Index storage method and device for access control policy, equipment and medium

Abstract

The invention discloses an index storage method and device for an access control policy, equipment and a medium, and the method comprises the steps: obtaining at least one to-be-processed policy rule in an access control architecture, and constructing a multi-dimensional attribute vector corresponding to each to-be-processed policy rule; performing clustering processing on all the multi-dimensional attribute vectors to obtain at least one cluster, and constructing a to-be-stored strategy template corresponding to each cluster; and performing index mapping on each to-be-stored strategy template, generating a target index corresponding to each to-be-stored strategy template, and performing uplink storage on the target index to the block chain. On the premise that the quality of the policy rules is not affected, the number of the policy rules is remarkably reduced, and the unique index corresponding to the policy rules is established so that the corresponding policy rules can be called according to the index information when the access request is received.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to an index storage method, device and equipment of an access control policy and a medium. BACKGROUND

[0002] As a key mechanism for ensuring data security, access control is directly related to the compliance use and authorization management of data in multi-party collaboration scenarios.

[0003] At present, the access control policy of the existing system relies on off-chain configuration, which leads to a split between policy definition and on-chain permission execution logic, a lack of global consistency verification of permission mapping relationship, data security problems, and an exponential growth of policy rule quantity due to the expansion of attribute dimensions, which not only causes a sharp decline in storage and matching efficiency, but also leads to a low matching efficiency of policy rules.

[0004] In order to solve the above problems, the index storage method of the access control policy needs to be improved to improve the request processing efficiency under the premise of ensuring data security based on the access control architecture. SUMMARY

[0005] The embodiments of the present application provide an index storage method, device and equipment of an access control policy to solve the problems of redundant policy rules, lack of unified index mechanism, data security problems and low matching processing efficiency of policy rules corresponding to access requests in the prior art.

[0006] In a first aspect, the embodiments of the present application provide an index storage method of an access control policy, comprising:

[0007] Obtaining at least one to-be-processed policy rule in an access control architecture, and constructing a multi-dimensional attribute vector corresponding to each to-be-processed policy rule; wherein the access control architecture comprises an access request party, an access control decision point, a policy information providing module and a policy management and generation module, the to-be-processed policy rule is stored in the policy information providing module, and the to-be-processed policy rule comprises at least one attribute item, the attribute item comprises a subject attribute, a resource attribute, an operation type attribute and a context condition attribute;

[0008] Clustering all multi-dimensional attribute vectors to obtain at least one cluster, and constructing a to-be-stored policy template corresponding to each cluster;

[0009] Index mapping is performed on each to-be-stored policy template to generate a target index corresponding to each to-be-stored policy template, and the target index is stored in a blockchain.

[0010] Secondly, embodiments of the present invention also provide an index storage device for access control policies, comprising:

[0011] A multi-dimensional attribute vector construction module is used to obtain at least one policy rule to be processed in the access control architecture and construct a multi-dimensional attribute vector corresponding to each policy rule to be processed; wherein, the access control architecture includes an access requester, an access control decision point, a policy information providing module and a policy management and generation module, the policy rule to be processed is stored in the policy information providing module, and the policy rule to be processed includes at least one attribute item, the attribute item including subject attribute, resource attribute, operation type attribute and context condition attribute;

[0012] The strategy template construction module is used to perform clustering processing on all multidimensional attribute vectors to obtain at least one cluster, and to construct the strategy template to be stored corresponding to each cluster.

[0013] The index storage module is used to perform index mapping on each strategy template to be stored, generate a target index corresponding to each strategy template to be stored, and store the target index on the blockchain.

[0014] Thirdly, embodiments of the present invention also provide an electronic device, comprising:

[0015] At least one processor; and

[0016] A memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to execute the index storage method of the access control policy according to any embodiment of the present invention.

[0018] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing computer instructions, which are used to cause a processor to implement the index storage method of the access control policy described in any embodiment of the present invention when executed.

[0019] Fifthly, embodiments of the present invention also provide a computer program product, including a computer program that, when executed by a processor, implements an index storage method for access control policies as described in any of the embodiments of the present invention.

[0020] The technical scheme of the embodiment of the present application obtains at least one to-be-processed policy rule in an access control architecture, constructs a multi-dimensional attribute vector corresponding to each to-be-processed policy rule, performs clustering processing on all multi-dimensional attribute vectors to obtain at least one clustering cluster, constructs a to-be-stored policy template corresponding to each clustering cluster, indexes and maps each to-be-stored policy template, generates a target index corresponding to each to-be-stored policy template, and stores the target index in a blockchain. Specifically, the technical scheme fuses the policy rule compression method of attribute weight similarity calculation and clustering analysis, and is matched with the design of a policy template abstraction and unique identification generation mechanism to form a structured, highly generalized, and indexable policy template set. Through the quantitative analysis of the semantic similarity of policy rules, the clustering and merging of policy rules are realized, so as to replace the original redundant and complex policy set, so that the execution efficiency and management controllability of the access control system can be significantly improved when an access request is received. The technical scheme solves the problems of redundant policy rules, lack of unified index mechanism, data security problems, and low matching processing efficiency of policy rules corresponding to access requests in the prior art, and achieves the effect of significantly reducing the number of policy rules without affecting the quality of policy rules, and establishing a unique index corresponding to the policy rules to facilitate the retrieval of corresponding policy rules according to index information when an access request is received. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the description of the embodiments of the present application will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of the contents of the embodiments of the present application and the drawings.

[0022] Figure 1 is a flowchart of an index storage method of an access control policy according to the first embodiment of the present application;

[0023] Figure 2 is a schematic diagram of an access control architecture according to the present application;

[0024] Figure 3 is a schematic diagram of an index storage method of an access control policy according to the present application;

[0025] Figure 4 is a flowchart of an index storage method of an access control policy according to the second embodiment of the present application;

[0026] Figure 5 is a structural schematic diagram of an index storage device of an access control policy according to the third embodiment of the present application;

[0027] Figure 6 Fig. 1 is a structural schematic diagram of an electronic device implementing an index storage method of an access control policy according to an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to make the personnel in the technical field better understand the present application scheme, the technical scheme in the embodiments of the present application will be described clearly and completely below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor should belong to the scope of protection of the present application. The acquisition, transmission, storage, use, processing and the like of data in the technical scheme of the present application all comply with the relevant provisions of national laws and regulations. It should be noted that in the embodiments of the present application, some industry existing schemes such as software, components or models may be mentioned, which should be considered as exemplary, and the purpose is only to illustrate the feasibility of the implementation of the technical scheme of the present application, but it does not mean that the applicant has or will necessarily use the scheme.

[0029] It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0030] Embodiment one

[0031] Figure 1 A flowchart of an index storage method of an access control policy is provided for the first embodiment of the present application. The present embodiment can be applicable to index mapping of policy rules in an attribute-based access control architecture, and storing the index information corresponding to the policy rules on the chain into the block chain. The method can be executed by an index storage device of an access control policy. The index storage device of the access control policy can be realized in the form of hardware and / or software, and can be configured in a computing device capable of executing the index storage method of the access control policy.

[0032] As shown in the figure, the method comprises: Figure 1

[0033] S110, acquiring at least one to-be-processed policy rule in an access control architecture, and constructing a multi-dimensional attribute vector corresponding to each to-be-processed policy rule.

[0034] ​The to-be-processed policy rule can be understood as an authorization instruction for determining whether to allow an access request to access based on logical judgment of subject attributes, resource attributes and environment attributes contained in the access request under specific conditions. The multi-dimensional attribute vector is a structured attribute set dynamically extracted from the access request for describing the current access context (subject, resource, action, environment, etc.).

[0035] In the technical solution, the access control architecture is an attribute-based access control architecture, such as Figure 2 As shown in the figure, the core components of the access control architecture include an access request party (PEP), an access control decision point (PDP), a policy information providing module (PIP) and a policy management and generation module (PAP). The to-be-processed policy rule is stored in the policy information providing module, and the to-be-processed policy rule includes at least one attribute item, and the attribute item includes subject attributes, resource attributes, operation type attributes and context condition attributes.

[0036] Specifically, corresponding to-be-processed policy rules can be set for different application scenarios, and the to-be-processed policy rules are mapped into multi-dimensional attribute vectors. The multi-dimensional attribute vector is composed of four types of key attributes, including subject attributes (Subject Attributes), resource attributes (Resource Attributes), operation type attributes (Action Type) and context condition attributes (Context Conditions). Among them, the subject attribute is used to describe the identity, role or organizational affiliation of the request entity; the resource attribute describes the category, sensitivity or data type of the accessed object; the operation type represents the nature of the request operation, such as reading, modifying or deleting; and the context condition covers environmental factors such as time constraints, geographic location or device type. When constructing the attribute vector, the system adopts a standardization method to ensure the dimensional consistency of numerical attributes, and at the same time, class embedding is performed on discrete attributes for subsequent calculation.

[0037] Optionally, at least one to-be-processed policy rule in the access control architecture is obtained, and a multi-dimensional attribute vector corresponding to each to-be-processed policy rule is constructed, including: in the configuration phase of the access control architecture, receiving attribute information list uploaded by a target user, and extracting at least one to-be-processed policy rule from the attribute information list; for each to-be-processed policy rule; determining the attribute weight corresponding to each attribute item in the current to-be-processed policy rule, and performing weighted processing on each attribute item and the attribute weight of the corresponding attribute item to obtain a multi-dimensional attribute vector corresponding to the current to-be-processed policy rule.

[0038] Exemplarily, a scenario of off-site access to an enterprise internal website by an enterprise employee can set a corresponding to-be-processed policy rule, specifically, "when a user logs in off-site, the user is allowed to log in off-site to the enterprise internal website by logging in a specified VPN, and the user position is position A and above". Then the to-be-processed policy rule is mapped to obtain a multi-dimensional attribute vector, which specifically includes the following attribute information: "the user position level is position A; the current login IP shows an off-site location; the enterprise specified VPN gateway has been successfully connected; the HR portal website of the enterprise is accessed; the operation type is access viewing; the access time is a weekday at 3 pm".

[0039] On the basis of the above example, a weighting mechanism is introduced in the process of constructing the multi-dimensional attribute vector, and different weights are allocated according to the relative importance of each attribute in the access control decision, thereby forming a weighted attribute vector. For the similarity measurement between policy rules, a weighted cosine similarity is adopted, and the calculation formula is as follows:

[0040]

[0041] Wherein, and respectively represent the weighted attribute vectors of policy and The numerator part is the inner product of the vector, which measures the matching degree of the two policies, and the denominator part is normalized by the length, which ensures that the similarity value is limited in the interval [0, 1], which provides a quantitative basis for subsequent clustering.

[0042] It should be noted that there may be similar to-be-processed policy rules in the access control architecture. Based on this, the similarity evaluation attributes between each pair of to-be-processed policy rules are determined in turn, and the two to-be-processed policy rules with a similarity evaluation attribute greater than a set similarity evaluation attribute are merged to obtain a to-be-encoded policy rule; based on at least one attribute item in the to-be-encoded policy rule and the attribute weight corresponding to each attribute item, a multi-dimensional attribute vector corresponding to the current to-be-processed policy rule is constructed.

[0043] S120, all multi-dimensional attribute vectors are clustered to obtain at least one cluster, and a to-be-stored policy template corresponding to each cluster is constructed.

[0044] In the technical solution, in order to facilitate the construction of policy templates based on to-be-processed policy rules, a multi-level clustering method can be used to cluster the multi-dimensional attribute vectors corresponding to the to-be-processed policy rules, so as to improve the accuracy and generalization ability of policy classification.

[0045] Exemplarily, a Canopy algorithm is used to preliminarily screen the policies, and two distance thresholds and ( ), grouping strategies with high similarity into the same initial cluster. Used to determine potential cluster centers, The system constrains the final classification scope, allowing for some redundancy in the initial classification to improve the robustness of subsequent refined clustering. Based on the initial classification, the system further employs an improved K-means clustering algorithm for fine-grained optimization. The initial cluster centers of the K-means algorithm are provided by the Canopy classification results and adjusted according to the policy similarity matrix to optimize intra-cluster compactness and inter-cluster separability. The goal of the K-means algorithm is to minimize the sum of squared errors (SSE) within clusters, calculated as follows:

[0046]

[0047] Where K is the final number of clusters, This represents the i-th cluster. The center of this cluster is defined. Through iterative optimization, a better policy classification result is obtained, which makes the policy rules within the same cluster have high similarity in the attribute space, while the policy rules between different clusters are significantly different.

[0048] S130. Perform index mapping on each strategy template to be stored, generate a target index corresponding to each strategy template to be stored, and store the target index on the blockchain.

[0049] The target index refers to the unique identifier information of the strategy template to be stored when querying or storing.

[0050] Optionally, the step of indexing and mapping each strategy template to be stored, generating a target index corresponding to each strategy template to be stored, and storing the target index on the blockchain includes: for each strategy template to be stored, determining the template vector and template vector weight of the current strategy template to be stored; performing index calculation on the template vector, the template vector, and the template vector weight based on a pre-set hash function to obtain a target index corresponding to the current strategy template to be stored; generating an index table based on the target index corresponding to each strategy template to be stored, and storing the index table on the blockchain. Specifically, determining the template vector and template vector weight of the current strategy template to be stored includes: vector encoding the current strategy template to be stored to obtain a template vector; and determining the template vector weight corresponding to the current strategy template to be stored based on the word frequency corresponding to at least one strategy field in the current strategy template to be stored, the number of strategy sets containing the strategy field, and the total number of strategy sets.

[0051] On the basis of the above examples, after obtaining the to-be-stored policy template, a blockchain-based indexing mechanism is further constructed to improve the retrieval efficiency of access control decisions.

[0052] Specifically, as shown in Figure 3 To ensure the uniqueness and security of the to-be-stored policy template, each to-be-stored policy template is mapped to a unique Policy-ID (i.e., target index), and the specific calculation method is as follows:

[0053]

[0054] Among them, is a Keccak-256 salted hash function, which is used to prevent Policy-ID from deducing the policy content and improve security; represents the template vector of the to-be-stored policy template, and each policy item is represented as an n-dimensional vector, is a weight coefficient (i.e., template vector weight), which represents the importance of different policy fields, and the calculation method is as follows:

[0055]

[0056] Among them, represents the term frequency of policy field i in the policy set, represents the number of policies containing this field, and N is the total number of policy sets. This weighting mechanism ensures that relatively rare but highly distinctive policy fields are given higher weights, thereby optimizing the accuracy of policy matching.

[0057] On this basis, the index table AccessIndexTable adopts a key-value pair mapping structure:

[0058]

[0059] Among them, AccessDecision represents the access authorization decision, and the value is Permit (allow), Deny (deny), or Conditional (conditional authorization). When the PDP calculates the Policy-ID of the access request, it first queries in the AccessIndexTable on the chain. If the Policy-ID already exists, it directly returns the corresponding access decision; if the Policy-ID does not exist, the PDP needs to calculate the access decision itself and register it in the AccessIndexTable.

[0060] The advantage of such arrangement is that the mechanism has significant computational efficiency and security advantages. First, through O(1) level hash query, the smart contract can directly match based on the Policy-ID efficiently, without comparing the policy content one by one, thereby greatly reducing the computational complexity. Second, the traceability of policy decision is guaranteed, all policy indexes are stored on the blockchain, ensuring the transparency and tamper resistance of access control decision. Finally, the mechanism adopts a hierarchical optimization scheme of computational burden, that is, the PDP only makes a complete access control decision when the Policy-ID appears for the first time, and the subsequent matching can directly use the blockchain index, thereby effectively reducing the computational overhead and improving the system throughput.

[0061] The technical scheme of the embodiment of the application acquires at least one to-be-processed policy rule in an access control architecture, and constructs a multi-dimensional attribute vector corresponding to each to-be-processed policy rule; performs clustering processing on all the multi-dimensional attribute vectors to obtain at least one clustering cluster, and constructs a to-be-stored policy template corresponding to each clustering cluster; indexes and maps each to-be-stored policy template, generates a target index corresponding to each to-be-stored policy template, and stores the target index on a chain in a blockchain. Specifically, the technical scheme fuses the policy rule compression method of attribute weight similarity calculation and clustering analysis, and designs a policy template abstraction and unique identification generation mechanism in a matching manner, to form a structured, highly generalized, and indexable policy template set. Through quantitative analysis of the semantic similarity of policy rules, the clustering and merging of policy rules are realized, so that the original redundant and complex policy set is replaced, and when an access request is received, the target index corresponding to the policy template can be quickly used to significantly improve the execution efficiency and management controllability of the access control system. The problems of policy rule redundancy, lack of unified indexing mechanism, data security issues, and low processing efficiency of policy rules corresponding to access requests in the prior art are solved, and the effect of significantly reducing the number of policy rules without affecting the quality of the policy rules and establishing a unique index corresponding to the policy rules to facilitate the retrieval of corresponding policy rules according to the index information when an access request is received is achieved.

[0062] Embodiment two

[0063] Figure 4 A flowchart of an access control policy index storage method provided by the second embodiment of the application is shown in FIG. 2. Optionally, the clustering processing on all the multi-dimensional attribute vectors to obtain at least one clustering cluster, and the construction of the to-be-stored policy template corresponding to each clustering cluster are refined.

[0064] As shown in FIG. 2, the method comprises the following steps. Figure 4

[0065] ​S210, acquire at least one to-be-processed policy rule in an access control architecture, and construct a multi-dimensional attribute vector corresponding to each to-be-processed policy rule.

[0066] S220, perform clustering processing on all multi-dimensional attribute vectors based on a preset clustering algorithm, and adaptively determine at least one cluster center.

[0067] The cluster center is one of the multi-dimensional attribute vectors.

[0068] S230, for each cluster center, construct a cluster corresponding to the cluster center based on a vector similarity between each multi-dimensional attribute vector and the cluster center.

[0069] The vector similarity between the multi-dimensional attribute vector in the cluster and the cluster center in the cluster is less than a preset vector similarity.

[0070] S240, perform attribute merging on the multi-dimensional attribute vectors in each cluster, obtain an attribute set corresponding to each cluster, and generate a to-be-stored policy template corresponding to each attribute set based on attribute items in each attribute set.

[0071] Optionally, the attribute merging on the multi-dimensional attribute vectors in each cluster, the obtaining of the attribute set corresponding to each cluster, and the generation of the to-be-stored policy template corresponding to each attribute set based on the attribute items in each attribute set comprise: extracting at least one attribute item included in each multi-dimensional attribute vector in each cluster, and performing permutation and combination on the at least one attribute item corresponding to all multi-dimensional attribute vectors to obtain at least one attribute set; and constructing a to-be-stored policy template corresponding to each attribute set based on the at least one attribute item included in each attribute set.

[0072] On the basis of policy rule clustering, the system further constructs a policy template to realize structured compression and generalized expression of a rule set. The construction process of the policy template comprises three parts: attribute merging, logic expression simplification, and operation merging.

[0073] Attribute merging aims to identify and merge rules with similar attribute values within the same policy cluster. For example, in a rule set with similar subject attributes but different resource attributes, wildcard or attribute range extension methods can be used to reduce the number of rules and improve matching efficiency. Logical expression simplification mainly optimizes the condition expressions in policy rules. Through logical conjunction, disjunction, and implication analysis, redundant conditions are eliminated and the expression structure is simplified. Operation merging integrates similar operation types by analyzing the operation patterns within the same policy cluster. For example, if multiple policies separately authorize "read" and "query" operations, they can be merged into a unified authorization for "access" permissions to reduce rule complexity.

[0074] S250, index mapping is performed on each to-be-stored policy template to generate a target index corresponding to each to-be-stored policy template, and the target index is stored in the blockchain.

[0075] Optionally, historical access data analysis is obtained; based on the historical access data analysis, the index query order of the target index corresponding to each to-be-stored policy template is dynamically rearranged, so that when a to-be-processed access request is received again, index querying is performed based on the rearranged target index.

[0076] Among the historical access data analysis, at least one of the access request distribution rate, the index query hit rate, the index storage overhead, and the on-chain Gas consumption information is included. Historical access data analysis refers to a data processing process of collecting, organizing, and analyzing historical access records of access request parties (including access objects, time, operation behavior, and results, etc.) to identify access patterns, assess risks, or optimize access control policies.

[0077] Based on the above examples, in the attribute-based access control system architecture, the computational complexity of permission determination directly affects the access efficiency of the system, and the existing access control mechanism usually needs to compare policy contents one by one, resulting in a long and tedious permission determination process, which is difficult to meet the high-frequency access demand. Therefore, if the on-chain permission index is not synchronized in time after the policy rule is updated, it may lead to access control decision failure, affecting the system security and consistency. Based on this, the technical solution sets Policy-ID as the index unit, dynamically adjusts and improves the index lookup efficiency based on hash mapping and reinforcement learning, and uses a transactional update mechanism to ensure the consistency of the index after the policy changes.

[0078] Specifically, the update process of the index query order of the target index corresponding to each to-be-stored policy template of the technical solution is as follows:

[0079] (1) Index optimization based on DQN

[0080] To optimize the long-term access pattern, the technical solution introduces DQN deep reinforcement learning to intelligently adjust the index structure. Under the DQN training framework, index optimization is modeled as a reinforcement learning problem, which is composed of three parts: state, action, and reward.

[0081] State : The history query pattern of the access request is defined as the current state, including the distribution frequency of the access request, the index query hit rate, the index storage overhead, and the on-chain Gas consumption.

[0082] Action : Index optimization adjustment operation, including index splitting, index merging, hot spot strategy cache adjustment, and permission mapping table reorganization.

[0083] Reward : An exponential decay reward mechanism is adopted, and the reward function is set as follows:

[0084]

[0085] Wherein, QueryCost represents the Gas consumption of the current index query, and a positive reward is obtained by reducing the cost; HitRatio represents the cache hit rate, and a positive reward is obtained by improving the hit rate; LatencyReduction represents the degree of reduction of query delay, and a positive reward is obtained by matching speed improvement.

[0086] Time difference learning is adopted to update the Q value:

[0087]

[0088] Wherein, is the learning rate, is the discount factor, which ensures the continuous convergence of the index optimization process.

[0089] In practical applications, the index optimization process consists of a four-stage closed-loop control mechanism, including data feature collection, intelligent decision generation, dynamic index reconstruction, and reinforcement learning feedback. Specifically, the process of constructing an index optimization decision model based on deep reinforcement learning theory is as follows:

[0090] State feature extraction: The historical access log is obtained through the on-chain data collection module, and the multi-dimensional state feature vector of Policy-ID is extracted, including access frequency distribution, query hit rate, average response delay, and cache utilization rate. The feature matrix is normalized and used as the input state space of DQN.

[0091] Optimization strategy decision: A Q-network model based on a hybrid neural architecture is constructed, which has a topology composed of a feature fusion layer, a deep pattern mining layer, and an action value evaluation layer. After the index state features are integrated in the input layer, the CNN-Transformer hybrid encoder is used to extract the potential optimization patterns. The output layer calculates the Q-value functions of candidate actions such as index splitting, merging, cache adjustment, and permission mapping table reorganization. The optimal action is selected based on the ε-greedy strategy.

[0092] Dynamic index adjustment: The execution strategy includes: (a) Index splitting strategy to achieve load balancing of high-frequency Policy-ID through hash bucket splitting; (b) Index merging strategy to reduce low-frequency data storage overhead by using B+ tree structure reorganization; (c) Adaptive cache strategy to dynamically adjust LRU cache capacity and replacement strategy; (d) Permission mapping table reorganization strategy to reconstruct the topology of AccessIndexTable based on access patterns.

[0093] Reinforcement learning iteration: The time difference (TD) algorithm is used to update the network parameters, and the experience replay mechanism is used to solve the overfitting problem caused by data correlation, realizing the maximization of long-term cumulative reward.

[0094] (2) Index update mechanism

[0095] To ensure the consistency and efficiency of the permission index after policy changes, this scheme designs a transactional index update mechanism to realize the dynamic maintenance and consistency guarantee of the on-chain permission index through incremental update strategy, version control mechanism, and transaction commit and rollback strategy.

[0096] In terms of policy change detection and index transaction submission, when the policy template is updated, the system automatically performs policy change detection to identify the added, modified, or invalid Policy-ID, and completes the incremental update of the index through the smart contract to reduce computational overhead and improve matching efficiency.

[0097] First, the system compares the new and old policy template sets and to calculate the Policy-ID difference set , representing the added or changed Policy-ID, which needs to be synchronized to the smart contract for index adjustment. Based on the detection results, the index update transaction is constructed and carries the access decision information, which is submitted to the smart contract to ensure the integrity and consistency of the index data. Finally, the smart contract uses the lazy replacement mechanism to adjust the index, that is, before the new index is completely constructed, the old index can still provide access control services, ensuring that access permissions will not be interrupted during policy changes, thereby improving the availability and robustness of the system.

[0098] In terms of index version management and consistency maintenance, the scheme introduces a version control mechanism to ensure the stability of access control decisions while supporting historical permission record backtracking queries. Specifically, each Policy-ID maintains a version number, and the current effective version is recorded in the AccessIndexTable. Access requests are always based on the latest version of the Policy-ID for permission matching, ensuring the real-time and accuracy of query results. In addition, through the historical version index storage mechanism, the system supports traceability analysis of access decisions before and after policy changes, combined with the tamper-proof nature of the blockchain, ensuring that historical changes to the permission index are verifiable and traceable. At the same time, to optimize the utilization of on-chain storage resources, the system sets an index version expiration policy to periodically clean up old version indexes that have not been accessed for a long time, reducing storage overhead and improving the scalability of the blockchain system.

[0099] In terms of transaction submission and exception recovery mechanism, the scheme proposes a transaction submission and rollback strategy to ensure the atomicity and consistency of index updates in the face of potential data competition, concurrency conflict or smart contract execution failure in the blockchain environment. First, before updating the index, the system performs pre-validation to analyze the conflict between the new and old indexes, avoiding potential permission matching errors. At the same time, before the index is changed, the system records an index state snapshot to form a transaction log for rolling back abnormal update operations. When the smart contract fails, the system rolls back to the index version before the change based on the transaction log, ensuring the integrity of the index structure. In addition, the smart contract uses the on-chain transaction confirmation mechanism to ensure that the index update is officially effective and broadcasts the latest index state to all access control nodes to synchronize the permission matching rules after policy changes, further ensuring the consistency and stability of the system.

[0100] The benefits of this setup are that the transactional index update mechanism proposed in this proposal achieves dynamic maintenance of on-chain permission indexes through incremental updates, version control and transaction rollback. First, the incremental update strategy is used instead of the traditional full index reconstruction, only updating the affected Policy-ID, thereby reducing computational complexity and improving index maintenance efficiency. Second, relying on version management and transaction control ensures the consistency of the permission index during policy updates, avoiding temporary access control rule failures. In addition, combined with the transaction log and exception recovery mechanism, the system can still roll back to a safe state in the case of smart contract execution exceptions, ensuring the integrity and recoverability of index data. Finally, the lazy replacement and expired data cleaning strategy optimizes on-chain storage resources while ensuring access control effectiveness, improving the scalability of the blockchain system. In summary, the scheme achieves an efficient, stable and traceable permission index update mechanism without relying on smart contract redeployment, providing an optimization scheme for ABAC access control systems based on the blockchain that balances computational efficiency, data consistency and system adaptability.

[0101] Optionally, when the access request is received by the access request side, the to-be-verified attribute information corresponding to the access request is obtained from the policy information providing module; at least one attribute item in the to-be-verified attribute information is used to determine the to-be-checked policy template corresponding to the to-be-verified attribute information from the policy management and generation module; the to-be-verified attribute information is subjected to information verification based on the policy rule corresponding to the to-be-checked policy template, and the access request is processed according to the verification result.

[0102] The to-be-verified attribute information refers to at least one attribute item included in the access request and attribute information corresponding to the attribute item. The to-be-checked policy template refers to a policy template determined from at least one to-be-stored policy template and matched with the to-be-verified attribute information. The to-be-checked measurement template corresponds to an attribute set composed of at least one attribute item in the to-be-verified attribute information.

[0103] In actual application, after receiving the access request, the access control architecture can determine at least one attribute item in the access request by analyzing the access request, and obtain the to-be-verified attribute information corresponding to each attribute item in the access request from the policy information providing module. On this basis, in order to determine whether to respond to the access request, the to-be-checked policy template matched with the access request is obtained from the policy management and generation module. It can be understood that, in the stage of constructing the policy template, the corresponding policy template is generated and stored mainly according to different permutations and combinations of attribute items. Therefore, in actual application, after determining the attribute items included in the access request, the to-be-stored policy template matched with the access request can be called from the policy management and generation module as the to-be-checked policy template according to the permutations and combinations (i.e., the attribute set) of the attribute items of the access request.

[0104] Further, the to-be-verified attribute information is subjected to information verification by the to-be-checked policy template. If the to-be-verified attribute information meets the detection conditions of each attribute information in the to-be-checked policy template, the access request can be responded, such as allowing the user to log in remotely. Otherwise, if the to-be-verified attribute information does not meet the detection conditions of the attribute information in the to-be-checked policy template, the access request is rejected, such as rejecting the user to log in remotely.

[0105] Optionally, when the access request is received, the processing record of the access request is stored based on the smart contract, and when the same type of access request corresponding to the access request is received again, the same type of access request is subjected to decision processing based on the smart contract.

[0106] Exemplarily, when the user A performs the off-site login, the attribute information to be checked corresponding to the access request is obtained from the policy information providing module, and the policy template to be checked corresponding to the access request is called from the policy management and generation module. The attribute information to be checked is detected by the policy template to be checked, and it is determined that the processing result of the access request of the user A is that the off-site login can be performed, and the login is performed according to the access request.

[0107] After the access request of the user A is processed, the access record of the user A is automatically recorded in the system as a historical access record row and is stored, so that when the same type of access request as that of the user A is detected again, for example, the user B performs the off-site login through the external network, if the attribute items included in the access requests of the user A and the user B are the same, it can be directly determined that the access requests of the user B and the user A are the same type of access request, and at this time, the access request of the user B can be directly processed based on the smart contract. At this time, the smart contract can detect the attribute information to be checked corresponding to the user B based on the policy template to be checked corresponding to the access request of the user A, and if the attribute information to be checked satisfies all detection conditions of the policy template to be checked, the access request of the user B is responded, and the user B is allowed to perform the off-site login. If there is attribute information to be checked that does not satisfy the detection condition of the policy template to be checked, for example, the position level of the user B in the company is low, or the user B does not perform the off-site login within a specified time period, at this time, the user B is refused to perform the off-site login.

[0108] The technical scheme of the embodiment of the application obtains at least one policy rule to be processed in an access control architecture, and constructs a multi-dimensional attribute vector corresponding to each policy rule to be processed. All multi-dimensional attribute vectors are clustered to obtain at least one cluster, and a policy template to be stored corresponding to each cluster is constructed. Each policy template to be stored is indexed and mapped to generate a target index corresponding to each policy template to be stored, and the target index is stored in a blockchain. Specifically, the technical scheme fuses the policy rule compression method of attribute weight similarity calculation and clustering analysis, and is matched with the design of the policy template abstraction and unique identification generation mechanism, to form a structured, highly generalized and indexable policy template set. Through the quantitative analysis of the semantic similarity of the policy rules, the clustering and merging of the policy rules are realized, so as to replace the original redundant and complex policy set, so that when an access request is received, the target index corresponding to the policy template can be quickly determined, and the execution efficiency and management controllability of the access control system are significantly improved. The problems of redundant policy rules, lack of unified indexing mechanism leading to data security problems and low matching processing efficiency of the policy rules corresponding to the access request in the prior art are solved, and the number of policy rules is significantly reduced without affecting the quality of the policy rules, and a unique index corresponding to the policy rule is established to facilitate the retrieval of the corresponding policy rule according to the index information when an access request is received.

[0109] Embodiment three

[0110] Figure 5 A structural schematic diagram of an index storage device of an access control policy provided by embodiment three of the present application is shown. As shown in the figure, the device comprises a multi-dimensional attribute vector construction module 310, a policy template construction module 320 and an index storage module 330. Figure 5

[0111] The multi-dimensional attribute vector construction module 310 is configured to obtain at least one to-be-processed policy rule in an access control architecture, and construct a multi-dimensional attribute vector corresponding to each to-be-processed policy rule. The access control architecture comprises an access requestor, an access control decision point, a policy information providing module and a policy management and generation module. The to-be-processed policy rule is stored in the policy information providing module. The to-be-processed policy rule comprises at least one attribute item. The attribute item comprises a subject attribute, a resource attribute, an operation type attribute and a context condition attribute.

[0112] The policy template construction module 320 is configured to perform clustering processing on all multi-dimensional attribute vectors to obtain at least one clustering cluster, and construct a to-be-stored policy template corresponding to each clustering cluster.

[0113] The index storage module 330 is configured to perform index mapping on each to-be-stored policy template, generate a target index corresponding to each to-be-stored policy template, and store the target index in a blockchain in a chain manner.

[0114] ​The technical scheme of the embodiment of the application obtains at least one to-be-processed policy rule in an access control architecture, constructs a multi-dimensional attribute vector corresponding to each to-be-processed policy rule, performs clustering processing on all multi-dimensional attribute vectors to obtain at least one clustering cluster, constructs a to-be-stored policy template corresponding to each clustering cluster, indexes and maps each to-be-stored policy template, generates a target index corresponding to each to-be-stored policy template, and stores the target index in a blockchain. Specifically, the technical scheme fuses a policy rule compression method based on attribute weight similarity calculation and clustering analysis, and is matched with a policy template abstraction and unique identification generation mechanism to form a structured, highly generalized and indexable policy template set. Through quantitative analysis of the semantic similarity of policy rules, the clustering and merging of policy rules are realized, so as to replace the original redundant and complex policy set, so that the execution efficiency and management controllability of the access control system can be significantly improved when an access request is received. The technical scheme solves the problems of redundant policy rules, lack of unified index mechanism, data security problems and low matching processing efficiency of policy rules corresponding to access requests in the prior art, and achieves the effect of significantly reducing the number of policy rules without affecting the quality of policy rules, and establishing a unique index corresponding to the policy rules to facilitate the retrieval of corresponding policy rules according to index information when an access request is received.

[0115] Optionally, the multi-dimensional attribute vector construction module comprises an extraction unit configured to receive attribute information lists uploaded by a target user in a configuration stage of the access control architecture, and extract at least one to-be-processed policy rule from the attribute information lists.

[0116] The multi-dimensional attribute vector construction unit is configured to determine attribute weights corresponding to each attribute item in the current to-be-processed policy rule, and perform weighted processing on each attribute item and the attribute weight of the corresponding attribute item to obtain a multi-dimensional attribute vector corresponding to the current to-be-processed policy rule.

[0117] Optionally, the index storage device of the access control policy further comprises a to-be-encoded policy rule determination module configured to determine similarity evaluation attributes between two to-be-processed policy rules in sequence, and perform merging processing on two to-be-processed policy rules with a similarity evaluation attribute greater than a set similarity evaluation attribute to obtain a to-be-encoded policy rule.

[0118] The attribute item determination module is configured to construct a multi-dimensional attribute vector corresponding to the current to-be-processed policy rule based on at least one attribute item in the to-be-encoded policy rule and the attribute weight corresponding to each attribute item.

[0119] Optionally, the policy template construction module comprises: a cluster center determination module configured to determine at least one cluster center by clustering all the multi-dimensional attribute vectors based on a preset clustering algorithm; wherein the cluster center is one of the multi-dimensional attribute vectors;

[0120] a cluster cluster determination module configured to, for each cluster center, construct a cluster cluster corresponding to the cluster center based on vector similarity between each multi-dimensional attribute vector and the cluster center; wherein the vector similarity between the multi-dimensional attribute vector in the cluster cluster and the cluster center in the cluster cluster is less than a preset vector similarity;

[0121] a policy template construction module configured to perform attribute merging on the multi-dimensional attribute vectors in each cluster cluster respectively to obtain an attribute set corresponding to each cluster cluster, and generate a to-be-stored policy template corresponding to each attribute set based on the attribute items in the attribute set.

[0122] Optionally, the policy template construction module comprises: an attribute set determination unit configured to extract at least one attribute item included in each multi-dimensional attribute vector in each cluster cluster respectively, and perform permutation and combination on the at least one attribute item corresponding to all the multi-dimensional attribute vectors to obtain at least one attribute set;

[0123] a policy template construction unit configured to construct a to-be-stored policy template corresponding to each attribute set based on the at least one attribute item included in the attribute set.

[0124] Optionally, the index storage module comprises: a weight determination unit configured to determine, for each to-be-stored policy template, a template vector and a template vector weight of the current to-be-stored policy template;

[0125] an index determination unit configured to perform index calculation on the template vector and the template vector and the template vector weight based on a preset hash function to obtain a target index corresponding to the current to-be-stored policy template;

[0126] an index storage unit configured to generate an index table based on the target index corresponding to each to-be-stored policy template, and store the index table on a chain in a blockchain.

[0127] Optionally, the weight determination unit comprises: a template vector determination subunit configured to perform vector encoding on the current to-be-stored policy template to obtain a template vector;

[0128] a weight determination subunit configured to determine a template vector weight corresponding to the current to-be-stored policy template based on a term frequency corresponding to at least one policy field in the current to-be-stored policy template, a number of policy sets containing the policy field, and a total number of policy sets.

[0129] Optionally, the index storage device of the access control policy is further configured to obtain historical access data analysis, wherein the historical access data analysis comprises at least one of an access request distribution rate, an index query hit rate, an index storage overhead, and on-chain Gas consumption information; and based on the historical access data analysis, dynamically rearranging an index query order of the target index corresponding to each to-be-stored policy template, so as to perform index query based on the rearranged target index when receiving a to-be-processed access request again.

[0130] Optionally, the index storage device of the access control policy further comprises an attribute information acquisition module configured to acquire to-be-verified attribute information corresponding to the access request from the policy information providing module when the access request is received by the access request side.

[0131] a template determination module configured to determine a to-be-verified policy template corresponding to the to-be-verified attribute information from the policy management and generation module according to at least one attribute item in the to-be-verified attribute information.

[0132] a request processing module configured to perform information verification on the to-be-verified attribute information based on a policy rule corresponding to the to-be-verified policy template, and process the access request according to a verification result.

[0133] Optionally, the index storage device of the access control policy is further configured to store a processing record of the access request based on a smart contract when the access request is received, and perform decision processing on a same-type access request corresponding to the access request based on the smart contract when the same-type access request is received again.

[0134] The index storage device of the access control policy provided in the embodiments of the present application can perform the index storage method of the access control policy provided in any of the embodiments of the present application, and has the corresponding function modules and beneficial effects of performing the method.

[0135] Embodiment Four

[0136] Figure 6 A structural schematic diagram of an electronic device 10 of an embodiment of the present application is shown. The electronic device is intended to represent a variety of forms including digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent a variety of mobile devices, such as personal digital assistants, cellular telephones, smart phones, wearable devices (e.g., headsets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit the implementations of the applications described and / or claimed in this document.

[0137] AsFigure 6 As shown, the electronic device 10 includes at least one processor 11, and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., communicatively connected to the at least one processor 11, where the memory stores a computer program executable by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or loaded into the random access memory (RAM) 13 from the storage unit 18. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0138] Various components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc., an output unit 17, such as various types of displays, a speaker, etc., a storage unit 18, such as a magnetic disk, an optical disk, etc., and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0139] The processor 11 can be various general and / or special purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs various methods and processes described above, such as the index storage method of access control policies.

[0140] In some embodiments, the index storage method of access control policies can be implemented as a computer program tangibly embodied in a computer readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the index storage method of access control policies described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to perform the index storage method of access control policies by any other appropriate means, such as by means of firmware.

[0141] The various embodiments of the systems and techniques described above can be implemented in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a complex programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0142] Computer programs used to implement the index storage method of access control policies of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the computer program running on the processor implements the functions / operations specified in the flowcharts and / or block diagrams. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine as a standalone software package and partially on a remote machine, or entirely on a remote machine or server.

[0143] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store computer programs for use by or in connection with an instruction execution system, apparatus, or device. Computer-readable storage media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of the machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fibers, portable compact disc read-only memories (CD-ROMs), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0144] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0145] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), blockchain network, and the Internet.

[0146] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. A server can be a cloud server, also known as cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service.

[0147] Embodiment Five

[0148] The embodiment of the present application further provides a computer program product, comprising a computer program which, when executed by a processor, implements the index storage method of an access control policy as provided in any embodiment of the present application.

[0149] The computer program code can also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce the computer implemented process such that the

[0150] It should be understood that the various forms of flow shown in the figures are illustrative examples of implementing the steps of the application. Several steps have been described as being performed by a single device. It will be understood that these steps can be performed by a single device or multiple devices. It will also be understood that the steps can be performed in a different order than that shown in the figures. It will also be understood that the steps can be performed concurrently or sequentially. It will also be understood that the steps can be performed by different entities. It will also be understood that the steps can be performed by a combination of hardware and software. It will also be understood that the steps can be performed by a combination of one or more devices and one or more computers.

[0151] The specific embodiments have been shown and described for the purposes of illustrating the physiological principles of the application. It will be understood that various modifications, combinations, sub-combinations, and alternatives can be made to the specific embodiments without departing from the spirit and principles of the application. Any modifications, equivalent substitutions, improvements, combinations or the like not described above are also encompassed within the scope of the application.

Claims

1. An index storage method for access control policies, characterized in that, include: Obtain at least one policy rule to be processed from the access control architecture, and construct a multi-dimensional attribute vector corresponding to each policy rule to be processed; wherein, the access control architecture includes an access requester, an access control decision point, a policy information providing module, and a policy management and generation module, the policy rule to be processed is stored in the policy information providing module, and the policy rule to be processed includes at least one attribute item, the attribute item including subject attribute, resource attribute, operation type attribute, and context condition attribute; Clustering is performed on all multidimensional attribute vectors to obtain at least one cluster, and a storage strategy template corresponding to each cluster is constructed. Each strategy template to be stored is indexed and mapped to generate a target index corresponding to each strategy template to be stored, and the target index is stored on the blockchain.

2. The method according to claim 1, characterized in that, The process involves obtaining at least one pending policy rule from the access control architecture and constructing a multi-dimensional attribute vector corresponding to each pending policy rule, including: During the configuration phase of the access control architecture, a list of attribute information uploaded by the target user is received, and at least one policy rule to be processed is extracted from the list of attribute information. For each policy rule to be processed, the attribute weights corresponding to each attribute item in the current policy rule to be processed are determined, and the attribute weights of each attribute item and the corresponding attribute item are weighted to obtain a multi-dimensional attribute vector corresponding to the current policy rule to be processed.

3. The method according to claim 2, characterized in that, Also includes: The similarity evaluation attributes between each pair of policy rules to be processed are determined sequentially, and the two policy rules to be processed with similarity evaluation attributes greater than the set similarity evaluation attributes are merged to obtain the policy rules to be encoded. Based on at least one attribute item in the policy rule to be encoded and the attribute weights corresponding to each attribute item, a multidimensional attribute vector corresponding to the current policy rule to be processed is constructed.

4. The method according to claim 1, characterized in that, The process of clustering all multidimensional attribute vectors to obtain at least one cluster, and constructing a storage strategy template corresponding to each cluster, includes: All multidimensional attribute vectors are clustered based on a preset clustering algorithm to adaptively determine at least one cluster center; wherein, the cluster center is one of the multidimensional attribute vectors; For each cluster center, a cluster corresponding to the cluster center is constructed based on the vector similarity between each multidimensional attribute vector and the cluster center; wherein, the vector similarity between the multidimensional attribute vector in the cluster and the cluster center in the cluster is less than a preset vector similarity. The multidimensional attribute vectors in each cluster are merged to obtain the attribute set corresponding to each cluster, and the corresponding storage strategy template is generated based on the attribute items in each attribute set.

5. The method according to claim 4, characterized in that, The step of performing attribute merging on the multidimensional attribute vectors in each cluster to obtain an attribute set corresponding to each cluster, and generating a storage strategy template corresponding to the attribute set based on the attribute items in each attribute set, includes: Extract at least one attribute item from each multidimensional attribute vector in each cluster, and arrange and combine the at least one attribute item corresponding to all multidimensional attribute vectors to obtain at least one attribute set; Based on at least one attribute item contained in each attribute set, construct a storage strategy template corresponding to each attribute set.

6. The method according to claim 1, characterized in that, The step of index mapping each strategy template to be stored, generating a target index corresponding to each strategy template to be stored, and storing the target index on the blockchain includes: For each policy template to be stored, determine the template vector and template vector weight of the current policy template to be stored; Based on a pre-set hash function, the template vector and its weight are indexed to obtain the target index corresponding to the current strategy template to be stored. An index table is generated based on the target index corresponding to each of the aforementioned storage strategy templates, and the index table is stored on the blockchain.

7. The method according to claim 6, characterized in that, The process of determining the template vector and template vector weights of the current policy template to be stored includes: The current policy template to be stored is vector-encoded to obtain a template vector; The template vector weight corresponding to the current strategy template to be stored is determined based on the word frequency corresponding to at least one strategy field in the current strategy template to be stored, the number of strategy sets containing the strategy field, and the total number of strategy sets.

8. The method according to claim 1, characterized in that, Also includes: Historical access data analysis is performed; wherein, the historical access data analysis includes at least one of access request distribution rate, index query hit rate, index storage overhead, and on-chain gas consumption information. Based on the analysis of the historical access data, the index query order of the target index corresponding to each storage strategy template is dynamically rearranged so that when a pending access request is received again, the index query is performed based on the rearranged target index.

9. The method according to claim 1, characterized in that, Also includes: When the access requester receives an access request, it obtains the attribute information to be verified corresponding to the access request from the policy information providing module; Based on at least one attribute item in the attribute information to be verified, determine the policy template to be verified corresponding to the attribute information to be verified from the policy management and generation module; The attribute information to be verified is verified based on the policy rules corresponding to the policy template to be verified, and the access request is processed according to the verification result.

10. The method according to claim 9, characterized in that, Also includes: Upon receiving the access request, the processing record of the access request is stored based on the smart contract, and upon receiving another access request of the same type corresponding to the access request, the same type of access request is processed based on the smart contract.

11. An index storage device for access control policies, characterized in that, include: A multi-dimensional attribute vector construction module is used to obtain at least one policy rule to be processed in the access control architecture and construct a multi-dimensional attribute vector corresponding to each policy rule to be processed; wherein, the access control architecture includes an access requester, an access control decision point, a policy information providing module and a policy management and generation module, the policy rule to be processed is stored in the policy information providing module, and the policy rule to be processed includes at least one attribute item, the attribute item including subject attribute, resource attribute, operation type attribute and context condition attribute; The strategy template construction module is used to perform clustering processing on all multidimensional attribute vectors to obtain at least one cluster, and to construct the strategy template to be stored corresponding to each cluster. The index storage module is used to perform index mapping on each strategy template to be stored, generate a target index corresponding to each strategy template to be stored, and store the target index on the blockchain.

12. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to execute the indexed storage method of the access control policy according to any one of claims 1-10.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the indexed storage method of the access control policy according to any one of claims 1-10.

14. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the index storage method of the access control policy as described in any one of claims 1-10.

Images