Resource access control system and method

Abstract

The invention belongs to the technical field of data processing, and discloses a resource access control system and method. Authority management based on user attributes is realized through the constructed access structure tree, the public parameter, the original pull stream address and the access structure tree are input into the encryption algorithm, then the public parameter, the private key and the encrypted ciphertext are input into the decryption algorithm through the pull stream user side, and the authentication pull stream address is generated based on the decryption result. And the stream is pulled through the streaming media server based on the authentication stream pulling address, so that the access levels of the users with different attributes can be distinguished in the stream pulling process, and a refined authority management effect is achieved.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a resource access control system and method. Background Technology

[0002] With the development of the internet and mobile networks, real-time streaming media has been widely used in online education, video conferencing, live streaming services, and other scenarios. However, users' access control needs for streaming media resources are becoming increasingly sophisticated. Traditional role-based or identity-based access control is unable to cope with the complex user roles and multi-dimensional permission management requirements, resulting in crude permission management and vulnerability to tampering attacks. Summary of the Invention

[0003] The main purpose of this application is to provide a resource access control system and method, which aims to solve the technical problem of how to achieve refined access management based on user attributes.

[0004] To achieve the above objectives, this application provides a resource access control system, which includes: an authorization center, a push streaming user terminal, a cloud server, a streaming media server, and a pull streaming user terminal; The authorization center is used to generate public parameters and the private keys corresponding to registered users, and to send the public parameters to the push streaming user end and the public parameters and private keys to the pull streaming user end. The cloud server is used to send the original pull stream address to the push stream user when it receives a push stream request from the push stream user. The push streaming client is used to input public parameters, the original pull streaming address, and the access structure tree into the encryption algorithm, and send the output encrypted ciphertext to the pull streaming client; The streaming client is used to input public parameters, private keys, and encrypted ciphertext into the decryption algorithm, and generate an authenticated streaming address based on the decryption result; A streaming media server is used to pull streams based on the authenticated pull stream address sent by the user client.

[0005] Optionally, the streaming client is also used to determine access attributes and the logical relationships between each access attribute according to a preset resource access strategy; The push-stream client is also used to construct an access tree structure with access attributes as leaf nodes and logical relationships as non-leaf nodes.

[0006] Optionally, the push streaming client is also used to receive the original push streaming address fed back by the cloud server based on the push streaming request; The push streaming client is also used to concatenate the original push streaming address and the push streaming user authentication string to obtain the authenticated push streaming address; The streaming client is also used to send an authenticated streaming address to the streaming media server so that the streaming media server can push the stream based on the authenticated streaming address.

[0007] Optionally, the streaming client is also used to input public parameters, private keys, and encrypted ciphertext into the decryption algorithm and output the decryption result; The streaming client is also used to concatenate the original streaming address and the streaming user authentication string in the decryption result if the decryption result is successful, so as to obtain the authenticated streaming address.

[0008] Optionally, the streaming user client is also used to match the streaming user attributes with the access structure tree in the encrypted ciphertext to obtain the matching result; The client-side streaming service is also used to calculate node values ​​when the matching result is a successful match. The client-side application that pulls the stream is also used to determine if the decryption result is successful when the node value matches the root node in the access tree structure.

[0009] Optionally, the authorization center is also used to input preset security parameters into the initialization algorithm and output public parameters and master key; The authorization center is also used to input public parameters, master keys, and access attributes into the key generation algorithm and output the private key corresponding to the registered user. The authorization center is also used to send public parameters to the push streaming user and to send the public parameters and private key to the pull streaming user.

[0010] Optionally, the streaming media server is also used to extract the streaming user authentication string from the authentication streaming address when it receives the authentication streaming address sent by the streaming user client; The streaming media server is also used to initiate media streaming transmission if the authentication string of the user pulling the stream passes the validity verification.

[0011] Optionally, the streaming media server is also configured to extract the streaming user authentication string from the authentication streaming address when it receives the authentication streaming address sent by the streaming user. The streaming media server is also used to bind the original streaming address sent by the cloud server with the streaming user authentication string and start media stream reception when the validity verification of the streaming user authentication string is passed.

[0012] This application also provides a resource access control method, applied to the resource access control system described above. The resource access control method includes the following steps: The authorization center generates public parameters and the private key corresponding to the registered user, and sends the public parameters to the push streaming user and the public parameters and private key to the pull streaming user. When the cloud server receives a push request from the push user, it sends the original pull address to the push user. The push streaming client inputs the common parameters, the original pull streaming address, and the access structure tree into the encryption algorithm, and sends the output encrypted ciphertext to the pull streaming client; The client inputs public parameters, private key, and encrypted ciphertext into the decryption algorithm, and generates an authenticated streaming address based on the decryption result; When the streaming media server receives the authenticated streaming address sent by the user client, it pulls the stream based on the authenticated streaming address.

[0013] Optionally, before the push streaming client inputs the public parameters, the original pull streaming address, and the access structure tree into the encryption algorithm, and before sending the output encrypted ciphertext to the pull streaming client, it also includes: The streaming client determines the access attributes and the logical relationships between each access attribute based on the preset resource access strategy. The streaming client constructs an access tree structure with access attributes as leaf nodes and logical relationships as non-leaf nodes.

[0014] The resource access control system in this application includes: an authorization center, a push streaming user terminal, a cloud server, a streaming media server, and a pull streaming user terminal. This application generates public parameters and private keys corresponding to registered users through the authorization center, and sends the public parameters to the push streaming user terminal. The public parameters and private keys are also sent to the pull streaming user terminal. Upon receiving a push streaming request from the push streaming user terminal, the cloud server sends the original push streaming address to the push streaming user terminal. The push streaming user terminal inputs the public parameters, the original pull streaming address, and the access structure tree into the encryption algorithm and sends the output encrypted ciphertext to the pull streaming user terminal. The pull streaming user terminal inputs the public parameters, the private key, and the encrypted ciphertext into the decryption algorithm and generates an authenticated pull streaming address based on the decryption result. Upon receiving the authenticated pull streaming address from the pull streaming user terminal, the streaming media server performs pull streaming based on the authenticated pull streaming address. This application implements user attribute-based permission management by constructing an access structure tree. The public parameters, the original streaming address, and the access structure tree are input into the encryption algorithm. Then, the streaming user inputs the public parameters, the private key, and the encrypted ciphertext into the decryption algorithm. Based on the decryption result, an authenticated streaming address is generated, and the streaming media server pulls the stream based on the authenticated streaming address. This can distinguish the access levels of users with different attributes during the streaming process, thereby achieving a fine-grained permission management effect. Attached Figure Description

[0015] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram of the structure of the first embodiment of the resource access control system of this application; Figure 2 This is an example diagram of the access structure tree of the first embodiment of the resource access control system of this application; Figure 3 This is a schematic diagram of the structure of the second embodiment of the resource access control system of this application; Figure 4 This is a flowchart illustrating the first embodiment of the resource access control method of this application.

[0018] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0019] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0020] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0021] This application provides a resource access control system, referring to... Figure 1 , Figure 1 This is a schematic diagram of the structure of the first embodiment of the resource access control system of this application.

[0022] In this embodiment, the resource access control system includes: an authorization center, a push streaming user terminal, a cloud server, a streaming media server, and a pull streaming user terminal.

[0023] The authorization center is used to generate public parameters and private keys corresponding to registered users, and to send the public parameters to the push streaming user client and the public parameters and private keys to the pull streaming user client.

[0024] Understandably, the Authorization Center (AC), as a trusted third party, is responsible for system initialization, user registration, and attribute management. Specifically, it can generate public parameters and private keys corresponding to registered users. Registered users can include all users who have registered information, such as push users and pull users.

[0025] In its implementation, the Authorization Center (AC) can send public parameters to the push streaming user client and send the public parameters and private key to the pull streaming user client. The push streaming user client is the content producer and publisher, such as game streamers, live-streaming e-commerce hosts, online classroom teachers, and video conference speakers. The pull streaming user client is the content consumer and viewer, such as viewers watching live streams, students attending classes, and audience members of video conferences.

[0026] Furthermore, in order to generate public parameters and private keys through the authorization center, in this embodiment, the authorization center is also used to input preset security parameters into the initialization algorithm and output public parameters and master key.

[0027] Understandably, the Authorization Center (AC) can pre-select security parameters, specifically a preset security parameter λ, which is a positive integer. This preset security parameter is then input into the initialization algorithm, which can be the Setup algorithm. Inputting the preset security parameter λ into the Setup algorithm outputs a public parameter PK and a master key MK. MK is privately stored by the server and can be represented as... .

[0028] The authorization center is also used to input public parameters, master keys, and access attributes into the key generation algorithm and output the private key corresponding to the registered user. It should be understood that the Authorization Center (AC) can assign access attributes according to user needs. For example, "Research Room 9" and "Backend Development Engineer" indicate that only backend development engineers in Research Room 9 can act as push or pull users.

[0029] In a specific implementation, the key generation algorithm can be the KeyGen algorithm. The public parameter PK, the master key MK, and the access attribute S are input into the KeyGen algorithm, and the algorithm outputs the private key SK corresponding to the registered user, which can be represented as follows: This embodiment uses an Authorization Center (AC) to assign attributes to users and generate corresponding private keys, avoiding the problem of "one leak causing global failure" in traditional symmetric encryption. When a user is added or revoked, the Authorization Center only needs to update the corresponding user's attributes and private key, without having to replace the entire global key, thus reducing system maintenance costs.

[0030] The authorization center is also used to send public parameters to the push streaming user and to send the public parameters and private key to the pull streaming user.

[0031] Understandably, the Authorization Center (AC) can send the public parameter PK to the push user client through a secure channel, and send the public parameter PK and private key SK to the pull client through a secure channel.

[0032] The cloud server is used to send the original pull stream address to the push stream user when it receives a push stream request from the push stream user.

[0033] It should be understood that for each registered user The authorization center (AC) can also generate a unique user identifier. and authentication string Unique user identifiers include the user identifier of the user pushing the stream. The authentication string includes the user pushing the stream. .

[0034] Understandably, the user client is pushing the stream. Send a push request to the cloud server CS. The push request may include the user identifier corresponding to the push client. Corresponding to the push streaming user client Cloud server CS can be verified. In one feasible embodiment, the validity of the authentication can be verified by comparing and querying an internal database, since each user is bound to a unique authentication string. If valid, the original streaming address is generated. For example, http: / / server / pull / stream, and send the original pull stream address to the push stream user client. .

[0035] The push streaming client is used to input public parameters, the original pull streaming address, and the access structure tree into the encryption algorithm, and send the output encrypted ciphertext to the pull streaming client.

[0036] It should be understood that the access structure tree T can be a structure tree constructed according to the needs of the streaming user. For example, the root node of T is the AND gate, and the leaf nodes are the required attributes.

[0037] In a specific implementation, the encryption algorithm can be the Encrypt algorithm, which combines the public parameter PK and the original streaming address. And the access structure tree T is input into the encryption algorithm, and the encrypted ciphertext CT is output, which can be represented as follows: The pushing client then sends the encrypted ciphertext to the pulling client.

[0038] Furthermore, in order to effectively construct the access structure tree, in this embodiment, the streaming user terminal is also used to determine the access attributes and the logical relationships between each access attribute according to the preset resource access strategy. The push-stream client is also used to construct an access tree structure with access attributes as leaf nodes and logical relationships as non-leaf nodes.

[0039] Understandably, Attribute-Based Encryption (ABE) is an encryption technology that authorizes access based on "attributes." The core idea is that the encryptor does not specify a particular recipient but instead "labels" the data with attributes. Only those who meet the label requirements (such as "department = technical department + position = engineer") can decrypt the data.

[0040] It should be understood that the Access Structure Tree is constructed by the data owner. To precisely define the data access strategy, where For a set of nodes, Let it be the set of edges. Each non-leaf node A threshold value is set. , used to express logical operations: when When indicates OR operation; when ( When the number of children of the node is equal to the number of children of that node, it represents an AND operation; otherwise, it represents a threshold operation. Leaf node The corresponding attribute value is denoted as ( (Represents the complete set of attributes). Assume an access strategy is defined: In other words, only users who simultaneously possess the "Research Room 9" attribute and meet the requirements of either "Backend Development Engineer" or "Chief Engineer" can successfully decrypt shared data. The access structure tree T clearly expresses the logical relationships between the attributes; only when the set of attributes in the user's key fully satisfies the requirements of T can the decryption key for the data be recovered.

[0041] In the specific implementation, refer to Figure 2 , Figure 2 This is an example diagram of the access structure tree of the first embodiment of the resource access control system of this application, as shown below. Figure 2 As shown, users 1 and 2 can successfully decrypt the ciphertext, while user 3 cannot. The leaf nodes a1, a2, a3, a4, a5, a6, and a7 represent access attributes, while the other non-leaf nodes represent the logical relationships between these attributes. For example, attributes a1 and a2 have an OR relationship, and attributes a3, a4, and a5 have an AND relationship. This embodiment constructs an Access Tree, implementing permission division based on user attributes. Unlike traditional binary control, it can distinguish the access levels of users with different attributes, such as limiting access to "only users who meet the attribute set can view," thus achieving a refined management effect.

[0042] The streaming client is used to input public parameters, private keys, and encrypted ciphertext into the decryption algorithm, and generate an authenticated streaming address based on the decryption result.

[0043] Understandably, the decryption algorithm can be the Decrypt algorithm, and the user client can be pulled into the decryption process. The public parameter PK, private key SK, and encrypted ciphertext CT are input into the decryption algorithm, and the decryption result is output, which can be represented as follows: or .

[0044] It should be understood that the decryption result may contain plaintext. And generate an authentication pull address based on the original pull address.

[0045] A streaming media server is used to pull streams based on the authenticated pull stream address sent by the user client.

[0046] In its implementation, the streaming media server SS can pull the stream based on the authenticated pull address sent by the user client at the receiving end, and then display it to the user client.

[0047] The resource access control system in this embodiment includes: an authorization center, a push streaming user terminal, a cloud server, a streaming media server, and a pull streaming user terminal. This application generates public parameters and the private key corresponding to the registered user through the authorization center, and sends the public parameters to the push streaming user terminal. The public parameters and private key are also sent to the pull streaming user terminal. Upon receiving a push streaming request from the push streaming user terminal, the cloud server sends the original push streaming address to the push streaming user terminal. The push streaming user terminal inputs the public parameters, the original pull streaming address, and the access structure tree into the encryption algorithm and sends the output encrypted ciphertext to the pull streaming user terminal. The pull streaming user terminal inputs the public parameters, the private key, and the encrypted ciphertext into the decryption algorithm and generates an authenticated pull streaming address based on the decryption result. Upon receiving the authenticated pull streaming address from the pull streaming user terminal, the streaming media server performs pull streaming based on the authenticated pull streaming address. This embodiment implements user attribute-based permission management by constructing an access structure tree. The public parameters, the original streaming address, and the access structure tree are input into the encryption algorithm. Then, the streaming user inputs the public parameters, the private key, and the encrypted ciphertext into the decryption algorithm. Based on the decryption result, an authenticated streaming address is generated, and the streaming media server pulls the stream based on the authenticated streaming address. This can distinguish the access levels of users with different attributes during the streaming process, thereby achieving a fine-grained permission management effect.

[0048] Based on the first embodiment described above, a second embodiment of the resource access control system of this application is proposed. In this embodiment, the push streaming user terminal is also used to receive the original push streaming address fed back by the cloud server based on the push streaming request.

[0049] Understandably, after receiving a push request from a user client, the cloud server (CS) can also generate the original push address. For example, rtmp: / / server / push / stream.

[0050] The push streaming client is also used to concatenate the original push streaming address and the push streaming user authentication string to obtain the authenticated push streaming address.

[0051] It should be understood that the streaming client can modify the original streaming address. And the user authentication string for streaming The URLs are concatenated to form the authentication push address. , can be represented as .

[0052] The streaming client is also used to send an authenticated streaming address to the streaming media server so that the streaming media server can push the stream based on the authenticated streaming address.

[0053] In a practical implementation, the streaming client can send an authenticated streaming address to the streaming media server SS, so that the streaming media server SS can push the stream based on the authenticated streaming address.

[0054] The streaming media server is also used to extract the streaming user authentication string from the authentication streaming address when it receives the authentication streaming address sent by the streaming user.

[0055] Understandably, the streaming media server SS receives the authentication streaming address sent by the streaming user. In this case, it can be pushed from the authentication address. Extract the user authentication string for streaming. .

[0056] The streaming media server is also used to bind the original streaming address sent by the cloud server with the streaming user authentication string and start media stream reception when the validity verification of the streaming user authentication string is passed.

[0057] It should be understood that the streaming media server can verify the validity of the authentication string of the user pushing the stream. In one feasible embodiment, the streaming media server will maintain a table to ensure that a user can only have one stream. This can be understood as a set. If the user is currently pushing or pulling a stream, the user will be in this set. If the user is not pushing or pulling a stream, the user will not be in this set. When a new request comes in, it will query this set. If the user is in the set, the request will be rejected. If the user is not in the set, the request will be approved.

[0058] In the specific implementation, if the authentication string of the pushing user passes the validity verification, the original pushing address can be... Authentication string with push user Binding is performed to initiate media stream reception, thereby preventing other users from using the same original push address. Streaming. This embodiment introduces a binding mechanism between the authentication string and the user's unique identity GID on the streaming media server side, and restricts each authentication string to correspond to only one streaming media at any given time. This not only prevents hotlinking and account sharing issues, but also avoids resource waste caused by a single user pulling multiple concurrent streams.

[0059] This embodiment receives the original streaming address from the cloud server based on the streaming request from the streaming user client. Then, it concatenates the original streaming address with the streaming user authentication string to obtain an authenticated streaming address. This authenticated streaming address is then sent to the streaming media server, enabling the streaming media server to stream based on it. This embodiment achieves a binding between the original streaming address and the streaming user authentication string by having the streaming user client concatenate the original streaming address and the streaming user authentication string, preventing other streaming users from using the same streaming address.

[0060] Based on the above embodiments, a third embodiment of the resource access control system of this application is proposed. In this embodiment, the streaming user terminal is also used to input public parameters, private keys and encrypted ciphertext into the decryption algorithm and output the decryption result.

[0061] Understandably, this involves pulling the user's data. The public parameter PK, private key SK, and encrypted ciphertext CT are input into the decryption algorithm, and the decryption result is output, which can be represented as follows: or .

[0062] The streaming client is also used to concatenate the original streaming address and the streaming user authentication string in the decryption result if the decryption result is successful, so as to obtain the authenticated streaming address.

[0063] It should be understood that if the decryption result is successful, the original streaming address and the streaming user authentication string can be concatenated to obtain the authenticated streaming address; if the decryption result is unsuccessful, ⊥ is returned, indicating that the corresponding streaming user client does not have access rights, and the process terminates.

[0064] Furthermore, in order to effectively determine whether decryption was successful, the streaming user client also matches the streaming user attributes with the access structure tree in the encrypted ciphertext to obtain the matching result.

[0065] Understandably, the client pulling the stream can match the user's attributes with the access structure tree T. If a matching subtree exists, the matching result is considered successful.

[0066] The client-side streaming function is also used to calculate node values ​​when the matching result is a successful match.

[0067] It should be understood that, when the matching result is a successful match, the user client can recursively calculate the node value, for example... Figure 2 The access structure tree shown shows that if a user has attribute a1, the OR node will be satisfied; if a user has attributes a3 and a4, the AND node in the middle will be satisfied; if a user has attributes a5 and a7, the 2of / 3 node will be satisfied, thus satisfying the AND of the root node. This process is called recursive calculation.

[0068] The client-side application that pulls the stream is also used to determine if the decryption result is successful when the node value matches the root node in the access tree structure.

[0069] In the actual implementation, the node value is used as part of the decryption parameters. If the attribute is satisfied, the node value calculation will be correct, resulting in successful decryption. Therefore, if the node value obtained by recursive calculation matches the root node in the access tree structure, the decryption result is determined to be successful.

[0070] The streaming media server is also used to extract the authentication string of the streaming user from the authentication streaming address when it receives the authentication streaming address sent by the streaming user.

[0071] Understandably, the streaming media server SS receives the authentication pull address sent by the user client. In this case, streaming can be pulled from the authenticated address. Extracting the user authentication string from the streaming source .

[0072] The streaming media server is also used to initiate media streaming transmission if the authentication string of the user pulling the stream passes the validity verification.

[0073] Understandably, streaming media servers can authenticate users who pull streams. Perform a validity verification, specifically using the method described above for verifying the user authentication string used for streaming. If the validity verification passes, initiate media stream transmission.

[0074] refer to Figure 3 , Figure 3 This is a schematic diagram of the overall structure of an embodiment of the resource access control system of this application. Figure 3As shown, both push and pull user clients can register in the authorization center, generating public parameters PK and master keys MK. A unique user identifier GID is also generated for each client, an access attribute set SK is assigned, and a private key SK and authentication string AuthToken are generated. The push user client requests a push address from the cloud server, sending the GID and AuthToken. The cloud server verifies the AuthToken, and upon successful verification, returns the original pull and push addresses. The push user client constructs an access structure tree T, encrypts the original push address to generate ciphertext CT, and uploads CT to the cloud server. The push user client then uses the original push address + A... When pushing a stream using the AuthToken, the streaming media server verifies the AuthToken and binds it to the original push URL. The client requesting the stream address from the cloud server sends the GID and AuthToken. The cloud server verifies the AuthToken and returns the encrypted CT to the client. The client decrypts the CT using SK. If decryption is successful, the client obtains the original stream address and uses the original stream address + AuthToken to pull the stream from the streaming media server. The streaming media server verifies the AuthToken, checks for duplicate streams, and then transmits the media stream to the client. If decryption fails, the client does not have access rights and the process terminates.

[0075] This embodiment inputs public parameters, a private key, and encrypted ciphertext into the decryption algorithm via the streaming user's client, and outputs the decryption result. If the decryption is successful, the original streaming address and the streaming user's authentication string in the decryption result are concatenated to obtain the authenticated streaming address. The decryption capability of a streaming user is determined by the matching relationship between their attribute set and the access structure; even legitimate streaming users can only decrypt streaming media within their authorized scope.

[0076] This application proposes a resource access control method, applied to the resource access control systems of the above embodiments, with reference to... Figure 4 , Figure 4 This is a flowchart illustrating the first embodiment of the resource access control method of this application. The resource access control method includes the following steps: Step S10: The authorization center generates public parameters and the private key corresponding to the registered user, and sends the public parameters to the push streaming user and the public parameters and private key to the pull streaming user.

[0077] Understandably, the Authorization Center (AC), as a trusted third party, is responsible for system initialization, user registration, and attribute management. Specifically, it can generate public parameters and private keys corresponding to registered users. Registered users can include all users who have registered information, such as push users and pull users.

[0078] In its implementation, the Authorization Center (AC) can send public parameters to the push streaming user client and send the public parameters and private key to the pull streaming user client. The push streaming user client is the content producer and publisher, such as game streamers, live-streaming e-commerce hosts, online classroom teachers, and video conference speakers. The pull streaming user client is the content consumer and viewer, such as viewers watching live streams, students attending classes, and audience members of video conferences.

[0079] Step S20: When the cloud server receives a push request from the push user, it sends the original pull address to the push user.

[0080] It should be understood that for each registered user The authorization center (AC) can also generate a unique user identifier. and authentication string Unique user identifiers include the user identifier of the user pushing the stream. The authentication string includes the user pushing the stream. .

[0081] Understandably, the user client is pushing the stream. Send a push request to the cloud server CS. The push request may include the user identifier corresponding to the push client. Corresponding to the push streaming user client Cloud server CS can be verified. In one feasible embodiment, the validity of the authentication can be verified by comparing and querying an internal database, since each user is bound to a unique authentication string. If valid, the original streaming address is generated. For example, http: / / server / pull / stream, and send the original pull stream address to the push stream user client. .

[0082] Step S30: The push streaming client inputs the public parameters, the original pull streaming address, and the access structure tree into the encryption algorithm, and sends the output encrypted ciphertext to the pull streaming client.

[0083] It should be understood that the access structure tree T can be a structure tree constructed according to the needs of the streaming user. For example, the root node of T is the AND gate, and the leaf nodes are the required attributes.

[0084] In a specific implementation, the encryption algorithm can be the Encrypt algorithm, which combines the public parameter PK and the original streaming address. And the access structure tree T is input into the encryption algorithm, and the encrypted ciphertext CT is output, which can be represented as follows: The pushing client then sends the encrypted ciphertext to the pulling client.

[0085] Furthermore, in this embodiment, before step S30, the method further includes: the streaming user terminal determining the access attributes and the logical relationships between each access attribute according to a preset resource access strategy; the streaming user terminal constructing an access structure tree with the access attributes as leaf nodes and the logical relationships as non-leaf nodes.

[0086] It should be understood that, as Figure 2 As shown, users 1 and 2 can successfully decrypt the ciphertext, while user 3 cannot. The leaf nodes a1, a2, a3, a4, a5, a6, and a7 represent access attributes, while the other non-leaf nodes represent the logical relationships between these attributes. For example, attributes a1 and a2 have an OR relationship, and attributes a3, a4, and a5 have an AND relationship. This embodiment constructs an Access Tree, implementing permission division based on user attributes. Unlike traditional binary control, it can distinguish the access levels of users with different attributes, such as limiting access to "only users who meet the attribute set can view," thus achieving a refined management effect.

[0087] Step S40: The client pulling the stream inputs the public parameters, private key, and encrypted ciphertext into the decryption algorithm, and generates an authenticated streaming address based on the decryption result.

[0088] Understandably, the decryption algorithm can be the Decrypt algorithm, and the user client can be pulled into the decryption process. The public parameter PK, private key SK, and encrypted ciphertext CT are input into the decryption algorithm, and the decryption result is output, which can be represented as follows: or .

[0089] It should be understood that the decryption result may contain plaintext. And generate an authentication pull address based on the original pull address.

[0090] Step S50: Upon receiving the authenticated streaming address sent by the streaming user, the streaming media server performs streaming based on the authenticated streaming address.

[0091] In its implementation, the streaming media server SS can pull the stream based on the authenticated pull address sent by the user client at the receiving end, and then display it to the user client.

[0092] This embodiment generates public parameters and the private key corresponding to the registered user through the authorization center, and sends the public parameters to the push streaming user terminal and the public parameters and private key to the pull streaming user terminal. When the cloud server receives the push streaming request from the push streaming user terminal, it sends the original push streaming address to the push streaming user terminal. The push streaming user terminal inputs the public parameters, the original pull streaming address, and the access structure tree into the encryption algorithm, and sends the output encrypted ciphertext to the pull streaming user terminal. The pull streaming user terminal inputs the public parameters, the private key, and the encrypted ciphertext into the decryption algorithm, and generates an authenticated pull streaming address based on the decryption result. When the streaming media server receives the authenticated pull streaming address sent by the pull streaming user terminal, it pulls the stream based on the authenticated pull streaming address. This embodiment implements user attribute-based permission management by constructing an access structure tree. The public parameters, the original streaming address, and the access structure tree are input into the encryption algorithm. Then, the streaming user inputs the public parameters, the private key, and the encrypted ciphertext into the decryption algorithm. Based on the decryption result, an authenticated streaming address is generated, and the streaming media server pulls the stream based on the authenticated streaming address. This can distinguish the access levels of users with different attributes during the streaming process, thereby achieving a fine-grained permission management effect.

[0093] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0094] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0095] The above are only some embodiments of this application and do not limit the scope of protection of this application. All equivalent structural transformations made under the technical concept of this application and using the content of this application specification and drawings, or direct / indirect applications in other related technical fields, are included in the scope of protection of this application.

Claims

1. A resource access control system, characterized in that, The resource access control system includes: an authorization center, a push streaming user terminal, a cloud server, a streaming media server, and a pull streaming user terminal; The authorization center is used to generate public parameters and private keys corresponding to registered users, and send the public parameters to the push user terminal, and send the public parameters and the private keys to the pull user terminal; The cloud server is used to send the original pull address to the push streaming user when it receives a push streaming request from the push streaming user. The push-stream user terminal is used to input the public parameters, the original pull-stream address, and the access structure tree into the encryption algorithm, and send the output encrypted ciphertext to the pull-stream user terminal; The streaming client is used to input the public parameters, the private key, and the encrypted ciphertext into the decryption algorithm, and generate an authenticated streaming address based on the decryption result; The streaming media server is configured to pull streams based on the authenticated pull stream address when it receives the authenticated pull stream address sent by the pull stream user client.

2. The resource access control system as described in claim 1, characterized in that, The streaming user terminal is also used to determine the access attributes and the logical relationship between each access attribute according to the preset resource access strategy; The streaming client is also used to construct the access structure tree with the access attributes as leaf nodes and the logical relationships as non-leaf nodes.

3. The resource access control system as described in claim 1, characterized in that, The push streaming user terminal is also used to receive the original push streaming address fed back by the cloud server based on the push streaming request; The streaming user terminal is also used to concatenate the original streaming address and the streaming user authentication string to obtain the authenticated streaming address; The streaming user terminal is also used to send the authenticated streaming address to the streaming media server so that the streaming media server can perform streaming based on the authenticated streaming address.

4. The resource access control system as described in claim 1, characterized in that, The streaming client is also used to input the public parameters, the private key, and the encrypted ciphertext into the decryption algorithm and output the decryption result; The streaming user terminal is further configured to, if the decryption result is successful, concatenate the original streaming address and the streaming user authentication string in the decryption result to obtain the authenticated streaming address.

5. The resource access control system as described in claim 4, characterized in that, The streaming user client is also used to match the streaming user attributes with the access structure tree in the encrypted ciphertext to obtain a matching result; The streaming user terminal is also used to calculate the node value when the matching result is a successful match; The streaming client is also used to determine that the decryption result is successful if the node value matches the root node in the access structure tree.

6. The resource access control system as described in claim 1, characterized in that, The authorization center is also used to input preset security parameters into the initialization algorithm and output public parameters and master key; The authorization center is also used to input the public parameters, the master key, and the access attributes into the key generation algorithm, and output the private key corresponding to the registered user; The authorization center is also used to send the public parameters to the push streaming user terminal and send the public parameters and the private key to the pull streaming user terminal.

7. The resource access control system as described in claim 1, characterized in that, The streaming media server is also configured to extract the streaming user authentication string from the authentication streaming address when it receives the authentication streaming address sent by the streaming user client; The streaming media server is also used to initiate media stream transmission if the validity verification of the user authentication string is passed.

8. The resource access control system as described in claim 3, characterized in that, The streaming media server is further configured to extract the streaming user authentication string from the authentication streaming address when it receives the authentication streaming address sent by the streaming user terminal. The streaming media server is further configured to bind the original streaming address sent by the cloud server to the streaming user authentication string and start media stream reception if the validity verification of the streaming user authentication string is passed.

9. A resource access control method, applied to the resource access control system according to any one of claims 1 to 8, characterized in that, The resource access control method includes the following steps: The authorization center generates public parameters and the private key corresponding to the registered user, and sends the public parameters to the push streaming user and the public parameters and the private key to the pull streaming user. Upon receiving a push request from the push user client, the cloud server sends the original pull address to the push user client. The push streaming client inputs the public parameters, the original pull streaming address, and the access structure tree into the encryption algorithm, and sends the output encrypted ciphertext to the pull streaming client; The streaming client inputs the public parameters, the private key, and the encrypted ciphertext into the decryption algorithm, and generates an authenticated streaming address based on the decryption result; When the streaming media server receives the authenticated streaming address sent by the streaming user, it performs streaming based on the authenticated streaming address.

10. The resource access control method as described in claim 9, characterized in that, Before the streaming user client inputs the public parameters, the original streaming address, and the access structure tree into the encryption algorithm and sends the output encrypted ciphertext to the streaming user client, it also includes: The streaming client determines the access attributes and the logical relationships between each access attribute according to a preset resource access strategy. The streaming client constructs the access structure tree using the access attributes as leaf nodes and the logical relationships as non-leaf nodes.

Images