A data element-based access control method and system

Abstract

The application discloses a data element type access control method and system, and relates to the field of data access processing, and comprises the following steps: creating a data element model; wherein the data element model comprises data and an embedded policy execution engine, the data comprises encrypted data and access control policy information; transmitting the data element model to a target environment; when a user initiates a data access request, the embedded policy execution engine verifies the access control policy according to the data access request; if the access control policy verification is successful, the embedded policy execution engine decrypts the encrypted data in the data and executes corresponding data processing operations according to the data access request, and returns a processing result. The application realizes controllable flow of data by inseparably binding data and control policy into a whole and adopting a simplified control mechanism based on task starting time.

Description

Technical Field

[0001] This invention relates to the field of data access control technology, and in particular to a data element-based access control method and system. Background Technology

[0002] With the rapid development of the digital economy and the increasing prominence of the value of data elements, the demand for data circulation among different organizations, systems, and users is constantly growing. In traditional data circulation models, data and control strategies are usually separate. Data owners protect data through database permission management, API access control, or file permissions, but these control strategies are often limited to the original storage environment of the data. Once data is downloaded, copied, or transferred to other environments, the original control strategies become completely ineffective, and data usage will fall outside the control of the data owner.

[0003] In existing access control systems, data and control policies exist independently. Once data leaves its original control environment, the policy ceases to function. Users can freely copy, store, or use data beyond their authorized scope, without the data owner's awareness or control, posing a serious data security risk. For example, existing access control systems such as RBAC and ABAC only perform permission verification at the data access point. After successful verification, users directly obtain the original data, resulting in a "one-time verification, subsequent loss of control" problem.

[0004] Moreover, existing time-based access control technologies fall into two extremes: either they perform one-time verification only when a user logs in or initiates a request, failing to handle time constraints during task execution; or they attempt complex real-time monitoring and interruption control during task execution, but this approach suffers from complex implementation, difficulty in guaranteeing data consistency, and high system performance overhead, making it unreliable in practical applications. For most data usage scenarios, control based on task startup time is sufficient to meet security requirements, but existing technologies do not offer a solution that balances security and practicality.

[0005] Furthermore, existing policy enforcement often relies on the cooperation of clients or third-party systems, which poses a risk of policy bypassing, tampering, or failure. Especially in multi-party collaboration scenarios, it is difficult to ensure that all participants strictly adhere to data usage policies, resulting in insufficient enforcement capabilities. Summary of the Invention

[0006] To address the technical problems existing in the background art, this invention proposes a data element-based access control method and system.

[0007] In a first aspect, the present invention proposes a data element-based access control method, comprising:

[0008] Create a data element model; wherein, the data element model includes data components and an embedded policy execution engine, and the data components include encrypted data and access control policy information;

[0009] Transmit the data element model to the target environment;

[0010] When a user initiates a data access request, the embedded policy execution engine verifies the access control policy based on the data access request; if the access control policy verification fails, the data access request is rejected.

[0011] If the access control policy verification is successful, the embedded policy execution engine decrypts the encrypted data in the data file and performs the corresponding data processing operation according to the data access request, and returns the processing result.

[0012] Preferably, the data element model further includes a lifecycle management module, which includes a cross-platform adaptation sub-module and is communicatively connected to the embedded policy execution engine.

[0013] After the data element model is transmitted to the target environment, the embedded policy execution engine automatically detects the runtime environment characteristics of the target environment. The cross-platform adaptation submodule performs adaptation processing and machine time zone unification according to the runtime environment characteristics of the target environment.

[0014] Preferably, the lifecycle management module further includes an audit and monitoring submodule, which is communicatively connected to the embedded policy execution engine;

[0015] After rejecting this data access request, the rejection record will be logged in the audit monitoring submodule as an audit log.

[0016] After returning the processing result, the detailed information of the data processing operation is recorded in the audit monitoring submodule in the form of an audit log;

[0017] When the full lifecycle management of the data element model ends or the data element model is destroyed, the audit monitoring submodule solidifies all audit logs by constructing a Merkle tree to perform hash fingerprinting, and puts the solidified root hash on the chain.

[0018] Preferably, creating a data element model includes:

[0019] The original data is encrypted to obtain encrypted data;

[0020] Encapsulate encrypted data and preset access control policy information into data files;

[0021] Generate an integrity check code based on the data file;

[0022] The integrity of the data file is verified based on the integrity check code.

[0023] If the verification passes, the cross-platform adaptation submodule will serialize and store the data.

[0024] Calculate the hash fingerprint of the serialized data item, and put the hash fingerprint of the data item, the creator's identity, the creator's address, the creation timestamp, and the digest of the access control policy information on the blockchain to obtain the on-chain transaction ID;

[0025] Store the on-chain transaction ID in the audit and monitoring submodule;

[0026] Based on the data element, the embedded policy execution engine, and the lifecycle management module, a data element model is obtained.

[0027] Preferably, after the cross-platform adaptation submodule performs adaptation processing based on the operating environment characteristics of the target environment and unifies the machine time zone, it further includes:

[0028] The embedded policy execution engine recalculates the hash fingerprint of the data item, queries the hash fingerprint record on the chain using the on-chain transaction ID, and performs on-chain integrity verification based on the recalculated hash fingerprint of the data item and the on-chain hash fingerprint record.

[0029] When on-chain integrity verification is successful, it indicates that the data element model is trustworthy, and the data element model is saved and used. When on-chain integrity verification fails, the network connection is checked, and on-chain integrity verification is re-performed after a preset interval. When on-chain integrity verification fails three times in a row, it indicates that the data element model has been tampered with, and the data element model is securely destroyed. The audit and monitoring submodule records the security event and notifies the creator.

[0030] Preferably, on-chain integrity verification is performed based on the recalculated hash fingerprint of the data item and the on-chain hash fingerprint record, specifically including:

[0031] The hash fingerprint of the recalculated data item is compared with the fingerprint information in the hash fingerprint record on the chain; if the fingerprint information matches, the on-chain integrity verification is confirmed to be successful; if the fingerprint information does not match, the on-chain integrity verification is confirmed to be unsuccessful.

[0032] Preferably, the access control policy information includes policies in four dimensions: time control policy, user permission control policy, data restriction policy, and network control policy. Among them, the time control policy includes validity period, access time window, and working time limit; the user permission control policy includes user whitelist, operation type restriction, and data range restriction; the data restriction policy includes maximum number of accesses and query frequency limit; and the network control policy includes restrictions on device location, device IP, public / private network, or local environment.

[0033] Preferably, during the process of the embedded policy execution engine verifying the access control policy based on the data access request, the embedded policy execution engine performs layered verification of the data access request in the order of time control policy, network control policy, data restriction policy, and user permission control policy. If any stage fails, the subsequent verification will be terminated.

[0034] Secondly, the present invention also proposes a data element-based access control system, comprising: a data element model creation module and an embedded policy execution engine;

[0035] The data element model creation module is used to construct data elements and create data element models based on the data elements and the embedded policy execution engine; wherein, the data element model includes data elements and the embedded policy execution engine; wherein, the data elements include encrypted data and access control policy information;

[0036] Once the data element is transmitted to the target environment, the embedded policy execution engine performs access control policy verification based on the data access request when the user initiates a data access request; if the access control policy verification fails, the data access request is rejected.

[0037] If the access control policy verification is successful, the embedded policy execution engine decrypts the data file and performs the corresponding data processing operations, returning the processing results.

[0038] Preferably, it also includes a lifecycle management module, which includes a cross-platform adaptation sub-module and is communicatively connected to the embedded policy execution engine.

[0039] The data element model is used to create a data element model based on data elements, an embedded policy execution engine, and a lifecycle management module; the data element model includes data elements, an embedded policy execution engine, and a lifecycle management module.

[0040] After the data element model is transmitted to the target environment, the embedded policy execution engine is used to automatically detect the runtime environment characteristics of the target environment, and the cross-platform adaptation submodule is used to perform adaptation processing and machine time zone unification according to the runtime environment characteristics of the target environment.

[0041] Preferably, the lifecycle management module further includes an audit and monitoring submodule, which is communicatively connected to the embedded policy execution engine;

[0042] After rejecting this data access request, the embedded policy execution engine will record the rejection in the audit monitoring submodule as an audit log.

[0043] After returning the processing result, the embedded policy execution engine records the detailed information of the data processing operation in the audit monitoring submodule in the form of an audit log;

[0044] When the full lifecycle management of the data element model ends or the data element model is destroyed, the audit monitoring submodule solidifies all audit logs by constructing a Merkle tree to perform hash fingerprinting, and puts the solidified root hash on the chain.

[0045] In this invention, the proposed data element-based access control method and system encapsulate encrypted data obtained from the original data and preset access control policies into inseparable data elements through the data elements in the created data element model. This ensures that the original data cannot escape the control of the access control policy in any environment, fundamentally solving the control failure problem caused by the separation of data and policy. Furthermore, when a user initiates a data access request, the embedded policy execution engine verifies the access control policy based on the data access request. That is, it adopts a control policy based on task start time, verifying the legality of the time window when the task starts. Once the verification is successful, the task is allowed to complete, avoiding complex real-time monitoring and interrupt handling. While ensuring security, it significantly reduces system complexity and simplifies the time control mechanism.

[0046] Moreover, by integrating an independent embedded policy execution engine within the data element, it ensures that access control policies can be executed autonomously without relying on external systems or client cooperation, eliminating the risk of policies being bypassed or tampered with.

[0047] Furthermore, by directly embedding access control policies into the data access process, this invention ensures that every data operation must be verified by the access control policies, thereby guaranteeing the enforcement of the access control policies and improving the reliability of data security control. Attached Figure Description

[0048] Figure 1 This is a flowchart illustrating a data element-based access control method in one embodiment of the present invention. Detailed Implementation

[0049] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0050] Firstly, referring to Figure 1 The present invention proposes a data element-based access control method, comprising:

[0051] Create a data element model; the data element model includes data components and an embedded policy execution engine, and the data components include encrypted data and access control policies;

[0052] Transmit the data element model to the target environment;

[0053] When a user initiates a data access request, the embedded policy execution engine verifies the access control policy based on the data access request; if the access control policy verification fails, the data access request is rejected.

[0054] If the access control policy verification is successful, the embedded policy execution engine decrypts the encrypted data in the data file and performs the corresponding data processing operation according to the data access request, and returns the processing result.

[0055] In this invention, the proposed data element-based access control method and system encapsulate encrypted data obtained from the original data and preset access control policies into inseparable data elements through the data elements in the created data element model. This ensures that the original data cannot escape the control of the access control policy in any environment, fundamentally solving the control failure problem caused by the separation of data and policy.

[0056] Furthermore, when a user initiates a data access request, the embedded policy execution engine verifies the access control policy based on the data access request. That is, it adopts a control policy based on the task start time, verifies the legality of the time window when the task starts, and allows the task to complete once the verification is successful. This avoids complex real-time monitoring and interrupt handling, significantly reduces system complexity and simplifies the time control mechanism while ensuring security.

[0057] Moreover, by integrating an independent embedded policy execution engine within the data element, it does not rely on external systems or client cooperation, ensuring that access control policies can be executed autonomously on various platforms such as different operating systems, container environments, and cloud environments. No additional infrastructure deployment is required, which significantly reduces system complexity, deployment costs, and operational difficulties, and eliminates the risk of policies being bypassed or tampered with.

[0058] Furthermore, by directly embedding access control policies into the data access process, this invention ensures that every data operation must be verified by the access control policies, thereby guaranteeing the enforcement of the access control policies and improving the reliability of data security control.

[0059] The preset access control policy information in this embodiment includes policies in four dimensions: time control policy, user permission control policy, data restriction policy, and network control policy. The policies are logically ANDed with each other, and all of them must be satisfied before data operations can be performed.

[0060] The time control strategy includes time constraints such as validity period, access time window, and working time limit; the user permission control strategy includes permission constraints such as user whitelist, operation type restriction, and data range restriction; the data restriction strategy includes usage constraints such as maximum number of accesses and query frequency limit; and the network control strategy includes restrictions on the location of the device used, the IP address of the device used, and public / private network or local environment.

[0061] During the process of the embedded policy execution engine verifying access control policies based on data access requests, layered verification is performed in the order of time control policy, network control policy, data restriction policy, and user permission control policy. If any stage fails, the subsequent verification will be terminated.

[0062] During the verification process of time control, the time control verification is carried out by combining UTC base time and local time zone information to ensure the consistency of time policy deployed across time zones.

[0063] In this embodiment, the data element model also includes a lifecycle management module, which includes a cross-platform adaptation sub-module and is communicatively connected to the embedded policy execution engine.

[0064] After the data element model is transmitted to the target environment, the embedded policy execution engine automatically detects the runtime environment characteristics of the target environment. The cross-platform adaptation submodule performs adaptation processing and machine time zone unification according to the runtime environment characteristics of the target environment.

[0065] With this configuration, the data element model in this invention can be adapted to the operating environment characteristics of the target environment, has a wide range of applications, and can maintain consistent control behavior in different computing environments, operating systems and network environments, thus solving the problem of inconsistent control in cross-environment applications in existing technologies.

[0066] In a further embodiment, the lifecycle management module also includes an audit and monitoring submodule, which is communicatively connected to the embedded policy execution engine;

[0067] After rejecting this data access request, the rejection record will be logged in the audit monitoring submodule as an audit log.

[0068] After returning the processing result, the detailed information of the data processing operation is recorded in the audit monitoring submodule in the form of an audit log;

[0069] When the full lifecycle management of the data element model ends or the data element model is destroyed, the audit monitoring submodule solidifies all audit logs by constructing a Merkle tree to perform hash fingerprinting, and puts the solidified root hash on the chain.

[0070] With this configuration, the audit monitoring submodule in this embodiment can perform full lifecycle management and auditing of the data element model, and upload the audit logs to the blockchain as fingerprints at the end of the lifecycle to form a complete trust chain.

[0071] Specifically, the audit and monitoring submodule includes pre-defined access control policy control mechanisms, status monitoring and update mechanisms, expiration handling mechanisms, secure destruction mechanisms, log fingerprint on-chain mechanisms, and log transmission mechanisms. The access control policy control mechanism ensures that every data access must be verified by the access control policy throughout the entire lifecycle of the component, thus ensuring the continuous effectiveness of the control policy. The status monitoring and update mechanism monitors usage and updates the component status. The expiration handling mechanism prohibits access after expiration and cleans up sensitive data in memory. The secure destruction mechanism ensures the secure removal of data from memory and storage. The log fingerprint on-chain mechanism calculates the execution log hash fingerprint of the data component model and uploads it to the blockchain along with the data component fingerprint and timestamp, recording the creator's address, component fingerprint, creation time, and execution log fingerprint. After being uploaded to the blockchain, the on-chain transaction ID serves as the "death certificate" of the data model. The log transmission mechanism transmits the data component model's behavior log along with the "death certificate" to the component creator, facilitating the creator's audit process.

[0072] In this embodiment, creating a data element model includes:

[0073] Obtain the raw data;

[0074] The original data is encrypted to obtain encrypted data;

[0075] Encapsulate encrypted data and preset access control policies into data files, and generate integrity verification codes based on the data files;

[0076] The integrity of the data file is verified based on the integrity check code.

[0077] If the verification passes, the cross-platform adaptation submodule will serialize and store the data.

[0078] Calculate the hash fingerprint of the serialized data item, and put the hash fingerprint of the data item, the creator's identity, the creator's address, the creation timestamp, and the digest of the access control policy information on the blockchain to obtain the on-chain transaction ID;

[0079] Store the on-chain evidence information in the lifecycle management module;

[0080] Based on the data element, the embedded policy execution engine, and the lifecycle management module, a data element model is obtained.

[0081] This embodiment encapsulates the encrypted original data and preset access control policies into an inseparable data component, ensuring that the original data cannot escape the control of the access control policy in any environment. Integrity verification is performed after data component encapsulation, effectively guaranteeing the integrity of the data component. Furthermore, the cross-platform adaptation submodule serializes the verified data component into a standard format, facilitating adaptation to different platforms. In addition, a dual blockchain evidence storage system is formed by uploading data to the blockchain at creation and at the end of the lifecycle (audit logs). A trusted root is established when the data component model is created, and integrity is verified after the data component model is transmitted. Combined with full lifecycle management and all audit logs at the end of the audit, a complete trust chain is formed. Compared to traditional single-point verification schemes, this effectively prevents data tampering, forgery, and abuse, significantly improving data credibility and audit traceability capabilities.

[0082] Of course, this embodiment also assigns a version number to each data element model to ensure that different versions of data element models can be correctly identified and processed, supporting backward compatibility with technological evolution.

[0083] In the process of calculating the hash fingerprint of a serialized data item, this embodiment uses AES-256 to perform hash processing on the serialized data item to calculate the hash fingerprint of the serialized data item and use it as an inherent attribute of the data item. Any data tampering will cause the hash verification to fail, thereby denying access.

[0084] During the serialization process of data files, the cross-platform adaptation submodule uses a combination of Java standard serialization mechanism and Base64 encoding to serialize data files, ensuring data transmission compatibility across different platforms. It automatically handles byte order differences between different platforms, avoids data parsing errors, and automatically removes platform-specific characters from the file names of data files, generating a cross-platform compatible standard file name format.

[0085] The timestamp in this embodiment uses UTC base time.

[0086] Specifically, in this embodiment, the data element model is transmitted to the target environment through network transmission, file copying, etc., so that the data element model can circulate between different environments. The encrypted data and the preset access control policy are always bound together and inseparable.

[0087] In a further embodiment, after the cross-platform adaptation submodule performs adaptation processing and machine time zone unification based on the operating environment characteristics of the target environment, it also includes:

[0088] The embedded policy execution engine recalculates the hash fingerprint of the data item, queries the on-chain hash fingerprint record using the on-chain transaction ID stored in the audit monitoring submodule, and performs on-chain integrity verification based on the recalculated hash fingerprint of the data item and the on-chain hash fingerprint record.

[0089] When on-chain integrity verification is successful, it indicates that the data element model is trustworthy, and the data element model is saved and used. When on-chain integrity verification fails, the network connection is checked, and on-chain integrity verification is re-performed after a preset interval. When on-chain integrity verification fails three times in a row, it indicates that the data element model has been tampered with, and the data element model is securely destroyed. The audit and monitoring submodule records the security event and notifies the creator.

[0090] This configuration establishes a trusted root source during data element model creation and verifies the integrity of the data element model after its complete transmission, effectively preventing data tampering, forgery, and abuse, and improving data credibility. Furthermore, through intelligent retry mechanisms and fault-tolerant design, basic functionality remains available even in the event of network anomalies or service interruptions, demonstrating stronger robustness and higher availability compared to traditional solutions that heavily rely on centralized services.

[0091] During on-chain integrity verification, the hash fingerprint of the recalculated data item is compared with the fingerprint information in the hash fingerprint record on the chain. If the fingerprint information matches, the on-chain integrity verification is confirmed to be successful; if the fingerprint information does not match, the on-chain integrity verification is confirmed to be unsuccessful.

[0092] During the execution of corresponding data processing operations based on data access requests, the system automatically routes data to the appropriate data processing logic based on the operation type in the data access request, such as query, aggregation, summarization, and analysis. The system uses the Java Stream API to implement streaming data processing, supporting efficient memory processing of large datasets.

[0093] During the process of returning the processing results, the number of records returned is dynamically limited according to the preset access control policy to ensure the effective execution of data access control.

[0094] Secondly, the present invention also proposes a data element-based access control system, comprising: a data element model creation module and an embedded policy execution engine;

[0095] The data element model creation module is used to construct data elements and create data element models based on the data elements and the embedded policy execution engine; wherein, the data element model includes data elements and the embedded policy execution engine; wherein, the data elements include encrypted data and access control policy information;

[0096] Once the data element is transmitted to the target environment, the embedded policy execution engine performs access control policy verification based on the data access request when the user initiates a data access request; if the access control policy verification fails, the data access request is rejected.

[0097] If the access control policy verification is successful, the embedded policy execution engine decrypts the data file and performs the corresponding data processing operations, returning the processing result.

[0098] In this embodiment, a lifecycle management module is also included. The lifecycle management module includes a cross-platform adaptation sub-module, and the cross-platform adaptation sub-module is communicatively connected to the embedded policy execution engine.

[0099] The data element model is used to create a data element model based on data elements, an embedded policy execution engine, and a lifecycle management module; the data element model includes data elements, an embedded policy execution engine, and a lifecycle management module.

[0100] After the data element model is transmitted to the target environment, the embedded policy execution engine is used to automatically detect the runtime environment characteristics of the target environment, and the cross-platform adaptation submodule is used to perform adaptation processing and machine time zone unification according to the runtime environment characteristics of the target environment.

[0101] The cross-platform adaptation submodule in this embodiment includes: an environment abstraction layer, a serialization adapter, and a time zone processor; the environment abstraction layer is used to provide a unified environment information interface to shield the differences between different platforms; the serialization adapter is used to ensure the compatibility of data elements transmitted between different platforms; the time zone processor is used to handle cross-time zone time control logic to ensure the consistency of time policies.

[0102] Specifically, the environment abstraction layer includes:

[0103] Unified Environment Information Interface: Abstracts the differences between different operating systems and runtime environments into a unified environment information model, shielding platform-specific implementation details;

[0104] System attribute standardization processing mechanism: Collect various system attributes and standardize them to provide a consistent environmental data format for policy execution;

[0105] Dynamic environment adaptation mechanism: Automatically adjust system behavior based on detected environmental characteristics, such as automatic handling of platform differences such as path separators and character encoding.

[0106] Specifically, the serialization adapter includes:

[0107] Cross-platform serialization protocol: It adopts a combination of Java standard serialization and Base64 encoding to ensure data transmission compatibility across different platforms;

[0108] Unified byte order processing mechanism: Automatically handles byte order differences between different platforms through a standard serialization mechanism to avoid data parsing errors;

[0109] File naming normalization algorithm: Automatically removes platform-specific characters from filenames and generates a standard filename format that is compatible with both platforms.

[0110] Specifically, the time zone processor includes:

[0111] UTC reference time system: Uses UTC time as the internal time reference to eliminate time calculation differences in different time zone environments;

[0112] Automatic local time zone conversion mechanism: Automatically converts the time zone when local time is required to ensure the accuracy of business time control;

[0113] Time precision standardization mechanism: Use millisecond-level time precision to ensure consistency and accuracy of time comparisons across platforms.

[0114] In a further embodiment, the lifecycle management module also includes an audit and monitoring submodule, which is communicatively connected to the embedded policy execution engine;

[0115] After rejecting this data access request, the embedded policy execution engine will record the rejection in the audit monitoring submodule as an audit log.

[0116] After returning the processing result, the embedded policy execution engine records the detailed information of the data processing operation in the audit monitoring submodule in the form of an audit log;

[0117] When the full lifecycle management of the data element model ends or the data element model is destroyed, the audit monitoring submodule solidifies all audit logs by constructing a Merkle tree to perform hash fingerprinting, and puts the solidified root hash on the chain.

[0118] In this embodiment, the audit monitoring module is used to perform full lifecycle management and auditing of data elements after they are loaded in the target environment, and to upload the audit logs to the blockchain as fingerprints at the end of the lifecycle to form a complete trust chain.

[0119] The audit monitoring module includes an operation logger, a blockchain validator, and an audit report generator. The operation logger records detailed information for each data access, including user, time, operation type, and result. The blockchain validator is an optional blockchain integration that provides proof of the immutability of operation records. The audit report generator generates audit reports that include operation statistics and violation detection.

[0120] Specifically, the operation recorder includes:

[0121] Structured audit log generation mechanism: Generates structured audit records for each data operation, including timestamps, user identifiers, operation types, execution results, and environment information;

[0122] Real-time operation tracking mechanism: Audit logs are generated synchronously at key nodes in the execution of data operations to ensure a complete record of the operation trajectory;

[0123] Standardized audit information format: Adopting a unified log format and field definition facilitates subsequent log analysis and compliance checks.

[0124] Specifically, blockchain validators include:

[0125] Hash chain integrity protection mechanism: Construct a hash chain structure based on SHA-256 for audit logs, with each record containing the hash value of the previous record, ensuring the immutability of audit logs;

[0126] Chained verification algorithm: Provides complete hash chain verification functionality, capable of detecting record tampering or loss at any position in the chain;

[0127] Incremental hashing mechanism: The hash of records is calculated incrementally to avoid repeated calculation of a large amount of historical data and improve verification efficiency.

[0128] Specifically, the audit report generator includes:

[0129] Multi-dimensional statistical analysis mechanism: Performs statistical analysis on audit data from multiple dimensions such as total volume, success rate, and user distribution to generate a comprehensive audit report;

[0130] Real-time statistical calculation mechanism: Real-time statistical calculation is performed based on audit data in memory, supporting dynamic operation monitoring and analysis;

[0131] Standardized report format: Generates audit reports with a uniform format, including key indicators and anomaly detection results, meeting compliance audit requirements.

[0132] During the creation of the data element model, the data element model creation module is used to encrypt the original data to obtain encrypted data, and encapsulate the pre-set access control policy information and the encrypted data into a data element; generate an integrity check code based on the data element, and verify the integrity of the data element based on the integrity check code;

[0133] The cross-platform adaptation submodule is used to serialize and store data items that have passed integrity verification;

[0134] The data element model creation module is also used to calculate the hash fingerprint of the serialized data element, and put the hash fingerprint of the data element, the creator's identity, the creator's address, the creation timestamp, and the digest of access control policy information on the chain to obtain the on-chain transaction ID; and store the on-chain transaction ID in the audit and monitoring sub-module in the lifecycle management module; and obtain the data element model based on the data element, the embedded policy execution engine, and the lifecycle management module.

[0135] The data element model creation module in this embodiment includes a data encryption processing unit, a policy embedding unit, and an integrity protection unit. The data encryption processing unit is responsible for encrypting the original data to obtain encrypted data, ensuring the security of the data content. The policy embedding unit encapsulates access control policies and encrypted data into data elements for inseparable binding. The integrity protection unit generates integrity verification codes for the data and policies based on the data elements to prevent tampering and verifies the integrity of the data elements based on the integrity verification codes.

[0136] In this embodiment, a policy configuration module is also included, which is used to configure access control policies.

[0137] In one specific embodiment, the policy configuration module includes a time control policy configurator, a permission control rule configurator, and a usage count control configurator; wherein, the time control policy configurator is used to support the configuration of time constraints such as validity period, access time window, and working time limit; the permission control rule configurator is used to support the configuration of permission constraints such as user whitelist, operation type restriction, and data range restriction; and the usage count control configurator is used to support the configuration of usage constraints such as maximum access count and query frequency limit.

[0138] Specifically, the time control strategy configurator configuration includes:

[0139] Relative time control algorithm: Calculates validity period based on component creation timestamp, avoiding time zone differences caused by absolute time settings and ensuring consistency of time control across environments;

[0140] Layered time constraint mechanism: Supports the combined application of multiple layers of time constraints such as validity period, working time, and working day. Access will be denied if any layer of constraint fails.

[0141] Pre-processing for time verification: Perform time validity checks before data operations are executed, using verification at task startup rather than real-time monitoring to simplify implementation complexity.

[0142] Specifically, the access control rule configurator includes:

[0143] Whitelist access control model: It adopts an explicit authorization mechanism, allowing access only to users on the user list, and rejecting access requests without explicit authorization by default;

[0144] User identity string matching verification: User authentication is performed through precise string matching, avoiding complex permission reasoning and calculation processes;

[0145] Immutability of permission configuration: Once permission configuration is set and encapsulated in a component, it cannot be dynamically modified at runtime, ensuring the stability of permission control.

[0146] Specifically, the usage count control configurator includes:

[0147] Multi-dimensional limit parameter settings: Supports independent configuration of various resource limit parameters such as total number of operations, number of records in a single query, and memory usage;

[0148] Preset threshold control mechanism: Various limit thresholds are preset when the component is created, and real-time comparison and verification are performed at runtime through counters or resource monitoring;

[0149] Enforcement of resource limits: When any resource limit reaches the threshold, the operation is immediately terminated and a failure result is returned to ensure the effectiveness of resource control.

[0150] The embedded policy execution engine in this embodiment includes: an environment detector, an access control policy verifier, and a data decryption and processor. The environment detector is used to automatically identify the current operating environment, including information such as the operating system, network environment, and time zone. The access control policy verifier is used to verify whether the current request and environment information comply with the preset access control policy. The data decryption and processor is used to decrypt the data and perform the corresponding data operation according to the request after the access control policy verification is passed.

[0151] Specifically, the embedded policy execution engine includes: an environment detector, a policy verifier, a data decryption unit, and a processor. The environment detector includes:

[0152] Automatic runtime environment identification algorithm: Automatically determines the current runtime environment type, such as operating system, container, and cloud environment, based on multiple indicators such as system attributes, file system characteristics, and environment variables;

[0153] Network environment classification mechanism: Based on IP address range and network interface information, it automatically identifies private networks, public networks and local environments, providing a basis for network control policies;

[0154] Environmental feature vector construction function: Integrates various detected environmental information into a structured environmental feature description, providing a unified data foundation for subsequent strategy adaptation.

[0155] The policy validator includes:

[0156] Multi-stage verification pipeline: Layered verification is performed in the order of time rules, network rules, and resource constraints. If any stage fails, the subsequent verification will be terminated.

[0157] Environment adaptability verification algorithm: Dynamically adjust verification parameters based on detected runtime environment characteristics, such as automatically halving the memory limit in a container environment;

[0158] Time zone-aware time verification mechanism: Combines UTC base time and local time zone information to perform time control verification, ensuring the consistency of time policies deployed across time zones.

[0159] The data decryption and processor include:

[0160] Operation type routing and distribution mechanism: Automatically routes requests to the corresponding data processing logic based on the operation type (query, aggregation, summary, analysis);

[0161] Streaming data processing technology: It uses the Java Stream API to implement streaming data processing and supports efficient memory processing of large datasets;

[0162] Result set dynamic filtering algorithm: Dynamically limits the number of records returned in the result set according to the strategy configuration to ensure the effective execution of data access control.

[0163] The present invention will now be described in conjunction with specific embodiments. Example 1

[0164] This embodiment proposes a data element-based access control method, including:

[0165] The original data is encrypted to obtain encrypted data;

[0166] Encrypted data and preset access control policy information are encapsulated into a data file; the access control policy information includes policies in four dimensions: time control policy, user permission control policy, data restriction policy, and network control policy.

[0167] Generate an integrity check code based on the data file;

[0168] The integrity of the data file is verified based on the integrity check code.

[0169] If the verification passes, the cross-platform adaptation submodule in the lifecycle management module will serialize and store the data.

[0170] Calculate the hash fingerprint of the serialized data item, and put the hash fingerprint, creator identity, creator address, creation timestamp, and access control policy information summary of the data item on the blockchain to obtain the on-chain transaction ID; and store the on-chain transaction ID in the audit and monitoring submodule of the lifecycle management module;

[0171] Based on the data components, the embedded policy execution engine, and the lifecycle management module, a data component model is obtained. The data component model includes data components, the embedded policy execution engine, and the lifecycle management module. The data components include encrypted data and access control policy information. The lifecycle management module includes a cross-platform adaptation submodule and an audit and monitoring submodule that communicate with the embedded policy execution engine.

[0172] Transmit the data element model to the target environment;

[0173] After the data element model is transmitted to the target environment, the embedded policy execution engine automatically detects the runtime environment characteristics of the target environment, and the cross-platform adaptation submodule performs adaptation processing and machine time zone unification according to the runtime environment characteristics of the target environment.

[0174] The embedded policy execution engine recalculates the hash fingerprint of the data item, queries the on-chain hash fingerprint record using the on-chain transaction ID stored in the audit monitoring submodule, and performs on-chain integrity verification based on the recalculated hash fingerprint of the data item and the on-chain hash fingerprint record.

[0175] When on-chain integrity verification fails, the network connection is checked and on-chain integrity verification is re-performed after a preset interval. When on-chain integrity verification fails three times in a row, it indicates that the data element model has been tampered with. The data element model is then securely destroyed, and the audit and monitoring submodule records the security event and notifies the creator.

[0176] When the on-chain integrity verification is successful, it indicates that the data element model is trustworthy, and the data element model can be saved and used.

[0177] When a user initiates a data access request, the embedded policy execution engine verifies the access control policy based on the data access request. The embedded policy execution engine performs layered verification of the data access request in the order of time control policy, network control policy, data restriction policy, and user permission control policy. If any stage fails, the subsequent verification will be terminated.

[0178] If the access control policy verification fails, the data access request will be rejected, and the rejection record will be recorded in the audit monitoring submodule in the form of an audit log.

[0179] If the access control policy verification is successful, the embedded policy execution engine decrypts the encrypted data in the data file and performs the corresponding data processing operation according to the data access request. The processing result is returned and the detailed information of the data processing operation is recorded in the audit monitoring submodule in the form of audit log.

[0180] When the full lifecycle management of the data element model ends or the data element model is destroyed, the audit monitoring submodule solidifies all audit logs by constructing a Merkle tree to perform hash fingerprinting, and puts the solidified root hash on the chain.

[0181] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A data element-based access control method, characterized in that, include: Create a data element model; wherein, the data element model includes data components, a lifecycle management module and an embedded policy execution engine, the data components include encrypted data and access control policy information, the lifecycle management module includes a cross-platform adaptation sub-module, and the cross-platform adaptation sub-module communicates with the embedded policy execution engine; The data element model is transmitted to the target environment. After the data element model is transmitted to the target environment, the embedded policy execution engine automatically detects the runtime environment characteristics of the target environment. The cross-platform adaptation submodule performs adaptation processing and machine time zone unification according to the runtime environment characteristics of the target environment. When a user initiates a data access request, the embedded policy execution engine verifies the access control policy based on the data access request. If the access control policy verification fails, the data access request is rejected. If the access control policy verification succeeds, the embedded policy execution engine decrypts the encrypted data in the data file and performs the corresponding data processing operation according to the data access request, and returns the processing result. Creating a data element model includes: The original data is encrypted to obtain encrypted data; the encrypted data and preset access control policy information are encapsulated into a data component; an integrity check code is generated based on the data component; the integrity of the data component is verified based on the integrity check code; if the verification passes, the cross-platform adaptation submodule serializes and stores the data component; the hash fingerprint of the serialized data component is calculated, and the hash fingerprint, creator identity, creator address, creation timestamp, and digest of access control policy information are uploaded to the blockchain to obtain the on-chain transaction ID; the on-chain transaction ID is stored in the audit and monitoring submodule; based on the data component, the embedded policy execution engine, and the lifecycle management module, a data element model is obtained.

2. The data element-based access control method according to claim 1, characterized in that, The lifecycle management module also includes an audit and monitoring submodule, which communicates with the embedded policy execution engine. After rejecting this data access request, the rejection record will be logged in the audit monitoring submodule as an audit log. After returning the processing result, the detailed information of the data processing operation is recorded in the audit monitoring submodule in the form of an audit log; When the full lifecycle management of the data element model ends or the data element model is destroyed, the audit monitoring submodule solidifies all audit logs by constructing a Merkle tree to perform hash fingerprinting, and puts the solidified root hash on the chain.

3. The data element-based access control method according to claim 2, characterized in that, After the cross-platform adaptation submodule performs adaptation processing based on the runtime environment characteristics of the target environment and unifies the machine time zone, it also includes: The embedded policy execution engine recalculates the hash fingerprint of the data item, queries the on-chain hash fingerprint record using the on-chain transaction ID stored in the audit monitoring submodule, and performs on-chain integrity verification based on the recalculated hash fingerprint of the data item and the on-chain hash fingerprint record. When on-chain integrity verification is successful, it indicates that the data element model is trustworthy, and the data element model is saved and used. When on-chain integrity verification fails, the network connection is checked, and on-chain integrity verification is re-performed after a preset interval. When on-chain integrity verification fails three times in a row, it indicates that the data element model has been tampered with, and the data element model is securely destroyed. The audit and monitoring submodule records the security event and notifies the creator.

4. The data element-based access control method according to claim 3, characterized in that, On-chain integrity verification is performed based on the recalculated hash fingerprint of the data item and the on-chain hash fingerprint record, specifically including: The hash fingerprint of the recalculated data item is compared with the fingerprint information in the hash fingerprint record on the chain; if the fingerprint information matches, the on-chain integrity verification is confirmed to be successful; if the fingerprint information does not match, the on-chain integrity verification is confirmed to be unsuccessful.

5. The data element-based access control method according to claim 1, characterized in that, Access control policy information includes policies in four dimensions: time control policy, user permission control policy, data restriction policy, and network control policy. Among them, time control policy includes validity period, access time window, and working time limit; user permission control policy includes user whitelist, operation type restriction, and data range restriction; data restriction policy includes maximum number of accesses and query frequency limit; and network control policy includes restrictions on device location, device IP, and public / private network or local environment.

6. The data element-based access control method according to claim 5, characterized in that, During the process of the embedded policy execution engine verifying access control policies based on data access requests, the embedded policy execution engine performs layered verification of data access requests in the order of time control policy, network control policy, data restriction policy, and user permission control policy. If any stage fails, the subsequent verification will be terminated.

7. A data element-based access control system, applied to the data element-based access control method according to any one of claims 1-6, characterized in that, include: Data element model creation module and embedded policy execution engine; The data element model creation module is used to construct data elements and create data element models based on the data elements and the embedded policy execution engine; wherein, the data element model includes data elements and the embedded policy execution engine, and the data elements include encrypted data and access control policy information; Once the data element is transmitted to the target environment, the embedded policy execution engine performs access control policy verification based on the data access request when the user initiates a data access request; if the access control policy verification fails, the data access request is rejected. If the access control policy verification is successful, the embedded policy execution engine decrypts the data file and performs the corresponding data processing operations, returning the processing results.

8. The data element-based access control system according to claim 7, characterized in that, It also includes a lifecycle management module, which includes a cross-platform adaptation sub-module and is connected to the embedded policy execution engine. The data element model creation module is used to create data element models based on data elements, the embedded policy execution engine, and the lifecycle management module; wherein, the data element model includes data elements, the embedded policy execution engine, and the lifecycle management module; After the data element model is transmitted to the target environment, the embedded policy execution engine is used to automatically detect the runtime environment characteristics of the target environment, and the cross-platform adaptation submodule is used to perform adaptation processing and machine time zone unification according to the runtime environment characteristics of the target environment.

9. The data element-based access control system according to claim 8, characterized in that, The lifecycle management module also includes an audit and monitoring submodule, which communicates with the embedded policy execution engine. After rejecting this data access request, the embedded policy execution engine will record the rejection in the audit monitoring submodule as an audit log. After returning the processing result, the embedded policy execution engine records the detailed information of the data processing operation in the audit monitoring submodule in the form of an audit log; When the full lifecycle management of the data element model ends or the data element model is destroyed, the audit monitoring submodule solidifies all audit logs by constructing a Merkle tree to perform hash fingerprinting, and puts the solidified root hash on the chain.

Images