credential for the target user includes:

[0025] Generate a credential header based on the credential type and a preset signature algorithm, and generate a credential payload based on the target user's identity information, a list of accessible resources, and the credential's validity period;

[0026] Signing the credential header and the credential payload to obtain signature information;

[0027] The signature information, the credential header, and the credential payload are connected to obtain an access token, and the access token is used as an access authorization credential.

[0028] Optionally, the encrypting and transmitting the target resource to the target user terminal based on a preset encryption algorithm and the HTTPS transmission protocol includes:

[0029] Encrypting the target resource using a symmetric encryption algorithm to obtain an encrypted resource;

[0030] Generate a symmetric key, and encrypt the symmetric key using an asymmetric encryption algorithm to obtain an encrypted key;

[0031] The encrypted resource and the encrypted key are transmitted to the target user terminal based on the HTTPS transmission protocol, so that after the target user terminal obtains the encrypted resource and the encrypted key, it uses an asymmetric decryption algorithm to decrypt the encrypted key, and uses the decrypted symmetric key and symmetric decryption algorithm to decrypt the encrypted resource to obtain the target resource.

[0032] Optionally, the process of transmitting the encrypted resource and the encrypted key to the target user terminal based on the HTTPS transmission protocol further includes:

[0033] Generate summary data using the national secret SM3 summary algorithm and the encrypted resource, and sign the summary data using the asymmetric encryption algorithm to obtain signed data;

[0034] The signed data is transmitted to a target user terminal, so that the target user terminal detects whether the encrypted resource is tampered with during resource transmission based on the signed data.

[0035] In a second aspect, the present application provides a resource access device, comprising:

[0036] A policy creation module is used to create access control policies in the target system based on the input information of the system administrator;

[0037] An information matching module is configured to, upon receiving a resource access request sent by a target user, extract user attribute information and resource attribute information from the resource access request to determine corresponding target attribute information, and match the target attribute information with each of the access control policies to obtain a matching result;

[0038] A credential generation module is configured to generate a corresponding access authorization credential for the target user if the matching result indicates that the target user has the corresponding resource access rights;

[0039] The resource transmission module is used to determine the corresponding target resource when the target user uses the access authorization certificate to access the resource, and encrypt and transmit the target resource to the target user terminal based on a preset encryption algorithm and HTTPS transmission protocol.

[0040] In a third aspect, the present application provides an electronic device, comprising:

[0041] Memory, used to store computer programs;

[0042] The processor is configured to execute the computer program to implement the aforementioned resource access method.

[0043] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned resource access method is implemented.

[0044] In the present application, in the target system, each access control policy is created based on the input information of the system administrator; when a resource access request sent by a target user is received, user attribute information and resource attribute information are extracted from the resource access request to determine the corresponding target attribute information, and the target attribute information is matched with each access control policy to obtain a matching result; if the matching result shows that the target user has the corresponding resource access rights, a corresponding access authorization certificate is generated for the target user; when the target user uses the access authorization certificate to access the resource, the corresponding target resource is determined, and the target resource is encrypted and transmitted to the target user end based on a preset encryption algorithm and HTTPS transmission protocol. As can be seen from the above, in the present application, in the target system, the creation of each access control policy is completed through the information input by the system administrator. When the target user initiates a resource access request, user attribute information and resource attribute information are extracted from the request, combined to form target attribute information, and the target attribute information is matched with the created access control policy to obtain a matching result. If the matching result shows that the target user has the access rights to the corresponding resource, an access authorization certificate is generated for the target user. When the target user subsequently attempts to access resources using the access authorization credentials, the corresponding target resource is first determined, and then the target resource is encrypted and transmitted to the target user terminal based on the preset encryption algorithm and HTTPS transmission protocol. In this way, this application can improve the flexibility and security of the resource access process, thereby effectively resisting security threats such as illegal access and data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0046] Figure 1 A flow chart of a resource access method disclosed in this application;

[0047] Figure 2 A policy query page diagram for an access control policy disclosed in this application;

[0048] Figure 3 A policy maintenance page diagram for an access control policy disclosed in this application;

[0049] Figure 4 This is a schematic diagram of the structure of a resource access device disclosed in this application;

[0050] Figure 5 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0051] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0052] Currently, traditional resource access control mechanisms and encryption technologies are difficult to meet the stringent requirements of trusted data spaces. Taking role-based access control as an example, it adopts a static role definition and permission allocation model. When faced with complex and changing business scenarios, it is unable to flexibly adjust permission policies and is difficult to meet diverse user needs and dynamically changing business logic. In terms of data encryption, traditional encryption methods lose sight of one thing while focusing on another. For example, ordinary encryption algorithms are difficult to resist advanced persistent threats and cannot fully guarantee data security. To this end, the present application provides a resource access method, device, equipment, and storage medium that can improve the flexibility and security of resource access.

[0053] See also Figure 1 As shown, an embodiment of the present invention discloses a resource access method, including:

[0054] Step S11: In the target system, create various access control policies based on the input information of the system administrator.

[0055] In this embodiment, within the target system environment, a comprehensive analysis of the users and resources within the system is first performed. Specifically, the various attribute information possessed by all users in the target system is collected and organized. This attribute information covers user identity, department, position level, role, and other content. This user information is integrated and determined as subject information. Simultaneously, various resources within the target system are sorted out, including but not limited to interfaces, files, data, and other resources, and these resources are determined as object information.

[0056] Next, the resource access request is analyzed. Specifically, contextual information is extracted from the resource access request, including but not limited to factors such as the time, location, and environment of the request, and determined as conditional information. Furthermore, the user's access scope to the resource and the data operation method, such as read, write, and modify, are determined, and this access scope and operation method are determined as action information.

[0057] Furthermore, based on the determined subject information, object information, condition information and action information, a policy structure is constructed. The policy structure is the basic framework of the access control policy and clarifies the relationship between the key elements involved in access control.

[0058] Afterward, the system administrator enters detailed information about the access control policy through a pre-set graphical interface or configuration file. This information includes a policy name, which uniquely identifies the access control policy; a policy description, which details the policy's functionality and applicable scenarios; applicable object attributes, which define the user groups to which the policy applies; resource attributes, which determine the resource types covered by the policy; and resource access rights, which define the scope of user access rights to resources. Once the target system receives this input information, it performs format and validity checks to ensure that the input policy information complies with regulatory requirements. Access control policies are then created based on the policy structure and the validated policy information.

[0059] In addition, to facilitate system administrators to manage and view policies, policy query and policy management functions are provided. When querying the created access control policy, such as Figure 2 As shown in the figure, system administrators can perform fuzzy or precise queries based on various conditions such as policy name, applicable object attributes, resource attributes, etc. to quickly locate the required policy. The query results will be displayed in a list format, including policy details and current status. In addition, when managing access control policies, the policy maintenance interface used can be as follows: Figure 3 shown.

[0060] After the access control policy is created, the effectiveness and consistency of the policy are continuously monitored. When the access control policy is modified, the logical relationship between the modified policy and other access control policies other than the modified policy is detected in real time. During the specific detection process, the various parameters and logical rules of the modified policy are analyzed and compared with the parameters and rules of other policies. If a logical conflict is found between the modified policy and other policies, such as a permission conflict, a condition conflict, etc., a corresponding alarm prompt information is generated based on the modified policy and the policy that conflicts with the modified policy. Among them, the alarm prompt information can describe the specific circumstances of the conflict in detail, including the name of the conflicting policy, the specific content of the conflict, etc., so that the system administrator can understand and deal with policy conflicts in a timely manner to ensure the accuracy and effectiveness of the access control policy.

[0061] Step S12: When a resource access request sent by a target user is received, user attribute information and resource attribute information are extracted from the resource access request to determine corresponding target attribute information, and the target attribute information is matched with each of the access control policies to obtain a matching result.

[0062] In this embodiment, when a resource access request is received from a target user, the request is first parsed to extract user attribute information and resource attribute information to determine the corresponding target attribute information. User attribute information includes, but is not limited to, user identity, environment information, position level, role, etc.; resource attribute information includes resource type, business domain, security level, etc.

[0063] Next, the extracted target attribute information is matched against each access control policy to obtain a matching result. To improve matching efficiency and accuracy, machine learning techniques can be introduced. Specifically, historical user data and resource information from the target system are first collected. This historical data covers a large amount of user access behavior and resource attribute information. A pre-set machine learning model is trained using this historical user data and resource information to obtain the target machine learning model.

[0064] During the training process of the preset machine learning model, supervised learning is used, taking historical user data and resource information as input and outputting the corresponding access control policy matching results. The model is repeatedly trained and optimized. Furthermore, during the training process, model performance can be evaluated using a variety of metrics, such as accuracy, recall, and F1 score (a metric used to evaluate classification model performance), to ensure the model's high generalization ability and predictive accuracy.

[0065] After obtaining the target machine learning model, it is used to match the user attributes in the target attribute information with each access control policy. Specifically, the user attribute information is input into the target machine learning model. The model calculates the similarity and matches the user attribute information with each access control policy based on the trained patterns and rules. The model outputs a matching score for each access control policy and user attribute information. A higher score indicates a stronger match.

[0066] At the same time, the target machine learning model is used to match the resource attribute information in the target attribute information with each access control policy. Similarly, the resource attribute information is input into the target machine learning model, and the model will evaluate the matching between the resource attribute information and each access control policy and output the corresponding matching score.

[0067] During the matching process, a comprehensive analysis of the matching results of user and resource attribute information can be performed. Specifically, the matching scores of user and resource attribute information are weighted and summed based on preset weight coefficients to obtain a final matching score for each access control policy. Based on the final matching score, the access control policy that best matches the target attribute information is determined and used as the matching result.

[0068] In addition, the matching process can be monitored and analyzed in real time, collecting various data and indicators during the matching process, such as matching accuracy, matching efficiency, and matching failure rate. By analyzing these data and indicators, problems and deficiencies in the matching process can be discovered in a timely manner, and the target machine learning model can be optimized and improved to improve matching efficiency and accuracy.

[0069] Step S13: If the matching result indicates that the target user has the corresponding resource access rights, a corresponding access authorization credential is generated for the target user.

[0070] In this embodiment, when the matching result obtained indicates that the target user has the corresponding resource access rights, a corresponding access authorization credential is generated for the target user. Specifically, first, a credential header is generated based on the credential type and the preset signature algorithm. The credential type is determined according to the access scenario and security requirements, including but not limited to short-term access credentials, long-term access credentials, one-time access credentials, etc. The preset signature algorithm adopts the SM (State Management, a cryptographic algorithm) series of algorithms, such as the SM2 (elliptic curve public key cryptography algorithm) asymmetric encryption algorithm to ensure the security and non-repudiation of the signing process. The credential header contains metadata such as the algorithm identifier and credential type, and is structured in JSON (JavaScript Object Notation, a lightweight data exchange format) format.

[0071] Next, a credential payload is generated based on the target user's identity information, the list of accessible resources, and the credential validity period. The identity information uses an encrypted unique user identifier to ensure the confidentiality of the user's identity. The accessible resource list is precisely determined based on the matching results, detailing the name, type, and access rights of the resources the user is authorized to access, enabling fine-grained control over resource access. The credential validity period is dynamically set based on business needs and security policies, and is expressed in UTC time format to ensure time consistency and accuracy. The credential payload is also structured in JSON format, and data integrity verification is performed to prevent data tampering.

[0072] After the credential header and credential payload are generated, they are signed to produce the signature information. This signing process utilizes digital signature technology and follows these steps: First, the credential header and credential payload are hashed to generate a message digest; then, the message digest is encrypted using the system's private key to generate a digital signature. This signing process strictly adheres to the encryption specifications of the SM2 algorithm, ensuring the security and uniqueness of the signature. As a crucial component of the credential, the signature information is used to verify its integrity and authenticity.

[0073] Finally, the signature information, credential header, and credential payload are concatenated to generate an access token, which is used as the access authorization credential. This concatenation process uses Base64 encoding (a method for representing binary data based on 64 printable characters) to securely concatenate the three components, generating a compact, easily transmittable string representation of the access token. This access token generation process ensures data integrity and security, preventing tampering or forgery during transmission.

[0074] Step S14: When the target user uses the access authorization certificate to access resources, the corresponding target resource is determined, and the target resource is encrypted and transmitted to the target user terminal based on a preset encryption algorithm and HTTPS transmission protocol.

[0075] In this embodiment, when a target user uses an access authorization credential to access a resource, the system first verifies the validity of the access authorization credential to ensure it has not expired or been revoked. Once verified, the system determines the corresponding target resource and encrypts and transmits the target resource to the target user using a pre-set encryption algorithm and the HTTPS (Hypertext Transfer Protocol Secure) transport protocol.

[0076] Specifically, the target resource is first encrypted using a symmetric encryption algorithm to obtain the encrypted resource. The symmetric encryption algorithm uses the SM4 algorithm (a block cipher). During the encryption process, encryption parameters can be dynamically adjusted based on the resource's characteristics and security level to ensure that the encryption strength matches the resource's sensitivity.

[0077] Next, a symmetric key is generated and encrypted using an asymmetric encryption algorithm to obtain the encrypted key. The asymmetric encryption algorithm uses the SM2 algorithm, which encrypts the symmetric key using the target system's private key. The symmetric key is generated using a true random number generator to ensure randomness and unpredictability. The encrypted symmetric key is transmitted along with the encrypted resource and is used by the target user to decrypt the resource.

[0078] Once encryption is complete, the encrypted resource and key are transmitted to the target user using the HTTPS transport protocol. The system then employs an encryption algorithm to perform a secondary encryption on the transmitted data, creating a dual encryption protection mechanism. During resource transmission, block-based transmission and streaming encryption techniques can be used to split large files into smaller pieces for encrypted transmission, improving both efficiency and security.

[0079] After obtaining the encrypted resource and encryption key, the target user first decrypts the encrypted key using an asymmetric decryption algorithm. The user then decrypts the encrypted key using a pre-assigned public key to obtain the original symmetric key. The encrypted resource is then decrypted using the decrypted symmetric key and the symmetric decryption algorithm to obtain the target resource. The decryption process strictly adheres to the inverse operation rules of the encryption algorithm to ensure the accuracy of the decryption result.

[0080] To further ensure the integrity and authenticity of resource transmission, the system uses the SM3 digest algorithm (a cryptographic hash algorithm) and encrypted resources to generate summary data. The SM3 digest algorithm generates a fixed-length hash value that is highly sensitive to the original data; any data modification will result in a significant change in the hash value. The summary data is then signed using an asymmetric encryption algorithm to produce the signed data. The signing process encrypts the summary data using the system's private key to ensure non-repudiation of the signature.

[0081] The signed data is transmitted to the target client, allowing the target client to detect whether the encrypted resource has been tampered with during transmission based on the signed data. After receiving the encrypted resource and signed data, the target client first hashes the encrypted resource using the same SM3 digest algorithm to generate local digest data. The signed data is then decrypted using the system's public key to obtain the original digest data. Finally, the local digest data is compared with the original digest data. If the two match, the resource has not been tampered with during transmission. Otherwise, the resource may have been tampered with, and the client will refuse to receive the resource and send a security alert to the target system.

[0082] In addition, a log audit and monitoring module can be set up to record system operation events and operating status, implement audit and monitoring functions, monitor the system in real time, discover potential security threats and abnormal behaviors, and provide logs for administrators to analyze and investigate.

[0083] Specifically, the module can set recording points at key nodes of the system to record events such as user login and logout, access requests, policy execution results, data encryption and decryption operations, etc. The recorded content covers information such as the time and location of the event, the users and resources involved, the type of operation and the results, such as relevant records of user file access requests. System administrators use the audit tools provided by the module to analyze and compile logs. The audit tool supports multiple query methods such as time range, user, operation type, etc., and can generate reports to help administrators quickly locate and analyze security events and abnormal behaviors, such as counting user access frequency and behavior patterns. In addition, the module can also monitor the system operation status and performance indicators in real time, including system resource usage, service operation status, network traffic, etc. Once an abnormality occurs in the system, such as memory usage exceeding the threshold, the monitoring module will automatically issue an alarm and provide fault information and solution suggestions.

[0084] As can be seen from the above, in this application, within the target system, the creation of each access control policy is completed through the information input by the system administrator. When the target user initiates a resource access request, the user attribute information and resource attribute information are extracted from the request, combined to form the target attribute information, and the target attribute information is matched with the created access control policy to obtain a matching result. If the matching result shows that the target user has access rights to the corresponding resource, an access authorization credential is generated for the target user. Subsequently, when the target user attempts to access the resource with the access authorization credential, the corresponding target resource is first determined, and then the target resource is encrypted and transmitted to the target user end according to the preset encryption algorithm and HTTPS transmission protocol. In this way, the present application can improve the flexibility and security of the resource access process, thereby effectively resisting security threats such as illegal access and data leakage.

[0085] The following describes the technical solution of the embodiment of the present application in detail in conjunction with the medical data access scenario.

[0086] Hospital information systems store vast amounts of patient medical data, including electronic medical records, diagnostic images, and test results. This data is highly sensitive, and hospitals need to ensure that authorized medical staff can easily access and use it while protecting patient privacy. Hospitals can use the resource access method proposed in this embodiment to build a medical data access control system.

[0087] When a doctor needs to review a patient's diagnosis report to develop the next treatment plan, he or she initiates a request to access the patient's medical data through the doctor's workstation system on the hospital's intranet. This request enters the medical data access control system through the hospital's application gateway.

[0088] When the system receives a doctor's resource access request, it immediately triggers the identity authentication process. First, the doctor's digital certificate and login credentials are verified to confirm their legitimacy. Next, the system extracts the doctor's user attributes from the request, including their ID (identity document), department, title, and role. It also extracts target resource attribute information, such as patient ID, resource type, and data sensitivity level. The system combines this information into target attribute information.

[0089] The system then matches the target attribute information with preconfigured access control policies. These policies can be developed based on the hospital's medical data access management specifications. The system uses a machine learning-based matching engine to perform policy matching on both user attributes and resource attributes. After calculation, the system determines that the doctor has permission to access the patient's diagnostic report, granting access.

[0090] Because the matching result indicates that the doctor has the appropriate resource access rights, the system generates an access authorization credential. The credential header uses the JWT (JSON Web Token) format, an open standard for secure information transmission, and contains an algorithm identifier and the credential type. The credential payload contains the doctor's identity, a list of accessible resources, and the credential's validity period. The system uses the hospital's private key to sign the credential header and payload, generating a digital signature. Finally, the signature information, credential header, and payload are concatenated into a complete JWT token and sent to the doctor's workstation via a secure channel.

[0091] After receiving the access authorization credentials, the doctor's workstation automatically attaches them to subsequent resource access requests. After verifying the credentials' validity, the system locates the diagnostic report stored in the electronic medical record system. To ensure data security, the system first encrypts these resources using the SM4 symmetric encryption algorithm and generates a random symmetric key. This symmetric key is then encrypted using the hospital's private key.

[0092] During the data transmission phase, the system transmits encrypted medical data and the encrypted symmetric key in batches to the doctor's workstation via the HTTPS protocol. To ensure data integrity, the system generates a data summary and signs it with the hospital's private key. After receiving the data, the doctor's workstation first decrypts it using the hospital's public key to obtain the symmetric key, which is then used to decrypt the original diagnosis report. Simultaneously, the workstation calculates a summary of the received data and compares it with the decrypted, signed summary to confirm that the data has not been tampered with during transmission.

[0093] By applying the technical solutions of the embodiments of this application, the hospital can achieve secure and controllable access to medical data to a certain extent, while protecting patient privacy, improving the work efficiency of medical staff, and effectively avoiding the risk of data leakage.

[0094] Accordingly, see Figure 4 As shown, an embodiment of the present application provides a resource access device, including:

[0095] A policy creation module 11 is used to create various access control policies in the target system based on input information from the system administrator;

[0096] The information matching module 12 is configured to, upon receiving a resource access request sent by a target user, extract user attribute information and resource attribute information from the resource access request to determine corresponding target attribute information, and match the target attribute information with each of the access control policies to obtain a matching result;

[0097] A credential generation module 13 is configured to generate a corresponding access authorization credential for the target user if the matching result indicates that the target user has the corresponding resource access rights;

[0098] The resource transmission module 14 is used to determine the corresponding target resource when the target user uses the access authorization certificate to access the resource, and encrypt and transmit the target resource to the target user terminal based on a preset encryption algorithm and HTTPS transmission protocol.

[0099] As can be seen from the above, in this application, within the target system, the creation of each access control policy is completed through the information input by the system administrator. When the target user initiates a resource access request, the user attribute information and resource attribute information are extracted from the request, combined to form the target attribute information, and the target attribute information is matched with the created access control policy to obtain a matching result. If the matching result shows that the target user has access rights to the corresponding resource, an access authorization credential is generated for the target user. Subsequently, when the target user attempts to access the resource with the access authorization credential, the corresponding target resource is first determined, and then the target resource is encrypted and transmitted to the target user end according to the preset encryption algorithm and HTTPS transmission protocol. In this way, the present application can improve the flexibility and security of the resource access process, thereby effectively resisting security threats such as illegal access and data leakage.

[0100] In some specific implementations, the policy creation module 11 specifically includes:

[0101] an object information determining unit, configured to determine each user's information as subject information, and determine the resources in the target system as object information;

[0102] an action information determining unit, configured to determine context information in a resource access request as condition information, and determine a resource access scope and a data operation mode as action information;

[0103] a structure determining unit, configured to determine the subject information, the object information, the condition information, and the action information as a policy structure;

[0104] An information determination unit is used to obtain the policy name, policy description information, applicable object attributes, resource attributes, and resource access rights of the access control policy input by the system administrator through a preset graphical interface or configuration file to determine the corresponding policy information;

[0105] A policy creation unit is configured to create various access control policies based on the policy structure and the policy information.

[0106] In some specific implementations, the policy creation module 11 further includes:

[0107] a relationship detection unit, configured to detect, in real time, a logical relationship between the modified policy and access control policies other than the modified policy after the access control policy is modified;

[0108] The information generating unit is configured to generate corresponding warning prompt information based on the modified policy and the policy that conflicts with the modified policy if there is a conflict in the logical relationship.

[0109] In some specific implementations, the information matching module 12 specifically includes:

[0110] a model training unit, configured to collect historical user data and resources in the target system, and train a preset machine learning model using the historical user data and the resources to obtain a target machine learning model;

[0111] A first information matching unit, configured to match the user attribute information in the target attribute information with each of the access control policies using the target machine learning model;

[0112] The second information matching unit is used to use the target machine learning model to match the resource attribute information in the target attribute information with each access control policy.

[0113] In some specific implementations, the credential generation module 13 specifically includes:

[0114] A payload generation unit, configured to generate a credential header based on the credential type and a preset signature algorithm, and to generate a credential payload based on the target user's identity information, a list of accessible resources, and a valid credential period;

[0115] A payload signing unit, configured to sign the credential header and the credential payload to obtain signature information;

[0116] The credential determination unit is used to connect the signature information, the credential header and the credential payload to obtain an access token, and use the access token as an access authorization credential.

[0117] In some specific implementations, the resource transmission module 14 specifically includes:

[0118] A resource encryption unit, configured to encrypt the target resource using a symmetric encryption algorithm to obtain an encrypted resource;

[0119] A key encryption unit, configured to generate a symmetric key and encrypt the symmetric key using an asymmetric encryption algorithm to obtain an encrypted key;

[0120] A resource decryption unit is used to transmit the encrypted resource and the encrypted key to the target user terminal based on the HTTPS transmission protocol, so that after the target user terminal obtains the encrypted resource and the encrypted key, it uses an asymmetric decryption algorithm to decrypt the encrypted key, and uses the decrypted symmetric key and symmetric decryption algorithm to decrypt the encrypted resource to obtain the target resource.

[0121] In some specific implementations, the resource transmission module 14 further includes:

[0122] A data signing unit, configured to generate summary data using the national secret SM3 summary algorithm and the encrypted resource, and sign the summary data using the asymmetric encryption algorithm to obtain signed data;

[0123] The resource detection unit is used to transmit the signed data to a target user terminal, so that the target user terminal detects whether the encrypted resource has been tampered with during the resource transmission process based on the signed data.

[0124] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be considered as any limitation on the scope of use of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the resource access method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0125] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0126] In addition, the memory 22 as a carrier for resource storage can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0127] The operating system 221 is used to manage and control the hardware devices on the electronic device 20 and the computer program 222, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs that can be used to implement the resource access method executed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include computer programs that can be used to perform other specific tasks.

[0128] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the resource access method disclosed above is implemented. For the specific steps of this method, please refer to the corresponding content disclosed in the above embodiments and will not be repeated here.

[0129] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0130] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0131] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0132] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0133] The above is a detailed introduction to the technical solution provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the ideas of the present application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A resource access method, characterized in that: include: In the target system, create access control policies based on the system administrator's input information; When receiving a resource access request sent by a target user, extracting user attribute information and resource attribute information from the resource access request to determine corresponding target attribute information, and matching the target attribute information with each of the access control policies to obtain a matching result; If the matching result indicates that the target user has the corresponding resource access rights, a corresponding access authorization credential is generated for the target user; When the target user uses the access authorization certificate to access resources, the corresponding target resource is determined, and the target resource is encrypted and transmitted to the target user terminal based on a preset encryption algorithm and HTTPS transmission protocol.

2. The resource access method according to claim 1, characterized in that: The creation of access control policies based on the input information of the system administrator includes: Determining each user's information as subject information and determining the resources in the target system as object information; Determine the context information in the resource access request as condition information, and determine the resource access scope and data operation mode as action information; determining the subject information, the object information, the condition information, and the action information as a policy structure; Obtaining the policy name, policy description, applicable object attributes, resource attributes, and resource access permissions of the access control policy entered by the system administrator through a preset graphical interface or configuration file to determine the corresponding policy information; Access control policies are created based on the policy structure and the policy information.

3. The resource access method according to claim 1, characterized in that: After creating each access control policy based on the input information of the system administrator, the following steps are also included: After the access control policy is modified, real-time detection of the logical relationship between the modified policy and access control policies other than the modified policy; If there is a conflict in the logical relationship, corresponding alarm prompt information is generated based on the modified policy and the policy that conflicts with the modified policy.

4. The resource access method according to claim 1, wherein: The matching of the target attribute information with each of the access control policies includes: Collecting historical user data and resources in the target system, and using the historical user data and the resources to train a preset machine learning model to obtain a target machine learning model; Matching the user attribute information in the target attribute information with each of the access control policies using the target machine learning model; The target machine learning model is used to match the resource attribute information in the target attribute information with each of the access control policies.

5. The resource access method according to any one of claims 1 to 4, characterized in that: Generating a corresponding access authorization credential for the target user includes: Generate a credential header based on the credential type and a preset signature algorithm, and generate a credential payload based on the target user's identity information, a list of accessible resources, and the credential's validity period; Signing the credential header and the credential payload to obtain signature information; The signature information, the credential header, and the credential payload are connected to obtain an access token, and the access token is used as an access authorization credential.

6. The resource access method according to claim 1, characterized in that: The encrypted transmission of the target resource to the target user terminal based on a preset encryption algorithm and the HTTPS transmission protocol includes: Encrypting the target resource using a symmetric encryption algorithm to obtain an encrypted resource; Generate a symmetric key, and encrypt the symmetric key using an asymmetric encryption algorithm to obtain an encrypted key; The encrypted resource and the encrypted key are transmitted to the target user terminal based on the HTTPS transmission protocol, so that after the target user terminal obtains the encrypted resource and the encrypted key, it uses an asymmetric decryption algorithm to decrypt the encrypted key, and uses the decrypted symmetric key and symmetric decryption algorithm to decrypt the encrypted resource to obtain the target resource.

7. The resource access method according to claim 6, characterized in that: The process of transmitting the encrypted resource and the encrypted key to the target client based on the HTTPS transmission protocol further includes: Generate summary data using the national secret SM3 summary algorithm and the encrypted resource, and sign the summary data using the asymmetric encryption algorithm to obtain signed data; The signed data is transmitted to a target user terminal, so that the target user terminal detects whether the encrypted resource is tampered with during resource transmission based on the signed data.

8. A resource access device, characterized in that: include: A policy creation module is used to create access control policies in the target system based on the input information of the system administrator; An information matching module is configured to, upon receiving a resource access request sent by a target user, extract user attribute information and resource attribute information from the resource access request to determine corresponding target attribute information, and match the target attribute information with each of the access control policies to obtain a matching result; A credential generation module is configured to generate a corresponding access authorization credential for the target user if the matching result indicates that the target user has the corresponding resource access rights; The resource transmission module is used to determine the corresponding target resource when the target user uses the access authorization certificate to access the resource, and encrypt and transmit the target resource to the target user terminal based on a preset encryption algorithm and HTTPS transmission protocol.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the resource access method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that Used to store a computer program; wherein, when the computer program is executed by a processor, the resource access method according to any one of claims 1 to 7 is implemented.

Images