Two-stage user access authentication authorization method based on network twinning

Abstract

The invention provides a two-stage user access authentication and authorization method based on network twinning. The method comprises the following steps: an authentication and authorization module ABAC access control gateway on a network twinning side receives a user service access request; the ABAC access authorization decision module calls models and services loaded by the ABAC, comprehensively evaluates and makes an access authorization decision, and the ABAC access control gateway executes the access authorization decision; when user service access is allowed, an authentication and authorization module RBAC access control gateway at a cloud native application side receives a service access request sent by an ABAC access control gateway, and forwards the service access request to an RBAC access authorization decision module; the RBAC access authorization decision-making module calls services and rules loaded by the RBAC to make an access control strategy, and the RBAC access control gateway executes the access control strategy. By means of the method, flexibility and fine-grained control are improved during user access authentication, the problem of role expansion is reduced, dynamic environment change is supported, system performance is optimized, and user experience is improved. The safety is enhanced; and the management and the compliance are simplified.

Description

Technical Field

[0001] The present invention relates to the field of network twin technology, and in particular to a two-stage user access authentication and authorization method based on network twin. Background Art

[0002] Existing RBAC technology suffers from insufficient flexibility, role expansion, limited permission granularity, and difficulty supporting dynamic environments. RBAC relies on predefined roles and permission assignments, making it difficult to adapt to complex, dynamic environments. RBAC often appears rigid when there are temporary needs or context-dependent access controls. In large enterprises, the number of roles may grow rapidly to meet varying permission requirements, making management and maintenance more difficult and prone to a "role explosion." RBAC primarily controls permissions based on roles, while ignoring environmental factors such as time, location, and device type, making it difficult to meet the needs of fine-grained permission control. RBAC lacks the ability to handle dynamic attributes (such as access time and geographic location), making it difficult to implement real-time security policy adjustments.

[0003] Existing ABAC technology suffers from high implementation complexity, high performance overhead, difficulty in management, and a lack of structured management. ABAC relies on the definition and real-time management of attributes, making configuration and implementation complex and requiring high policy writing and management requirements. ABAC requires checking multiple attributes during authorization, which can involve complex rule-based judgments and leads to high system performance overhead, especially with a high number of concurrent requests. ABAC requires defining and maintaining a large number of attribute rules and policies, making it difficult to manage permissions concisely for complex systems or large-scale users. ABAC's permission control is decentralized and lacks a hierarchical structure similar to roles in RBAC, making it difficult to implement concise permission management and auditing.

[0004] It can be concluded that how to improve flexibility and fine-grained control during user access authentication, reduce role expansion problems, support dynamic environment changes, optimize system performance, enhance security and simplify management and compliance has become one of the existing technical problems that need to be solved urgently. Summary of the Invention

[0005] The present invention provides a two-stage user access authentication and authorization method based on network twins, which is used to improve flexibility and fine-grained control during user access authentication, reduce role expansion problems, support dynamic environmental changes, optimize system performance, enhance security, and simplify management and compliance.

[0006] In a first aspect, a two-stage user access authentication and authorization method based on network twins is provided, comprising:

[0007] The authentication and authorization module ABAC access control gateway on the network twin side receives the user service access request and forwards it to the ABAC access authorization decision module;

[0008] The ABAC access authorization decision module calls the models and services loaded by ABAC, comprehensively evaluates and makes an access authorization decision, and sends the access authorization decision to the ABAC access control gateway, which executes the access authorization decision;

[0009] When allowing user service access, the RBAC access control gateway, an authentication and authorization module on the cloud-native application side, receives the service access request sent by the ABAC access control gateway and forwards it to the RBAC access authorization decision module;

[0010] The RBAC access authorization decision module calls the services and rules loaded by RBAC, makes an access control policy, and sends the access control policy to the RBAC access control gateway, which executes the access control policy.

[0011] In one embodiment, the user service access request includes: network and terminal security information of the network environment, risk information of the physical environment and identity information of the user, where the user is a person, a machine or an object.

[0012] In one embodiment, the models and services loaded by the ABAC include: a network trust evaluation model, a resource sensitivity inference service, an access control policy model, and a security situation analysis service.

[0013] In one embodiment, the resource sensitivity inference service is implemented by calling a data or application risk database; the security situation analysis service is implemented by calling a log or indicator or monitoring database.

[0014] In one embodiment, the network trust evaluation model includes: identity authentication service, terminal or access network security evaluation service, physical environment risk evaluation service and role rights inference model.

[0015] In one embodiment, the identity authentication service is implemented by calling a user, device, software or service feature library; and the role authority inference model is implemented by calling an identity-role mapping database.

[0016] In one embodiment, the ABAC access authorization decision module calls the loaded models and services, comprehensively evaluates and makes access authorization decisions, specifically including:

[0017] The ABAC access authorization decision module uses the network trust evaluation model to verify the user's identity and give an identity credibility score; it also evaluates the security of the terminal and access network and gives a network environment credibility score; it also evaluates the security of the physical environment and gives a physical environment credibility score; and it gives a role access permission score based on user roles and permission rules.

[0018] The ABAC access authorization decision module calls the resource sensitivity inference service to infer the sensitivity of the resource and provide an environmental sensitivity score;

[0019] The ABAC access authorization decision module calls the access control policy model, evaluates and infers authorization risks based on the current network trust evaluation and resource sensitivity inference, and obtains the authorization risk score;

[0020] The ABAC access authorization decision module calls the security situation analysis service to analyze the system security situation, monitor abnormal events, provide abnormal event alarm information, and obtain security situation scores;

[0021] The final score is obtained based on the identity credibility score, network environment credibility score, physical environment credibility score, role access permission score, environmental sensitivity score, authorization risk score, and security posture score. It is then compared with the set threshold. If the score is higher than the threshold, the user's business access request is allowed; otherwise, it is denied.

[0022] In one embodiment, the access subject of the service access request sent by the ABAC access control gateway is a person, machine, object or its corresponding network twin; the service access request sent by the ABAC access control gateway also includes identity authentication information.

[0023] In one embodiment, the RBAC access authorization decision module calls the services and rules loaded by RBAC, formulates an access control policy, and sends the access control policy to the RBAC access control gateway, specifically including:

[0024] The RBAC access authorization decision module passes the received identity authentication information to the RBAC identity authentication service and sends an identity authentication request. The RBAC identity authentication service authenticates the user to confirm whether the user's identity is authentic and valid;

[0025] If the user's identity is real and valid, the RBAC access authorization decision module will determine the user's currently activated role information based on the role binding rules;

[0026] Based on the user's role information, the RBAC access authorization decision module confirms the permissions corresponding to the role according to the access control rules, generates the access control policy for the business access request sent by the ABAC access control gateway based on all permissions, and sends it to the RBAC access control gateway.

[0027] In one embodiment, the role binding rule is implemented by calling an identity role mapping database; and the access control rule is implemented by calling a role permission mapping database.

[0028] An embodiment of the present invention provides a two-stage user access authentication and authorization method based on network twins, including: the authentication and authorization module ABAC access control gateway on the network twin side receives the user's business access request and forwards it to the ABAC access authorization decision module; the ABAC access authorization decision module calls the models and services loaded by ABAC, comprehensively evaluates and makes an access authorization decision, sends the access authorization decision to the ABAC access control gateway, and the ABAC access control gateway executes the access authorization decision; when allowing user business access, the authentication and authorization module RBAC access control gateway on the cloud native application side receives the business access request sent by the ABAC access control gateway and forwards it to the RBAC access authorization decision module; the RBAC access authorization decision module calls the services and rules loaded by RBAC, makes an access control policy, sends the access control policy to the RBAC access control gateway, and the RBAC access control gateway executes the access control policy. Through the above method, flexibility and fine-grained control are improved during user access authentication, role expansion problems are reduced, dynamic environmental changes are supported, system performance is optimized, security is enhanced, and management and compliance are simplified.

[0029] Other features and advantages of the present invention will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present invention. The purposes and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0031] Figure 1 Flowchart of a two-stage user access authentication and authorization method based on network twins according to an embodiment of the present invention;

[0032] Figure 2 Schematic diagram of segmented composite authentication and authorization based on network twins according to an embodiment of the present invention. DETAILED DESCRIPTION

[0033] In order to achieve greater flexibility and fine-grained control in user access authentication, reduce role expansion problems, support dynamic environment changes, optimize system performance, enhance security, and simplify management and compliance, a two-stage user access authentication and authorization method based on network twins is provided.

[0034] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention and are not used to limit the present invention. In addition, the embodiments of the present invention and the features in the embodiments may be combined with each other if there is no conflict.

[0035] As a foundational service running on the cloud, network twins support key functions such as identity authentication and access authorization, becoming the user's gateway to the network—a key element in implementing zero trust. The network twin's security agent functionality primarily includes five components: access control gateway, identity authentication, security posture analysis, security policy engine, and access authorization decision-making.

[0036] Phase 1: Authentication and authorization from user to network twin

[0037] Multi-attribute status collection for humans, machines, objects, and the environment:

[0038] Since the physical environment in which data access subjects such as people / machines / objects are located is dynamically changing, and the trust levels of the network environments in which business is conducted are also different, combined with the sensitivity of the accessed data, before deciding to grant data access rights, it is necessary to comprehensively collect the multi-attribute status of people / machines / objects / environment to support authorization evaluation decisions.

[0039] For access subjects such as humans, machines, and objects, it is necessary to obtain their identity authentication information, including username and password, digital certificates, and other multi-factor authentication (MFA) information. Environmental status information mainly includes network and terminal environment status, as well as physical environment status. For network and terminal environment status, the main focus is collecting information such as the network connection type, available bandwidth, supported encryption modes, and terminal hardware and software configuration, vendor, and deployment. For physical environment status, the main focus is collecting information such as the physical location of the access subject, the time the access occurred, and the confidentiality level.

[0040] Authorization mechanism - Attribute-based access control (ABAC):

[0041] By integrating the multi-attribute status information of people / machines / objects / environment, we conduct assessments on identity confidence, network environment risks, and physical environment risks. We use trust assessment rules or models to infer trust, and then perform fine-grained permission control based on the resource attributes of the accessed data, such as data sensitivity level, access time window, and other information.

[0042] Data push:

[0043] After the data access subject passes the ABAC authorization of the network twin, if the network twin has cached the data required by the user, the cached data can be pushed directly to the user. If there is no relevant data, the network twin needs to apply for data access to the cloud native application side. At this time, the second authentication and authorization mode needs to be carried out, that is, the authentication and authorization from the network twin to the cloud native application.

[0044] Since the network twin is a private security agent of the access subject, it will always grasp all kinds of status information of the subject. The network twin directly performs fine-grained authentication and authorization of the access subject based on the comprehensive status information. While ensuring the security and reliability of user data, it also avoids frequent cloud platform authentication, thereby improving user experience and system efficiency.

[0045] This includes several key aspects: the access control gateway, access authorization decision-making, identity authentication services, resource sensitivity inference, network trust assessment models, security posture analysis, and access control policy models. The access control gateway, as the Policy Enforcement Point (PEP) in Zero Trust security, is the entry point for receiving user applications and initiating the authentication and authorization process. The access authorization decision service, as the Policy Decision Point (PDP) in Zero Trust security, is the core of the authentication and authorization process.

[0046] Phase 2: Authentication and Authorization from Network Twins to Cloud-Native Applications

[0047] Identity information collection:

[0048] As a private security agent of an access subject, the network twin has all the user's identity authentication information. Therefore, the network twin can request data access permissions from cloud-native applications on behalf of the subject, and send identity information to the cloud-native application for authentication.

[0049] Authorization mechanism - Role-based access control (RBAC):

[0050] Since the network and physical environments in which the network twin is located are stable and controlled, the authentication and authorization at this stage can adopt a role-based access control mode. That is, after the user identity is verified, the bound role information is checked, and the network twin enjoys its access rights to cloud-native application data according to the role assigned to its subject.

[0051] Data caching:

[0052] Once the network twin obtains data access permissions through the RBAC mechanism, it can retrieve the corresponding data from the cloud-native application according to the subject's requirements and temporarily cache the data in its own storage space. If the subject subsequently changes or deletes its own data, the network twin can synchronize the subject's data operations with the cloud-native application side at the appropriate time. The purpose of this is to improve data transmission efficiency and reduce the direct access load on the cloud-native application.

[0053] It primarily includes the access control gateway, access authorization decision-making, identity authentication services, role binding rules, and access control rules. The access control gateway, as the Policy Enforcement Point (PEP) in Zero Trust security, is the entry point for receiving user applications and initiating the authentication and authorization process. The access authorization decision service, as the Policy Decision Point (PDP) in Zero Trust security, is the core of the authentication and authorization process.

[0054] like Figure 1-2 As shown, the embodiment provides a two-stage user access authentication and authorization method based on network twins, and the specific implementation steps include:

[0055] S11. The authentication and authorization module ABAC access control gateway on the network twin side receives the user service access request and forwards it to the ABAC access authorization decision module.

[0056] In specific implementations, the access control gateway receives user access requests. Service access requests from users or systems are first intercepted by the access control gateway, initiating the authentication and authorization process. The ABAC access control gateway then sends the request to the ABAC access authorization decision module on the control plane. As a policy enforcement point, the ABAC access control gateway does not directly make access decisions, but instead forwards the request to the ABAC access authorization decision module on the control plane. The user service access request includes network and terminal security information for the network environment, risk information for the physical environment, and the identity information of the user, whether the user is a person, machine, or object.

[0057] S12. The ABAC access authorization decision module calls the models and services loaded by ABAC, comprehensively evaluates and makes an access authorization decision, and sends the access authorization decision to the ABAC access control gateway. The ABAC access control gateway executes the access authorization decision.

[0058] In specific implementation, access authorization decisions call various models and services in sequence: first, the network trust evaluation model is called, and the following sub-services are implemented:

[0059] The ABAC access authorization decision module calls upon the network trust evaluation model. The identity authentication service verifies the user identity and provides an identity credibility score. The terminal / access network security assessment evaluates the security of the terminal and access network and provides a network environment credibility score. The physical environment risk assessment evaluates the security of the physical environment and provides a physical environment credibility score. The role permission inference model provides a role access permission score based on user roles and permission rules.

[0060] The ABAC access authorization decision module calls the resource sensitivity inference service to infer the sensitivity of the resource and provide an environmental sensitivity score;

[0061] The ABAC access authorization decision module calls the access control policy model, evaluates and infers authorization risks based on the current network trust evaluation and resource sensitivity inference, and obtains the authorization risk score;

[0062] The ABAC access authorization decision module calls the security situation analysis service to analyze the system security situation, monitor abnormal events, provide abnormal event alarm information, and obtain security situation scores;

[0063] The final score is obtained based on the identity credibility score, network environment credibility score, physical environment credibility score, role access permission score, environmental sensitivity score, authorization risk score, and security posture score. It is then compared with the set threshold. If the score is higher than the threshold, the user's business access request is allowed; otherwise, it is denied.

[0064] The ABAC access control gateway receives the access authorization decision from the control plane and then allows or denies the service access request.

[0065] In one embodiment, the models and services loaded by the ABAC include: a network trust assessment model, a resource sensitivity inference service, an access control policy model, and a security situation analysis service. The resource sensitivity inference service is implemented by calling a data or application risk database; the security situation analysis service is implemented by calling a log or indicator or monitoring database. The network trust assessment model includes: an identity authentication service, a terminal or access network security assessment service, a physical environment risk assessment service, and a role rights protection inference model. The identity authentication service is implemented by calling a user, device, software, or service feature library; the role authority inference model is implemented by calling an identity-role mapping database.

[0066] S13. When allowing user service access, the RBAC access control gateway, an authentication and authorization module on the cloud native application side, receives the service access request sent by the ABAC access control gateway and forwards it to the RBAC access authorization decision module.

[0067] In practice, the access subject issues a request to access enterprise system resources over the network. This request is passed to the access control gateway, known as the Policy Enforcement Point (PEP) in Zero Trust security. The access subject can be a human, machine, or object, or its corresponding network twin. After receiving the user's access request, the RBAC access control gateway (PEP) passes the request to the RBAC access authorization decision module, shifting the authentication and authorization process to the control plane.

[0068] S14. The RBAC access authorization decision module calls the services and rules loaded by RBAC, formulates an access control policy, and sends the access control policy to the RBAC access control gateway. The RBAC access control gateway executes the access control policy.

[0069] In specific implementation, the RBAC access authorization decision module passes the received identity authentication information to the RBAC identity authentication service and sends an identity authentication request. The RBAC identity authentication service authenticates the user and confirms whether the user's identity is authentic and valid;

[0070] If the user's identity is real and valid, the RBAC access authorization decision module will query the role information bound to the user's identity and determine the user's currently activated role information based on the role binding rules.

[0071] Based on the user's role information, the RBAC access authorization decision module confirms the permissions corresponding to the role according to access control rules. Based on all permissions, it generates an access control policy for the service access request sent by the ABAC access control gateway and sends it to the RBAC access control gateway. Based on the received access control policy, the RBAC access control gateway decides whether to allow the user's service access request. If the user's permissions meet the access requirements, access is allowed; if not, access is denied.

[0072] In one embodiment, the role binding rule is implemented by calling an identity role mapping database; and the access control rule is implemented by calling a role permission mapping database.

[0073] An embodiment provides a two-stage user access authentication and authorization method based on network twins, including: the authentication and authorization module ABAC access control gateway on the network twin side receives the user's business access request and forwards it to the ABAC access authorization decision module; the ABAC access authorization decision module calls the models and services loaded by ABAC, comprehensively evaluates and makes an access authorization decision, sends the access authorization decision to the ABAC access control gateway, and the ABAC access control gateway executes the access authorization decision; when allowing user business access, the authentication and authorization module RBAC access control gateway on the cloud native application side receives the business access request sent by the ABAC access control gateway and forwards it to the RBAC access authorization decision module; the RBAC access authorization decision module calls the services and rules loaded by RBAC, makes an access control policy, sends the access control policy to the RBAC access control gateway, and the RBAC access control gateway executes the access control policy. Through the above method, flexibility and fine-grained control are improved during user access authentication, role expansion problems are reduced, dynamic environmental changes are supported, system performance is optimized, security is enhanced, and management and compliance are simplified.

[0074] This patent adopts a segmented composite authentication and authorization model based on network twins, which allows people, machines, and objects to fully enjoy their own data sovereignty while ensuring data security and control. The specific advantages are as follows:

[0075] (1) Security. The segmented authentication and authorization mechanism can effectively control the security of data access. Segmented authentication and authorization ensures that users not only have the right to operate the data they request, but also must operate within the network environment and physical environment requirements that meet them.

[0076] (2) Efficiency. The data caching mechanism ensures that the subject can obtain the required data from the network twin as soon as the data access conditions are met, reducing direct access to cloud native applications and improving the efficiency of the subject's data operations.

[0077] (3) Flexibility. Attribute-based access control enables the authentication and authorization process to flexibly adapt to dynamic changes in the user environment, providing more fine-grained access control and improving user experience while ensuring data security.

[0078] The advantages of this patent over the existing technology are:

[0079] Improve flexibility and fine-grained control: Combining RBAC and ABAC, you can use roles for basic permission management, and then combine attributes for refined control, making permission management both flexible and in line with real-time dynamic needs.

[0080] Reduce role expansion: RBAC can reduce the number of roles by introducing attributes. This eliminates the need to create separate roles for each permission scenario, thereby reducing the risk of role expansion.

[0081] Support for dynamic environment changes: By introducing dynamic attributes (such as access time, location, device, etc.) through ABAC, permission control can be automatically adjusted according to the real-time environment, which is more adapted to modern dynamic access needs.

[0082] Optimizing system performance: RBAC provides simpler role management and fast verification, while ABAC provides dynamic judgment when needed. Combining the two can meet fine-grained control while reducing performance overhead.

[0083] Enhanced security: Access conditions are restricted by attributes, further strengthening role-based control logic. For example, access conditions such as device, network environment, and geographic location can be added in addition to roles, thereby reducing the potential risk of permission abuse.

[0084] Simplified management and compliance: RBAC provides structured role management for easier auditing and management. Meanwhile, ABAC attribute control ensures stricter compliance requirements, thus meeting complex permission requirements while maintaining good manageability.

[0085] This patent is based on a zero-trust security architecture based on network twins. It can be deployed on both enterprise networks and public networks. It can provide users with authentication and authorization when joining the network and "always online" information services. It can fully support the implementation of the zero-trust security architecture and has strong universality.

[0086] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0087] Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if such changes and modifications fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.

Claims

1. A two-stage user access authentication and authorization method based on network twins, characterized in that: include: The authentication and authorization module ABAC access control gateway on the network twin side receives the user service access request and forwards it to the ABAC access authorization decision module; The ABAC access authorization decision module calls the models and services loaded by ABAC, comprehensively evaluates and makes an access authorization decision, and sends the access authorization decision to the ABAC access control gateway, which executes the access authorization decision; When allowing user service access, the RBAC access control gateway, an authentication and authorization module on the cloud-native application side, receives the service access request sent by the ABAC access control gateway and forwards it to the RBAC access authorization decision module; The RBAC access authorization decision module calls the services and rules loaded by RBAC, makes an access control policy, and sends the access control policy to the RBAC access control gateway, which executes the access control policy.

2. The method according to claim 1, characterized in that The user service access request includes: network and terminal security information of the network environment, risk information of the physical environment and identity information of the user, where the user is a person, a machine or an object.

3. The method according to claim 2, characterized in that The models and services loaded by ABAC include: network trust evaluation model, resource sensitivity inference service, access control policy model and security situation analysis service.

4. The method according to claim 3, characterized in that The resource sensitivity inference service is implemented by calling data or application risk database; the security situation analysis service is implemented by calling log or indicator or monitoring database.

5. The method according to claim 3, characterized in that The network trust evaluation model includes: identity authentication service, terminal or access network security evaluation service, physical environment risk evaluation service and role rights protection inference model.

6. The method according to claim 5, characterized in that The identity authentication service is implemented by calling a user, device, software or service feature library; the role authority inference model is implemented by calling an identity-role mapping database.

7. The method according to claim 5, characterized in that The ABAC access authorization decision module calls the loaded models and services, comprehensively evaluates and makes access authorization decisions, including: The ABAC access authorization decision module uses the network trust evaluation model to verify the user's identity and give an identity credibility score; it also evaluates the security of the terminal and access network and gives a network environment credibility score; it also evaluates the security of the physical environment and gives a physical environment credibility score; and it gives a role access permission score based on user roles and permission rules. The ABAC access authorization decision module calls the resource sensitivity inference service to infer the sensitivity of the resource and provide an environmental sensitivity score; The ABAC access authorization decision module calls the access control policy model, evaluates and infers authorization risks based on the current network trust evaluation and resource sensitivity inference, and obtains the authorization risk score; The ABAC access authorization decision module calls the security situation analysis service to analyze the system security situation, monitor abnormal events, provide abnormal event alarm information, and obtain security situation scores; The final score is obtained based on the identity credibility score, network environment credibility score, physical environment credibility score, role access permission score, environmental sensitivity score, authorization risk score, and security posture score. It is then compared with the set threshold. If the score is higher than the threshold, the user's business access request is allowed; otherwise, it is denied.

8. The method according to claim 7, characterized in that The access subject of the service access request sent by the ABAC access control gateway is a person, a machine, an object or its corresponding network twin; the service access request sent by the ABAC access control gateway also includes identity authentication information.

9. The method according to claim 8, characterized in that The RBAC access authorization decision module calls the services and rules loaded by RBAC, formulates the access control policy, and sends the access control policy to the RBAC access control gateway. Specifically, it includes: The RBAC access authorization decision module passes the received identity authentication information to the RBAC identity authentication service and sends an identity authentication request. The RBAC identity authentication service authenticates the user to confirm whether the user's identity is authentic and valid; If the user's identity is real and valid, the RBAC access authorization decision module will determine the user's currently activated role information based on the role binding rules; Based on the user's role information, the RBAC access authorization decision module confirms the permissions corresponding to the role according to the access control rules, generates the access control policy for the business access request sent by the ABAC access control gateway based on all permissions, and sends it to the RBAC access control gateway.

10. The method according to claim 9, characterized in that The role binding rule is implemented by calling the identity role mapping database; the access control rule is implemented by calling the role authority mapping database.

Images