Access control method and device

Abstract

The embodiment of the invention provides an access control method and device. The method comprises the steps of performing identity authentication on a first application based on identity authentication information in a target data use strategy in a safe environment, and executing access control on a first access operation of target data of the first application based on an access control strategy in the target data use strategy under the condition that the identity authentication succeeds, therefore, the data security problem caused by false use of the application is effectively prevented, and the use security of the data is effectively improved.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to an access control method and apparatus. Background Technology

[0002] With the development of data security technology, users have increasingly higher requirements for data security. To prevent risks such as data leakage and misuse during data transmission, strengthening the management and control of data security has become an urgent problem to be solved. Summary of the Invention

[0003] This application provides an access control method and apparatus, which can effectively improve data security.

[0004] Firstly, this application provides an access control method. The method includes: in a secure environment, acquiring target data and a target data usage policy, wherein the target data usage policy includes authentication information and an access control policy, the authentication information indicating that the application identified by the authentication information is allowed to access the target data, and the access control policy indicating the access behavior allowed for the application to perform on the target data; wherein the authentication information is generated based on the application's computer program. Acquiring first authentication information of a first application and a first access operation of the first application on the target data; wherein the first authentication information is generated based on the first application's computer program. If authentication of the first authentication information is successful, access control is performed on the first access operation based on the access control policy. Thus, in a secure environment, the integrity and security of the application and data can be ensured. Furthermore, deploying the module for performing the above steps in a secure environment does not require access from other servers or media (such as blockchain), reducing the deployment difficulty of the system. Also, the method of generating authentication information based on a computer program in this application can uniquely identify an application through the authentication information, effectively preventing other illegal applications from impersonating legitimate applications (i.e., successfully authenticated applications), further improving data security. Furthermore, this application controls access behavior based on data usage policies. When the application is successfully authenticated, it can further control the access operations performed by the legitimate application (i.e., the successfully authenticated application) on the target data, so as to prevent the legitimate application from performing illegal access behavior on the target data, and control the legitimate application's access behavior on the target data within the scope of access behavior specified by the access control policy, thereby further improving data security.

[0005] For example, the security environment can be a TEE in a Trust Zone, a confidential computing environment in a CAA, or a security environment in other architectures; this application does not limit it.

[0006] For example, the computer program of the first application is stored in the memory of the device. The computer program of the first application can be understood as: when the processor runs the computer program of the application, it enables the first application, that is, starts the first application and implements the functions that the first application can provide.

[0007] For example, the target data usage strategy may include one or more authentication information entries. Each authentication information entry is used to identify an application.

[0008] For example, in a secure environment, due to the firmware interface settings of that environment, the verification of the target data usage policy is enforced, which can prevent applications from bypassing the verification process and stealing data, thereby improving data security.

[0009] In one possible implementation, the first identity authentication information includes a baseline value generated based on all or part of the computer program of the first application. Thus, this application can use the baseline value generated by all or part of the computer program of the application as a unique identifier for an application's identity authentication, thereby verifying the application's identity and preventing other unauthorized applications from impersonating legitimate applications (i.e., successfully authenticating the identity), further improving data security.

[0010] In one possible implementation, the baseline value is a hash value calculated based on all or part of the computer program of the first application. Thus, by generating a hash value, the irreversibility of the hash value ensures the security of the baseline value during transmission and storage; and based on the uniqueness of the hash value, the device can compare the received hash value with the stored hash value to determine whether the received baseline value is complete, thereby ensuring the integrity of the baseline value during transmission and storage.

[0011] In one possible implementation, the target data and the target data usage policy are carried within an encrypted data packet. Obtaining the target data and the target data usage policy includes decrypting the data packet to obtain the plaintext data of the target data and the target data usage policy. In this way, the data owner in this application can generate a corresponding data usage policy based on authentication information, enabling data users to control application access to the target data based on the data usage policy. Furthermore, by using authentication information for identity verification and executing access control through access control policies, this application can effectively prevent unauthorized applications (or counterfeit applications) from accessing the data, and also prevent legitimate applications (i.e., those successfully authenticated) from unauthorized accessing the data (i.e., access behaviors outside the scope of the usage policy), thus sufficiently ensuring data security. This allows the data owner to simply encrypt the data packet, eliminating the need for complex algorithms to encrypt the data packet and the target data within it, and the process of generating a complex key. Furthermore, in existing technologies, data packets and their contents (including target data and usage policies) are bound to complex keys, making it impossible to dynamically adjust usage policies. In other words, if a change in usage policy is needed, a new data packet containing the target data and usage policy must be generated and bound to the corresponding key. This application, however, uses a simple encryption method, and the target data is already stored in plaintext on the data user's side. Accordingly, the data owner can update the data usage policy according to scenario requirements (e.g., the addition of a new data user) and send it to each data user, providing a way to dynamically adjust the data usage policy. Moreover, after obtaining the data, the data user only needs to decrypt the data packet, without needing to perform complex decryption algorithms (e.g., attribute-based encryption, ABE). Furthermore, the data is stored in plaintext in a secure environment, ensuring data security based on the security features of that environment. Additionally, after successful application authentication and access verification, the plaintext can be directly obtained without decrypting the data each time, improving access efficiency.

[0012] In one possible implementation, if authentication of the first identity authentication information based on the identity authentication information is successful, access control is performed on the first access operation based on an access control policy, including: matching the first identity authentication information with the identity authentication information. If the first identity authentication information matches the identity authentication information successfully, the first application's authentication is successful, and the first application is allowed to access the target data. If the first identity authentication information fails to match the identity authentication information, the first application's authentication fails, and the first application's access to the target data is denied. Thus, this application performs authentication of the application through identity authentication information to prevent unauthorized access by counterfeit applications, which could compromise data security. The application is only allowed to access data if authentication is successful. If authentication fails, the application's access to the data is denied.

[0013] For example, a successful match between the first identity authentication information and the identity authentication information may occur if the target data usage policy contains identity authentication information identical to the first identity authentication information. Conversely, a failure to match between the first identity authentication information and the identity authentication information may occur if the target data usage policy does not contain identity authentication information identical to the first identity authentication information.

[0014] In one possible implementation, the access control policy includes at least one of the following: an access operation type policy and an access operation count policy; wherein the access operation type policy indicates the types of access operations that the application is allowed to perform on the target data; and the access operation count policy indicates the maximum number of times the application is allowed to access the target data. In this way, the data owner can set different access control policies to control the application's access to the data, thereby preventing the application from illegally accessing the data after successful authentication, which could lead to data leaks and other problems.

[0015] In one possible implementation, access control is applied to the first access operation based on an access control policy. This includes: performing access operation type verification and access operation count verification on the first access operation based on the access control policy; if both access operation type verification and access operation count verification are successful, the first application is allowed to perform the first access operation on the target data; if either access operation type verification or access operation count verification fails, the first application is denied access to the target data. In this way, the data owner can set different access control policies to control the application's access to the data, thereby preventing unauthorized access to the data by the application after successful authentication, which could lead to data leakage and other problems.

[0016] For example, the access control policy may include an access operation type policy. Accordingly, if the access operation type verification for the first access operation is successful based on the access operation type policy, the application is allowed to access the target data. Alternatively, the access control policy may include access operation count verification. Accordingly, if the access operation count verification for the first access operation is successful based on the access operation count policy, the application is allowed to access the target data.

[0017] In some instances, access control policies may also include one or more other policies for planning access behavior, which are not limited in this application.

[0018] Secondly, this application provides an access control device, comprising: a first acquisition module, configured to acquire target data and a target data usage policy in a secure environment, wherein the target data usage policy includes authentication information and an access control policy, the authentication information being used to instruct an application identified by the authentication information to access the target data, and the access control policy being used to instruct an application to perform an access action on the target data; wherein the authentication information is generated based on a computer program of the application; a second acquisition module, configured to acquire first authentication information of a first application and a first access operation of the first application on the target data; wherein the first authentication information is generated based on a computer program of the first application; and an execution module, configured to execute access control on the first access operation based on the access control policy if the authentication of the first authentication information based on the authentication information is successful.

[0019] In one possible implementation, the first identity authentication information includes a baseline value generated based on all or part of the computer program of the first application.

[0020] In one possible implementation, the baseline value is a hash value calculated based on all or part of the computer program of the first application.

[0021] In one possible implementation, the target data and the target data usage strategy are carried in an encrypted data packet. The first acquisition module is specifically used to: decrypt the data packet to obtain the plaintext data of the target data and the target data usage strategy.

[0022] In one possible implementation, the execution module includes an authentication unit, configured to: match the first identity authentication information with the identity authentication information; if the first identity authentication information matches the identity authentication information successfully, the first application's authentication is successful, allowing the first application to access the target data; if the first identity authentication information does not match the identity authentication information, the first application's authentication fails, denying the first application access to the target data.

[0023] For example, the authentication unit may also be called an identity authentication unit or an identity verification unit, and this application does not limit it.

[0024] In one possible implementation, the access control policy includes at least one of the following: an access operation type policy and an access operation count policy; wherein the access operation type policy is used to indicate the type of access operation that the application is allowed to perform on the target data; and the access operation count policy is used to indicate the maximum number of times the application is allowed to access the target data.

[0025] In one possible implementation, the execution module includes a policy execution unit, configured to: perform access operation type verification and access operation count verification on the first access operation based on the access control policy; if both access operation type verification and access operation count verification are successful, allow the first application to perform the first access operation on the target data; if either access operation type verification or access operation count verification fails, deny the first application from performing the first access operation on the target data.

[0026] For example, the policy enforcement unit may also be called an access control unit, an access behavior verification unit, etc., and this application does not limit it.

[0027] Thirdly, this application provides an access control device, including one or more processors; a memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and when the computer programs are executed by the one or more processors, the device performs the method of the first aspect or any possible implementation thereof.

[0028] Fourthly, embodiments of this application provide a computer device, including: a transceiver / transceiver pin and a processor, optionally further including a memory. The transceiver / transceiver pin, the processor, and the memory communicate with each other via internal interconnection paths; the processor is used to execute instructions to control the transceiver / transceiver pin to send or receive signals; the memory is used to store instructions. When the processor executes instructions, the processor performs the method described in the first aspect or any possible implementation thereof.

[0029] Fifthly, embodiments of this application provide a computer-readable medium for storing a computer program, the computer program including instructions for performing the method in the first aspect or any possible implementation of the first aspect.

[0030] In a sixth aspect, embodiments of this application provide a computer program including instructions for performing the method in the first aspect or any possible implementation thereof.

[0031] In a seventh aspect, embodiments of this application provide a chip including a processing circuit and transceiver pins. The transceiver pins and the processing circuit communicate with each other via an internal connection path. The processing circuit executes the method in the first aspect or any possible implementation of the first aspect to control the receiving pin to receive signals and to control the transmitting pin to transmit signals. Attached Figure Description

[0032] Figure 1 This is a schematic diagram of a communication system as an example.

[0033] Figure 2 This is a schematic diagram of a CCA architecture provided in the embodiments of this application;

[0034] Figure 3 A flowchart illustrating the access control method provided in this application embodiment;

[0035] Figure 4 A flowchart illustrating the access control method provided in an embodiment of this application;

[0036] Figure 5 This is a schematic diagram of an access control flow as an example.

[0037] Figure 6 This is a schematic diagram of the structure of an access control device as an example.

[0038] Figure 7 This is a schematic diagram of the structure of an access control device as an example. Detailed Implementation

[0039] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0040] Figure 1 The schematic diagram of the communication system is shown as an example. First, it is combined with... Figure 1 The communication system according to an embodiment of this application will be described. Please refer to... Figure 1 The communication system includes, but is not limited to, a first electronic device and a second electronic device.

[0041] For example, the role of the first electronic device in this application embodiment can be referred to as the data owner, data provider, data owner, etc., and this application does not limit it. The role of the second electronic device in this application embodiment can be referred to as the data user. It can be understood that the first electronic device and the data owner involved in this application embodiment can be arbitrarily replaced, and the second electronic device and the data user can be arbitrarily replaced. Optionally, in some instances, the data owner and the data user can also refer to the user using the first electronic device or the second electronic device, and this application does not limit it.

[0042] It should be noted that, Figure 1 The number of electronic devices included is merely illustrative; the system may include more data owners and / or data users, and can be deployed according to actual needs. This application does not limit this.

[0043] Optionally, the communication system may also include, but is not limited to, a remote server, which can be used for data interaction between the first electronic device and the second electronic device. For example, the second electronic device can send information (such as baseline values ​​involved in the embodiments of this application) to the remote server, and the remote server can save the information sent by the second electronic device. The first electronic device can obtain the information sent by the second electronic device from the remote server.

[0044] The electronic devices (including the first electronic device and the second electronic device) in the embodiments of this application can be mobile phones, tablets, wearable devices, in-vehicle devices, augmented reality (AR) / virtual reality (VR) devices, laptops, ultra-mobile personal computers (UMPCs), personal digital assistants (PDAs), and other electronic devices. This application does not limit them.

[0045] In this embodiment, the electronic device's system architecture includes a secure environment, such as, but not limited to, a trusted execution environment (TEE) or a confidential computer environment. The electronic device can process private or confidential information within this secure environment to protect the security of personal or device privacy or confidential information.

[0046] For example, electronic devices based on ARM Trust Zones include, but are not limited to, TEEs and Rich Execution Environments (REEs). These devices isolate highly security-sensitive applications from the general software environment, providing a dedicated Trusted Execution Environment (TEE) and protecting the confidentiality, integrity, and access rights of application resources and data; while providing a general-purpose REE for vulnerable traditional operating systems. Applications running on the REE side are called client applications (CAs), such as banking applications and other third-party payment applications. Applications running on the TEE side are called trusted applications (TAs), such as applications performing critical services like signature and encryption / decryption calculations. Because TAs run within the Trusted Execution Environment (TEE), their deployment / upgrade operations must strictly adhere to the security verification specifications of the TEE issuer (usually the terminal manufacturer), such as using digital signatures, to ensure that all aspects of the TEE are truly trustworthy. The Trusted Execution Environment (TEE) includes the Trusted Execution Environment Internal Application Programming Interface (TEEInternal API) and the Trusted Operating System (TES) component. The main functions of the TEE Internal API are: to provide the functions of the TES component, to communicate with the client application CA, to enable communication between TAs, and to provide secure storage, cryptographic functions, time functions, etc.

[0047] In the embodiments of this application, the system architecture of the electronic device can be a TEE based on the ARM Trust Zone architecture, a confidential computing environment based on the ARM Confidential Compute Architecture (CCA) architecture, or a security environment based on other architectures. This application does not limit the scope of the application.

[0048] Figure 2 This is a schematic diagram of a CCA architecture provided in an embodiment of this application. Please refer to... Figure 2 The CAA architecture includes privilege levels, which divide the CAA system into different exception levels (ELs). Optionally, ELs include, but are not limited to: EL0, EL1, EL2, and EL3. The higher the EL number, the higher the corresponding privilege.

[0049] For example, the CCA architecture includes, but is not limited to, the following three states: Realm state, Non-secure state (also known as Normal state), and Secure state.

[0050] like Figure 2 As shown, applications and operating systems can run in the Realm state. The data processing applications of the first electronic device involved in this application embodiment, as well as the data obtained by the first electronic device from the second electronic device (which can also be called confidential data or private information, etc., which is not limited in this application), can run or be stored in this state. For example, the method in this application embodiment can be understood as being for data that requires security control, or for data that needs to be kept confidential. Other data that is not sensitive to security can be stored or operated in a non-secure state, which is not limited in this application.

[0051] For example, such as Figure 2 As shown, the Realm state runs Realm VM (Virtual Machine) 0 and Realm VM1. Taking Realm VM0 as an example, Realm VM includes, but is not limited to: OS Kernel (Operating System Kernel), Data Processing Application 1 (also known as the first data processing application, data processing program, etc., which are not limited in this application), Data Sharing Agent (DS Agent), etc.

[0052] In this embodiment, the DS Agent is used to authenticate applications (e.g., data processing application 1) on its associated node or device (e.g., Realm VM), and also to manage application access to data (e.g., target data involved in this embodiment, also known as confidential data in a secure environment), which can be understood as performing access control (or permission control). The specific implementation will be described in detail below.

[0053] In this embodiment, the DS Agent has a mandatory access control mechanism. Specifically, due to the interface and firmware configuration in the TEE, each application in the TEE must authenticate and verify the access to data with confidentiality requirements before it can access the data (including reading, writing, querying, etc.). This can be understood as the DS Agent providing a fixed access interface for each application. In scenarios where an application accesses data, it must do so through this unique fixed access interface. The DS Agent can authenticate and verify the application using a usage policy (collectively referred to as access control verification or access verification, which is not limited in this application) based on the access request received through this interface. After successful verification, the application is allowed to continue accessing the data. In other words, applications in the TEE cannot bypass the DS Agent to access data. Therefore, in this embodiment, after authenticating the application, the DS Agent can prevent impersonating applications from illegally accessing data, and monitor and control the application's access behavior through data usage policies to prevent the application itself from illegally accessing or stealing data, thereby improving data security.

[0054] Optionally, the DS Agent is used to acquire and store the authentication information of the data processing application. In this embodiment, the authentication information is the baseline value of the data processing application (also referred to as a benchmark value, metric value, etc., which is not limited in this application). The baseline value of the data processing application is generated based on all or part of the computer program of the data processing application. Optionally, the computer program of the data processing application can be stored in memory, that is, the computer program of the data processing application is stored in the memory space to which the data processing application belongs. Here, the computer program of the application can be understood as: when the processor executes the computer program, it can enable the application, or it can be understood as being able to start and run the application. Optionally, the data processing application can generate a corresponding hash value based on all or part of the computer program corresponding to the application as the baseline value. Of course, in some examples, the data processing application can also use other calculation or encryption methods to calculate the computer program to calculate the baseline value of the data processing application and obtain the authentication information.

[0055] Optionally, in some examples, the authentication information of the data processing application can also be a combination of a baseline value and at least one other piece of information. For example, it can be a combination of the data processing application's identification information (e.g., application ID) and the baseline value. The data processing application can generate a corresponding hash value based on the application ID and the baseline value as its authentication information.

[0056] For example, the DS Agent is also used to authenticate data processing applications (also known as identity verification, signature verification, etc.). Specifically, the DS Agent authenticates the data processing application based on its identity authentication information and the identity authentication information in the data usage policy to determine the true identity of the data processing application and prevent data leakage caused by application impersonation.

[0057] For example, the DS Agent can also be used to control access behavior of data processing applications. Access behavior, also known as access operation, includes various access behaviors such as reading, writing, and querying. Specifically, the DS Agent can manage the access behavior of data processing applications based on the data usage policies defined by the data owner.

[0058] Optionally, the DS Agent can be configured with execution sub-modules (or units) corresponding to different policy contents. For example, suppose the data usage policy includes an access operation type policy and an access operation count policy. The access operation type policy indicates the types of access operations allowed on the data. The access operation count policy indicates the maximum number of times the application is allowed to access the data, or it can also indicate the maximum number of times the application is allowed to perform the same access operation type on the data. The number of times the application accesses the data can be understood as the number of times the application accesses the data (not limited to operation type). The number of times the application performs a specific access operation type on the data can be understood as the number of times the application performs a particular access operation on the data. For example, the access operation type policy includes: read operation, and the access operation count policy includes: read operation count is 3. That is, this data usage policy allows the data processing application to perform read operations on the data (i.e., it can read the data, but cannot modify (including adding, deleting, and modifying) the data), and the number of read operations allowed by the data processing application is less than or equal to 3.

[0059] For example, a DS Agent may include, but is not limited to, an operation type determination submodule (or unit) and an operation count determination submodule (or unit). The operation type determination submodule is used to control the type of access behavior of the data processing application based on an access operation type policy. The operation count determination submodule is used to control the number of times the data processing application accesses an operation based on an access operation count policy.

[0060] For example, the DS Agent Manager is used to configure corresponding resources for each DS Agent (e.g., DS Agent0 or DS Agent1) according to the computing needs of the node or device (e.g., RealmVM) to which the DS Agent belongs. Resources include, but are not limited to, CPU resources, memory resources, and device resources (e.g., network interface cards), etc., which are not limited in this application.

[0061] For example, RMM (Realm Management Monitor), running in EL2 mode, is the manager of Realm states, providing interface services for applications within Realms. RMM can be used to manage the lifecycle of Realms, including their creation and destruction.

[0062] For example, Figure 2 It also includes other modules such as Hypervisor, APP, TOS (Trust Zone Operating System), Secure Partition, SPM, and Monitor. The descriptions of other modules can be found in existing technical embodiments, and will not be repeated here.

[0063] It should be noted that the CCA architecture is used as an example in the embodiments of this application. The technical solutions in the embodiments of this application can also be applied to other security environments, such as TEE based on the ARM Trust Zone architecture. This application does not limit them.

[0064] To ensure data security, existing technologies typically employ data encryption to guarantee data security and integrity during data transmission. One possible implementation method used in existing technologies is as follows:

[0065] 1. Data owner (e.g., for Figure 1 The first electronic device in the system encrypts the data and uploads the encrypted data to the cloud for storage.

[0066] 2. The data owner uploads the usage policy and decryption key corresponding to the data to the blockchain.

[0067] 3. Data users create TEE instances (such as confidential virtual machines or Enclave (images)) on the cloud side and deploy data processing applications within the TEE instances.

[0068] 4. Data processing applications within the TEE instance send data usage requests to the blockchain, including the TEE instance's metrics and data usage requests.

[0069] 5. The blockchain server sends the metric value of the TEE instance to the verification server. The verification server verifies the metric value of the TEE instance, and upon successful verification, retrieves the decryption key from the blockchain and returns the decryption key to the TEE instance.

[0070] 6. The TEE instance obtains encrypted data from the cloud test and uses the obtained decryption key to decrypt the encrypted data to obtain plaintext data. Data processing applications in the TEE instance can perform data operations (also known as access operations, such as reading, writing, and querying) on ​​the data.

[0071] However, in this approach, data security requires the participation of blockchain, and data key management relies on blockchain. In other words, blockchain needs to be deployed in this scenario, which increases the difficulty and complexity of system deployment.

[0072] Figure 3 For an exemplary flowchart illustrating the access control method, please refer to... Figure 3 Specifically, including but not limited to the following steps:

[0073] S301, In a secure environment, acquire target data and the strategy for using the target data.

[0074] For example, in a secure environment (also known as a confidential environment, etc.), a data processing application generates authentication information in response to a received user operation. Specifically, the data processing application retrieves all or part of the computer program corresponding to the data processing application from memory. The data processing application retrieves the corresponding all or part of the computer program from memory and calculates the corresponding hash value based on a preset algorithm (e.g., including MD5 (Message-Digest Algorithm), SHA-1 (Secure Hash Algorithm), SHA-256, SHA-3, etc.). This value is referred to as the baseline value of the data processing application in this embodiment, and optionally serves as the authentication information of the data processing application, used to uniquely identify the data processing application.

[0075] In one possible implementation, the trigger for the data processing application to generate authentication information can also be automatic. For example, authentication information can be generated after the data processing application is installed. This application does not limit this.

[0076] In another possible implementation, the authentication information of the data processing application can also be a combination of a baseline value and at least one other piece of information. For example, it could be a combination of the data processing application's identification information (e.g., application ID) and the baseline value. The data processing application can generate a corresponding hash value based on the application ID and the baseline value, which serves as the application's authentication information.

[0077] For example, a data processing application, acting as a data user, sends authentication information to the data owner (e.g., Figure 1 (The first electronic device shown).

[0078] In one example, a data processing application in a data user (e.g., a second electronic device, or ReamVm within the second electronic device) can directly send authentication information to the data owner (e.g., a first electronic device). In another example, the data processing application in the data user can send the authentication information to a remote server. The remote server receives and stores the authentication information. The data owner can obtain the authentication information of at least one data processing application from the remote server.

[0079] For example, the data owner obtains the authentication information of one or more data processing applications (such as the first application involved in the embodiments of this application). The data owner generates a data usage policy. The data usage policy includes one or more authentication information and an access control policy corresponding to each authentication information.

[0080] Optionally, the data owner may receive N authentication messages. The user to whom the data owner belongs can determine, based on actual needs, which applications can access the target data and their corresponding access control policies. In response to the received user instructions, the data owner (e.g., the first electronic device) generates a target data usage policy corresponding to the target data. The target data usage policy may include M authentication messages, where M is less than or equal to N. That is, after the data owner receives N authentication messages, some applications may not be allowed to access the target data; accordingly, the target data usage policy may optionally exclude the authentication messages corresponding to these applications.

[0081] Optionally, the data usage policy can also include a blacklist and a whitelist. The authentication information in the whitelist is used to indicate whether the corresponding application is allowed to access the target data, while the authentication information in the blacklist is used to indicate whether the corresponding application is not allowed to access the target data.

[0082] Optionally, after receiving one or more authentication messages and generating a corresponding data usage policy, the data owner can dynamically adjust the data usage policy if they receive authentication messages from other applications. For details on how to implement this, please see the description below.

[0083] For example, authentication information in a data usage policy is used to instruct the application identified by the authentication information to access the target data.

[0084] For example, an access control policy is used to indicate the access behaviors that an application is allowed to perform on target data. For instance, the access control policy may further include, but is not limited to, an access operation type policy and an access operation count policy, wherein the access operation type policy indicates the types of access operations that the application is allowed to perform on the data, and the access operation count indicates the maximum number of times the same access operation type can be executed. For example, the access operation type policy includes a read operation, and the access operation count policy includes a read operation count of 3, meaning that the data use policy allows the data processing application to perform read operations on the data (i.e., it can read the data, but cannot modify it (including adding, deleting, or modifying)), and the number of read operations allowed for the data processing application is less than or equal to 3.

[0085] In one possible implementation, the data usage strategy can be in tabular form; of course, it can also take other forms in other instances, and this application does not limit it. Table 1 is an exemplary data usage strategy; please refer to Table 1:

[0086] Table 1

[0087]

[0088] As shown in Table 1, assume the data owner obtains the baseline values ​​of the first application, the second application, and the third application. The data owner decides that the target data can only be accessed by the first and second applications. Accordingly, the target data usage strategy includes, but is not limited to: the authentication information of the first application and its corresponding access control policy 1, and the authentication information of the second application and its corresponding access control policy 2. Access control policy 1 and access control policy 2 can be the same or different, and this application does not impose any limitations. That is, in this example, the data owner of the first application can authenticate the identity of the first application based on the authentication information of the first application. Furthermore, if authentication is successful, access control can continue to be applied to the first application's access to the target data based on the access control policy corresponding to the first application (which can also be understood as the authentication information of the first application).

[0089] For example, the data owner sends a data packet to all data users who need the target data (which could be a first electronic device or a Realm VM, this application is not limited to this). The data packet includes, but is not limited to, the target data and the target data usage policy. Optionally, the data packet may also include an access list. The access list includes, but is not limited to, the identification information (e.g., application ID) of at least one data processing application, used to indicate that the data usage policy is formulated for the data processing application indicated by the identification information. That is, applications in the list (this is only an example in list form, this application is not limited to this) can continue to execute the subsequent access control process, while applications not in the list do not need to execute the subsequent access control process. It can also be understood that data processing applications not in the list are not allowed to access (or use) the target data. That is, in this embodiment of the application, data users within the scope of use specified by the access list are allowed to use the target data. In order to prevent unauthorized applications from impersonating the application's identification information, it is necessary to further determine the authenticity of the application's identity based on an authentication step. That is, the identification information indicated in the access list and the identity authentication information included in the data usage policy are both used to indicate the data users who are allowed to use the target data. The data owner who can actually use the data needs to have consistent identification information and identity authentication information, meaning that both must be within the scope of the data owner's authentication before they can use the target data.

[0090] Optionally, after generating the data packet, the data owner encrypts the data packet and transmits the encrypted data packet to the data user, thereby ensuring data security during the data transmission process.

[0091] For example, a second electronic device or a Realm VM0 within the second electronic device (see reference) Figure 2 For example, in this application embodiment, the data user can refer to a second electronic device or a virtual electronic device within the second electronic device, such as a Realm VM; this application does not impose any limitation. The data user receives data packets sent by the data owner. The data user obtains the access list, target data, and data usage policy from the data packets.

[0092] In one possible implementation, if a new data user's application needs to access the target data, it can send its authentication information to the data owner. The data owner can update the target data's data usage policy, for example, by adding the new application's authentication information and corresponding access control policy to Table 1. Furthermore, the data owner sends the new target data usage policy to each data user. Upon receiving the new target data usage policy, the data user can delete the old policy and use the new policy to enforce access control.

[0093] In another possible implementation, the data owner can also remove applications that are allowed to access the target data by updating the data usage policy. For example, the data owner can send a new data usage policy to each data user, which can exclude the authentication information of the first application and its corresponding access control policy. Accordingly, the electronic device to which the first application belongs can determine, based on the new data usage policy, that the first application does not have permission to access the target data.

[0094] S302, Obtain the identity authentication information of the first application and the first application's access operation to the target data.

[0095] For example, the data user obtains the authentication information of the first application and the first application's access operations to the target data from the first application. The authentication information of the first application includes, but is not limited to, a baseline value generated by the first application based on all or part of the computer program of the first application. The first application can be any application in a secure environment that has access to the target data; in this embodiment, it can be a data processing application.

[0096] In the embodiments of this application, the application's data access operations include, but are not limited to, reading, writing, querying, and deleting. This application does not impose any limitations.

[0097] S303, if the identity authentication information of the first identity authentication information is successfully verified, access control shall be performed on the first access operation based on the access control policy.

[0098] For example, a data user can implement access control on the first application based on a target data usage policy. In this embodiment, access control may include, but is not limited to, authentication and access behavior verification.

[0099] Specifically, data users can verify the identity information of the first application based on the identity authentication information in the target data usage strategy.

[0100] In one example, if authentication is successful—that is, the authentication information of the first application matches at least one authentication information in the target data usage policy—then subsequent access behavior verification continues.

[0101] In another example, if authentication fails, meaning the authentication information of the first application fails to match at least one of the authentication information in the target data usage policy, then the first application's access to the target data is denied.

[0102] For example, after successful authentication, the data user verifies the access behavior of the first application's access operation to the target data based on the access control policy.

[0103] For example, access control policies include, but are not limited to, access operation type policies and access operation count policies. The access operation type policy indicates the permitted types of access operations to the data, while the access operation count indicates the maximum number of times the same access operation type can be executed. For instance, the access operation type policy may include a read operation, and the access operation count policy may include a read operation count of 3. This means that the data use policy allows data processing applications to perform read operations on the data (i.e., they can read the data, but cannot modify it (including adding, deleting, or modifying)), and the number of read operations allowed by the data processing application is less than or equal to 3. For example, a data user can control the types of access behavior of a first application based on the access operation type policy, and the data user can control the number of times the first application's access behavior corresponds to the access operation count policy.

[0104] Figure 4 This is a flowchart illustrating the access control method provided in the embodiments of this application. The following is a summary of the process. Figure 4 right Figure 3 For a detailed explanation of the method described in the document, please refer to [link / reference]. Figure 4 Specifically, including but not limited to the following steps:

[0105] S401, The data processing application generates identity authentication information.

[0106] For example, in response to a received user operation, the data processing application generates authentication information. Specifically, the data processing application retrieves all or part of the computer program corresponding to the data processing application from memory. Based on a preset algorithm, the data processing application calculates the corresponding hash value from the computer program. This value, referred to as the baseline value of the data processing application in this embodiment, can optionally serve as the authentication information of the data processing application, used to uniquely identify the data processing application.

[0107] In one possible implementation, the trigger for the data processing application to generate authentication information can also be automatic. For example, the data processing application can generate authentication information after initialization, and this application does not limit this.

[0108] In another possible implementation, the authentication information of the data processing application can also be a combination of a baseline value and at least one other piece of information. For example, it could be a combination of the data processing application's identification information (e.g., application ID) and the baseline value. The data processing application can generate a corresponding hash value based on the application ID and the baseline value, which serves as the application's authentication information.

[0109] Thus, by generating authentication information based on the computer program of the data processing application in this embodiment to uniquely identify the data processing application, the problem of application spoofing can be avoided. For example, suppose there is a spoofed data processing application. If the traditional method of using the data processing application ID as authentication information is used, the spoofed application, after obtaining the application ID of the real data processing application, may use this ID as its own application identifier and access confidential data based on this application ID. When the system authenticates the application, if authentication is based on the application ID, it cannot identify the application's true identity, allowing the spoofed application to illegally access data. However, in this embodiment, by generating authentication information based on the computer program of the data processing application, since the computer program of the spoofed application is different from the computer program of the real data processing application, the data processing application cannot generate the same authentication information as the real data processing application, thus ensuring the uniqueness of the data processing application's authentication information. This uniqueness optionally refers to uniqueness within the same device (e.g., Realm VM), meaning that multiple applications with the same authentication information will not exist within the same Realm VM. Alternatively, if the same application is installed on different Realm VMs, i.e. on different devices, its authentication information can be the same.

[0110] S402, the data processing application sends authentication information to the first electronic device.

[0111] For example, in response to a received user operation, a data processing application sends a data request message to a first electronic device. The data request message is used to request target data. The data request message includes, but is not limited to, at least one of the following: identification information of the data processing application, authentication information of the data processing application, and data request indication information.

[0112] The identification information for the data processing application can be its ID. The data request indication information is used to request the target data.

[0113] S403, The first electronic device obtains data usage policies based on identity authentication information.

[0114] For example, a first electronic device (i.e., the data owner) receives a data request message. Based on the data request message, it can be determined that a data processing application has a need to use the target data.

[0115] In response to the received user operation, the first electronic device generates a target data usage policy. This data usage policy includes authentication information and access control policies.

[0116] For example, authentication information is used to indicate whether the application indicated by the authentication information is allowed to access the target data. In this instance, for instance, the data usage policy includes the authentication information of a data processing application to indicate whether the data processing application is allowed to use (or access) the target data.

[0117] For example, an access control policy is used to indicate the access behaviors allowed on target data. For instance, the access control policy may further include, but is not limited to, an access operation type policy and an access operation count policy, wherein the access operation type policy indicates the types of access operations allowed on the data, and the access operation count indicates the maximum number of times the same access operation type can be executed. For example, the access operation type policy includes a read operation, and the access operation count policy includes a read operation count of 3. That is, the data use policy allows data processing applications to perform read operations on the data (i.e., they can read the data, but cannot modify it (including adding, deleting, or modifying)), and the number of read operations allowed for the data processing application is less than or equal to 3.

[0118] S404, The first electronic device generates an encrypted data packet (data + usage policy + access list).

[0119] For example, a first electronic device generates a data packet. The data packet includes, but is not limited to, target data and a target data usage policy. Optionally, the data packet may also include an access list.

[0120] The access list includes, but is not limited to, the identification information (e.g., application ID) of at least one data processing application. This information indicates that the data usage policy is tailored to the data processing application specified in the identification information. In other words, applications in the list (this is only an example and is not intended to limit access) can continue with subsequent access control procedures, while applications not in the list do not need to undergo further access control. This can also be understood as data processing applications not in the list being prohibited from accessing the target data. For example, in this instance, the access list may include the identification information of the data processing application.

[0121] Optionally, after generating the data packet, the data owner encrypts the data packet and transmits the encrypted data packet to the data user, thereby ensuring data security during the data transmission process.

[0122] It should be noted that, in this embodiment, the first electronic device can receive authentication information sent by multiple data users (e.g., a second application, a third application, etc.). However, not every data user is allowed to use the target data; this can be set according to actual needs, and this application does not impose any limitations.

[0123] S405, the first electronic device sends a data packet to the second electronic device.

[0124] For example, the data owner sends data packets to all data users who need the target data (which could be the first electronic device or the Realm VM; this application does not limit this). Optionally, the data owner can send data packets to all data processing applications that have sent authentication information to it. However, as mentioned above, not all data users are allowed to use the target data; this can be set according to actual needs, and this application does not limit this. That is, data users who may receive the data packets may not be within the scope of the access list.

[0125] The DS Agent in the first electronic device receives a data packet from the data owner. For example, the first electronic device also includes a communication module. Based on the interface configuration, the communication module receives the data packet, performs decapsulation and other processing on the data packet, and then transmits the decapsulated data packet to the DS Agent. It can be understood that, in this embodiment, based on the interface settings in the secure environment, the DS Agent has mandatory supervisory authority over the target data. All operations requiring access to the target data must be authenticated by the DS Agent (i.e., identity verification and access behavior verification) before access to the target data can be achieved through the interface provided by the DS Agent. This prevents unauthorized applications from bypassing the authentication module to access the data, thus avoiding threats to data security.

[0126] S406, the DS Agent decrypts the data packet to obtain the plaintext data.

[0127] For example, the DS Agent decrypts the data packet to obtain the plaintext data of the target data. The DS Agent stores the plaintext data in the memory of a secure environment. Thus, based on the mandatory authentication mechanism of the DS Agent in this embodiment, while preventing unauthorized applications from bypassing the DS Agent to access the target data, this application can store the target data in plaintext form, eliminating the need to decrypt the data each time it is accessed, thereby improving the efficiency of data access and avoiding the algorithmic burden introduced by repeated decryption.

[0128] In the embodiments of this application, the encryption and decryption process of data packets can adopt a simple encryption and decryption algorithm to reduce the algorithm complexity while ensuring the security of data transmission. The specific algorithm can be set according to actual needs, and this application does not limit it.

[0129] S407, the data processing application sends a read data request to the DS Agent.

[0130] For example, the reading behavior (or access operation) of a data processing application on target data is used as an example for illustration. Specifically, in response to a received user operation (which may also be actively triggered, this application is not limited to this), the data processing application sends a read data request to the DS Agent to request the reading of the target data. The read data request includes, but is not limited to: information about the target data (such as storage location), the authentication information of the data processing application, and the identification information of the data processing application (such as application ID), etc.

[0131] Optionally, the authentication information and identification information (such as application ID) of the data processing application can also be included during execution. Figure 4 The authentication information is obtained before the corresponding verification step. For example, before authenticating a data processing application, the DS Agent can send an authentication information retrieval request to the data processing application to obtain its authentication information. The data processing application responds to this request by sending the authentication information back to the DS Agent. Other information is similar and is not limited herein.

[0132] S408, the DS Agent uses policies to enforce access control based on the target data.

[0133] Figure 5 For an exemplary diagram illustrating the access control flow, please refer to... Figure 5 Specifically, including but not limited to the following steps:

[0134] S501 determines whether the data processing application can use the target data based on the access list and the identification information of the data processing application.

[0135] Specifically, the DS Agent matches the identification information of the data processing application with the identification information in the access list.

[0136] In one example, if the match is successful, meaning the data owner allows the data processing application to use (or access) the target data, proceed with S502.

[0137] In another example, if a match fails—for example, if the data processing application's identifier is not found in the list, or if a blacklist exists that includes the data processing application's identifier—then the data processing application's access to the target data is denied. Optionally, the DS Agent sends an access denial message to the data processing application, instructing it to refuse access to the target data.

[0138] S502 verifies the identity information of data processing applications based on identity authentication information.

[0139] Specifically, the DS Agent matches the authentication information of the data processing application with the authentication information in the data usage policy.

[0140] In one example, if the match is successful, meaning the data owner allows the data processing application to use the target data, and the data processing application is the same application indicated by the identification information (i.e., the identification information and the authentication information are consistent), and the data processing application's real authentication is successful, then S503 is executed.

[0141] In another example, if the match fails—that is, if the identification information and the authentication information do not match—the data processing application's authentication fails. For instance, an unauthorized application might impersonate the data processing application's identification information, but its authentication fails. Optionally, the DS Agent sends an access denial message to the data processing application, instructing it to deny the application access to the target data.

[0142] S502 determines whether a data processing application has read permissions based on access control policies.

[0143] Specifically, let's take access control policies, including but not limited to: access operation type policies and access operation count policies, as examples. The access operation type policy indicates the types of access operations allowed on the data, while the access operation count indicates the maximum number of times the same access operation type can be executed. For example, the access operation type policy might include a read operation, and the access operation count policy might include a read operation count of 3. This means that the data processing application is allowed to perform read operations on the data (i.e., it can read the data, but cannot modify it (including adding, deleting, or modifying)), and the number of read operations allowed is less than or equal to 3.

[0144] Optionally, taking a data application type policy as an example, the policy may include the correspondence between the application's identification information and the allowed access operations. For example, if the policy includes the identification information of the data processing application, and the corresponding access operation includes, but is not limited to, reading, then this policy indicates that the data processing application is allowed to read the target data, but is not allowed to perform other access operations besides reading, such as adding, deleting, or modifying.

[0145] For example, the DS Agent verifies the access behavior (also known as access behavior type verification) of the data processing application's read operation on the target data based on the access operation type policy in the access control policy.

[0146] In one example, if the access control policy contains an identifier that matches the data processing application, and the corresponding access operation includes a read operation, then the data processing application is allowed to read the target data, and step S503 is executed. Otherwise, an access denial message is sent to the data processing application to instruct it to deny access to the target data.

[0147] For example, this application embodiment only illustrates the use of an access control policy that includes an access operation type policy and an access operation count policy. In some instances, the access control policy may include an access operation type policy. Accordingly, if the access operation type verification for the first access operation is successful based on the access operation type policy, the application is allowed to access the target data. In other instances, the access control policy includes access operation count verification. Accordingly, if the access operation count verification for the first access operation is successful based on the access operation count policy, the application is allowed to access the target data. Of course, in still other instances, the access control policy may also include one or more other policies for planning access behavior, which is not limited in this application.

[0148] S503, based on access control policies, determines whether the number of read attempts by a data processing application has reached the limit.

[0149] Specifically, the DS Agent verifies the number of read operations performed by the data processing application on the target data based on the access operation count policy in the access control policy (also known as access behavior count verification) to determine whether the number of read operations performed by the data processing application has reached the upper limit (e.g., the policy requires the number of read operations to be less than or equal to 3).

[0150] In one example, if the number of read operations on the target data by the data processing application has not reached the upper limit, then the data processing application is allowed to access the target data. Specifically, the DS Agent can send data indication information to the memory controller through its interface, indicating that the data processing application is allowed to read the target data. In response to the received data indication information, the memory controller sends the target data that the data processing application wants to read to the data processing application.

[0151] In another example, if the data processing application's read operations on the target data exceed the upper limit, an access denial message is sent to the data processing application to instruct it to deny access to the target data.

[0152] The above mainly describes the solution provided by the embodiments of this application from the perspective of interaction between various network elements. It is understood that, in order to achieve the above functions, the access device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should readily recognize that, in conjunction with the units and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0153] This application embodiment can divide the access device into functional modules according to the above method example. For example, each function can be divided into a separate functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods.

[0154] When each function is divided into its own modules, the remaining modules are defined according to their respective functions. Figure 6 A possible structural schematic diagram of the access control device 600 involved in the above embodiments is shown, such as... Figure 6 As shown, the access control device 600 includes: a first acquisition module 601, configured to acquire target data and a target data usage policy in a secure environment. The target data usage policy includes authentication information and an access control policy. The authentication information is used to instruct the application identified by the authentication information to access the target data, and the access control policy is used to instruct the access behavior that the application is allowed to perform on the target data. The authentication information is generated based on the application's computer program. A second acquisition module 602, configured to acquire first authentication information of a first application and a first access operation of the first application on the target data. The first authentication information is generated based on the first application's computer program. An execution module 603, configured to execute access control on the first access operation based on the access control policy if the authentication of the first authentication information based on the authentication information is successful.

[0155] In one possible implementation, the first identity authentication information includes a baseline value generated based on all or part of the computer program of the first application.

[0156] In one possible implementation, the baseline value is a hash value calculated based on all or part of the computer program of the first application.

[0157] In one possible implementation, the target data and the target data usage strategy are carried in an encrypted data packet. The first acquisition module 601 is specifically used to: decrypt the data packet and acquire the plaintext data of the target data and the target data usage strategy.

[0158] In one possible implementation, the execution module 603 includes an authentication unit 6031, configured to: match the first identity authentication information with the identity authentication information; if the first identity authentication information matches the identity authentication information successfully, the authentication of the first application is successful, and the first application is allowed to access the target data; if the first identity authentication information does not match the identity authentication information, the authentication of the first application fails, and the first application is denied access to the target data.

[0159] In one possible implementation, the access control policy includes at least one of the following: an access operation type policy and an access operation count policy; wherein the access operation type policy is used to indicate the type of access operation that the application is allowed to perform on the target data; and the access operation count policy is used to indicate the maximum number of times the application is allowed to access the target data.

[0160] In one possible implementation, the execution module 603 includes a policy execution unit 6032, configured to: perform access operation type verification and access operation count verification on the first access operation based on the access control policy; allow the first application to perform the first access operation on the target data if both access operation type verification and access operation count verification are successful; and refuse the first application to perform the first access operation on the target data if either access operation type verification or access operation count verification fails.

[0161] Figure 7 A schematic block diagram of an access control device 700 according to an embodiment of this application is shown. The access control device may include a processor 701 and a transceiver / transceiver pin 702, and optionally, a memory 703. The processor 701 can be used to execute the steps performed by the second electronic device, the Realm VM in the second electronic device, or the DSAgent in the methods of the foregoing embodiments, and control the receive pin to receive signals and control the transmit pin to transmit signals.

[0162] The various components of the access control device 700 are coupled together via a bus 704, which includes a data bus, a power bus, a control bus, and a status signal bus. However, for clarity, all buses are labeled as bus system 704 in the figure.

[0163] Optionally, the memory 703 can be used for storage instructions in the foregoing method embodiments.

[0164] It should be understood that the access control device 700 according to the embodiments of this application may correspond to the second electronic device in the methods of the foregoing embodiments, and the above and other management operations and / or functions of each element in the access control device 700 are respectively for implementing the corresponding steps of the foregoing methods, which will not be described in detail here for the sake of brevity.

[0165] All relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0166] Based on the same technical concept, embodiments of this application also provide a computer-readable storage medium storing a computer program containing at least one piece of code that can be executed by an access control device to control the access control device to implement the above-described method embodiments.

[0167] Based on the same technical concept, this application also provides a computer program, which, when executed by an access control device, is used to implement the above-described method embodiments.

[0168] The program may be stored, in whole or in part, on a storage medium packaged with the processor, or in part or in whole on a memory not packaged with the processor.

[0169] Based on the same technical concept, this application also provides a processor for implementing the above-described method embodiments. The processor can be a chip.

[0170] The steps of the methods or algorithms described in conjunction with the embodiments of this application can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in random access memory (RAM), flash memory, read-only memory (ROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, portable hard disks, CD-ROMs, or any other form of storage medium well known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor.

[0171] Those skilled in the art will recognize that the functions described in the embodiments of this application in one or more of the above examples can be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transfer of a computer program from one place to another. Storage media can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0172] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0173] The terms "first" and "second," etc., used in the specification and claims of this application are used to distinguish different objects, not to describe a specific order of objects. For example, "first target object" and "second target object," etc., are used to distinguish different target objects, not to describe a specific order of target objects.

[0174] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0175] In the description of the embodiments in this application, unless otherwise stated, "multiple" means two or more. For example, multiple processing units means two or more processing units; multiple systems means two or more systems.

[0176] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. An access control method characterized by, The method comprises the following steps: In a secure environment, obtaining target data and a target data usage policy, the target data usage policy comprising identity authentication information and an access control policy, the identity authentication information being used to indicate that an application identified by the identity authentication information is allowed to access the target data, and the access control policy being used to indicate that the application is allowed to perform an access behavior on the target data; wherein the identity authentication information is generated based on a computer program of the application; Obtaining first identity authentication information of a first application and a first access operation of the first application on the target data; wherein the first identity authentication information is generated based on a computer program of the first application; In a case where identity verification of the first identity authentication information based on the identity authentication information is successful, performing access control on the first access operation based on the access control policy.

2. The method of claim 1, wherein, The first identity authentication information comprises a baseline value generated based on all or part of the computer program of the first application.

3. The method of claim 2, wherein, The baseline value is a hash value calculated based on all or part of the computer program of the first application.

4. The method of claim 1, wherein, The target data and the target data usage policy are carried in an encrypted data packet, and the obtaining of the target data and the target data usage policy comprises the following steps: Decrypting the data packet to obtain plaintext data of the target data and the target data usage policy.

5. The method of claim 1, wherein, The performing of access control on the first access operation based on the access control policy in a case where identity verification of the first identity authentication information based on the identity authentication information is successful comprises the following steps: Matching the first identity authentication information with the identity authentication information; If the first identity authentication information matches the identity authentication information successfully, identity verification of the first application is successful, and the first application is allowed to access the target data; If the first identity authentication information fails to match the identity authentication information, identity verification of the first application fails, and the first application is denied to access the target data.

6. The method of claim 1, wherein, The access control policy comprises at least one of the following: An access operation type policy and an access operation frequency policy; The access operation type policy is used to indicate an access operation type that the application is allowed to perform on the target data, and the access operation frequency policy is used to indicate a maximum access frequency of the application on the target data.

7. The method of claim 6, wherein, The performing of access control on the first access operation based on the access control policy comprises the following steps: Based on the access control policy, performing access operation type verification and access operation frequency verification on the first access operation; In a case where the access operation type verification and the access operation frequency verification are both successful, the first application is allowed to perform the first access operation on the target data; In a case where the access operation type verification or the access operation frequency verification fails, the first application is denied to perform the first access operation on the target data.

8. An access control device, characterized in that The method comprises the following steps: The first obtaining module is configured to obtain target data and a target data usage policy in a secure environment, the target data usage policy including identity authentication information and an access control policy, the identity authentication information being used to indicate that an application identified by the identity authentication information is allowed to access the target data, and the access control policy being used to indicate that the application is allowed to perform an access behavior on the target data, and the identity authentication information being generated based on a computer program of the application; The second obtaining module is configured to obtain first identity authentication information of a first application and a first access operation of the first application on the target data, and the first identity authentication information being generated based on a computer program of the first application; The execution module is configured to perform access control on the first access operation based on the access control policy when the identity authentication information is successfully authenticated based on the identity authentication information.

9. The apparatus of claim 8, wherein, The first identity authentication information includes a baseline value generated based on all or part of the computer program of the first application.

10. The apparatus of claim 9, wherein, The baseline value is a hash value calculated based on all or part of the computer program of the first application.

11. The apparatus of claim 8, wherein, The target data and the target data usage policy are carried in an encrypted data packet, and the first obtaining module is specifically configured to: decrypt the data packet to obtain plaintext data of the target data and the target data usage policy.

12. The apparatus of claim 8, wherein, The execution module includes an authentication unit, and the authentication unit is configured to: match the first identity authentication information with the identity authentication information; if the first identity authentication information is successfully matched with the identity authentication information, the identity authentication of the first application is successful, and the first application is allowed to access the target data; if the first identity authentication information fails to be matched with the identity authentication information, the identity authentication of the first application fails, and the first application is denied to access the target data.

13. The apparatus of claim 8, wherein, The access control policy includes at least one of the following: an access operation type policy and an access operation frequency policy; The access operation type policy is used to indicate an access operation type that the application is allowed to perform on the target data, and the access operation frequency policy is used to indicate a maximum access frequency corresponding to the access operation type that the application is allowed to perform on the target data.

14. The apparatus of claim 13, wherein, The execution module includes a policy execution unit, and the policy execution unit is configured to: perform access operation type verification and access operation frequency verification on the first access operation based on the access control policy; allow the first application to perform the first access operation on the target data when the access operation type verification and the access operation frequency verification are both successful; deny the first application to perform the first access operation on the target data when the access operation type verification or the access operation frequency verification fails.

15. A computer device, comprising: The apparatus includes: one or more processors; a memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and when the computer programs are executed by the one or more processors, cause the computer device to perform the method of any one of claims 1-7.

16. A computer program product, characterised in that, When the computer program product is run on a computer, it causes the computer to perform the method of any one of claims 1-7.

Images