Dynamic attribute encryption access control method and system for data element bearer network

Abstract

The invention discloses a dynamic attribute encryption access control method and system of a data element bearing network, and belongs to the technical field of data processing technology and information security. Comprising the following steps: receiving an access request, acquiring a multi-dimensional risk attribute associated with the access request in real time by a risk awareness engine RPE in a bearer network through a deterministic network method, and calculating a risk score of the access request by utilizing a preset fuzzy reasoning system; a dynamic policy decision point D-PDP dynamically generates a final ABE access policy matched with the risk score on the basis of a preset baseline ABE access policy according to the risk score output by the risk awareness engine; and executing access control. According to the method, the security and the credibility of the data elements in the full life cycle of circulation, transaction and application in the bearer network are remarkably improved.

Description

Technical Field

[0001] This invention belongs to the fields of data processing technology and information security technology, and specifically relates to a dynamic attribute encryption access control method and system for a data element carrier network. Background Technology

[0002] With the development of the digital economy, the value of data as a key production factor is becoming increasingly prominent. Data element carrier networks based on deterministic technologies provide a fundamental guarantee for the efficient and secure flow of data elements in core areas such as the Industrial Internet, the Internet of Vehicles, and smart healthcare by offering low latency, high reliability, and wide coverage. In these scenarios, data interaction is frequent, the participating entities are diverse, and the requirements for security and real-time performance are extremely high.

[0003] Existing access control technologies, such as Role-Based Access Control (RBAC), typically employ statically predefined policies, making them ill-suited to the complex and ever-changing access scenarios and potential security risks within data element-bearing networks. While Attribute-Based Access Control (ABAC) and its complementary Attribute-Based Encryption (ABE) technologies offer one-to-many, more granular access control capabilities, their access policies are usually fixed after deployment. When the behavior of authorized subjects (users), environmental context, or resource sensitivity changes in real time, static policies cannot dynamically adjust authorization granularity and security levels, potentially leading to privilege abuse or access obstruction in emergency situations. This fails to meet the stringent dynamic security requirements of deterministic networks.

[0004] Therefore, there is an urgent need for a technical solution that can dynamically perceive real-time risks and adaptively generate and execute access control policies to ensure that data flow in deterministic data element carrier networks is both efficient and secure. Summary of the Invention

[0005] Purpose of the invention: To overcome the shortcomings of existing access control strategies that are static and unable to adapt to real-time risk changes, and to provide a dynamic attribute encryption access control method and system for data element carrier networks.

[0006] Technical solution: To achieve the above objectives, the technical solution adopted by this invention is as follows:

[0007] A method for dynamic attribute encryption access control of a data element carrier network includes the following steps:

[0008] Step 1: Receive access request. The receiving subject initiates an access request for a data element object encrypted using the Attribute Base Encryption (ABE) method.

[0009] Step 2, Real-time Risk Perception: The Risk Perception Engine (RPE) in the bearer network acquires the multi-dimensional risk attributes associated with the access request in real time through the deterministic network method, and calculates the risk score of this access request using a preset fuzzy inference system.

[0010] Step 3, Dynamic Policy Generation: Based on the risk score output by the risk perception engine, the Dynamic Policy Decision Point (D-PDP) dynamically generates a final ABE access policy that matches the risk score, on the basis of a preset baseline ABE access policy.

[0011] Step 4, execute access control: The access execution point (PEP) verifies the attribute private key of the subject based on the final ABE access policy generated by the dynamic policy decision point. If the verification passes, access is authorized. If the verification fails, access is denied.

[0012] Preferably, the method for calculating the risk score of this access request using a preset fuzzy inference system in step 2 includes:

[0013] Step 21, fuzzification, using the trigonometric function (trimf): f(x; a, b, c) = max(min( , ), And the trapezoidal function (trapmf): f(x; a, b, c, d) = max(min( , ), Based on the membership functions of the three subclass attributes, and using the attribute risk fuzzy output function, the risk levels are divided into the following five levels:

[0014] permissible : attrRisk(x) = (x; 0, 0,10, 20).

[0015] allow : attrRisk(x) = (x;10, 25, 40).

[0016] med : attrRisk(x) = (x;30, 45, 60).

[0017] warn : attrRisk(x) = (x;50, 65,80).

[0018] danger: attrRisk(x) = (x; 70,85,100,100).

[0019] Where trimf represents the trigonometric function, f(x; a, b, c) represents the specific calculation formula of the trigonometric function, x represents the input value, and a, b, c represent the parameters of the trigonometric function, used to define the coordinates of the three vertices of the triangle. Let trapmf represent the trapezoidal relationship function, f(x; a, b, c, d) represent the specific calculation formula of the trapezoidal relationship function, d represent the parameters of the trapezoidal relationship function, and together with a, b, and c, define the coordinates of the four vertices of the trapezoid. attrRisk(x) represents the attribute risk fuzzy output function, and permissible, allowable, med, warn, and dangerous are the five "risk levels" divided in fuzzy inference. They are also used as linguistic variables of risk in the subsequent "IF-THEN" rule.

[0020] Step 22, Rule Evaluation: Using the following attribute risk rules, and based on a fuzzy rule base containing multiple "IF-THEN" logic rules, inference is performed on the fuzzy linguistic variables to obtain fuzzy output:

[0021] 1) If (attrCon permissible) and(attrScu permissible) and(attrSenpermissible) then(attrRisk permissible).

[0022] 2) If (attrCon permissible) and(attrScu permissible) and(attrSen low)then(attrRisk allow).

[0023] 3) If (attrCon permissible) and(attrScu low) and(attrSenpermissible) then(attrRisk allow).

[0024] 4), If (attrCon permissible) and(attrScu low) and(attrSen low) then(attrRisk med).

[0025] 5), If (attrCon low) and(attrScu permissible) and(attrSen low) then(attrRisk med).

[0026] 6), If (attrCon low) and(attrScu low) and(attrSen permissible) then(attrRisk med).

[0027] 7), If (attrCon low) and(attrScu low) and(attrSen low) then(attrRiskmed).

[0028] 8), If (attrCon med) and(attrScu med) and(attrSen not high) then(attrRisk warn).

[0029] 9), If (attrCon med) and(attrScu not high) and(attrSen med) then(attrRisk warn).

[0030] 10), If(attrCon not high) and(attrScu med) and(attrSen med) then(attrRisk warn).

[0031] Among them, attrCon represents the attribute context, attrScu represents the attribute security, attrSen represents the attribute sensitivity, and attrRisk represents the attribute risk level. The permissible, low, allo, med, not high, and warn rules are used to define different levels of risk or status.

[0032] Step 23, defuzzify, using the centroid function risk = Perform fuzzy output and convert the fuzzy output into a precise, quantified risk score.

[0033] Here, risk represents the final output value, that is, "a precise, quantified risk score" calculated through the centroid function, x i This represents the variable used for summation in the calculation of the centroid function; it typically represents a specific value or sampling point in the fuzzy output set.

[0034] Preferably, in step 2, the risk perception engine acquires multi-dimensional attributes including subject static attributes, subject dynamic trust value, and real-time context attributes. Subject static attributes include the subject's role, department, or security level. The subject dynamic trust value is a trust score dynamically calculated based on the subject's historical access behavior logs. The real-time context attributes include the source IP address, geographical location, initiation time, and security status of the terminal device for the access request.

[0035] Preferably, the method for calculating the subject's dynamic trust value is as follows:

[0036] Set the entity behavior that needs to be reviewed to the entity behavior that needs to review the authentication value. 1. 2、…、 The result of each action Designated as Credit rating, the current recorded behavioral outcome , ∈ [0, -1]. Each The weight parameters are , ∈[0, 1], and ∑ 1 = 1.

[0037] Authentication value T = ∑ 1 = ∑ 1 - .

[0038] Average credibility score = .

[0039] Preferred method: The method for generating the dynamic strategy in step 3 is as follows:

[0040] Multiple risk level thresholds are preset, and the risk score is divided into one of three risk levels: low, medium, and high.

[0041] If the risk level is low, the final ABE access strategy is equal to the baseline ABE access strategy.

[0042] If the risk level is medium or high, a more stringent final ABE access policy is generated by logically ANDing one or more additional attribute conditions on the baseline ABE access policy.

[0043] Preferred approach: In step 3, the dynamic strategy decision point maintains a mapping relationship between risk levels and strategy templates. Upon receiving a risk value, the following operations are performed: Risk level determination: Map the input comprehensive risk value to a predefined risk level. Dynamic strategy generation: Select and instantiate the corresponding CP-ABE strategy template based on the risk level.

[0044] Preferably, the step of performing access control in step 4 specifically includes:

[0045] Step 41, Intercept the request: When a subject attempts to access an object, PEP intercepts the access request.

[0046] Step 42, Request Decision: The PEP passes the relevant information of the access request to the Policy Decision Point (PDP), which makes the final access control decision.

[0047] Step 43, Accept Decision: The PDP evaluates the access policy and makes a decision based on the information obtained from the policy library and attribute database, and then returns this decision to the PEP.

[0048] Step 44, Execute the decision: After receiving the decision from the PDP, the PEP will enforce the decision. If the decision is "Allow," the PEP will approve the subject's access to the object. If the decision is "Deny," the PEP will block the access.

[0049] Preferably, in step 4, the access execution point performs the following operations: When the data requester initiates access, the access execution point obtains the dynamically generated CP-ABE policy. The access execution point calls the FAME algorithm to encrypt the target data element or its access key and returns the ciphertext to the data requester. The data requester attempts to decrypt using its own attribute private key. If its attributes meet the policy requirements, decryption succeeds and access is allowed. Otherwise, decryption fails and access is denied.

[0050] Another objective of this invention is to provide a dynamic attribute-encrypted access control system for a data element carrier network, comprising a data storage unit, an attribute authorization center, a risk perception engine (RPE), a dynamic policy decision point (D-PDP), and an access execution point (PEP), wherein:

[0051] The data storage unit is used to store data elements encrypted using the baseline ABE access strategy.

[0052] The attribute authorization center is used to manage subject attributes and generate attribute private keys.

[0053] The Risk Perception Engine (RPE) is configured to receive access requests from subjects, acquire multi-dimensional risk attributes associated with the requests in real time through a deterministic network, and calculate risk scores using a fuzzy inference system.

[0054] The Dynamic Policy Decision Point (D-PDP) is connected to the Risk Awareness Engine and is configured to dynamically generate a final ABE access policy based on the received risk score and the baseline ABE access policy.

[0055] The access execution point (PEP) is connected to the dynamic policy decision point and is configured to match the subject's attribute private key according to the generated final ABE access policy, and perform authorization or denial operations.

[0056] Another object of the present invention is to provide a non-transitory computer-readable storage medium that stores computer instructions that cause the computer to execute the dynamic attribute encryption access control method for the data element carrier network.

[0057] Compared with the prior art, the present invention has the following advantages:

[0058] This invention innovatively introduces a Risk Awareness Engine (RPE), fully leveraging the low latency of deterministic networks to aggregate and analyze multi-dimensional risk factors in real time, including static attributes of the subject, dynamic trust values, and real-time contextual attributes. The core of the engine employs a fuzzy inference system to intelligently quantify complex access scenarios into precise risk scores. Subsequently, the Dynamic Policy Decision Point (D-PDP) dynamically generates or enhances access policies based on this risk score, building upon a baseline ABE policy, achieving real-time adaptive adjustment of the policy. Finally, the system executes encrypted access control by matching user attributes with this dynamically generated final policy. This method achieves a shift from "static authorization" to "dynamic context-aware authorization," significantly improving the security and trustworthiness of data elements throughout their flow, transactions, and applications within the network. Attached Figure Description

[0059] Figure 1 This is an overall flowchart of a dynamic attribute encryption access control method applied to data element carrier networks.

[0060] Figure 2 This is the diagram showing the start of a request initiated by the main entity.

[0061] Figure 3It is a dynamic strategy selection and access execution graph.

[0062] Figure 4 This is a diagram showing the final strategy judgment and access results.

[0063] Figure 5 It is a record and dynamic trust update graph. Detailed Implementation

[0064] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that these examples are for illustrative purposes only and are not intended to limit the scope of the invention. After reading this invention, any modifications of the invention in various equivalent forms by those skilled in the art will fall within the scope defined by the appended claims.

[0065] Example 1

[0066] In deterministic data element carrier networks, data, as a core production factor, undergoes high-value, high-frequency flow and sharing, placing unprecedented demands on the security, dynamism, and granularity of access control. Traditional access control models, such as Role-Based Access Control (RBAC) and static Attribute-Based Encryption (ABE), have fixed policies and are ill-equipped to address the dynamic security threats faced by data elements in complex application scenarios. Therefore, this embodiment provides a dynamic attribute-based encryption access control method for data element carrier networks. Specifically, it includes three key components: a risk perception engine algorithm, a dynamic policy decision-making algorithm, and an access control execution algorithm. This method organically combines real-time risk perception, dynamic policy adjustment, and attribute-based cryptographic encryption execution, ensuring that in deterministic data element carrier networks, data access control not only meets preset rules but also intelligently adapts to the real-time changing risk environment, providing a solid guarantee for the secure flow of high-value data elements. Figure 1 As shown, it includes the following steps:

[0067] Step 1, Receive access request, such as Figure 2 As shown, this is an access request initiated by the receiving entity to a data element object encrypted using the Attribute Base Encryption (ABE) method. The input consists of multi-dimensional attribute information collected in real time, which can be categorized into: attribute risk information, operational risk information, and historical risk information.

[0068] Step 2, real-time risk perception, such as Figure 3 As shown, the Risk Perception Engine (RPE) in the bearer network obtains the multi-dimensional risk attributes associated with the access request in real time through the deterministic network method, and calculates the risk score of the access request using a preset fuzzy inference system.

[0069] The Risk Perception Engine (RPE) collects risk information. RPE collects information from the following three main risk modules: attribute risk module, operational risk module, and historical risk module.

[0070] The risk perception engine acquires multi-dimensional attributes including static attributes of the subject, dynamic trust value of the subject, and real-time contextual attributes. Static attributes include the subject's role, department, or security level. The dynamic trust value is a trust score dynamically calculated based on the subject's historical access behavior logs. Real-time contextual attributes include the source IP address, geographical location, initiation time, and security status of the terminal device in the access request.

[0071] The method for calculating the subject's dynamic trust value is as follows:

[0072] Set the entity behavior that needs to be reviewed to the entity behavior that needs to review the authentication value. 1. 2、…、 The result of each action Designated as Credit rating, the current recorded behavioral outcome , ∈ [0, -1]. Each The weight parameters are , ∈[0, 1], and ∑ 1 = 1.

[0073] Authentication value T = ∑ 1 = ∑ 1 - .

[0074] Average credibility score = .

[0075] For risk quantification, RPE uses a fuzzy inference system to quantify various risk factors collected. Specifically, the method for calculating the risk score of this access request using a preset fuzzy inference system includes:

[0076] Step 21, fuzzification: Convert the precise input values ​​into fuzzy language labels using a membership function. The membership calculation formula is as follows:

[0077] f(x; a, b, c) = max(min( , ), )

[0078] f(x; a, b, c,d) = max(min( , ), )

[0079] Using the trigonometric function (trimf): f(x; a, b, c) = max(min( , ), And the trapezoidal function (trapmf): f(x; a, b, c, d) = max(min( , ), Based on the membership functions of the three subclass attributes, and using the attribute risk fuzzy output function, the risk levels are divided into the following five levels:

[0080] permissible : attrRisk(x) = (x; 0, 0,10, 20).

[0081] allow : attrRisk(x) = (x;10, 25, 40).

[0082] med : attrRisk(x) = (x;30, 45, 60).

[0083] warn : attrRisk(x) = (x;50, 65,80).

[0084] danger: attrRisk(x) = (x; 70,85,100,100).

[0085] Where trimf represents the trigonometric function, f(x; a, b, c) represents the specific calculation formula of the trigonometric function, x represents the input value, and a, b, c represent the parameters of the trigonometric function, used to define the coordinates of the three vertices of the triangle. Let trapmf represent the trapezoidal relationship function, f(x; a, b, c, d) represent the specific calculation formula of the trapezoidal relationship function, d represent the parameters of the trapezoidal relationship function, and together with a, b, and c, define the coordinates of the four vertices of the trapezoid. attrRisk(x) represents the attribute risk fuzzy output function, and permissible, permissible, med, warn, and dangerous are the five "risk levels" divided in fuzzy inference. They are also used as linguistic variables of risk in the subsequent "IF-THEN" rule.

[0086] Step 22, Rule Evaluation: Using the following attribute risk rules, and based on a fuzzy rule base containing multiple "IF-THEN" logic rules, inference is performed on the fuzzy linguistic variables to obtain fuzzy output:

[0087] 1) If (attrCon permissible) and(attrScu permissible) and(attrSenpermissible) then(attrRisk permissible).

[0088] 2) If (attrCon permissible) and(attrScu permissible) and(attrSen low)then(attrRisk allow).

[0089] 3) If (attrCon permissible) and(attrScu low) and(attrSenpermissible) then(attrRisk allow).

[0090] 4), If (attrCon permissible) and(attrScu low) and(attrSen low) then(attrRisk med).

[0091] 5), If (attrCon low) and(attrScu permissible) and(attrSen low) then(attrRisk med).

[0092] 6), If (attrCon low) and(attrScu low) and(attrSen permissible) then(attrRisk med).

[0093] 7), If (attrCon low) and(attrScu low) and(attrSen low) then(attrRiskmed).

[0094] 8), If (attrCon med) and(attrScu med) and(attrSen not high) then(attrRisk warn).

[0095] 9), If (attrCon med) and(attrScu not high) and(attrSen med) then(attrRisk warn).

[0096] 10), If(attrCon not high) and(attrScu med) and(attrSen med) then(attrRisk warn).

[0097] Among them, attrCon represents the attribute context, attrScu represents the attribute security, attrSen represents the attribute sensitivity, and attrRisk represents the attribute risk level. The permissible, low, allo, med, not high, and warn rules are used to define different levels of risk or status.

[0098] Step 23: Defuzzify, aggregate the fuzzy outputs of all rules, and calculate a precise, quantified comprehensive risk value using methods such as the centroid method. The centroid function `risk = ...` is then used. Perform fuzzy output and convert the fuzzy output into a precise, quantified risk score.

[0099] barycentric function:

[0100] risk =

[0101] Here, risk represents the final output value, that is, "a precise, quantified risk score" calculated through the centroid function, x i This represents the variable used for summation in the calculation of the centroid function; it typically represents a specific value or sampling point in the fuzzy output set.

[0102] This implementation of the fuzzy inference system can be divided into the following steps: First, the precise input values ​​are processed through the trigonometric function (trimf): f(x; a, b, c) = max(min( , ), And the trapezoidal function (trapmf): f(x; a, b, c, d) = max(min( , ), The process involves converting the fuzzy rules into fuzzy language labels (such as "safe", "low", "medium", and "high"); then performing rule evaluation using a pre-defined fuzzy rule base for reasoning; next, aggregating the conclusions of all triggered fuzzy rules to form a total fuzzy output; and finally, defuzzifying the aggregated fuzzy output by using methods such as the centroid method to convert it into a precise and quantifiable comprehensive risk value.

[0103] Step 3, Dynamic Strategy Generation: (e.g., ...) Figure 3 As shown, the Dynamic Policy Decision Point (D-PDP) receives the comprehensive risk value output by the Risk Perception Engine (RPE) and dynamically generates an access policy. Based on the risk score output by the Risk Perception Engine, the D-PDP dynamically generates a final ABE access policy that matches the risk score, building upon a preset baseline ABE access policy.

[0104] The method for generating dynamic strategies in step 3 is as follows:

[0105] Multiple risk level thresholds are preset, and the risk score is divided into one of three risk levels: low, medium, and high.

[0106] If the risk level is low, the final ABE access strategy is equal to the baseline ABE access strategy.

[0107] If the risk level is medium or high, a more stringent final ABE access policy is generated by logically ANDing one or more additional attribute conditions on the baseline ABE access policy.

[0108] The dynamic strategy decision point maintains a mapping relationship between risk levels and strategy templates. Upon receiving a risk value, it performs the following operations: Risk Level Determination: Maps the input comprehensive risk value to a predefined risk level. Dynamic Strategy Generation: Selects and instantiates the appropriate CP-ABE strategy template based on the risk level.

[0109] Risk level determination: D-PDP maps the comprehensive risk value to a predefined risk level.

[0110] Based on the risk level, D-PDP dynamically constructs a CP-ABE access policy. This process applies the concept of Adaptive Control Theory (DCTA), but uses it for policy generation:

[0111] Low-risk level (e.g., "Allow"): Generates a more lenient CP-ABE policy, such as requiring only the fulfillment of core role and department attributes; High-risk level (e.g., "Warning"): Generates a more stringent policy, adding additional environmental or dynamic attribute constraints on top of the core attributes.

[0112] In this embodiment, the dynamic strategy decision point maintains a mapping relationship between risk levels and strategy templates. When a risk value is received, the following operations are performed: Risk level determination: Map the input comprehensive risk value to a predefined risk level; Dynamic strategy generation: Select the corresponding CP-ABE strategy template according to the risk level and instantiate it.

[0113] Step 4, implement access control: such as Figure 4 , 5 As shown, the access execution point (PEP) verifies the attribute private key of the subject based on the final ABE access policy generated by the dynamic policy decision point. If the verification passes, access is authorized. If the verification fails, access is denied.

[0114] The specific steps for implementing access control in step 4 are as follows:

[0115] Step 41, Intercept the request: When a subject attempts to access an object, PEP intercepts the access request.

[0116] Step 42, Request Decision: The PEP passes the relevant information of the access request to the Policy Decision Point (PDP), which makes the final access control decision.

[0117] Step 43, Accept Decision: The PDP evaluates the access policy and makes a decision based on the information obtained from the policy library and attribute database, and then returns this decision to the PEP.

[0118] Step 44, Execute the decision: After receiving the decision from the PDP, the PEP will enforce the decision. If the decision is "Allow," the PEP will approve the subject's access to the object. If the decision is "Deny," the PEP will block the access.

[0119] In step 4, the access execution point performs the following operations: When a data requester initiates access, the access execution point obtains the dynamically generated CP-ABE policy. The access execution point calls the FAME algorithm to encrypt the target data element or its access key and returns the ciphertext to the data requester. The data requester attempts to decrypt using its own attribute private key. If its attributes meet the policy requirements, decryption succeeds and access is allowed. Otherwise, decryption fails and access is denied.

[0120] To ensure the efficiency of the encryption strategy, the FAME algorithm is adopted. The system establishment formula for the FAME algorithm is: generate random numbers aϵZp, and calculate:

[0121] Y = e(g,g)α

[0122] MSK = g α

[0123] MPK = {Y, gβ}

[0124] MSK represents the system master key, and MPK represents the system public key.

[0125] FAME algorithm encryption core formula:

[0126] C = e(g,g)α(alpha s)

[0127] C0 =gs

[0128] Ci1 = gβγ iH(i)-pi

[0129] C =gp i

[0130] SKC = C,C0,{Ci1,C }i ∊ leafNodes

[0131] Where C represents the ciphertext component, i is the attribute of the leaf node, and SKC is the SKR encrypted ciphertext;

[0132] FAME Algorithm Decryption Core Formula:

[0133] Pi = e(Ci1, D0) e(C ,Di ) = e(g,g)βtγ i

[0134] e(C0,D) = e(g,g)αse(g,g)βts

[0135] C / e(g,g)αs = M

[0136] Where M represents plaintext.

[0137] Access control is enforced cryptographically using dynamic policies generated by D-PDP at the access execution point.

[0138] S401: Obtain Dynamic Policy: PEP obtains the CP-ABE access policy freshly generated for this request from D-PDP;

[0139] S402: PEP calls the CP-ABE encryption algorithm to encrypt the data elements (or their symmetric encryption key). To meet the high-performance requirements of deterministic networks, this embodiment uses the FAME method;

[0140] S403: Decryption and Access Decision;

[0141] S4031: PEP returns the encrypted ciphertext to the data requester;

[0142] S4032: DU attempts to decrypt using its user attribute private key (ABESK) associated with its own attribute set, which it obtained from the Attribute Authorization Center (AA).

[0143] S4033: FAME Decryption Process: The DU first uses its private key ABESK to decrypt the key text SKC, recovering the symmetric key SKR. This process requires that the DU's attributes satisfy the structure of the Access Control Tree (ACT). Then, the DU uses the recovered SKR to perform AES decryption on the ciphertext data, obtaining the plaintext M.

[0144] In this embodiment, when the data requester initiates access, the access execution point obtains the dynamically generated CP-ABE policy; the access execution point calls the FAME algorithm to encrypt the target data element (or its access key) and returns the ciphertext to the data requester; the data requester attempts to decrypt using its own attribute private key. If its attributes meet the policy requirements, decryption is successful and access is allowed; otherwise, decryption fails and access is denied.

[0145] In another embodiment, a dynamic attribute-encrypted access control system for a data element carrier network is provided, including a data storage unit, an attribute authorization center, a risk perception engine (RPE), a dynamic policy decision point (D-PDP), and an access execution point (PEP), wherein:

[0146] The data storage unit is used to store data elements encrypted using the baseline ABE access strategy.

[0147] The attribute authorization center is used to manage subject attributes and generate attribute private keys.

[0148] The Risk Perception Engine (RPE) is configured to receive access requests from subjects, acquire multi-dimensional risk attributes associated with the requests in real time through a deterministic network, and calculate risk scores using a fuzzy inference system. The RPE is further configured to dynamically update the subject's trust value based on the subject's historical access behavior logs, and use this trust value as one of the inputs for calculating the risk scores of subsequent access requests.

[0149] The Dynamic Policy Decision Point (D-PDP) is connected to the Risk Awareness Engine and is configured to dynamically generate a final ABE access policy based on the received risk score and the baseline ABE access policy.

[0150] The access execution point (PEP) is connected to the dynamic policy decision point and is configured to match the subject's attribute private key according to the generated final ABE access policy, and perform authorization or denial operations.

[0151] In another embodiment, a non-transitory computer-readable storage medium is provided, the non-transitory computer-readable storage medium storing computer instructions that cause the computer to execute the dynamic attribute encryption access control method for the data element carrier network.

[0152] This invention innovatively introduces a Risk Awareness Engine (RPE), fully leveraging the low latency of deterministic networks to aggregate and analyze multi-dimensional risk factors in real time, including static attributes of the subject, dynamic trust values, and real-time contextual attributes. The core of the engine employs a fuzzy inference system to intelligently quantify complex access scenarios into precise risk scores. Subsequently, the Dynamic Policy Decision Point (D-PDP) dynamically generates or enhances access policies based on this risk score, building upon a baseline ABE policy, achieving real-time adaptive adjustment of the policy. Finally, the system executes encrypted access control by matching user attributes with this dynamically generated final policy. This method achieves a shift from "static authorization" to "dynamic context-aware authorization," significantly improving the security and trustworthiness of data elements throughout their flow, transactions, and applications within the network.

[0153] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A dynamic attribute-encrypted access control method for a data element carrier network, characterized in that, Includes the following steps: Step 1: Receive access request. Receive the access request initiated by the subject to the data element object encrypted using the Attribute Base Encryption (ABE) method. Step 2, Real-time risk perception: The risk perception engine RPE in the bearer network obtains the multi-dimensional risk attributes associated with the access request in real time through the deterministic network method, and calculates the risk score of the access request using a preset fuzzy inference system. Step 3, Dynamic Policy Generation: Based on the risk score output by the risk perception engine, the Dynamic Policy Decision Point (D-PDP) dynamically generates a final ABE access policy that matches the risk score, on the basis of a preset baseline ABE access policy. Step 4, execute access control: The access execution point PEP matches and verifies the attribute private key of the subject according to the final ABE access policy generated by the dynamic policy decision point. If the verification is successful, access is authorized. If the verification fails, access will be denied.

2. The dynamic attribute encryption access control method for data element carrier network according to claim 1, characterized in that: The method for calculating the risk score of this access request using a preset fuzzy inference system in step 2 includes: Step 21, fuzzification, using the trigonometric function (trimf): f(x; a, b, c) = max(min( , ), And the trapezoidal function (trapmf): f(x; a, b, c, d) = max(min( , ), Based on the input membership functions of the three subclass attributes, and using the attribute risk fuzzy output function, the risk levels are divided into the following five levels: permissible: attrRisk(x) = (x; 0, 0,10, 20); allow : attrRisk(x) = (x;10, 25, 40); med : attrRisk(x) = (x;30, 45, 60); warn : attrRisk(x) = (x;50, 65,80); danger: attrRisk(x) = (x; 70,85,100,100); Where trimf represents the trigonometric function, f(x; a, b, c) represents the specific calculation formula of the trigonometric function, x represents the input value, and a, b, c represent the parameters of the trigonometric function, used to define the coordinates of the three vertices of the triangle. Let trapmf represent the trapezoidal relationship function, f(x; a, b, c, d) represent the specific calculation formula of the trapezoidal relationship function, d represent the parameters of the trapezoidal relationship function, and together with a, b, and c, define the coordinates of the four vertices of the trapezoid. attrRisk(x) represents the attribute risk fuzzy output function, and permissible, allowable, med, warn, and dangerous are the five "risk levels" divided in fuzzy inference. They are also used as linguistic variables of risk in the subsequent "IF-THEN" rule. Step 22, Rule Evaluation: Using the following attribute risk rules, and based on a fuzzy rule base containing multiple "IF-THEN" logic rules, inference is performed on the fuzzy linguistic variables to obtain fuzzy output: 1) If (attrCon permissible) and(attrScu permissible) and(attrSenpermissible) then(attrRisk permissible); 2) If (attrCon permissible) and(attrScu permissible) and(attrSen low)then(attrRisk allow); 3), If (attrCon permissible) and(attrScu low) and(attrSen permissible)then(attrRisk allow); 4), If (attrCon permissible) and(attrScu low) and(attrSen low) then(attrRisk med); 5), If (attrCon low) and(attrScu permissible) and(attrSen low) then(attrRisk med); 6), If (attrCon low) and(attrScu low) and(attrSen permissible) then(attrRisk med); 7), If (attrCon low) and(attrScu low) and(attrSen low) then(attrRisk med); 8), If (attrCon med) and(attrScu med) and(attrSen not high) then(attrRiskwarn); 9), If (attrCon med) and(attrScu not high) and(attrSen med) then(attrRiskwarn); 10), If(attrCon not high) and(attrScu med) and(attrSen med) then(attrRiskwarn); Among them, attrCon represents the attribute context, attrScu represents the attribute security, attrSen represents the attribute sensitivity, and attrRisk represents the attribute risk level. The permissible, low, allo, med, not high, and warn rules are used to define different levels of risk or status. Step 23, Defuzzify, using the centroid function risk = A fuzzy output is generated, which is then converted into a precise, quantified risk score; where risk represents the final output value, and x represents the risk score. i This represents the variable used for summation in the calculation of the centroid function.

3. The dynamic attribute encryption access control method for data element carrier network according to claim 1, characterized in that: In step 2, the risk perception engine acquires multidimensional attributes including subject static attributes, subject dynamic trust value, and real-time context attributes. Subject static attributes include the subject's role, department, or security level; the subject dynamic trust value is a trust score dynamically calculated based on the subject's historical access behavior logs; the real-time context attributes include the source IP address, geographical location, initiation time, and security status of the terminal device of the access request.

4. The dynamic attribute encryption access control method for data element carrier network according to claim 3, characterized in that: The method for calculating the subject's dynamic trust value is as follows: Set the entity behavior that needs to be reviewed to the entity behavior that needs to review the authentication value.

1. 2, ... The result of each action Designated as Credit rating, the current recorded behavioral outcome , ∈ [0, -1]; each The weight parameters are , ∈[0, 1], and ∑ 1 = 1; Authentication value T = ∑ 1 = ∑ 1 - ; Average credibility score = .

5. The dynamic attribute encryption access control method for data element carrier network according to claim 4, characterized in that: The method for generating dynamic strategies in step 3 is as follows: Multiple risk level thresholds are preset, and the risk score is divided into one of three risk levels: low, medium, and high. If the risk level is low, the final ABE access strategy is equal to the baseline ABE access strategy. If the risk level is medium or high, a more stringent final ABE access policy is generated by logically ANDing one or more additional attribute conditions on the baseline ABE access policy.

6. The dynamic attribute encryption access control method for data element carrier network according to claim 5, characterized in that: In step 3, the dynamic strategy decision point maintains a mapping relationship between risk level and strategy template. When a risk value is received, the following operations are performed: Risk level determination: Map the input comprehensive risk value to a predefined risk level. Dynamic strategy generation: Select and instantiate the appropriate CP-ABE strategy template based on the risk level.

7. The dynamic attribute encryption access control method for data element carrier network according to claim 6, characterized in that: The specific steps for implementing access control in step 4 are as follows: Step 41, Intercept the request: When a subject attempts to access an object, PEP intercepts the access request; Step 42, Request Decision: The PEP passes the relevant information of the access request to the Policy Decision Point (PDP), which makes the final access control decision. Step 43, Accept Decision: The PDP evaluates the access policy and makes a decision based on the information obtained from the policy base and attribute database, and then returns this decision to the PEP; Step 44, Execute the decision: After receiving the decision from the PDP, the PEP will enforce the decision; if the decision is "allow", the PEP will approve the subject's access to the object; if the decision is "deny", the PEP will block the access.

8. The dynamic attribute encryption access control method for data element carrier network according to claim 7, characterized in that: In step 4, the access execution point performs the following operations: when the data requester initiates access, the access execution point obtains the dynamically generated CP-ABE strategy; The access execution point calls the FAME algorithm to encrypt the target data element or its access key, and returns the ciphertext to the data requester; the data requester attempts to decrypt using its own attribute private key. If its attributes meet the policy requirements, decryption is successful and access is allowed. Otherwise, decryption will fail and access will be denied.

9. An encrypted access control system based on the dynamic attribute encrypted access control method of the data element carrier network as described in claim 1, characterized in that: This includes data storage units, an attribute authorization center, a risk awareness engine (RPE), a dynamic policy decision point (D-PDP), and an access execution point (PEP), among which: The data storage unit is used to store data elements encrypted using the baseline ABE access strategy. The attribute authorization center is used to manage subject attributes and generate attribute private keys; The Risk Perception Engine (RPE) is configured to receive access requests from subjects, acquire multi-dimensional risk attributes associated with the requests in real time through a deterministic network, and calculate risk scores using a fuzzy inference system. The Dynamic Policy Decision Point (D-PDP) is connected to the Risk Awareness Engine and is configured to dynamically generate a final ABE access policy based on the baseline ABE access policy according to the received risk score. The access execution point (PEP) is connected to the dynamic policy decision point and is configured to match the subject's attribute private key according to the generated final ABE access policy, and perform authorization or denial operations.

10. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions that cause the computer to execute the dynamic attribute encryption access control method for the data element carrier network as described in any one of claims 1 to 8.

Images