A two-stage user access authentication and authorization method based on network twinning
By using a two-stage user access authentication and authorization method based on network twins, combined with ABAC and RBAC, the problem of insufficient flexibility and management complexity in existing technologies is solved. This enables flexible fine-grained control and dynamic environmental adaptation, thereby improving system performance and security.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- THE 32008TH UNIT OF THE PEOPLES LIBERATION ARMY OF CHINA
- Filing Date
- 2025-06-06
- Publication Date
- 2026-05-12
AI Technical Summary
Existing RBAC and ABAC technologies suffer from insufficient flexibility, role expansion, limited permission granularity, high management complexity, and large performance overhead when authenticating user access, making them difficult to adapt to dynamic environments and fine-grained control.
A two-stage user access authentication and authorization method based on network twins is adopted, combining ABAC and RBAC. Attribute and role control are performed through the ABAC access control gateway on the network twin side and the RBAC access control gateway on the cloud-native application side, respectively, to achieve fine-grained access authorization decisions.
提高了用户接入认证的灵活性和细粒度控制，减少角色膨胀问题，支持动态环境变化，优化系统性能，增强安全性并简化管理和合规性。
Smart Images
Figure CN120602149B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network twin technology, and in particular to a two-stage user access authentication and authorization method based on network twins. Background Technology
[0002] Existing RBAC technologies suffer from insufficient flexibility, role bloat, and limited permission granularity, making them unsuitable for dynamic environments. RBAC relies on predefined roles and permission assignments, making it difficult to adapt to complex dynamic environments. RBAC often proves rigid when there are temporary needs or context-dependent access controls. In large enterprises, the number of roles can grow rapidly to meet diverse permission requirements, leading to increased management and maintenance difficulties and potentially causing "role explosion." RBAC primarily controls permissions based on roles, neglecting environmental factors such as time, location, and device type, making it difficult to meet the needs of fine-grained permission control. RBAC lacks handling of dynamic attributes (such as access time and geographical location), hindering real-time adjustments to security policies.
[0003] Existing ABAC technology suffers from high implementation complexity, significant performance overhead, difficult management, and a lack of structured management. ABAC relies on attribute definition and real-time management, making configuration and implementation complex and requiring sophisticated policy writing and management. During authorization, ABAC needs to check multiple attributes, potentially involving complex rule judgments, leading to significant system performance overhead, especially under high concurrent request scenarios. ABAC requires defining and maintaining a large number of attribute rules and policies, making it difficult to manage permissions simply for complex systems or large user bases. ABAC's access control is also relatively decentralized, lacking a hierarchical structure similar to roles in RBAC, hindering the implementation of concise access management and auditing.
[0004] Therefore, improving flexibility and fine-grained control during user access authentication, reducing role bloat, supporting dynamic environmental changes, optimizing system performance, enhancing security, and simplifying management and compliance have become some of the pressing existing technical challenges. Summary of the Invention
[0005] This invention provides a two-stage user access authentication and authorization method based on network twins, which improves flexibility and fine-grained control during user access authentication, reduces role bloat, supports dynamic environmental changes, optimizes system performance, enhances security, and simplifies management and compliance.
[0006] Firstly, a two-stage user access authentication and authorization method based on network twins is provided, including:
[0007] The authentication and authorization module of the network twin side, ABAC access control gateway, receives user service access requests and forwards them to the ABAC access authorization decision module;
[0008] The ABAC access authorization decision module calls the models and services loaded in ABAC, comprehensively evaluates and makes an access authorization decision, and sends the access authorization decision to the ABAC access control gateway, which then executes the access authorization decision.
[0009] When allowing user services to access the service, the RBAC access control gateway, the authentication and authorization module on the cloud-native application side, receives the service access request sent by the ABAC access control gateway and forwards it to the RBAC access authorization decision module.
[0010] The RBAC access authorization decision module calls the services and rules loaded in RBAC, makes an access control policy, and sends the access control policy to the RBAC access control gateway, which then executes the access control policy.
[0011] In one implementation, the user service access request includes: network and terminal security information of the network environment, risk information of the physical environment, and user identity information, wherein the user is a person, machine, or thing.
[0012] In one implementation, the models and services loaded in the ABAC include: a network trust assessment model, a resource sensitivity inference service, an access control policy model, and a security posture analysis service.
[0013] In one implementation, the resource sensitivity inference service is implemented by calling a data or application risk database; the security situation analysis service is implemented by calling logs, indicators, or a monitoring database.
[0014] In one implementation, the network trust assessment model includes: identity authentication service, terminal or access network security assessment service, physical environment risk assessment service, and role-based rights protection inference model.
[0015] In one implementation, the identity authentication service is implemented by calling a user, device, software, or service feature library; the role permission inference model is implemented by calling an identity-role mapping database.
[0016] In one implementation, the ABAC access authorization decision module invokes the loaded models and services to comprehensively evaluate and make an access authorization decision, specifically including:
[0017] The ABAC access authorization decision module calls the network trust assessment model to verify the user's identity and give an identity trust score; assess the security of the terminal and the access network and give a network environment trust score; assess the security of the physical environment and give a physical environment trust score; and give a role access permission score based on user roles and permission rules.
[0018] The ABAC access authorization decision module calls the resource sensitivity inference service to infer the sensitivity of resources and provide an environmental sensitivity score.
[0019] The ABAC access authorization decision module calls the access control policy model, assesses and infers authorization risks based on the current network trust level assessment and resource sensitivity inference, and obtains an authorization risk score.
[0020] The ABAC access authorization decision module calls the security posture analysis service to analyze the system security posture, monitor abnormal events, provide abnormal event alarm information, and obtain a security posture score.
[0021] The final score is obtained by comprehensively considering identity credibility score, network environment credibility score, physical environment credibility score, role access permission score, environmental sensitivity score, authorization risk score, and security posture score. The score is then compared with a set threshold. If the score is higher than the threshold, the user's business access request is allowed; otherwise, it is rejected.
[0022] In one implementation, the access subject of the service access request sent by the ABAC access control gateway is a person, machine, or thing, or its corresponding network twin; the service access request sent by the ABAC access control gateway also includes identity authentication information.
[0023] In one implementation, the RBAC access authorization decision module invokes the services and rules loaded in the RBAC to formulate an access control policy and sends the access control policy to the RBAC access control gateway, specifically including:
[0024] The RBAC access authorization decision module transmits the received identity authentication information to the RBAC identity authentication service and sends an identity authentication request. The RBAC identity authentication service verifies the user's identity and confirms whether the user's identity is genuine and valid.
[0025] If the user's identity is genuine and valid, the RBAC access authorization decision module will determine the user's currently activated role information according to the role binding rules;
[0026] Based on the user's role information, the RBAC access authorization decision module confirms the permissions corresponding to the role according to the access control rules, generates the access control policy for the service access request sent by the ABAC access control gateway based on all permissions, and sends it to the RBAC access control gateway.
[0027] In one implementation, the role binding rule is implemented by calling the identity and role mapping database; the access control rule is implemented by calling the role and permission mapping database.
[0028] This invention provides a two-stage user access authentication and authorization method based on network twins, comprising: an authentication and authorization module (ABAC) access control gateway on the network twin side receiving a user service access request and forwarding it to an ABAC access authorization decision module; the ABAC access authorization decision module calling the models and services loaded in ABAC, comprehensively evaluating and making an access authorization decision, and sending the access authorization decision to the ABAC access control gateway, which then executes the access authorization decision; when allowing user service access, an authentication and authorization module (RBAC) access control gateway on the cloud-native application side receiving a service access request sent by the ABAC access control gateway and forwarding it to the RBAC access authorization decision module; the RBAC access authorization decision module calling the services and rules loaded in RBAC, making an access control policy, and sending the access control policy to the RBAC access control gateway, which then executes the access control policy. This method improves flexibility and fine-grained control during user access authentication, reduces role bloat, supports dynamic environmental changes, optimizes system performance, enhances security, and simplifies management and compliance.
[0029] Other features and advantages of the invention will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and accompanying drawings. Attached Figure Description
[0030] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings:
[0031] Figure 1 This is a flowchart of a two-stage user access authentication and authorization method based on network twins according to an embodiment of the present invention;
[0032] Figure 2 This is a schematic diagram of a segmented composite authentication and authorization system based on network twins according to an embodiment of the present invention. Detailed Implementation
[0033] To improve flexibility and fine-grained control during user access authentication, reduce role bloat, support dynamic environmental changes, optimize system performance, enhance security, and simplify management and compliance, a two-stage user access authentication and authorization method based on network twins is provided.
[0034] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention. Furthermore, the embodiments and features in the embodiments of the present invention can be combined with each other without conflict.
[0035] As a foundational service running in the cloud, network twins support crucial functions such as identity authentication and access authorization, serving as a gateway for users to access the network—a key element in implementing zero trust. The security proxy functionality of network twins primarily comprises five parts: access control gateway, identity authentication, security posture analysis, security policy engine, and access authorization decision-making.
[0036] Phase 1: User authentication and authorization via cyber twin
[0037] Multi-attribute status acquisition for people / machines / objects / environment:
[0038] Since the physical environment in which people / machines / things / other data access subjects are located is dynamic and the trust level of the network environment in which they conduct business is also different, it is necessary to comprehensively collect the status of multiple attributes of people / machines / things / environment before deciding to grant data access permissions, taking into account the sensitivity of the data being accessed, in order to support the authorization assessment decision.
[0039] For users (people, machines, objects, etc.), their identity authentication information needs to be obtained, including username and password, digital certificate, and other multi-factor authentication (MFA) information. Environmental status information mainly includes network and terminal environment status, as well as physical environment status. For network and terminal environment status, information such as network connection type, available bandwidth, supported encryption modes, and terminal hardware and software configuration, vendor, and deployment is collected. For physical environment status, information such as the physical location of the user, the time of access, and the level of confidentiality is collected.
[0040] Authorization Mechanism—Attribute-Based Access Control (ABAC):
[0041] By comprehensively considering the multi-attribute status information of people, machines, things, and environment, we conduct assessments on aspects such as identity trustworthiness, network environment risk, and physical environment risk. We use trust assessment rules or models to infer trust, and then implement fine-grained access control based on the resource attributes of the accessed data, such as data sensitivity level and access time window.
[0042] Data push:
[0043] After the data access subject is authorized through the ABAC of the network twin, if the network twin has cached the data required by the user, the cached data can be directly pushed to the user. If there is no relevant data, the network twin needs to apply for data access from the cloud-native application side. At this time, a second authentication and authorization mode needs to be carried out, namely the authentication and authorization from the network twin to the cloud-native application.
[0044] Since a network twin is a private security proxy for the accessing subject, it constantly monitors various status information of the subject. The network twin directly uses the comprehensive status information to perform fine-grained authentication and authorization for the accessing subject. While ensuring the security and reliability of user data, it also avoids frequent cloud platform authentication, thereby improving user experience and system efficiency.
[0045] This mainly includes several aspects such as access control gateway, access authorization decision, identity authentication service, resource sensitivity inference, network trust assessment model, security posture analysis, and access control policy model. Among these, the access control gateway, as the policy enforcement point (PEP) in zero-trust security, is the entry point for receiving user requests and initiating the authentication and authorization process. The access authorization decision service, as the policy decision point (PDP) in zero-trust security, is the core of the authentication and authorization process.
[0046] Phase Two: Certification and Authorization from Network Twins to Cloud-Native Applications
[0047] Identity information collection:
[0048] As a private security proxy for the access subject, a cyber twin possesses all the user's identity authentication information. Therefore, a cyber twin can request data access permissions from cloud-native applications on behalf of the subject, while simultaneously sending the identity information to the cloud-native applications for authentication.
[0049] Authorization mechanism—Role-based access control (RBAC):
[0050] Since the network and physical environments in which the network twin exists are stable and controlled, the authentication and authorization at this stage can adopt a role-based access control model. That is, after the user's identity is verified, the role information bound to them can be viewed. The network twin enjoys access to cloud-native application data according to the role assigned to its subject.
[0051] Data caching:
[0052] Once the network twin obtains data access permissions through the RBAC mechanism, it can retrieve the corresponding data from the cloud-native application according to the subject's requirements and temporarily cache the data in its own storage space. Subsequently, if the subject modifies or deletes its data, the network twin can synchronize the subject's data operations with the cloud-native application side at an appropriate time. The purpose of this is to improve data transmission efficiency and reduce the direct access load on the cloud-native application.
[0053] This mainly includes several aspects such as the access control gateway, access authorization decision, identity authentication service, role binding rules, and access control rules. Among these, the access control gateway, as the policy enforcement point (PEP) in zero-trust security, is the entry point for receiving user requests and initiating the authentication and authorization process. The access authorization decision service, as the policy decision point (PDP) in zero-trust security, is the core of the authentication and authorization process.
[0054] like Figure 1-2 As shown, the embodiment provides a two-stage user access authentication and authorization method based on network twins, and the specific implementation steps include:
[0055] S11. The authentication and authorization module of the network twin side, ABAC access control gateway, receives user service access requests and forwards them to the ABAC access authorization decision module.
[0056] In practice, the access control gateway receives user access requests: Service access requests from users or systems are first intercepted by the access control gateway, initiating the authentication and authorization process. The ABAC access control gateway then forwards the request to the ABAC access authorization decision module on the control plane. As a policy enforcement point, the ABAC access control gateway does not directly make access decisions but instead forwards the request to the ABAC access authorization decision module on the control plane. The user service access request includes: network and terminal security information of the network environment, risk information of the physical environment, and the user's identity information, where the user is a person, machine, or object.
[0057] S12. The ABAC access authorization decision module calls the models and services loaded in ABAC, comprehensively evaluates and makes an access authorization decision, and sends the access authorization decision to the ABAC access control gateway. The ABAC access control gateway executes the access authorization decision.
[0058] In practice, the access authorization decision calls various models and services in sequence: First, it calls the network trust assessment model, which specifically performs the following sub-services:
[0059] The ABAC access authorization decision module calls the network trust assessment model, identity authentication service: verifies the user's identity and gives an identity trust score; terminal / access network security assessment: assesses the security of the terminal and access network and gives a network environment trust score; physical environment risk assessment: assesses the security of the physical environment and gives a physical environment trust score; role permission inference model: based on user roles and permission rules, gives a role access permission score.
[0060] The ABAC access authorization decision module calls the resource sensitivity inference service to infer the sensitivity of resources and provide an environmental sensitivity score.
[0061] The ABAC access authorization decision module calls the access control policy model, assesses and infers authorization risks based on the current network trust level assessment and resource sensitivity inference, and obtains an authorization risk score.
[0062] The ABAC access authorization decision module calls the security posture analysis service to analyze the system security posture, monitor abnormal events, provide abnormal event alarm information, and obtain a security posture score.
[0063] The final score is obtained by comprehensively considering identity credibility score, network environment credibility score, physical environment credibility score, role access permission score, environmental sensitivity score, authorization risk score, and security posture score. The score is then compared with a set threshold. If the score is higher than the threshold, the user's business access request is allowed; otherwise, it is rejected.
[0064] The ABAC access control gateway receives access authorization decisions from the control plane and then allows or denies service access requests.
[0065] In one implementation, the models and services loaded into the ABAC include: a network trust assessment model, a resource sensitivity inference service, an access control policy model, and a security posture analysis service. The resource sensitivity inference service is implemented by calling a data or application risk database; the security posture analysis service is implemented by calling logs, indicators, or monitoring databases. The network trust assessment model includes: an identity authentication service, a terminal or access network security assessment service, a physical environment risk assessment service, and a role-based access control inference model. The identity authentication service is implemented by calling a user, device, software, or service feature library; the role-based access control inference model is implemented by calling an identity-role mapping database.
[0066] S13. When allowing user services to access, the RBAC access control gateway, the authentication and authorization module on the cloud-native application side, receives the service access request sent by the ABAC access control gateway and forwards it to the RBAC access authorization decision module.
[0067] In practice, the accessing entity sends a request to access enterprise system resources via the network. The request is then forwarded to the access control gateway, which is the policy enforcement point (PEP) in zero-trust security. The accessing entity can be a human, machine, or thing, or its corresponding network twin. After receiving the user's access request, the RBAC access control gateway (PEP) forwards the request to the RBAC access authorization decision module, transferring the authentication and authorization process to the control plane.
[0068] S14. The RBAC access authorization decision module calls the services and rules loaded in the RBAC, makes an access control policy, and sends the access control policy to the RBAC access control gateway. The RBAC access control gateway executes the access control policy.
[0069] In practice, the RBAC access authorization decision module transmits the received identity authentication information to the RBAC identity authentication service and sends an identity authentication request. The RBAC identity authentication service verifies the user's identity to confirm whether the user's identity is genuine and valid.
[0070] If the user's identity is genuine and valid, the RBAC access authorization decision module will query the role information bound to the user's identity and, according to the role binding rules, clarify the user's currently activated role information;
[0071] Based on the user's role information, the RBAC access authorization decision module confirms the permissions corresponding to the role according to the access control rules. Based on all permissions, it generates an access control policy for the service access request sent by the ABAC access control gateway and sends it to the RBAC access control gateway. The RBAC access control gateway then decides whether to allow the user's service access request based on the received access control policy. If the user's permissions meet the access requirements, access is allowed; otherwise, access is denied.
[0072] In one implementation, the role binding rule is implemented by calling the identity and role mapping database; the access control rule is implemented by calling the role and permission mapping database.
[0073] This embodiment provides a two-stage user access authentication and authorization method based on network twins, including: An authentication and authorization module (ABAC) on the network twin side, the access control gateway, receives a user service access request and forwards it to an ABAC access authorization decision module; the ABAC access authorization decision module calls the models and services loaded in ABAC, comprehensively evaluates and makes an access authorization decision, and sends the access authorization decision to the ABAC access control gateway, which then executes the access authorization decision; when allowing user service access, an authentication and authorization module (RBAC) on the cloud-native application side, the access control gateway, receives the service access request sent by the ABAC access control gateway and forwards it to the RBAC access authorization decision module; the RBAC access authorization decision module calls the services and rules loaded in RBAC, makes an access control policy, and sends the access control policy to the RBAC access control gateway, which then executes the access control policy. This method improves flexibility and fine-grained control during user access authentication, reduces role bloat, supports dynamic environmental changes, optimizes system performance, enhances security, and simplifies management and compliance.
[0074] This patent employs a segmented, composite authentication and authorization model based on network twins, ensuring data security and control while allowing individuals, machines, and objects to fully exercise their data sovereignty. Specific advantages include the following:
[0075] (1) Security. The segmented authentication and authorization mechanism can effectively control the security of data access. Segmented authentication and authorization ensures that users not only have the right to operate on the data they request, but also that they must operate within the required network and physical environment conditions.
[0076] (2) High efficiency. The data caching mechanism ensures that once the subject has the conditions to access the data, it can obtain the required data from the network twin, reducing direct access to cloud-native applications and improving the efficiency of the subject's data operations.
[0077] (3) Flexibility. Attribute-based access control enables the authentication and authorization process to adapt flexibly to dynamic changes in the user environment, providing more granular access control and improving user experience while ensuring data security.
[0078] The advantages of this patent compared to existing technologies are:
[0079] Enhance flexibility and fine-grained control: By combining RBAC and ABAC, basic permission management can be carried out using roles, and fine-grained control can be carried out by combining attributes, making permission management both flexible and in line with real-time dynamic needs.
[0080] Reduce role bloat: RBAC can reduce the number of roles by introducing attributes, eliminating the need to create separate roles for each permission scenario, thereby reducing the risk of role bloat.
[0081] Supports dynamic environment changes: By introducing dynamic attributes (such as access time, location, device, etc.) through ABAC, access control can be automatically adjusted according to the real-time environment, making it more adaptable to modern dynamic access needs.
[0082] Optimize system performance: RBAC provides relatively simple role management and fast verification, while ABAC provides dynamic judgment when needed. Combining the two can reduce performance overhead while satisfying fine-grained control.
[0083] Enhanced security: Access restrictions are further strengthened by limiting access conditions based on attributes. For example, access conditions such as device, network environment, and geographical location can be added in addition to roles, thereby reducing the potential risk of privilege abuse.
[0084] Simplified management and compliance: RBAC provides structured role management, which facilitates auditing and management; at the same time, ABAC's attribute control ensures stricter compliance requirements, thereby maintaining good manageability while meeting complex permission needs.
[0085] This patent is based on a zero-trust security architecture using network twins. It can be deployed on enterprise networks as well as public networks. It can provide users with authentication and authorization when entering the network and "always online" information services. It can fully support the implementation of zero-trust security architecture and has strong versatility.
[0086] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the invention.
[0087] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.
Claims
1. A two-stage user access authentication and authorization method based on network twins, characterized in that, include: The authentication and authorization module of the network twin side, ABAC access control gateway, receives user service access requests and forwards them to the ABAC access authorization decision module; The ABAC access authorization decision module calls the models and services loaded in ABAC, comprehensively evaluates and makes an access authorization decision, and sends the access authorization decision to the ABAC access control gateway, which then executes the access authorization decision. When allowing user business access, the RBAC access control gateway of the cloud-native application side receives the business access request sent by the ABAC access control gateway and forwards it to the RBAC access authorization decision module. Specifically, after the data access subject is authorized by the network twin through ABAC, if the network twin has cached the data required by the user, the cached data is directly pushed to the user. If there is no relevant data, the network twin applies for data access from the cloud-native application side and carries out the second authentication and authorization mode, that is, the authentication and authorization from the network twin to the cloud-native application. The network twin directly performs fine-grained authentication and authorization for the access subject based on the comprehensive status information. The RBAC access authorization decision module calls the services and rules loaded in RBAC, makes an access control policy, and sends the access control policy to the RBAC access control gateway, which then executes the access control policy.
2. The method according to claim 1, characterized in that, The user service access request includes: network and terminal security information of the network environment, risk information of the physical environment, and user identity information, wherein the user is a person, machine, or thing.
3. The method according to claim 2, characterized in that, The models and services loaded in ABAC include: network trust assessment model, resource sensitivity inference service, access control policy model, and security posture analysis service.
4. The method according to claim 3, characterized in that, The resource sensitivity inference service is implemented by calling a data or application risk database; the security situation analysis service is implemented by calling logs, indicators, or monitoring databases.
5. The method according to claim 3, characterized in that, The network trust assessment model includes: identity authentication service, terminal or access network security assessment service, physical environment risk assessment service, and role and permission inference model.
6. The method according to claim 5, characterized in that, The identity authentication service is implemented by calling a user, device, software, or service feature library; the role permission inference model is implemented by calling an identity-role mapping database.
7. The method according to claim 5, characterized in that, The ABAC access authorization decision module calls the loaded models and services to comprehensively evaluate and make access authorization decisions, specifically including: The ABAC access authorization decision module calls the network trust assessment model to verify the user's identity and give an identity trust score; assess the security of the terminal and the access network and give a network environment trust score; assess the security of the physical environment and give a physical environment trust score; and give a role access permission score based on user roles and permission rules. The ABAC access authorization decision module calls the resource sensitivity inference service to infer the sensitivity of resources and provide an environmental sensitivity score. The ABAC access authorization decision module calls the access control policy model, assesses and infers authorization risks based on the current network trust level assessment and resource sensitivity inference, and obtains an authorization risk score. The ABAC access authorization decision module calls the security posture analysis service to analyze the system security posture, monitor abnormal events, provide abnormal event alarm information, and obtain a security posture score. The final score is obtained by comprehensively considering identity credibility score, network environment credibility score, physical environment credibility score, role access permission score, environmental sensitivity score, authorization risk score, and security posture score. The score is then compared with a set threshold. If the score is higher than the threshold, the user's business access request is allowed; otherwise, it is rejected.
8. The method according to claim 7, characterized in that, The access subject of the service access request sent by the ABAC access control gateway is a person, machine, or thing, or its corresponding network twin; the service access request sent by the ABAC access control gateway also includes identity authentication information.
9. The method according to claim 8, characterized in that, The RBAC access authorization decision module invokes the services and rules loaded in the RBAC, formulates an access control policy, and sends the access control policy to the RBAC access control gateway, specifically including: The RBAC access authorization decision module transmits the received identity authentication information to the RBAC identity authentication service and sends an identity authentication request. The RBAC identity authentication service verifies the user's identity and confirms whether the user's identity is genuine and valid. If the user's identity is genuine and valid, the RBAC access authorization decision module will determine the user's currently activated role information according to the role binding rules; Based on the user's role information, the RBAC access authorization decision module confirms the permissions corresponding to the role according to the access control rules, generates the access control policy for the service access request sent by the ABAC access control gateway based on all permissions, and sends it to the RBAC access control gateway.
10. The method according to claim 9, characterized in that, The role binding rules are implemented by calling the identity and role mapping database; the access control rules are implemented by calling the role and permission mapping database.