Access control method, apparatus, device, medium, and product

Abstract

This application discloses an access control method, apparatus, device, medium, and product, relating to the field of communication technology. The access control method includes: when a terminal senses a switch from a trusted network environment to an untrusted network environment, the proxy terminal sends a long-connection request to a target business system; acquiring processing data of the target business system's response to the long-connection request, performing trustworthiness verification based on the processing data and the switching context data, and generating a restricted access credential for the terminal and enabling a one-way isolation mode for the terminal when the trustworthiness verification result is positive; with the one-way isolation mode enabled, authenticating the terminal's access behavior command to the target business system based on the restricted access credential, sending the access behavior command to the target business system after successful authentication, and filtering the response data received from the target business system before sending the filtered response data to the terminal.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to an access control method, apparatus, device, medium and product. Background Technology

[0002] In related technologies, to ensure security, some internal business systems can be deployed in trusted network environments such as private networks. Terminals are allowed to access these systems within these trusted environments, but not in untrusted network environments. However, in some cases, during user terminal access to the business system, the terminal may move. If the terminal switches from a trusted network environment like a private network to an untrusted network environment like the public internet, the business system may experience issues such as unresponsiveness, offline status, or disconnection, impacting user service continuity. Conversely, allowing terminals to directly access the business system in untrusted network environments could lead to security vulnerabilities such as eavesdropping and penetration attacks. Summary of the Invention

[0003] The purpose of this application is to provide an access control method, apparatus, device, medium, and product for balancing user business continuity and security, and improving user business continuity while ensuring security.

[0004] In a first aspect, embodiments of this application provide an access control method, the method comprising: When the terminal is detected to switch from a trusted network environment to an untrusted network environment, the proxy terminal sends a long connection request to the target business system. Obtain the processing data of the target business system for the long connection request, and based on the processing data and the switching context data, perform trustworthiness verification to obtain a trustworthiness verification result; If the trustworthiness verification result is positive, a restricted access credential is generated for the terminal, and a one-way isolation mode is enabled for the terminal. When the one-way isolation mode is enabled for the terminal, if an access instruction for the target business system is received from the terminal, the access instruction is authenticated based on the restricted access credential. After successful authentication, the access instruction is sent to the target business system. If response data to the access instruction is received from the target business system, the response data is filtered and sent to the terminal.

[0005] In some embodiments, the long-lived connection request includes: a dynamically heterogeneous redundant DHR encapsulation object; the processing data includes: behavioral data consuming the DHR encapsulation object; and the trustworthiness assessment based on the processing data and the switching context data, to obtain a trustworthiness assessment result, includes: Based on the behavioral data and the context data, the following three types of recognition checks are performed. If at least two of the following three recognition checks pass, the credibility recognition result is determined as recognition: Switching time acceptance check, DHR encapsulated object empty jump activity acceptance check, and channel compliance acceptance check.

[0006] In some embodiments, filtering the response data includes: Obtain network situation and resource decision information, and determine the filtering strength based on the information; Based on the filtering intensity, a filtering method is determined, and the determined filtering method is used to filter the response data.

[0007] In some embodiments, the response data includes: a result code and content data; the step of determining a filtering method based on the filtering strength, filtering the response data using the determined filtering method, and sending the filtered response data to the terminal includes: If the filtering intensity is greater than the intensity threshold, the filtering method is determined to be the first filtering method, the content data is filtered out using the first filtering method, and the result code is sent to the terminal. If the filtering intensity is less than or equal to the intensity threshold, the filtering method is determined to be the second filtering method. The second filtering method is used to perform mapping transformation processing on the content data, and the result code and the processed content data are sent to the terminal. The mapping transformation processing includes at least one of the following: encrypted mapping transformation processing and desensitized mapping transformation processing.

[0008] In some embodiments, the method further includes: Determine the risk factor of the access behavior instruction; Based on the aforementioned risk coefficient, an appropriate range for processing subsequent access behavior instructions is determined; Based on the aforementioned appropriate range, subsequent access behavior instructions are processed.

[0009] In some embodiments, the method further includes: When the terminal is detected to have switched from an untrusted network environment to a trusted network environment, the historical access parameters of the terminal to the target service system are obtained. The historical access parameters are hidden in the communication air interface hop and sent to the target service system so that the target service system can confirm whether the terminal is a trusted device. If the target business system confirms that the terminal is a trusted device, it will disable the one-way isolation mode for the terminal.

[0010] Secondly, embodiments of this application provide an access control device, the device comprising: The request module is used to proxy the terminal to send a long connection request to the target business system when it detects that the terminal has switched from a trusted network environment to an untrusted network environment. The authentication module is used to obtain the processing data of the target business system for the long connection request, and to perform trust authentication based on the processing data and the switching context data to obtain a trust authentication result. The mode control module is used to generate a restricted access credential for the terminal and enable a one-way isolation mode for the terminal if the trustworthiness recognition result is recognition. The access control module is configured to, when the one-way isolation mode is enabled for the terminal, if it receives an access instruction from the terminal to the target business system, authenticate the access instruction based on the restricted access credentials, and send the access instruction to the target business system after successful authentication; if it receives response data from the target business system to the access instruction, it filters the response data and sends the filtered response data to the terminal.

[0011] Thirdly, embodiments of this application provide an access control device, the device comprising: A memory on which computer programs are stored; A processor for processing the computer program to implement the access control method described above.

[0012] Fourthly, embodiments of this application provide a readable storage medium having a computer program stored thereon, the computer program being executable by a processor to implement the above-described access control method.

[0013] Fifthly, embodiments of this application provide a computer program product, including a computer program that can be executed by a processor to implement the above-described access control method.

[0014] The access control method, apparatus, device, medium, and product provided in this application, when sensing a terminal switching from a trusted network environment to an untrusted network environment, proxy the terminal to send a long-connection request to the target business system. Then, it obtains the processing data of the target business system regarding the long-connection request. Based on the processing data and the switching context data, it performs a trustworthiness verification to obtain a trustworthiness verification result. If the trustworthiness verification result is positive, it generates a restricted access credential for the terminal and enables a one-way isolation mode for the terminal. Subsequently, while the one-way isolation mode is enabled for the terminal, if an access behavior instruction from the terminal to the target business system is received, the access behavior instruction is authenticated based on the restricted access credential. After successful authentication, the access behavior instruction is sent to the target business system. If a response data from the target business system to the access behavior instruction is received, the response data is filtered, and the filtered response data is sent to the terminal. This approach can improve the continuity of user operations on the target business system and enhance the continuity of user services while ensuring security when the terminal switches from a trusted network environment to an untrusted network environment. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a flowchart illustrating an access control method according to an embodiment of this application; Figure 2 This is a schematic diagram of gap concealment according to an embodiment of this application; Figure 3 This is a schematic diagram of the interaction flow of an access control method according to an embodiment of this application; Figure 4 This is a schematic diagram of an access control device according to an embodiment of the present application.

[0017] Figure 5 This is a schematic diagram of the structure of an access control device according to an embodiment of this application. Detailed Implementation

[0018] This application provides an access control method, apparatus, device, medium, and product.

[0019] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0020] This application provides an access control method for balancing security and business continuity when a terminal switches from a trusted network to an untrusted network. This method can be executed by an access control device between the terminal and the target business system. Please refer to... Figure 1 An access control method according to an embodiment of this application may include the following steps: S102, when the terminal senses that it has switched from a trusted network environment to an untrusted network environment, the proxy terminal sends a long connection request to the target business system.

[0021] The target business system can be a business system deployed in a trusted network environment. Before the terminal switches from a trusted network environment to an untrusted network environment, the terminal can be in a trusted network environment and can access and operate the target business system deployed in the trusted network environment. Within the limited time slot from the start of the terminal switching from a trusted network environment to an untrusted network environment to the end of the terminal switching from an untrusted network environment to a trusted network environment, the access control method of this embodiment can be executed to balance user business continuity and security. The trusted network is, for example, an internal private network, i.e., an intranet, and the untrusted network is, for example, a public network, i.e., an extranet. The target business system is, for example, an internal business system deployed in an internal private network environment. The terminal is, for example, a smartphone, a laptop, a tablet computer, etc.

[0022] In implementation, whether a terminal has switched from a trusted network environment to an untrusted network environment can be determined based on the terminal's Measurement Report (MR) and reporting signaling. When a terminal is preparing to switch from a trusted network environment to an untrusted network environment, it can send a reporting signaling to the access control device. When the terminal actually switches from a trusted network environment to an untrusted network environment, the base station in the untrusted network environment can send the terminal's MR measurement report to the access control device. The access control device can determine whether a handover event from a trusted network environment to an untrusted network environment has occurred based on the reporting signaling and the terminal's MR measurement report. If so, it will proxy the terminal to send a long-term connection request to the target service system.

[0023] S104: Obtain the processing data of the target business system for long connection requests, and perform trustworthiness verification based on the processing data and the switching context data to obtain the trustworthiness verification result.

[0024] Among them, the processing data of the target business system in handling long-connection requests are immutable data generated by the target business system during the processing of long-connection requests. The handover context data can be the context data of the terminal's handover event from a trusted network environment to an untrusted network environment.

[0025] In this embodiment, the credibility of the connection request is determined by the data on the processing of the long connection request and the context data of the switch in the target business system. By combining the evidence information from both the business system side and the network side, the legitimacy of the connection request can be accurately determined, thus preventing eavesdropping from being disguised and infiltrated along with the connection request.

[0026] S106, if the trustworthiness verification result is "approved", generate restricted access credentials for the terminal and enable one-way isolation mode for the terminal.

[0027] Specifically, restricted access credentials can be sent to the terminal, enabling the terminal to send an access command to the target business system to the proxy control device based on the restricted access credentials.

[0028] S108: When the terminal is in one-way isolation mode, if an access command to the target business system is received from the terminal, the access command is authenticated based on the restricted access credentials. After successful authentication, the access command is sent to the target business system. If the response data of the target business system to the access command is received, the response data is filtered and the filtered data is sent to the terminal.

[0029] The terminal's access command to the target business system can be an operation command from the terminal to the target business system. The target business system's response data to the access command can include: a result code returned by the target business system indicating the execution status of the access command, such as success or failure; and content data returned by the target business system when the access command is successful. Filtering the response data can involve completely intercepting the content data, de-identifying sensitive data within the content data, or encrypting and transforming the content data.

[0030] For example, an access command could be to download a specified file. If the download is successful, the response data could include a download success code and the specified file. Sensitive content within the specified file can be anonymized, and the download success message and the anonymized file can be sent to the terminal. Alternatively, only the download success message can be sent to the terminal without sending the file itself.

[0031] In this embodiment, when a terminal senses a switch from a trusted network environment to an untrusted network environment, the proxy terminal sends a long-connection request to the target business system. Then, it obtains the target business system's processing data for the long-connection request, performs trustworthiness verification based on the processing data, and obtains a trustworthiness verification result. If the trustworthiness verification result is positive, it generates a restricted access credential for the terminal and enables a one-way isolation mode for the terminal. Subsequently, while the terminal is in one-way isolation mode, if an access command to the target business system is received from the terminal, the access command is authenticated based on the restricted access credential. After successful authentication, the access command is sent to the target business system. If a response data from the target business system to the access command is received, the response data is filtered, and the filtered data is sent to the terminal. This approach improves the continuity of user operations on the target business system and enhances user service continuity while ensuring security when the terminal switches from a trusted network environment to an untrusted network environment.

[0032] In the above embodiments, in step S104, the credibility of the processing data and switching context data of the long connection request in the target business system is verified to prevent eavesdropping from infiltrating with the long connection request and improve security. The long connection request is used to request the establishment of a secure communication channel with the target business system. It can be a re-long connection access request made by the proxy terminal of the proxy control device to the target business system. This can also be referred to as a long connection request LQR or LQR request.

[0033] In one embodiment, to further enhance security, a long-lived connection request may include a DHR (Dynamic Heterogeneous Redundancy) encapsulated object. The processing data for the long-lived connection request may include behavioral data of the target business system consuming the DHR encapsulated object over multiple consecutive time slots. The trustworthiness verification check may be a verification check based on the principle of least confidence. In step S104 above, based on the behavioral data of the target business system consuming the DHR encapsulated object over multiple consecutive time slots and the switching context data, the following three verification checks can be performed. If at least two of the following three verification checks pass, the trustworthiness verification result is determined as a verification: Switching time approval check; DHR encapsulated object idling activity approval check; channel compliance approval check.

[0034] In this embodiment, three types of recognition checks are performed: switching time recognition check, empty jump activity recognition check of DHR encapsulated object, and channel compliance recognition check. When at least two of the three recognition checks pass, the credibility recognition result is determined as recognition. Cross-validation can be performed on recognition results from different dimensions such as time, empty jump activity, and channel to improve the reliability of the credibility recognition result.

[0035] The DHR encapsulation object is a protocol header or encapsulation layer specifically designed for security authentication and behavioral analysis, used to establish a unique, dynamic, and measurable security context for this connection. The DHR encapsulation object may include fields such as: magic number, option flags, handle block length, and dynamic handle identifier. The magic number is used to quickly locate the start position of the DHR packet in the data stream. Option flags are bitmasks used to declare the features supported or enabled in this connection, allowing the receiver to know the connection characteristics without an additional handshake. The handle block length declares the length of each "data block" in subsequent communication, allowing the receiver to "consume" data according to this length. The dynamic handle identifier is a unique random ID that identifies this session, used to prevent attackers from guessing valid handles for injection.

[0036] In implementation, based on the context data of the handover, a time-minimum constraint acceptance check can be performed on the changed address and the changed channel content. Based on the behavioral data of the target business system consuming DHR encapsulated objects, a minimum activity check for the number of empty hops of the DHR encapsulated object and a compliance check for the end-to-end instantaneous short message channel, i.e., the established long connection channel, can be performed.

[0037] For example, for the recognition check of time minimization constraints on changing addresses and changing channel content, it can be determined whether the following time constraint formula is met, then the check is determined to pass; if the following time constraint formula is not met, then the check is determined to fail.

[0038]

[0039] in, Delay due to address change. For channel switching delay, C(t) represents the time when the terminal last sent a message on the corresponding channel before the handover, and C(t-1) represents the time when the message was sent on the corresponding channel after the handover. This is the channel's own delay coefficient. Based on the delay. This represents the maximum allowed latency for the handover. This data can be obtained from the handover context data.

[0040] For the minimum active acceptance check of the empty hop count of the DHR encapsulated object, the newly added body content in the DHR encapsulated object can be queried to check whether the magic number, option flags, handle block length, dynamic handle identifier, and reserved bits are complete. If complete, the empty hop count consumption of the DHR during long transmission can be further analyzed. For the DHR, the DHR message body itself does not need to be verified. Instead, based on the mapping of the message body, that is, on the DHR replica, each time slot t and DHR replica DHi are observed to determine whether they meet the minimum active acceptance constraint of the empty hop count. If they are met, the check is determined to pass; if they are not met, the check is determined to fail.

[0041]

[0042] in, This is an indicator function DHR replica, whose value is 1 for a non-empty replica and 0 for an empty replica; =T H, The duration is the time required to consume T slots, and H is the communication width of the DHR body.

[0043] For compliance checks on end-to-end instantaneous short message channels, since the established long connection channels are completely closed, it is impossible to dismantle the channels for verification. To verify the compliance of the channels, the compliance of the instantaneous short message channels can be obtained by analyzing the content of the received DHR message bodies or FFG empty message bodies.

[0044] Specifically, the maximum side-by-side cumulative value of the channel messages can be calculated first using the following formula. :

[0045] in, This represents the accumulation of individual blocks from the leftmost to the rightmost in the channel messages at instantaneous time slot t, and the calculation of the accumulated value. The hash accumulation value; k is the column number of the accumulated single block, starting from 1.

[0046] Then, we can evaluate whether the following condition formula is satisfied when t=T:

[0047] in, The initial conserved value, Fixed consumption value.

[0048] If the above conditions are true or satisfied, the check is considered passed; otherwise, the check is considered failed.

[0049] In the above embodiment, in step S108, when the one-way isolation mode is enabled, if the response data of the target business system to the access behavior instruction is received, the response data is filtered and the filtered data is sent to the terminal to balance security and business continuity.

[0050] In one embodiment, in order to achieve a better balance between security and business continuity and to optimize security and business continuity as much as possible, in step S108, network situation and resource decision information is obtained, the filtering strength is determined based on the information, the data filtering method is determined based on the filtering strength, the response data is filtered using the determined data filtering method, and the filtered response data is sent to the terminal.

[0051] In this embodiment, by calculating the filtering intensity, a data filtering method is determined based on the filtering intensity, and the determined data filtering method is used to filter the response data. This enables adaptive filtering of the response data, effectively balancing security and data availability.

[0052] Network situation and resource decision information may include: network load, resource variable mobility, reverse stress resistance, and DOS attack pressure.

[0053] In implementation, the device location information in the network layer switching variables can be used to determine whether the terminal is within the approved area. If so, the filtering intensity Fdd can be calculated based on the above information using the following formula:

[0054] Where D represents the reverse DOS attack, i.e., the DOS attack pressure value; L represents the remaining network load; R represents the reverse stress resistance value, 0 for no stress resistance and 1 for full stress resistance; M represents the location switching movement variable, which is the log value of the movement location vector length; ε is the threshold for the maximum variable; ε is a minimal constant.

[0055] Then, the filtration method can be determined based on the filtration intensity Fdd.

[0056] The filtering method may include a first filtering method and a second filtering method. The first filtering method may be a high-intensity transformation method, such as filtering out all content data in the response data, leaving only the result code, and returning only the result code to the terminal. The second filtering method may be a low-intensity filtering method, such as performing data encryption or desensitization processing on the content data in the response data to obtain processed content data, and returning the behavioral result data and the processed content data to the terminal. If the filtering intensity Fdd is greater than the intensity threshold Bi, the first filtering method can be determined as the data filtering method. If the filtering intensity Fdd is less than or equal to the intensity threshold Bi, the second filtering method can be determined as the data filtering method. Step S108 above may include: If the filtering intensity is greater than the intensity threshold, the filtering method is determined to be the first filtering method. The first filtering method is used to filter out the content data, and the result code is sent to the terminal. If the filtering intensity is less than or equal to the intensity threshold, the filtering method is determined to be the second filtering method. The second filtering method is used to perform mapping and transformation processing on the content data, and the result code and the transformed content data are sent to the terminal.

[0057] In one embodiment, to further balance security and business continuity, after step S108 above, a risk coefficient of the access behavior instruction can be determined; based on the risk coefficient, an appropriate range for processing subsequent access behavior instructions can be determined; and based on the appropriate range, subsequent access behavior instructions can be processed.

[0058] The risk factor can include the potential penetration granularity of the behavior in the access behavior instruction.

[0059] In implementation, the potential penetration granularity of behaviors in access behavior instructions can be quantified using the following formula. :

[0060] Wherein, C is the normalized value of the complexity of the access behavior command, which can be determined based on a pre-built table mapping the access behavior commands and their complexities to the target business system. H is the historical penetration threat index, which can be obtained based on the average complexity of historical behavior commands. The historical penetration threat index can be obtained by dividing the average complexity by the baseline threat value. R is the resource availability rate of the target business system, which can be the real-time availability ratio of resources such as CPU / bandwidth. S refers to the security policy tightening coefficient, which can be set by expert experience. α and β are the behavioral feature weights, which are default values, for example, α=0.6, β=0.4. γ and δ are constraint factors, with default values ​​of γ=0.7, δ=0.3.

[0061] Then, it can be based on the potential permeability granularity The appropriate space (L, U) for subsequent access behavior instructions is calculated using the following formula: ) ) in, ρ is the threat level correction coefficient, and ZA is the basic elasticity value; The minimum behavioral entropy safety threshold, This is the maximum behavioral entropy safety threshold.

[0062] Subsequently, based on the aforementioned appropriate space, subsequent access behavior commands can be processed. This processing can be one of the following: sending the subsequent access behavior command to the target business system for a response, or discarding the subsequent access control command. For example, if a subsequent access behavior command is received, the behavior entropy of the command can be calculated. If the behavior entropy of the command is within the aforementioned calculated appropriate range, the command can be sent to the target business system to enable the target business system to respond to the command; if the behavior entropy of the command is not within the aforementioned calculated appropriate space, the command can be ignored and discarded.

[0063] In the above embodiments, when the terminal switches from a trusted network environment to an untrusted network environment, the proxy terminal sends a long connection request to the target business system. After the trust is verified, a one-way isolation mode is enabled for the terminal to balance security and business continuity.

[0064] In one embodiment, the network environment of the terminal can be continuously monitored. When the terminal switches from an untrusted network environment to a trusted network environment, the historical access parameters of the terminal to the target business system can be obtained. These historical access parameters are hidden in the communication air interface hops and sent to the target business system so that the target business system can confirm whether the terminal is a trusted device. If the target business system confirms that the terminal is a trusted device, the one-way isolation mode is disabled for the terminal. When the one-way isolation mode is disabled for the terminal, the proxy control device can perform data pass-through between the terminal and the target business system. The terminal's access behavior instructions to the target business system can be pass-through to the target business system, and the response data of the target business system to the access behavior instructions can be pass-through to the terminal. The proxy control device no longer filters the response data. The terminal can operate the target business system normally.

[0065] In this embodiment, by continuously sensing the network environment of the terminal, when the terminal switches from an untrusted network environment to a trusted network environment, the terminal's historical access parameters to the target business system are hidden in the communication air interface hop and sent to the target business system. This allows the target business system to confirm whether the terminal is a trusted device. When the target business system confirms that the terminal is a trusted device, the one-way isolation mode is turned off for the terminal. This enables seamless trust migration for users when the network environment changes dynamically. When the trusted environment is restored, the two-way communication capability between the terminal and the target business system can be quickly rebuilt, balancing the continuity of security protection and the convenience of business access.

[0066] Among them, the historical access parameters of the terminal to the target business system can be the access parameters when the terminal last accessed the target business system, which can include parameters such as PLMN, TAC, DNN, STT, and SD.

[0067] In implementation, the proxy control device can continuously monitor changes in the terminal's network environment. Once a change is detected, it can determine whether the source of the change information originates from a trusted network based on the MAC address and the block arrangement array under a specific time slot in the terminal's change information. The block arrangement array under a specific time slot refers to the underlying block transmission rules specifically constrained within the private network.

[0068] If so, the proxy control device can hide core data within communication air interface hops and send it to the target business system. Hoop hiding methods include, for example... Figure 2 As shown. Among them, Figure 2 In this diagram, data transmission is represented as block transmission. The green area represents the actual transmission blocks used to transmit basic data. The red area represents historical access parameter data. Theoretically, historical access parameters can be transmitted along with basic data, forming a stacked transmission pattern, creating a virtual stack in the data space. The yellow area is a schematic diagram of the stacked ordinary data and core data. The form of the transmission array is modulated for each network standard. The basic logic is that the form of each communication is not fixed and is temporarily determined through the initial handshake protocol.

[0069] The access control method described in the above embodiments of this application achieves security without relying on external intelligence. Through interactive process design, it embeds security capabilities into the system architecture and workflow, constructing an intrinsic security architecture. This architecture consists of three main components: a terminal, an access control device, and a target business system. The access control device can dynamically perceive the terminal's network environment and automatically switch between two access modes: 'direct access' and 'proxy isolation,' achieving a seamless security experience for the user.

[0070] In application, the trusted network can be a private network (VPC), while the untrusted network can be a public network (PPP). The target business system can be an internal business system deployed within the VPC, possessing an intrinsic interface. The above architecture can be divided into three logical sides: the VPC side, the boundary control side, and the public network side. The boundary control side can bear all the functions of the aforementioned access control device and may include the following components: NAC unidirectional isolation node, ACK authentication request node, MFA-ISP node, class intrinsic interface, and cross-network interface switching node. The access control method of this application embodiment will be further described below in conjunction with the interaction flow of the above components.

[0071] Please refer to Figure 3 An access control method according to an embodiment of this application may include the following interaction flow: Step 1: When the terminal is currently connected to the MR1 area network and is preparing to switch networks, it activates its own mechanism and sends a reporting signaling message Session-TER to the cross-network interface switching interface. At the same time, the terminal conducts long-term regional communication with the intrinsic interface in the MR1 area based on the class-intrinsic interface.

[0072] The MR1 area is a private network coverage area, belonging to the private network side, and the internal system is located in the MR1 area.

[0073] The signaling format for the Session-TER reporting signaling is as follows: [Host IP || CBOR-encoded semantic communication || Multiplexing + 0-RTT fast reconnection || MR1-IP] Among them, the host IP is the current terminal IP address; CBOR-encoded semantic communication is for efficient compression and self-descriptive introduction of structured data; the multiplexing +0-RTT fast reconnection information is to enable the transmission process of protocols such as TCP+TLS+HTTP in the reporting signaling to be retransmitted in the time slots. This message contains the number of instantaneous handovers and the effective duration of the handover action connection, which is counted by the terminal itself; MR1-IP is to let cross-network interface handover nodes know the handover behavior that the terminal is performing.

[0074] Step 2: When the terminal switches from MR1 area to MR2 area, the terminal's full MR measurement report is transparently transmitted from the base station to the class-inherent interface. At the same time, the cross-network interface handover node will parse the handover behavior parameters in the MR measurement report to determine whether the terminal has performed MR coverage handover behavior, and send the terminal handover behavior to the class-inherent interface.

[0075] The MR2 area is a public network coverage area and belongs to the public network side.

[0076] The Session-TER reporting signal can be sent as part of the MR measurement report. The MR measurement report can also include handover behavior parameters, which can be present in the multiplexed +0-RTT fast reconnection message body. These parameters include the number of instantaneous handovers and the effective duration of the handover action connection. When the product of the number of handovers and the effective duration of the handover action connection is greater than the threshold H, it proves that a valid MR handover has occurred. The threshold can be set at any time during subsequent use.

[0077] Step 3: When the class-endogenous interface receives the MR measurement report and the switching behavior conditions of the cross-network interface switching node, it sends a long connection request for access behavior to the endogenous interface to apply for LQR.

[0078] The long-lived connection request (LQR) can include an API access object and a DHR wrapper object.

[0079] During the post-switchover access process, eavesdropping may occur. To prevent eavesdropping from being disguised and infiltrated through long-connection access requests to intercept critical information within the system, the following series of actions are taken to mitigate this risk.

[0080] Step 4: The endogenous interface continuously consumes the DHR encapsulation content in the long connection request, and when time T has been consumed, and the DHR is not empty but below the threshold value, it further initiates an acknowledgment procedure to the MFA-ISP node.

[0081] Step 5: The MFA-ISP node verifies and agrees on the class-native interface, the DHR encapsulated object in the native interface, and the number of communication channel hops required to consume T slots, based on the minimum recognition principle embedded in the node.

[0082] The minimum recognition principle includes: (1) recognition of time-minimum constraints for changing addresses and altered channel content; (2) minimum active recognition of the number of empty hops for DHR transport encapsulation objects; and (3) end-to-end instantaneous short message channel compliance recognition. When two of the above three recognition processes are compliant, the recognition result is positive; otherwise, it is negative. The recognition conclusion and intermediate recognition data are then encapsulated together to obtain the ternary recognition process value TTX. The format of TTX is illustrated below: TTX={R(1.0)}{[Header][Trigger][DHR_Object][Slot_T]} The [Header] section contains the source node ID of the acknowledging worker node, the acknowledgment encapsulation timestamp, and the encapsulation signaling type (Auth_Check). The [Trigger] section contains the acknowledgment process for time minimization constraints on changed addresses and altered channel content, minimum active acknowledgment for the number of empty hops of the DHR transport encapsulation object, and end-to-end instantaneous short message channel compliance acknowledgment. The [DHR_Object] section contains the sub-results and final merged result for acknowledgment of time minimization constraints on changed addresses and altered channel content, minimum active acknowledgment for the number of empty hops of the DHR transport encapsulation object, and end-to-end instantaneous short message channel compliance acknowledgment. [Slot_T] describes the time slot occupied by this TTX. R(1.0) represents the final acknowledgment result, positive or negative.

[0083] Step 6: During the recognition process, MFA-ISP continuously receives the changed address and changed channel content sent by the cross-interface switching node and performs time minimization constraints, and performs minimum recognition based on this information.

[0084] Step 7: The MFA-ISP node sends the three-element recognition process value TTX and the recognition result R(1.0) to the ACK request authentication node for data verification. At the same time, the cross-network interface switching interface sends the network layer switching variable to the ACK request authentication interface. Combined with the recognition result data of MFA-ISP, the pre-access operation behavior of the class-native interface is subjected to one-way data infiltration isolation processing. The ACK authentication request interface returns the direct communication address to the class-native interface.

[0085] The ACK request authentication node performs data verification, including whether the encapsulation format is the same as the initial one and whether the carried object is the same.

[0086] The direct communication address is the ACK request authentication interface after encapsulation and replacement. The communication address message is encapsulated by the class-inherent interface through the previous round connection verification information in the private network connection process. Even if it is eavesdropped on, the eavesdropper cannot know the previous round connection verification information of the class-inherent interface in the private network connection process. Therefore, even if the eavesdropper knows the information, he cannot use it.

[0087] The one-way data leakage prevention and isolation process is executed by the NAC one-way isolation interface. At this time, based on the request information, the ACK request authentication interface will simultaneously perform a pre-start action in the background to switch the one-way irreversible isolation work for the NAC isolation node on one side.

[0088] Layer handover variables refer to parameters or conditions that control or influence the handover process between different network layers (such as the network layer and transport layer) or network nodes during the network handshake communication process. These include handover levels between base stations, access points, or network slices; network load and resource variables; mobility variable values; or location change values ​​and DOS related to location variables. In the current scenario, the above three elements are used, and adjustments can be made as needed for different scenarios.

[0089] Step 8: After receiving the direct communication address, the class-native interface sends the access behavior instruction Qs to the ACK request authentication interface according to the operation logic in the previous private network access process.

[0090] At this point, the device has not yet truly accessed the system via the public or general network. The ACK instruction is anonymously forwarded to the internal interface. For the internal network system, its access logic only allows dedicated network devices to truly access the system, and does not allow general network users to truly access the system. For general network user devices, only one-way access operations can be isolated.

[0091] The access command Qs refers to the operation that a terminal wants to perform on the internal system in a general network environment. Specifically, this operation could be a user requesting to download the "Strategic Deployment Meeting Minutes" promotional material, or viewing the detailed coordinates of 5G base station construction. This data is core and confidential, requiring a private network connection for access. When the user is in a general network environment, the system will not ignore or ignore the user's Qs command; instead, it will perform an isolated one-way access operation, returning only the result without showing the process.

[0092] Step 9: The endogenous interface returns all the data in the instruction to the NAC one-way isolation interface for one-way data leakage prevention before exiting the zone.

[0093] Since the NAC one-way isolation interface has been preprocessed in the previous steps, when the NAC one-way isolation interface receives the full information fed back by the endogenous interface, the NAC one-way isolation interface feeds back the behavior result information to the class endogenous interface. This result only contains the yes or no result and does not include the processing process.

[0094] Step 10: The NAC one-way isolation interface calculates the potential penetration granularity GC of the behavior in the class-native interface access behavior instruction forwarded by the ACK request authentication interface, feeds back the appropriate range (L,U) of the class-native interface access behavior instruction forwarded by the ACK request authentication interface to the native interface, and sends the appropriate range value to the ACK request authentication interface.

[0095] Step 11: The ACK request authentication interface responds to or ignores / discards the access behavior instruction sent by the class-native interface after N slot times based on the appropriate range value (L,U) of the instruction.

[0096] Specifically, the behavior entropy in the access behavior command is filtered based on the appropriate range value (L,U). If it is within the range, it is responded to; otherwise, it is ignored or discarded.

[0097] Step 12: The ACK request authentication interface continuously monitors the broadcast change information of the cross-network interface switching interface. Once the change information is detected and the change content in the change information comes from the private network, the ACK request authentication interface stops the current process from step one to step eleven, and resends the feedback message of the core parameter data of the most recent access to the private network to the class-inherent interface. It also allows the class-inherent interface to directly hide the core data in the gap based on the most recent actual communication air interface gap and send it to the inherent interface.

[0098] Step 13: The native interface parses the content hidden in the hops based on the password from the most recent transmission process on the private network, and confirms whether it is a request from a trusted device on the private network.

[0099] For intrinsic interfaces, since they have previously connected to the internal system, upon reconnecting, they will be matched against their historical transmission strategies. At this point, the transmission password from the previous connection can be obtained, and based on this password, the hiding method used can be determined. The decryption method can then be derived by reverse engineering the hiding method. Once the content hidden in the hop is parsed, it can be confirmed that the request originated from a trusted device. Furthermore, the MAC address of the private network, along with core parameters such as PLMN, TAC, DNN, STT, and SD, can be compared with compliant data in the historical database. A match further confirms that the request originated from a trusted device on the private network.

[0100] Step 14: If the result of step 13 is yes, then the intrinsic interface informs the NAC one-way isolation interface to stop the isolation operation and allow normal access.

[0101] When the terminal is a trusted device, the NAC one-way isolation interface no longer provides isolation but instead allows the user's access. At this point, the user has switched from the general network to another private network, and can access the internal system normally to read data and issue tasks.

[0102] The above describes the access control method according to embodiments of this application. Based on the same concept, embodiments of this application also provide an access control device. Please refer to... Figure 4 An access control device 400 according to an embodiment of this application includes: Request module 410 is used to send a long connection request to the target business system on behalf of the terminal when it senses that the terminal has switched from a trusted network environment to an untrusted network environment. The authentication module 420 is used to obtain the processing data of the target business system for the long connection request, and to perform credibility authentication based on the processing data and the switching context data to obtain a credibility authentication result. The mode control module 430 is used to generate a restricted access credential for the terminal and enable a one-way isolation mode for the terminal if the trustworthiness recognition result is recognition. The access control module 440 is configured to, when the one-way isolation mode is enabled for the terminal, if it receives an access instruction from the terminal to the target business system, authenticate the access instruction based on the restricted access credential, and send the access instruction to the target business system after successful authentication; if it receives response data from the target business system to the access instruction, filter the response data, and send the filtered response data to the terminal.

[0103] In some embodiments, the long-lived connection request includes: a dynamic heterogeneous redundant DHR encapsulation object, the processing data includes: behavioral data consuming the DHR encapsulation object, and the recognition module 420 is specifically used for: Based on the behavioral data and the context data, the following three types of recognition checks are performed. If at least two of the following three recognition checks pass, the credibility recognition result is determined as recognition: Switching time acceptance check, DHR encapsulated object idling activity acceptance check, and channel compliance acceptance check.

[0104] In some embodiments, the access control module 440 is specifically used for: Obtain network situation and resource decision information, determine the filtering strength based on the information; determine the filtering method based on the filtering strength, and use the determined filtering method to filter the response data.

[0105] In some embodiments, the access control module 440 is specifically used for: If the filtering intensity is greater than the intensity threshold, the filtering method is determined to be the first filtering method, the content data is filtered out using the first filtering method, and the result code is sent to the terminal. If the filtering intensity is less than or equal to the intensity threshold, the filtering method is determined to be the second filtering method. The second filtering method is used to perform mapping transformation processing on the content data, and the result code and the processed content data are sent to the terminal. The mapping transformation processing includes at least one of the following: encrypted mapping transformation processing and desensitized mapping transformation processing.

[0106] In some embodiments, the access control module 440 is further configured to: Determine the risk factor of the access behavior instruction; Based on the aforementioned risk coefficient, an appropriate range for processing subsequent access behavior instructions is determined; Based on the aforementioned appropriate range, subsequent access behavior instructions are processed.

[0107] In some embodiments, the mode control module 420 is further configured to: When the terminal is detected to have switched from an untrusted network environment to a trusted network environment, the historical access parameters of the terminal to the target service system are obtained. The historical access parameters are hidden in the communication air interface hop and sent to the target service system so that the target service system can confirm whether the terminal is a trusted device. If the target business system confirms that the terminal is a trusted device, it will disable the one-way isolation mode for the terminal.

[0108] The access control device in this application embodiment can serve as the execution subject of the access control method in this application embodiment, and implement all the functions of the access control method in this application embodiment. Since the principle is the same, it will not be described again here.

[0109] The above describes the access control device provided in the embodiments of this application. Based on the same idea, the embodiments of this application also provide an access control device, such as... Figure 5 As shown.

[0110] The access control device can be an electronic device that performs the access control method provided in the above embodiments.

[0111] Access control devices can vary considerably due to differences in configuration or performance, and may include one or more memory 510s and processors 520s. The memory 510 stores a computer program, and the processor 520 processes the computer program to implement the access control method of the embodiments of this application.

[0112] Furthermore, one or more embodiments of this application also provide a storage medium for storing computer-executable instruction information. In one specific embodiment, the storage medium may be a USB flash drive, optical disc, hard disk, etc. When the computer-executable instruction information stored in the storage medium is executed by a processor, it can implement the access control method of the embodiments of this application.

[0113] Furthermore, one or more embodiments of this application also provide a computer program product, including a computer program that can be executed by a processor to implement the access control method of the embodiments of this application.

[0114] The foregoing has described specific embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0115] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0116] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0117] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0118] For ease of description, the above apparatus is described by dividing it into various functional units. Of course, when implementing one or more embodiments of this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0119] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this application may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0120] Embodiments of this application are described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable parallel device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable parallel device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0121] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable fraud device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0122] These computer program instructions can also be loaded onto a computer or other programmable device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0123] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0124] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0125] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0126] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0127] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this application may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this application may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0128] One or more embodiments of this application can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. One or more embodiments of this application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In a distributed computing environment, program modules can reside in local and remote computer storage media, including storage devices.

[0129] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0130] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. An access control method, characterized in that, The method includes: When the terminal is detected to switch from a trusted network environment to an untrusted network environment, the proxy terminal sends a long connection request to the target business system. Obtain the processing data of the target business system for the long connection request, and perform trustworthiness verification based on the processing data and the switching context data to obtain a trustworthiness verification result; If the trustworthiness verification result is positive, a restricted access credential is generated for the terminal, and a one-way isolation mode is enabled for the terminal. When the one-way isolation mode is enabled for the terminal, if an access instruction for the target business system is received from the terminal, the access instruction is authenticated based on the restricted access credential. After successful authentication, the access instruction is sent to the target business system. If response data to the access instruction is received from the target business system, the response data is filtered and sent to the terminal.

2. The method according to claim 1, characterized in that, The long-lived connection request includes: a dynamically heterogeneous redundant DHR encapsulation object; the processing data includes: behavioral data consuming the DHR encapsulation object; and the trustworthiness assessment based on the processing data and the switching context data, to obtain a trustworthiness assessment result, includes: Based on the behavioral data and the context data, the following three types of recognition checks are performed. If at least two of the following three recognition checks pass, the credibility recognition result is determined as recognition: Switching time acceptance check, DHR encapsulated object idling activity acceptance check, and channel compliance acceptance check.

3. The method according to claim 1, characterized in that, The filtering of the response data includes: Obtain network situation and resource decision information, and determine the filtering strength based on the information; Based on the filtering intensity, a filtering method is determined, and the determined filtering method is used to filter the response data.

4. The method according to claim 3, characterized in that, The response data includes: a result code and content data; the step of determining a filtering method based on the filtering strength, filtering the response data using the determined filtering method, and sending the filtered response data to the terminal includes: If the filtering intensity is greater than the intensity threshold, the filtering method is determined to be the first filtering method, the content data is filtered out using the first filtering method, and the result code is sent to the terminal. If the filtering intensity is less than or equal to the intensity threshold, the filtering method is determined to be the second filtering method. The second filtering method is used to perform mapping transformation processing on the content data, and the result code and the processed content data are sent to the terminal. The mapping transformation processing includes at least one of the following: encrypted mapping transformation processing and de-identified mapping transformation processing.

5. The method according to claim 1, characterized in that, The method further includes: Determine the risk factor of the access behavior instruction; Based on the aforementioned risk coefficient, an appropriate range for processing subsequent access behavior instructions is determined; Based on the aforementioned appropriate range, subsequent access behavior instructions are processed.

6. The method according to claim 1, characterized in that, The method further includes: When the terminal is detected to switch from an untrusted network environment to a trusted network environment, the historical access parameters of the terminal to the target service system are obtained; The historical access parameters are hidden in the communication air interface hop and sent to the target service system so that the target service system can confirm whether the terminal is a trusted device. If the target business system confirms that the terminal is a trusted device, it will disable the one-way isolation mode for the terminal.

7. An access control device, characterized in that, The device includes: The request module is used to proxy the terminal to send a long connection request to the target business system when it detects that the terminal has switched from a trusted network environment to an untrusted network environment. The authentication module is used to obtain the processing data of the target business system for the long connection request, and to perform credibility authentication based on the processing data and the switching context data to obtain a credibility authentication result. The mode control module is used to generate a restricted access credential for the terminal and enable a one-way isolation mode for the terminal if the trustworthiness recognition result is recognition. The access control module is configured to, when the one-way isolation mode is enabled for the terminal, if it receives an access instruction from the terminal to the target business system, authenticate the access instruction based on the restricted access credentials, and send the access instruction to the target business system after successful authentication; if it receives response data from the target business system to the access instruction, it filters the response data and sends the filtered response data to the terminal.

8. An access control device, characterized in that, The device includes: A memory on which computer programs are stored; A processor for processing the computer program to implement the access control method according to any one of claims 1 to 6.

9. A readable storage medium, characterized in that, It stores a computer program that can be executed by a processor to implement the access control method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, Includes a computer program that can be executed by a processor to implement the access control method according to any one of claims 1 to 6.

Images