An MQTT access control policy security analysis method and device based on sequential matching semantics

Abstract

This invention provides a method and apparatus for security analysis of MQTT access control policies based on sequential matching semantics. The method includes the following steps: grouping all ACL rules based on the applicable subject and operation type in the ACL rules of the agent, and assigning ACL rules with the same applicable subject and operation type to the same tuple; for ACL rules in the same tuple, sorting the ACL rules in the same tuple based on the verification order of all ACL rules of the agent, and obtaining a processing order for each tuple; for ACL rules in the same tuple, performing rule reachability verification one by one based on the processing order; in the rule reachability verification step, determining the language space based on the topic resources of each ACL rule, calculating the effective matching space based on the language space of each ACL rule and the language space of the ACL rules preceding the current ACL rule in the processing order; and determining whether the ACL rule is occluded based on the effective matching space.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) technology, and in particular to a method and apparatus for security analysis of MQTT access control policies based on sequence matching semantics. Background Technology

[0002] In IoT systems, the MQTT protocol is widely used for device access, data collection, and distribution due to its lightweight nature and publish / subscribe communication mechanism. With the rapid growth of terminal scale and the continuous expansion of multi-tenant services, systems are placing higher demands on granular access control management and security isolation capabilities. To ensure permission isolation and data security between different entities, MQTT Brokers typically introduce Access Control Lists (ACLs) to restrict and manage the publish and subscribe behavior of entities on different topics.

[0003] In practical engineering applications, MQTT Brokers generally support access control configuration based on rule sequences. When determining authorization, some MQTT Brokers employ a "top-down matching, stop when a rule is matched" sequential matching mechanism: access requests are matched according to the rule sequence, and once a rule is matched, an authorization result is output and subsequent matching ceases. Under this operational semantics, rule expressions include both hierarchical matching semantics such as wildcard matching (e.g., "+" and "#") and semantic forms such as exact matching. Different rules may form overriding or masking relationships, making the actual authorization result of the policy highly dependent on the combination of rule order and expression, thus significantly increasing the complexity of policy semantic understanding and security analysis.

[0004] For MQTT access control policies that use a sequential matching mechanism, existing technologies suffer from the superposition of sequential matching semantics and topic matching semantics, making it difficult to intuitively determine the true authorization space of the policy through manual means. This can easily lead to situations where default denial rules are overridden by preceding rules, the scope of permissions is unexpectedly expanded, access boundaries between different subjects are disrupted, and some rules become unreachable due to improper sequence settings. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a security analysis method for MQTT access control policies based on sequence matching semantics, in order to eliminate or improve one or more defects existing in the prior art.

[0006] One aspect of the present invention provides a security analysis method for MQTT access control policies based on sequence matching semantics. The method is applied to a proxy, where each proxy connects to multiple entities. The steps of the method include: Based on the applicable subject and operation type in the ACL rules on the proxy side, all ACL rules are grouped, and ACL rules with the same applicable subject and operation type are assigned to the same tuple; For ACL rules in the same tuple, the ACL rules in the same tuple are sorted based on the verification order of all ACL rules on the proxy side, and the processing order is obtained for each tuple. For ACL rules with the same tuple, reachability verification is performed on each rule according to the processing order. In the rule reachability verification step, the language space is determined based on the topic resources of each ACL rule, and the effective matching space is calculated based on the language space of each ACL rule and the language space of the ACL rule preceding the current ACL rule in the processing order; the ACL rule is determined to be occluded based on the effective matching space.

[0007] The above approach suffers from drawbacks. Because access control policies employ a sequential matching rule execution mechanism, preceding rules may overwrite or obscure the matching space of subsequent rules. This can lead to some ACL rules failing to fully express their permissions in actual operation, or even becoming completely unreachable. Partial reachability or unreachability not only introduces redundant configurations and increases the difficulty of policy maintenance and updates, but may also mask semantic biases and introduce potential security risks. Therefore, this solution proposes a rule reachability check method. Based on the preceding ACL rules of the current ACL rule, a unified language space is constructed. Using both the language space of the current ACL rule and the unified language space, it determines whether the preceding ACL rules overwrite the current ACL rule. This method can determine the actual effectiveness of each rule under sequential semantics, identify redundant and obscured rules, and improve the maintainability and security of access control policies. This solution eliminates the need for manual identification and can automatically identify cases of unreachability caused by improper sequence settings.

[0008] In some embodiments of the present invention, an effective matching space is calculated based on the language space of each ACL rule and the language space of the ACL rules preceding the current ACL rule in the processing order; in the step of determining whether an ACL rule is occluded based on the effective matching space, a difference operation is performed on the language space of the ACL rule and the language space of the ACL rules preceding the current ACL rule to obtain the effective matching space; if the effective matching space is an empty set, then the current ACL rule is occluded.

[0009] In some embodiments of the present invention, the method further includes the following steps: if the effective matching space is not an empty set, then the current ACL rule is not occluded; if it is not occluded, then the ACL rule is assigned to the allowed language set or the denied language set based on the authorization decision of the ACL rule.

[0010] In some embodiments of the present invention, the method further includes the following steps: For the last ACL rule in the verification order of all ACL rules on the proxy side, if the ACL rule is the same as any standard fallback rule, it is determined to meet the default rejection check; if the ACL rule is different from any standard fallback rule, it is determined to not meet the default rejection check.

[0011] For a pair of ACL rules whose applicable subject is "all" and whose operation type is "publish" or "subscribe", the last ACL rule in the processing order is used to calculate the effective matching space based on the language space of the ACL rule and the language space of the ACL rule preceding the current ACL rule in the processing order; based on the effective matching space, it is determined whether the ACL rule is occluded.

[0012] In some embodiments of the present invention, the method further includes the following steps: for each tuple, constructing an actual authorization space based on the topic resources of the ACL rules in the final allowed language set, performing a difference operation on the actual authorization space and the pre-set planned allowed authorization space, and determining that there is a transitional authorization if the result of the difference operation is empty.

[0013] In some embodiments of the present invention, the method further includes the following steps: if over-authorization exists for any binary tuple, then it is determined that the subject corresponding to the binary tuple has over-authorization, and then an access isolation check is performed on both the first subject and any other subject. In the access isolation check processing step: A first set is constructed based on all ACL rules related to the first subject with cross-authorization, and a second set is constructed based on all ACL rules related to the second subject that performs access isolation checks on the first subject. Based on the operation types of the ACL rules in the first set, the first set is divided into a first publishing set and a first subscription set; based on the operation types of the ACL rules in the second set, the second set is divided into a second publishing set and a second subscription set. The first actual publishing space is constructed based on the topic resources of all ACL rules in the first publishing set, and the first actual subscription space is constructed based on the topic resources of all ACL rules in the first subscription set. A second actual publishing space is constructed based on the topic resources of all ACL rules in the second publishing set, and a second actual subscription space is constructed based on the topic resources of all ACL rules in the second subscription set. The actual shared publishing space is calculated based on the first actual publishing space and the second actual publishing space. The actual shared subscription space is calculated based on the first actual subscription space and the second actual subscription space. The actual positive space is calculated based on the first actual publishing space and the second actual subscription space. The actual negative space is calculated based on the first actual subscription publishing space and the second actual publishing space. Based on the preset first expected publishing space, first expected subscription space, second expected publishing space, and second expected subscription space, calculate the expected shared publishing space, expected shared subscription space, expected positive space, and expected negative space; Based on the actual shared publishing space, actual shared subscription space, actual positive space, actual negative space, first expected publishing space, first expected subscription space, second expected publishing space, second expected subscription space, expected shared publishing space, expected shared subscription space, expected positive space, and expected negative space, we conduct attack premise risk assessment and attack path risk assessment.

[0014] In some embodiments of the present invention, in the step of calculating the expected shared publishing space, expected shared subscription space, expected positive space, and expected negative space based on the preset first expected publishing space, first expected subscription space, second expected publishing space, and second expected subscription space, the expected shared publishing space is calculated based on the first expected publishing space and the second expected publishing space, the expected shared subscription space is calculated based on the first expected subscription space and the second expected subscription space, the expected positive space is calculated based on the first expected publishing space and the second expected subscription space, and the expected negative space is calculated based on the first expected subscription space and the second expected publishing space.

[0015] In some embodiments of the present invention, the attack prerequisite risk assessment includes read cross-tab risk assessment and write cross-tab risk assessment. In the step of assessing the attack prerequisite risk based on the actual shared publishing space, actual shared subscription space, actual positive space, actual negative space, and preset expected shared subscription space, preset expected shared publishing space, preset expected positive space, and preset expected negative space: Calculate the difference between the actual shared subscription space and the expected shared subscription space as the first difference set, and calculate the intersection between the first difference set and the second expected subscription space as the first intersection set. If the first intersection set is not empty, it is determined that there is a risk of read crossover. Calculate the difference between the actual shared publishing space and the expected shared publishing space as the second difference set, and calculate the intersection between the second difference set and the second expected publishing space as the second intersection set. If the second intersection set is not empty, it is determined that there is a risk of write crossover.

[0016] In some embodiments of the present invention, the attack path risk assessment includes eavesdropping risk assessment and control risk assessment. In the step of assessing attack path risk based on the actual shared publishing space, actual shared subscription space, actual positive space, actual negative space, and preset expected shared subscription space, preset expected shared publishing space, preset expected positive space, and preset expected negative space: Calculate the difference between the actual forward space and the expected forward space as the third difference set, and calculate the intersection of the third difference set and the second expected subscription space as the third intersection set. If the third intersection set is not empty, it is determined that there is a control risk. Calculate the difference between the actual negative space and the expected negative space as the fourth difference set, and calculate the intersection of the fourth difference set and the second expected publishing space as the fourth intersection set. If the fourth intersection set is not empty, it is determined that there is a subscription risk.

[0017] A second aspect of the present invention also provides a security analysis apparatus for MQTT access control policies based on sequence matching semantics. The apparatus includes a computer device, which includes a processor and a memory. The memory stores computer instructions, and the processor executes the computer instructions stored in the memory. When the computer instructions are executed by the processor, the apparatus implements the steps of the method described above.

[0018] A third aspect of the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the aforementioned MQTT access control policy security analysis method based on sequence matching semantics.

[0019] Additional advantages, objects, and features of the invention will be set forth in part in the description which follows, and will also become apparent in part to those skilled in the art upon studying the text, or may be learned by practice of the invention. The objects and other advantages of the invention will become apparent from the description and the accompanying drawings.

[0020] Those skilled in the art will understand that the objectives and advantages achievable with the present invention are not limited to those specifically described above, and that the above and other objectives achievable with the present invention will become clearer from the following detailed description. Attached Figure Description

[0021] The accompanying drawings, which are provided to further illustrate the invention and form part of this application, are not intended to limit the scope of the invention.

[0022] Figure 1 This is a schematic diagram of the first implementation of the MQTT access control policy security analysis method based on sequence matching semantics in this scheme; Figure 2 This is a schematic diagram of the second implementation of the MQTT access control policy security analysis method based on sequence matching semantics in this scheme; Figure 3 This is a schematic diagram of the third implementation method of the MQTT access control policy security analysis method based on sequence matching semantics in this scheme; Figure 4 This is a schematic diagram of the fourth implementation method of the MQTT access control policy security analysis method based on sequence matching semantics in this scheme; Figure 5 This is a schematic diagram of the fifth implementation of the MQTT access control policy security analysis method based on sequence matching semantics in this scheme; Figure 6 A schematic diagram illustrating the steps involved in access isolation checks; Figure 7 This is a schematic diagram of the ACL rule data structure; Figure 8 A schematic diagram of constructing a DFA for a topic; Figure 9 A schematic diagram of constructing a Topic for a DFA. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0024] It should also be noted that, in order to avoid obscuring the invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the invention are shown in the accompanying drawings, while other details that are not closely related to the invention are omitted.

[0025] While existing technologies have explored security assessments of MQTT access control policies, they differ significantly from the technical approach, semantic modeling methods, and scope of security property analysis described in this invention. The invention focuses on sequence-matching MQTT access control policies and rigorously performs formal security assessments at the permission space level based on their operational semantics. The main related solutions are as follows: GitHub open-source project: ACL Formal Verifier Previous work has conducted formal verification research on access control policies for MQTT / Mosquitto Broker, exploring an ACL security detection method based on automata modeling. This scheme formally represents ACL rules by constructing a deterministic finite automaton (DFA) and can identify some over-authorization issues.

[0026] However, this method's modeling is primarily based on Deny priority or set union semantic expansion, failing to characterize the sequential matching semantics of "top-down matching, stop upon hit," and neglecting to systematically analyze the impact of rule order dependencies and rule coverage / shadowing relationships on the final authorization result. Therefore, it struggles to accurately depict the true authorization space of sequential matching MQTT ACLs and cannot precisely analyze authorization changes caused by rule order alterations.

[0027] Furthermore, this scheme uses regular expressions as an intermediate layer to build the automata model, which can easily lead to the problem of state size expansion. It also fails to retain the original text of the rules and their location information for result traceability and interpretation, making it difficult to provide traceable security assessment results on rule reachability and coverage relationships.

[0028] GitHub open-source project: MQTT-Security-Scanner Existing work has conducted baseline scanning research on the deployment and configuration security of MQTT Brokers, and proposed a security detection tool that combines rule-based and use case probing. By reading the preset scanning configuration, it checks the connectivity and security options of the target Broker, and provides basic permission control verification capabilities such as rejection policies for specified topics at the message level, thereby discovering risks such as disabled authentication, weak security configurations, or missing policies.

[0029] However, this solution only tested the rejection policy capabilities of the MQTT Broker and did not conduct a comprehensive and systematic security analysis of its access control policies.

[0030] GitHub open-source project: MQTT-ACL-Tool Previous work has focused on access control behavior of MQTT Brokers, conducting research on permission inference and verification. This research proposes an ACL detection method based on a combination of proactive interactive testing and traffic analysis. This scheme initiates credentialed connection requests to the target Broker and performs publish / subscribe behavior tests on a given list of topics one by one, inferring the actual access permissions of the subject from the response results. Simultaneously, it combines packet sniffing technology to extract authentication and topic access pattern information, thereby enabling analysis of the ACL implementation effect and identifying some unauthorized access or improper policy configuration issues.

[0031] However, the MQTT-ACL-Tool solution mainly uses the Biba integrity model to perform high / low information flow consistency checks on ACL rules. Its analysis focuses on the identification of violations under specific integrity constraints, and does not provide a comprehensive and systematic formal modeling and verification of key security properties in MQTT / EMQX ACLs, such as topic wildcard matching semantics, rule order masking effect, minimum authorization, isolation, and rule reachability.

[0032] In summary, while existing technologies have explored formal modeling, baseline scanning, and permission inference for MQTT access control policies, they still lack an accurate characterization of the sequential execution semantics of "top-down matching, stop upon hit," making it difficult to systematically analyze rule order dependencies, masking and overriding relationships, and the security properties of the final authorization space. In contrast, this invention strictly constructs a formal permission space-level model based on the actual execution semantics of sequential matching MQTT ACLs and enables verifiable and traceable evaluation of key security properties such as minimum authorization, isolation, and rule reachability.

[0033] The existing technologies mainly suffer from the following problems: On the one hand, due to the superposition of sequential matching semantics and topic matching semantics, the true authorization space of a policy is difficult to judge intuitively by manual means. This can easily lead to situations where default denial rules are covered by preceding rules, the scope of permissions is unexpectedly expanded, the access boundaries between different subjects are broken, and some rules are unreachable or redundant due to improper sequence settings. As a result, it is difficult to accurately assess whether the policy meets security requirements such as default denial, least privilege, and access isolation. On the other hand, existing evaluation methods mostly adopt the approach of constructing test cases and performing behavioral verification. The evaluation effect depends on the coverage of the test samples, making it difficult to conduct a systematic analysis of the complete authorization space. Furthermore, there is a lack of clear formal definitions for security properties such as default denial, least privilege, access isolation, and rule reachability, making it difficult for the evaluation results to form a deterministic judgment on the overall security status of the policy.

[0034] Therefore, in MQTT access control policy application scenarios that adopt the sequence matching mechanism, how to construct a systematic and formal security assessment method that is strictly consistent with the actual authorization operation semantics, and to conduct a comprehensive and computable analysis and verification of security properties such as default denial, least privilege, access isolation, and rule reachability, has become an urgent technical problem to be solved.

[0035] This solution addresses the aforementioned issues by formally modeling MQTT access control rules. It represents the authorization rules for each subject under different operations as a deterministic finite automaton (DFA), characterizing its actual authorization space. Following a "top-down matching, stop upon hit" semantic, it performs sequential merging calculations, conducting set operations and comparisons on the authorization spaces of different subjects. This enables systematic analysis and verification of security properties such as policy default denial, minimum authorization, access isolation, and rule reachability, providing reliable technical support for the auditing and optimization of MQTT access control policies.

[0036] like Figure 1 As shown, this invention proposes a security analysis method for MQTT access control policies based on sequence matching semantics. The method is applied to a proxy, where each proxy connects to multiple entities. The steps of the method include: In its implementation, this solution constructs a unified MQTT ACL rule data representation model, providing structured abstraction of different subjects (such as clientid, username, IP, etc.), different operation types (publish, subscribe), and different topic matching semantics. While fully preserving the rule order information, this model explicitly distinguishes between Topic Filter matching and exact matching semantics, and organizes and structures the dispersed rules according to subject and operation type, thereby providing a unified, standardized, and traceable data foundation for subsequent permission space construction and security analysis.

[0037] Step S100: Group all ACL rules based on the applicable subject and operation type in the ACL rules of the agent, and assign ACL rules with the same applicable subject and operation type to the same tuple; In practice, the ACL rules include four core elements: Permission, Subject, Action, and Topic. Permission is used to indicate the access control result that should be returned when a rule is successfully matched. Its value is usually "allow" or "deny", which means authorization is successful or authorization fails, respectively.

[0038] The `Subject` property describes the subject to which the rule applies. Subjects can be matched based on client attributes such as `clientid`, `username`, `IP address`, or other request characteristics to distinguish the source of the request. In the abstract syntax, `Subject` can also take the special value `all`, indicating that the rule applies to all subjects.

[0039] Actions are used to distinguish different access behaviors. In MQTT scenarios, common operations include publish and subscribe, corresponding to message publishing and message subscription behaviors, respectively. If the action value is all, it means that the rule applies to all operation types of the subject.

[0040] The Topic is the core matching object for access control decisions. During authorization, the target Topic in the request needs to be matched against the topic expression in the rules. If a match is successful, the appropriate decision is returned based on the permission; if a match fails, the process continues matching the next rule in order. Topic matching may involve the semantics of the MQTT wildcards "+" and "#": in Topic Filter mode, "+" matches any single-level topic, and "#" matches zero or more levels of topics starting from the current position; in exact match mode, literal matching is performed on the topic string, and wildcard semantics are not enabled.

[0041] By abstracting the above four elements, key information in MQTT ACL rules can be extracted, a unified data representation model can be constructed, and a structured data foundation can be provided for subsequent formal modeling of the permission space and security property analysis.

[0042] While the above rule syntax abstraction allows for the extraction of core elements such as permission, subject, action, and topic from a single ACL rule, in actual MQTT ACL policies, rules typically appear in a discrete and concurrent manner: the same subject often corresponds to multiple rules, which may cover different operation types, different topic ranges, and different authorization decisions. Especially under the "sequential matching, stop upon hit" execution semantics, rules may also form overlapping and masking relationships, making it impossible to directly reconstruct the actual effective authorization result of the policy by relying solely on field extraction from a single rule. Therefore, this is insufficient to support a systematic security assessment of MQTT ACL policies.

[0043] To support the goal of constructing an access control space with "subject-operation" as the analysis granularity and strictly preserving the semantic order of rules, this patent buckets and aggregates ACL rules in the manner of "subject → operation → rule sequence," and designs a structured, bucketable, and traceable data representation model (such as...). Figure 7 (As shown). This model uses the value of the subject as the index key and maintains the rule sequences corresponding to the publish and subscribe operations respectively. At the same time, it records the authorization decision, topic matching information, rule order information and metadata (such as source file, line number and original text) for each rule to support subsequent permission space calculation, rule reachability analysis and diagnostic result tracing.

[0044] A dictionary is constructed based on the ACL rule data, using the Subject value as the key and key information as the value. The key information parameters are explained in Table 1.

[0045] Table 1 The above aggregation method can organize scattered rules into a unified structure, enhancing traceability while preserving sequence information, and providing a reliable data foundation for subsequent formal construction of permission space and verification of security properties.

[0046] To ensure that the sequential matching semantics are strictly maintained when constructing the permission space at the "subject-operation" granularity, this scheme performs the following normalization processing for the two types of global constraints, Subject=all and Action=all, in the rule syntax abstraction: (1) Handling Subject = all When Subject is set to 'all', the rule applies to all subjects. To avoid losing its scope of influence after subject-based bucketing, this method writes the rule into a global subject bucket (e.g., __ALL__) for backtracking and auditing, while preserving the original order identifier; simultaneously, it is equivalently propagated to each subject bucket in the currently known subject set, allowing it to participate in subsequent sequential semantic merging calculations within the rule sequence of each subject. Through this processing, the impact of the global rule on the authorization space of each subject is consistently characterized.

[0047] (2) Handling Action = all When Action is set to "all", the rule applies to all operations of the same subject. To ensure that subsequent permission space calculations are performed only at a single operation dimension (publish / subscribe), this method equivalently splits the rule into two rules: one for the publish rule sequence and the other for the subscribe rule sequence of the subject, while maintaining the same order identifier and meta information as the original rule, thus ensuring that the masking / overlay relationship under the sequential matching semantics is not disrupted.

[0048] Through the above normalization operations, this method can fully extract the key semantic information of ACL rules without relying on specific configuration carriers, and complete rule clustering and order information preservation in a structured manner, while maintaining traceability, providing a reliable data foundation for subsequent formal calculation of permission space and verification of security properties.

[0049] Through the extraction and structuring of ACL rule information described above, a rule data representation model with "subject-operation" granularity and strict preservation of rule sequence semantics can be obtained. Based on this, this method completes the processing of each pair of tuples through two stages: rule language modeling and sequence semantic merging. Formal computation of the permission space.

[0050] Rule-based language modeling: formalizing Topic matching conditions into a language space represented by automata; Sequential semantic merging: The rule language is differentially synthesized according to sequential semantics to obtain the final authorization space.

[0051] Because ACL rules have a natural hierarchical structure and support matching semantics such as single-level and multi-level wildcards, complex overlapping and intersecting relationships may form between different rules, making it difficult to perform precise set operations directly at the string level. Therefore, this solution abstracts the Topic matching conditions of each rule into a formal language set to characterize the complete Topic space it can match, thereby achieving a formal expression and computable modeling of the permission scope.

[0052] To this end, the Topic expressions in the ACL rules are first divided into levels according to the separator " / ", each level is regarded as the input symbol of the automaton (topic level), and the level matching result is used as the state transition condition to construct the corresponding deterministic finite automaton (DFA) to represent the matching language of the rule.

[0053] Depending on the matching pattern, the following construction methods are adopted: Topic Filter Mode In Topic Filter mode, the "+" and "#" symbols in expressions have special wildcard semantics: The "+" indicates that any single-level topic can be matched; The "#" symbol matches zero or more levels of topics starting from the current position and is only allowed at the end of the expression.

[0054] When constructing a DFA: If the current level is a regular string, the state transition will only occur if the input level is equal to that string. If the current level is "+", then a state transition will be performed for any single-level input; If the current level is "#", then a self-loop transition is established in the current state so that it can match zero or multiple level inputs, and the state is marked as an accepting state.

[0055] Exact match mode In exact matching mode, all characters in the Topic expression are matched literally, and wildcard semantics are not enabled. Therefore, the DFA is constructed by matching the corresponding string layer by layer. If any level does not match, it enters a dead state, and only enters the accepting state when all levels match completely.

[0056] In this way, the Topic expression of each ACL rule can be transformed into a computable deterministic automaton representation, thereby accurately characterizing its corresponding language space and providing a formal basis for subsequent set difference and sequential semantic merging.

[0057] Taking Topic = “tenants / + / devices / #” as an example, its corresponding DFA structure is as follows: Figure 8 As shown.

[0058] The state transition relationships are as follows: q0→q1: Read in the literal "tenants"; q1→q2: Read in any single-level string ("+" wildcard); q2→q3: Read in the literal "devices"; q3→q3: Self-loop transfer, reads any level zero or more times ("#" wildcard), q3 is the accepting state; qd is in a dead state: This state is entered when input that does not match the expected literal is read in state q0 or q2.

[0059] Step S200: For ACL rules of the same tuple, sort the ACL rules of the same tuple based on the verification order of all ACL rules on the agent, and obtain the processing order for each tuple. In practical implementation, MQTT access control policies employing sequential matching mechanisms typically consist of a series of rules arranged in configuration order. The same subject often corresponds to multiple ACL rules, and these rules may cover different operation types (publish / subscribe), different authorization decisions (allow / deny), and different topic expressions for different resources. Because this type of ACL uses a "top-down matching, stop upon hit" semantic, preceding rules may obscure or override subsequent rules, making the actual authorization result highly dependent on the combination of rule order and expression, which is difficult to accurately reconstruct manually. To support the subsequent construction of its authorization space and security analysis at the "subject-operation" dimension, it is necessary to abstract the scattered rules into a structured, bucketable, and traceable data representation, while fully preserving the rule order information.

[0060] Furthermore, sequential matching MQTT ACLs typically employ different matching modes in their Topic rule expressions: one is Topic Filter matching, which follows the wildcard semantics of MQTT Topic Filters, where "+" matches any single level, "#" matches zero or more levels from the current position, and "#" can only appear at the end of the expression; the other is exact matching, which performs literal matching on the Topic string, disabling wildcard semantics and treating characters like "+" and "#" as ordinary characters. This can lead to situations where "rule strings are the same but the matching languages ​​are different." Therefore, the data model must explicitly distinguish between different matching modes; otherwise, semantic discrepancies will arise in subsequent authorization space construction and security analysis.

[0061] Step S300: For ACL rules with the same tuple, rule reachability verification is performed one by one based on the processing order; In step S400, during the rule reachability verification step, the language space is determined based on the topic resources of each ACL rule, and the effective matching space is calculated based on the language space of each ACL rule and the language space of the ACL rule preceding the current ACL rule in the processing order; based on the effective matching space, it is determined whether the ACL rule is occluded.

[0062] In practical implementation, the language space of the ACL rules preceding the current ACL rule is the union of the language spaces of the ACL rules preceding this ACL rule in the processing order, constructed as follows: gather.

[0063] In the specific implementation process, in the step of determining the language space based on the topic resources of each ACL rule, a DFA is constructed for each ACL rule based on the Topic expression of the topic resources. The DFA is used as the language space. After the DFA is constructed for the Topic expression of each ACL rule, each rule can be represented as a computable language space.

[0064] Specifically, calculate the first The effective matching space for each rule is shown in the following formula: in, Indicates the first A rule-based language space, This represents the union of the language spaces of the ACL rules preceding this ACL rule, which is the current ACL rule. gather, By connecting with the current Perform a set difference operation on the sets to obtain the valid matching space that the rule has not yet been covered by the preceding rules. .like If the rule is unreachable (shadowed) under the current tuple, then the rule is unreachable (shadowed); otherwise, In actual operation, this rule has a scope of effectiveness. Through the above rule reachability check, the reachability of each rule in the access control policy can be systematically determined, thereby identifying completely unreachable rules and partially reachable rules. This provides a basis for subsequent rule auditing, redundancy reduction and policy optimization, and reduces security risks caused by rule occlusion or redundancy.

[0065] The above approach suffers from drawbacks. Because access control policies employ a sequential matching rule execution mechanism, preceding rules may overwrite or obscure the matching space of subsequent rules. This can lead to some ACL rules failing to fully express their permissions in actual operation, or even becoming completely unreachable. Partial reachability or unreachability not only introduces redundant configurations and increases the difficulty of policy maintenance and updates, but may also mask semantic biases and introduce potential security risks. Therefore, this solution proposes a rule reachability check method. Based on the preceding ACL rules of the current ACL rule, a unified language space is constructed. Using both the language space of the current ACL rule and the unified language space, it determines whether the preceding ACL rules overwrite the current ACL rule. This method can determine the actual effectiveness of each rule under sequential semantics, identify redundant and obscured rules, and improve the maintainability and security of access control policies. This solution eliminates the need for manual identification and can automatically identify cases of unreachability caused by improper sequence settings.

[0066] In some embodiments of the present invention, an effective matching space is calculated based on the language space of each ACL rule and the language space of the ACL rules preceding the current ACL rule in the processing order; in the step of determining whether an ACL rule is occluded based on the effective matching space, a difference operation is performed on the language space of the ACL rule and the language space of the ACL rules preceding the current ACL rule to obtain the effective matching space; if the effective matching space is an empty set, then the current ACL rule is occluded.

[0067] like Figure 2 As shown, in some embodiments of the present invention, the method further includes the following steps: step S500, if the effective matching space is not an empty set, then the current ACL rule is not occluded; if it is not occluded, then the ACL rule is assigned to the allowed language set or the denied language set based on the authorization decision of the ACL rule.

[0068] In practice, after each ACL rule is determined to be either blocked or not, it is assigned to the allowed or denied language set, and the allowed and denied permission spaces are updated simultaneously. gather.

[0069] In its implementation, this scheme employs a formal computation method for the permission space based on deterministic finite automata (DFA). This method combines the hierarchical structure of MQTT topics to construct a hierarchical automaton model, representing each topic rule as a corresponding set of formal languages. It strictly follows a "top-down matching, stop upon hit" order to perform rule merging and masking, calculating the allowed permission space of the allowed language set and the denied permission space of the corresponding denied language set for each subject under different operations. This ensures that the constructed permission space remains consistent with the actual authorization results.

[0070] Based on the semantic execution order of "top-down matching, stop upon hit", this scheme applies the same... The language space is arranged in rule order, and the difference and cumulative union operations are performed on each rule to determine the effective coverage of each rule in actual operation, and the system is constructed. The final permission space of the corresponding set of allowed languages The final rejection permission space corresponding to the set of rejection languages .

[0071] By employing the above scheme, this scheme performs set operations and relational analysis on the aforementioned permission space. The system can automatically verify key security properties such as default denial, least privilege, access isolation, and rule reachability, and generate interpretable diagnostic results containing rule location information, original rule text, and counterexample topics. This enables a systematic security assessment and risk identification of sequential matching MQTT access control policies.

[0072] Based on unified rule representation, strict preservation of sequential matching semantics, and computable modeling of the permission space, this solution enables a systematic, automated, and traceable assessment of the security properties of MQTT access control policies. It can effectively identify configuration risks such as over-authorization, breach of isolation boundaries, failure of default denial, and rule shading or unreachability, providing reliable technical support and engineering implementation path for the auditing, optimization, and security hardening of access control policies.

[0073] After completing the formal computation of the permission space of the binary tuple, the corresponding final allowed permission space can be obtained. With final denial of permissions space Based on this, this solution can conduct a systematic security analysis of MQTT access control policies, mainly including the following four key security properties: Default denial: The policy should have an effective fallback denial mechanism to ensure that access requests that are not explicitly allowed are not allowed by default; Least authorization: The scope of permissions that an entity is granted under the actual policy should not exceed the scope of authorization it expects or pre-sets. Access isolation: Different subjects should not have unintended read / write interactions, information leaks, or control relationships within non-shared permission spaces; Rule reachability: Each rule in the policy should have an actual effective permission space under sequential matching semantics to avoid completely obscuring or redundant rules.

[0074] like Figure 3 As shown, in some embodiments of the present invention, the method further includes the following steps: Step S600: For the last ACL rule in the verification order of all ACL rules on the agent side, if the ACL rule is the same as any standard fallback rule, it is determined that it meets the default rejection check; if the ACL rule is not the same as any standard fallback rule, it is determined that it does not meet the default rejection check.

[0075] For a pair of ACL rules whose applicable subject is "all" and whose operation type is "publish" or "subscribe", the last ACL rule in the processing order is used to calculate the effective matching space based on the language space of the ACL rule and the language space of the ACL rule preceding the current ACL rule in the processing order; based on the effective matching space, it is determined whether the ACL rule is occluded.

[0076] The standard catch-all rule can be: If a rule that satisfies the above characteristics exists, then it can be determined that the strategy explicitly declares a catch-all rejection rule.

[0077] like Figure 4 As shown, in some embodiments of the present invention, the method further includes the following steps: Step S700, for each tuple, constructing an actual authorization space based on the topic resources of the ACL rules in the final allowed language set, performing a difference operation on the actual authorization space and the pre-set planned allowed authorization space, and determining that there is a transitional authorization if the result of the difference operation is empty.

[0078] The pre-defined plan allows authorized spaces to be set up by staff based on historical processing experience.

[0079] like Figure 5 As shown, in some embodiments of the present invention, the method further includes the following steps: step S800, if there is over-authorization for any tuple, then it is determined that the subject corresponding to the tuple has over-authorization, and then an access isolation check is performed on the first subject and any subject. like Figure 6As shown, in the steps of the access isolation check process: Step S810: Construct a first set based on all ACL rules related to the first subject with transitional authorization, and construct a second set based on all ACL rules related to the second subject that performs access isolation checks on the first subject; Step S820: Based on the operation type of the ACL rules in the first set, the first set is divided into a first publishing set and a first subscription set; based on the operation type of the ACL rules in the second set, the second set is divided into a second publishing set and a second subscription set. Step S830: Construct a first actual publishing space based on the topic resources of all ACL rules in the first publishing set, and construct a first actual subscription space based on the topic resources of all ACL rules in the first subscription set; The first actual publishing space is the union of the language spaces of the topic resources of all ACL rules in the first publishing set; the first actual subscription space is the union of the language spaces of the topic resources of all ACL rules in the first subscription set.

[0080] Step S840: Construct a second actual publishing space based on the topic resources of all ACL rules in the second publishing set, and construct a second actual subscription space based on the topic resources of all ACL rules in the second subscription set; The second actual publishing space is the union of the language spaces of the topic resources of all ACL rules in the second publishing set; the second actual subscription space is the union of the language spaces of the topic resources of all ACL rules in the second subscription set.

[0081] Step S850: Calculate the actual shared publishing space based on the first actual publishing space and the second actual publishing space; calculate the actual shared subscription space based on the first actual subscription space and the second actual subscription space; calculate the actual positive space based on the first actual publishing space and the second actual subscription space; calculate the actual negative space based on the first actual subscription publishing space and the second actual publishing space. In the specific implementation process, the intersection of the first actual publishing space and the second actual publishing space is taken as the actual shared publishing space; the intersection of the first actual subscription space and the second actual subscription space is taken as the actual shared subscription space; the intersection of the first actual publishing space and the second actual subscription space is taken as the actual positive space; and the intersection of the first actual subscription publishing space and the second actual publishing space is taken as the actual negative space.

[0082] Step S860: Calculate the expected shared publishing space, expected shared subscription space, expected positive space, and expected negative space based on the preset first expected publishing space, first expected subscription space, second expected publishing space, and second expected subscription space; The preset first expected publishing space, first expected subscription space, second expected publishing space, and second expected subscription space are spaces set by staff based on historical processing experience.

[0083] The method for calculating the expected shared publish space, expected shared subscribe space, expected positive space, and expected negative space is the same as the method for calculating the actual shared publish space, actual shared subscribe space, actual positive space, and actual negative space.

[0084] Step S870: Based on the actual shared publishing space, actual shared subscription space, actual positive space, actual negative space, first expected publishing space, first expected subscription space, second expected publishing space, second expected subscription space, expected shared publishing space, expected shared subscription space, expected positive space, and expected negative space, perform attack premise risk assessment and attack path risk assessment.

[0085] In some embodiments of the present invention, in the step of calculating the expected shared publishing space, expected shared subscription space, expected positive space, and expected negative space based on the preset first expected publishing space, first expected subscription space, second expected publishing space, and second expected subscription space, the expected shared publishing space is calculated based on the first expected publishing space and the second expected publishing space, the expected shared subscription space is calculated based on the first expected subscription space and the second expected subscription space, the expected positive space is calculated based on the first expected publishing space and the second expected subscription space, and the expected negative space is calculated based on the first expected subscription space and the second expected publishing space.

[0086] In the specific implementation process, the intersection of the first expected publishing space and the second expected publishing space is taken as the expected shared publishing space; the intersection of the first expected subscription space and the second expected subscription space is taken as the expected shared subscription space; the intersection of the first expected publishing space and the second expected subscription space is taken as the expected positive space; and the intersection of the first expected subscription space and the second expected publishing space is taken as the expected negative space.

[0087] In some embodiments of the present invention, the attack prerequisite risk assessment includes read cross-tab risk assessment and write cross-tab risk assessment. In the step of assessing the attack prerequisite risk based on the actual shared publishing space, actual shared subscription space, actual positive space, actual negative space, and preset expected shared subscription space, preset expected shared publishing space, preset expected positive space, and preset expected negative space: Calculate the difference between the actual shared subscription space and the expected shared subscription space as the first difference set, and calculate the intersection between the first difference set and the second expected subscription space as the first intersection set. If the first intersection set is not empty, it is determined that there is a risk of read crossover. Calculate the difference between the actual shared publishing space and the expected shared publishing space as the second difference set, and calculate the intersection between the second difference set and the second expected publishing space as the second intersection set. If the second intersection set is not empty, it is determined that there is a risk of write crossover.

[0088] Using the above scheme, the pre-attack risk is used to identify overlapping permissions between different entities in non-shared spaces. This type of risk does not necessarily constitute an exploitable attack chain, but it may provide necessary conditions for subsequent attack paths. If A is the first entity to determine over-authorization, and B is the second entity, and the difference between the actual shared subscription space and the expected shared subscription space of A and B intersects with the expected subscription permission space of B, then... This indicates that A has permission to perform subscription operations on B's subscribed topics that is not intended for A; if the difference between the actual shared publication space and the intended shared publication space of A and B intersects with the intended publication permission space of B, then... This indicates that A has permission to perform publishing operations on B's publishing topic in a way that is not intended.

[0089] In some embodiments of the present invention, the attack path risk assessment includes eavesdropping risk assessment and control risk assessment. In the step of assessing attack path risk based on the actual shared publishing space, actual shared subscription space, actual positive space, actual negative space, and preset expected shared subscription space, preset expected shared publishing space, preset expected positive space, and preset expected negative space: Calculate the difference between the actual forward space and the expected forward space as the third difference set, and calculate the intersection of the third difference set and the second expected subscription space as the third intersection set. If the third intersection set is not empty, it is determined that there is a control risk. Calculate the difference between the actual negative space and the expected negative space as the fourth difference set, and calculate the intersection of the fourth difference set and the second expected publishing space as the fourth intersection set. If the fourth intersection set is not empty, it is determined that there is a subscription risk.

[0090] Using the above scheme, attack path risk is used to identify exploitable attack links with a clear read-write causal relationship, which can be directly used as the basis for determining isolation breaches; if the difference between the actual subscription of A to B's publishing space and the expected subscription of A to B's publishing space, and the intersection of B's ​​expected published permitted authorization space, are not equal. This indicates that A possesses unintended permission to subscribe to topics published by B, which could serve as a path for A to launch an eavesdropping attack on B; if the difference between the actual A-published B subscription space and the expected A-published B subscription space intersects with B's expected subscription permitted authorization space, then... This indicates that A has the unauthorized permission to perform publishing operations on B's subscribed topics, which can be used as a path for A to launch a control attack on B.

[0091] This solution identifies overlapping permissions and attack links that exceed the planned scope by comparing the difference between the expected shared space and the actual shared space. This allows for a more granular analysis of the security impact on entities with over-authorization, providing theoretical support for subsequent risk identification and strategy optimization.

[0092] In summary, after completing the above safety property analysis, structured feedback of the assessment conclusions is required. This patent designs corresponding feedback content and presentation methods for different safety properties to ensure that the safety analysis results are verifiable, identifiable, and verifiable.

[0093] The default rejection analysis output is: whether there is an explicitly configured fallback rejection rule that is effective under sequential semantics.

[0094] The feedback method is to provide a conclusion on whether the default rejection condition is met.

[0095] The output of the minimum authorization analysis is: Does a certain The actual allowed permission space exceeds the expected allowed permission space.

[0096] The feedback method is: if there is over-delegation, then clearly define the corresponding [issues / problems]. Yes, and generate a matching counterexample topic from the excess portion to verify the analysis conclusions and help locate the authorization boundary deviation.

[0097] The output of access isolation analysis is: given that a subject has over-authorized access, is there a risk of further attacks targeting other subjects?

[0098] The feedback method is as follows: if there is a risk, the subject pair involved in the risk, the type of operation and the category of risk are identified, and a counterexample topic is generated from the corresponding risk space to verify the risk conclusion and support subsequent handling.

[0099] The output of rule reachability analysis is: whether there are ACL rules that are completely unreachable or partially reachable under sequential matching semantics.

[0100] The feedback method is as follows: if there are unreachable or partially reachable rules, the position of the rule in the input source and the original rule text are located based on the metadata in the unified data structure; at the same time, a Topic is provided to verify that the rule is hidden for completely unreachable rules, and a reachable Topic and an unreachable Topic are provided for partially reachable rules to support the judgment result of "partially reachable".

[0101] Topic generation is based on the DFA representation of the corresponding rule. A suitable Topic is generated by constructing a path that reaches an acceptable state. The specific process is as follows: Figure 9 As shown.

[0102] The following is an example of how DFA generates topics: start → q0: ==""; q0 → q1: Read in the literal "tenants". =="tenants"; q1 → q2: Match the single-level input with "+", and take the example segment "a". =="tenants / a"; q2 → q3: Read in the literal "devices", =="tenants / a / devices"; q3 → q3: Matches multiple inputs of "#", taking the example segment "b" (can be repeated 0 or more times). =="tenants / a / devices / b", output after reaching the receiving state. As the generated result.

[0103] This invention also provides a security analysis device for MQTT access control policies based on sequence matching semantics. The device includes a computer device, which includes a processor and a memory. The memory stores computer instructions, and the processor executes the computer instructions stored in the memory. When the computer instructions are executed by the processor, the device implements the steps of the method described above.

[0104] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned MQTT access control policy security analysis method based on sequence matching semantics. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0105] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the desired tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave.

[0106] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0107] In this invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0108] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations of the embodiments of the present invention are possible. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A security analysis method for MQTT access control policies based on sequence matching semantics, characterized in that, The method is applied to a proxy terminal, where each proxy terminal connects to multiple entities. The steps of the method include: Based on the applicable subject and operation type in the ACL rules on the proxy side, all ACL rules are grouped, and ACL rules with the same applicable subject and operation type are assigned to the same tuple; For ACL rules in the same tuple, the ACL rules in the same tuple are sorted based on the verification order of all ACL rules on the proxy side, and the processing order is obtained for each tuple. For ACL rules with the same tuple, reachability verification is performed on each rule according to the processing order. In the rule reachability verification step, the language space is determined based on the topic resources of each ACL rule, and the effective matching space is calculated based on the language space of each ACL rule and the language space of the ACL rule preceding the current ACL rule in the processing order; the ACL rule is determined to be occluded based on the effective matching space.

2. The MQTT access control policy security analysis method based on sequence matching semantics according to claim 1, characterized in that, In the step of calculating the effective matching space based on the language space of each ACL rule and the language space of the ACL rules preceding the current ACL rule in the processing order; and in the step of determining whether an ACL rule is occluded based on the effective matching space, the difference operation is performed on the language space of the ACL rule and the language space of the ACL rules preceding the current ACL rule to obtain the effective matching space; if the effective matching space is an empty set, then the current ACL rule is occluded.

3. The MQTT access control policy security analysis method based on sequence matching semantics according to claim 2, characterized in that, The method further includes the following steps: if the effective matching space is not an empty set, then the current ACL rule is not occluded; if it is not occluded, then the ACL rule is assigned to the allowed language set or the denied language set based on the authorization decision of the ACL rule.

4. The MQTT access control policy security analysis method based on sequence matching semantics according to claim 1, characterized in that, The method further includes the following steps: For the last ACL rule in the verification order of all ACL rules on the proxy side, if the ACL rule is the same as any standard fallback rule, it is determined to meet the default rejection check; if the ACL rule is different from any standard fallback rule, it is determined to not meet the default rejection check.

5. The MQTT access control policy security analysis method based on sequence matching semantics according to any one of claims 1 to 4, characterized in that, The method further includes the following steps: for each tuple, constructing an actual authorization space based on the topic resources of the ACL rules in the final allowed language set, performing a difference operation on the actual authorization space and the pre-set planned allowed authorization space, and determining that there is a transitional authorization if the result of the difference operation is empty.

6. The MQTT access control policy security analysis method based on sequence matching semantics according to claim 5, characterized in that, The method further includes the following steps: if over-authorization exists for any tuple, then it is determined that the subject corresponding to the tuple has over-authorization, and then an access isolation check is performed on both the first subject and any other subject. In the access isolation check processing step: A first set is constructed based on all ACL rules related to the first subject with cross-authorization, and a second set is constructed based on all ACL rules related to the second subject that performs access isolation checks on the first subject. Based on the operation types of the ACL rules in the first set, the first set is divided into a first publishing set and a first subscription set; based on the operation types of the ACL rules in the second set, the second set is divided into a second publishing set and a second subscription set. The first actual publishing space is constructed based on the topic resources of all ACL rules in the first publishing set, and the first actual subscription space is constructed based on the topic resources of all ACL rules in the first subscription set. A second actual publishing space is constructed based on the topic resources of all ACL rules in the second publishing set, and a second actual subscription space is constructed based on the topic resources of all ACL rules in the second subscription set. The actual shared publishing space is calculated based on the first actual publishing space and the second actual publishing space. The actual shared subscription space is calculated based on the first actual subscription space and the second actual subscription space. The actual positive space is calculated based on the first actual publishing space and the second actual subscription space. The actual negative space is calculated based on the first actual subscription publishing space and the second actual publishing space. Based on the preset first expected publishing space, first expected subscription space, second expected publishing space, and second expected subscription space, calculate the expected shared publishing space, expected shared subscription space, expected positive space, and expected negative space; Based on the actual shared publishing space, actual shared subscription space, actual positive space, actual negative space, first expected publishing space, first expected subscription space, second expected publishing space, second expected subscription space, expected shared publishing space, expected shared subscription space, expected positive space, and expected negative space, we conduct attack premise risk assessment and attack path risk assessment.

7. The MQTT access control policy security analysis method based on sequence matching semantics according to claim 6, characterized in that, In the steps of calculating the expected shared publishing space, expected shared subscription space, expected positive space, and expected negative space based on the preset first expected publishing space, first expected subscription space, second expected publishing space, and second expected subscription space, the expected shared publishing space is calculated based on the first expected publishing space and the second expected publishing space, the expected shared subscription space is calculated based on the first expected subscription space and the second expected subscription space, the expected positive space is calculated based on the first expected publishing space and the second expected subscription space, and the expected negative space is calculated based on the first expected subscription space and the second expected publishing space.

8. The MQTT access control policy security analysis method based on sequence matching semantics according to claim 6, characterized in that, The attack prerequisite risk assessment includes read cross-tab risk assessment and write cross-tab risk assessment. In the step of assessing attack prerequisite risks based on the actual shared publish space, actual shared subscribe space, actual positive space, actual negative space, and preset expected shared subscribe space, preset expected shared publish space, preset expected positive space, and preset expected negative space: Calculate the difference between the actual shared subscription space and the expected shared subscription space as the first difference set, and calculate the intersection between the first difference set and the second expected subscription space as the first intersection set. If the first intersection set is not empty, it is determined that there is a risk of read crossover. Calculate the difference between the actual shared publishing space and the expected shared publishing space as the second difference set, and calculate the intersection between the second difference set and the second expected publishing space as the second intersection set. If the second intersection set is not empty, it is determined that there is a risk of write crossover.

9. The MQTT access control policy security analysis method based on sequence matching semantics according to claim 6, characterized in that, The attack path risk assessment includes eavesdropping risk assessment and control risk assessment. In the step of assessing attack path risk based on the actual shared publishing space, actual shared subscription space, actual positive space, actual negative space, and preset expected shared subscription space, preset expected shared publishing space, preset expected positive space, and preset expected negative space: Calculate the difference between the actual forward space and the expected forward space as the third difference set, and calculate the intersection of the third difference set and the second expected subscription space as the third intersection set. If the third intersection set is not empty, it is determined that there is a control risk. Calculate the difference between the actual negative space and the expected negative space as the fourth difference set, and calculate the intersection of the fourth difference set and the second expected publishing space as the fourth intersection set. If the fourth intersection set is not empty, it is determined that there is a subscription risk.

10. A security analysis device for MQTT access control policies based on sequence matching semantics, characterized in that, The device includes a computer device, which includes a processor and a memory, wherein computer instructions are stored in the memory, and the processor is configured to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the device implements the steps of the method as described in any one of claims 1 to 9.

Images