A trusted buffer data access control method and device based on bidirectional authentication

Abstract

The application provides a kind of trusted buffer data access control method and device based on two-way authentication, comprising the attribute two-way authentication process based on the attribute information of access subject and access environment information;After attribute two-way authentication process passes, the first authentication token containing identity role information is generated;Based on the identity of access subject and the first authentication token, identity two-way authentication process is executed;After identity two-way authentication process passes, the second authentication token containing dynamic access permission is generated;According to the pre-allocated buffer network resource strategy, the corresponding logical buffer access channel is mapped for the second authentication token;Through logical buffer access channel, the access operation to physical buffer data is executed.The application can realize the high-strength security and hidden association of user identity information, effectively solve the problem that identity privacy is easily leaked in traditional authentication.

Description

Technical Field

[0001] This application relates to the field of computer network security technology, and more specifically, to a trusted buffer data access control method and apparatus based on two-way authentication. Background Technology

[0002] In critical infrastructure sectors such as power and finance, it is often necessary to establish security buffer zones between trusted and untrusted network areas to isolate risks and manage the security of external access services. With the diversification of access terminal types and the increasing complexity of services, traditional access control technologies face severe challenges: on the one hand, mechanisms based on single-authentication are prone to exposing user privacy during the authentication process and struggle to cope with dynamically changing access demands; on the other hand, static, coarse-grained permission allocation cannot meet the requirements of flexible scheduling and fine-grained management of buffer resources. Furthermore, how to protect identity privacy while achieving highly dynamic access authorization during multi-factor authentication, and simultaneously working in conjunction with a pre-planned buffer network architecture, has become a key technical challenge in building a trusted and open access system.

[0003] Therefore, there is an urgent need for a trusted buffer data access control scheme that can balance identity confidentiality, dynamic authorization, and resource adaptation. Summary of the Invention

[0004] The present invention aims to overcome the shortcomings of the prior art and provide a trusted buffer data access control method and apparatus based on two-way authentication, so as to solve the technical problems of easy leakage of identity privacy, rigid access permissions and disconnection from underlying resource scheduling in the prior art when accessing buffer data.

[0005] In a first aspect, the present invention provides a trusted buffer data access control method based on two-way authentication, the method comprising:

[0006] Based on the attribute information of the accessing subject and the access environment information, perform a two-way attribute authentication process;

[0007] After the attribute two-way authentication process is completed, a first authentication token containing identity and role information is generated;

[0008] Based on the identity identifier of the accessing subject and the first authentication token, a two-way identity authentication process is performed;

[0009] After the two-way identity authentication process is completed, a second authentication token containing dynamic access permissions is generated;

[0010] According to the pre-allocated buffer network resource policy, map the logical buffer access channel corresponding to the second authentication token;

[0011] Access to physical buffer data is performed through the logical buffer access channel.

[0012] Preferably, the attribute two-way authentication process includes:

[0013] Verify whether the attribute information of the access subject meets the attribute requirements of the current access task;

[0014] Verify whether the access environment information meets the predefined security context requirements;

[0015] When both the attribute requirements and the security context requirements are met, the attribute two-way authentication process is deemed successful.

[0016] Preferably, the process of performing two-way identity authentication includes:

[0017] Verify the integrity and validity of the first authentication token;

[0018] Verify whether the identity identifier of the access subject has a legitimate binding relationship with the identity role information encapsulated in the first authentication token;

[0019] When the integrity and validity verification passes and the legitimate binding relationship is established, the two-way identity authentication process is deemed to have passed.

[0020] Preferably, generating the first authentication token containing identity and role information includes:

[0021] The role of the accessing entity is determined based on its identity identifier;

[0022] Based on the polynomial function corresponding to the assigned role, the output of the attribute two-way authentication process is encrypted to generate a token digest.

[0023] The token digest is encapsulated with the identifier corresponding to the assigned role to obtain the first authentication token.

[0024] Preferably, generating a second authentication token containing dynamic access permissions includes:

[0025] Based on the identity and role information in the first authentication token and the current security policy, dynamically calculate the access permission set;

[0026] The access permission set is bound to the timeliness parameter to generate the second authentication token.

[0027] Preferably, the logical buffer access channel corresponding to the second authentication token mapping includes:

[0028] Based on the pre-allocated buffer network resource policy, determine a logical buffer partition that matches the dynamic access permissions in the second authentication token;

[0029] A unique access channel is established between the second authentication token and the logical buffer partition, forming the logical buffer access channel.

[0030] Preferably, the operation of accessing physical buffer data includes:

[0031] Data access requests are forwarded to the corresponding physical buffers through the logical buffer access channel.

[0032] Based on the dynamic access permission and the timeliness parameter in the second authentication token, the data access request is validated for permission.

[0033] After the permission verification passes, data read or write operations are performed on the physical buffer.

[0034] Secondly, the present invention provides a trusted buffer data access control device based on two-way authentication, comprising:

[0035] The attribute two-way authentication process execution module is configured to perform the attribute two-way authentication process based on the attribute information of the access subject and the access environment information;

[0036] The first authentication token generation module is configured to generate a first authentication token containing identity and role information after the attribute two-way authentication process is passed.

[0037] The identity two-way authentication process execution module is configured to perform an identity two-way authentication process based on the identity identifier of the access subject and the first authentication token;

[0038] The second authentication token generation module is configured to generate a second authentication token containing dynamic access permissions after the identity two-way authentication process is completed.

[0039] The mapping module is configured to map the logical buffer access channel corresponding to the second authentication token according to a pre-allocated buffer network resource policy.

[0040] The execution module is configured to perform access operations on physical buffer data through the logical buffer access channel.

[0041] Thirdly, the present invention provides a readable medium including executable instructions, which, when executed by a processor of an electronic device, cause the electronic device to perform any of the methods described in the first aspect.

[0042] Fourthly, the present invention provides an electronic device including a processor and a memory storing execution instructions, wherein when the processor executes the execution instructions stored in the memory, the processor performs the method as described in any of the first aspects.

[0043] Beneficial effects:

[0044] This invention provides a trusted buffer data access control method and apparatus based on two-way authentication. Through a two-level authentication mechanism of "attribute two-way authentication" and "identity two-way authentication," identity information is concealed during the initial authentication (attribute authentication), protecting user privacy. During the secondary authentication (identity authentication), a first token generated based on a role-based polynomial function is used for highly dynamic and fine-grained permission calculation and binding, enabling flexible and real-time control of access permissions. The access control process is deeply integrated with the underlying buffer network architecture, precisely matching dynamically generated access permissions to logical buffer resources based on pre-allocated policies and establishing dedicated access channels. This allows access policies to directly drive the allocation and use of network resources, achieving trusted and controllable access across the entire chain from "identity / attribute" to "permission" to "specific resource." This method significantly increases the difficulty of unauthorized access through multi-factor (attribute, environment, identity, role) and multi-stage (two-level authentication, dynamic authorization, resource mapping) verification and adjudication. Simultaneously, dynamic permission calculation and timely binding can quickly respond to changes in security policies and fluctuations in business needs, making it suitable for complex and ever-changing access environments such as the power IoT.

[0045] The further effects of the aforementioned non-conventional preferred method will be explained below in conjunction with specific embodiments. Attached Figure Description

[0046] Figure 1 A schematic diagram of a trusted buffer data access control method based on two-way authentication provided in an embodiment of the present invention;

[0047] Figure 2 A schematic diagram of another trusted buffer data access control method based on two-way authentication provided in an embodiment of the present invention;

[0048] Figure 3 A schematic diagram illustrating the composition of a trusted buffer data access control device based on two-way authentication, provided in an embodiment of the present invention;

[0049] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0051] This invention provides a trusted buffer data access control method based on two-way authentication. See also... Figure 1 As shown, in this embodiment, the trusted buffer data access control method based on two-way authentication includes:

[0052] Step 101: Based on the attribute information of the access subject and the access environment information, perform the attribute two-way authentication process.

[0053] Specifically, in this embodiment, the access subject refers to the entity that initiates the data access request, such as a user terminal, application, or service process. Attribute information is a set of key-value pairs describing the static characteristics of the subject, which may include metadata such as the subject's department affiliation, job level, device certificate hash value, and security domain. Access environment information characterizes the dynamic context state when the access request occurs, including but not limited to the request initiation time, source network address (IP), access network type (such as 5G private network, Wi-Fi), request protocol, and requested service port number. The attribute two-way authentication process is a two-way verification and negotiation process, and its execution logic specifically includes:

[0054] Verify attribute compliance: Based on the predefined attribute requirements of the current access task (e.g., "Read log file" or "Configure edge device"), verify whether the attribute information provided by the access subject meets the minimum necessary set. For example, for the "Configure device" task, the subject attributes must include the "Operations Engineer" role tag and the device certificate must be on the trusted list.

[0055] Verify environment security: Based on predefined security context requirements, determine whether the current access environment is in a permitted state. This includes checking whether the request comes from an authorized network zone, whether the current time is within an allowed operation window, and whether the network connection meets the minimum security level (such as using Chinese national standard SSL encryption).

[0056] Two-way verification and determination: This process is not a one-way authentication. Simultaneously, the accessing entity can verify the legitimacy of the buffer service it is connecting to based on credentials obtained from the system (such as an environment challenge value or digital certificate issued by the system), preventing access to spoofed services. The system determines that the two-way attribute authentication process is successful only if the entity's attributes meet the task requirements, the current environment conforms to the security context, and the entity's verification by the system also passes.

[0057] The attribute requirements and security context requirements in this step are typically predefined based on the security level of the data asset and business rules. For example, for a task accessing "real-time power grid operation data," the attribute requirements might include that the subject must have a "dispatcher" or "system administrator" role, and that their terminal device certificate must be issued by a designated trusted certificate authority. Security context requirements might mandate that access must be made through an internal leased network using the national cryptographic SSL protocol, and that the initiation time must fall within the system's defined maintenance time window. The entire two-way authentication process is implemented through a challenge-response mechanism. The system sends a challenge message containing a random number and a timestamp to the subject, who must respond using their attribute key. While verifying the validity of the response, the system also presents its own service certificate to the subject for verification, thereby achieving trusted two-way identity and environment confirmation.

[0058] Step 102: After the attribute two-way authentication process is completed, a first authentication token containing identity and role information is generated;

[0059] Furthermore, the core of this step is to covertly associate the anonymous subject, authenticated by attributes, with its backend identity and role, generating an unforgeable intermediary credential. The specific implementation is as follows:

[0060] Role Determination: Based on the verified identity identifier (such as a digital ID card) provided by the access subject after step 101, the identity management system is queried to determine the subject's assigned role. Roles are the core unit of access control policies, such as "Auditor," "Operator," and "System Administrator."

[0061] Token digest generation based on role polynomial function: Let the role assigned by the main body be... A polynomial function can be generated for the character, either pre-defined or dynamically. The output of step 101, the attribute two-way authentication process (e.g., intermediate data containing attribute digests and environment signatures), will be used. ) as a variable The input is then processed. Subsequently, cryptographic operations are performed to generate a token digest. :

[0062] ,

[0063] in, Cryptographic hash functions (such as SM3). Polynomial functions. The introduction of token digests With specific roles Strongly bound, and due to the one-way nature of hash functions, from Unable to reverse the process This involves using identity information to achieve identity confidentiality. Encryption operations based on role-based polynomial functions are the core of achieving identity privacy protection and highly dynamic association. Specifically, roles are defined... Corresponding to a polynomial defined on a finite field , where the coefficient Based on the role by the system The authorization features and security policies are generated and securely stored. A trusted digest output from the attribute two-way authentication process is generated. As a variable Substitution The calculation was performed, and the result was obtained. The token digest is then generated through a cryptographic hash function (such as SM3). The advantages of this design are: firstly, polynomial operations ensure that the output matches the role. The strong binding of the hash means that even if different roles have the same input, their outputs will be completely different; secondly, the hash operation ensures one-wayness, effectively preventing the reverse derivation of role information and original authentication information.

[0064] Token encapsulation: Finally, the calculated token digest is... With character identifier Perform digital signing and encapsulation to form the first authentication token. This token proves that the subject has been authenticated through attributes and environment, implicitly associates with its identity role, and does not expose plaintext identity information.

[0065] Step 103: Perform a two-way authentication process based on the access subject's identity identifier and the first authentication token;

[0066] Furthermore, this step aims to provide final confirmation of the access subject's true identity and verify its legitimate binding relationship with the role in the first token, which is a concrete manifestation of two-way identity authentication. The specific authentication process includes:

[0067] Token verification: Verify the first authentication token The integrity (e.g., whether the digital signature is valid) and validity (e.g., whether it is within the validity period or has not been revoked).

[0068] Identity and role binding verification: The accessing entity must submit its strong identity identifier (e.g., an identifier obtained through biometric or hardware key authentication). The system verifies this. Is it related to generation? The identity identifier used at that time is consistent, thus confirming Whether it is legal to own The role of encapsulation This is a two-way process: the system verifies the authenticity of the subject's identity; simultaneously, the subject can utilize... Verify that it is working with the correct people who know their roles. It interacts with the system backend.

[0069] Process determination: When It is valid in itself, and the subject of the confirmation submission is confirmed. Indeed related to the character If a valid and current binding relationship exists, the two-way authentication process is considered successful. This step ensures that access permissions are granted to the correct, fully authenticated entity.

[0070] Step 104: After the identity two-way authentication process is completed, a second authentication token containing dynamic access permissions is generated.

[0071] Furthermore, after identity verification, this step dynamically generates fine-grained, time-sensitive specific operation permissions based on roles and real-time policies. The specific process includes:

[0072] Dynamic permission calculation: based on the first authentication token Identity and role information By combining current security policies (such as risk-based adaptive policies and time-sensitive policies), a set of access permissions is dynamically calculated. The calculation process can be formalized as follows:

[0073] ,

[0074] in, It is a permission calculation function. This is the latest security context. It is the decision output of the security policy engine.

[0075] Permissions and expiration time binding: This involves calculating the set of access permissions. With a timeliness parameter Encrypt and bind (e.g., expired timestamp) to generate a second authentication token. . It serves as the direct credential for ultimately performing data access operations, clearly identifying "who" (through whom) (Related) before "when" ( Which operations can be performed? ).

[0076] The dynamic calculation access permission set in this embodiment This can be performed by the second authentication token generation module in the device. This module uses the role information parsed from the first authentication token. The system takes the current detailed security context (which may include real-time threat level, system load, data access hotspots, etc.) as input, queries and executes relevant access control policy rules.

[0077] Policy rules typically exist in the form of "If (Condition) Then (Permission)," for example: "IF role is 'Auditor' AND time is 'within the financial settlement cycle' AND threat level is 'low' THEN grant 'read-only' permission to 'financial statement buffer'." The module uses real-time reasoning to merge, deduplicate, and resolve conflicts (e.g., following the "least privilege" or "deny first" principle) permissions defined in all policy rules that meet the conditions, ultimately generating a precise, conflict-free set of access permissions. Subsequently, With a timeliness parameter generated according to the security policy Bind, The duration can be dynamically adjusted according to the criticality and risk level of the task (e.g., only 5 minutes are authorized for highly sensitive operations), thereby generating a second authentication token, realizing the "on-demand, real-time, and time-limited" granting of permissions.

[0078] Step 105: Map the corresponding logical buffer access channel to the second authentication token according to the pre-allocated buffer network resource policy;

[0079] Furthermore, the buffer network resource allocation strategy in this embodiment is a predefined set of resource partitioning and mapping rules used to map data access requests with different security attributes to specific logical buffer partitions. Its fundamental purpose is to logically divide physically contiguous buffer resources (such as memory pools, storage arrays, network bandwidth, and CPU cores) into multiple mutually isolated logical buffer partitions with different attributes, and to define explicit access attributes for each partition, thereby avoiding resource contention, achieving fault isolation, and providing a physical carrier for fine-grained security control. This strategy typically exists in the form of configuration files, policy databases, or management interface rules, and includes the following key elements:

[0080] Partition definition: Specifies which logical buffer partitions to create (e.g., "real-time transaction buffer", "log audit buffer", "video stream temporary buffer", "management signaling area").

[0081] Resource quotas: Allocate specific physical resource limits for each logical partition, such as memory size (e.g., partition A is allocated 4GB RAM), storage capacity, network bandwidth threshold (e.g., partition B is limited to 1Gbps), and CPU time slice ratio.

[0082] Security attributes: Bind the security label or level to each partition (e.g., partition C is labeled "Internal Public", partition D is labeled "Secret").

[0083] Access topology: Defines the allowed network paths and protocols between partitions, and between partitions and external networks (trusted / untrusted zones). For example, it may stipulate that the "management signaling zone" can communicate with external management terminals, but the "real-time transaction cache zone" can only be accessed by internal core services.

[0084] Mapping rules: Pre-establish static association rules between access patterns or data tags and logical partitions. For example, a policy might stipulate: "All data access requests labeled 'financial' will be directed to the 'financial data cache' by default"; or "Traffic using 'protocol X' and destination port 'Y' should enter the 'video stream buffer'".

[0085] This step interfaces logical access permissions with physical buffer resources. Specifically, it includes:

[0086] Logical buffer partition matching: Analyze the second authentication token based on a predefined buffer network resource allocation strategy. Dynamic access permission set in The data objects or services involved. Subsequently, one or more matching logical buffer partitions (LBPs) are identified at the logical level. For example, permissions. If the value contains "read financial database cache", then it matches the logical partition "financial data cache area".

[0087] Unique access channel established: In A unique, controlled logical buffer access channel (LAC) is dynamically established between the matched logical buffer partition (LBP) and the LBP. This channel is not a physical line, but a virtual access path containing routing rules, traffic policies, and session identifiers, used to guide all subsequent data flows.

[0088] Step 106: Access the physical buffer data through the logical buffer access channel.

[0089] Furthermore, this step is the final data manipulation execution phase. The specific process includes:

[0090] Request forwarding and verification: When an access subject initiates a specific data operation request (such as an SQL query, file read / write), the request is forcibly routed to its corresponding logical buffer access channel (LAC). First, based on... Dynamic access permission set in and timeliness parameters The system performs real-time permission checks on the operation type and target data object of this request, and confirms that the request occurred within the validity period.

[0091] Physical access execution: After permission verification passes, the request is transparently forwarded to the corresponding physical buffer hardware resource (such as a specific memory pool or storage node) via the LAC. Finally, the actual data read or write operation is completed on the physical buffer. Throughout the process, the subject perceives access to logical resources, thus achieving a strict and secure mapping from logical permissions to physical resources.

[0092] As can be seen from the above technical solutions, the beneficial effects of this embodiment are as follows: Firstly, through a two-level bidirectional authentication process involving attributes and identity, the security of the access subject's attributes and environment is verified at the initial authentication stage. Secondly, by generating tokens using role-based polynomial functions, high-strength confidentiality and concealed association of user identity information are achieved, effectively solving the problem of easy leakage of identity privacy in traditional authentication. Thirdly, based on the authentication token and real-time security policies, precise and timely access permissions are dynamically generated, achieving fine-grained and highly dynamic access authorization, enabling the system to flexibly adapt to constantly changing business needs and security threats. Finally, by accurately mapping dynamically authorized access permissions to corresponding logical buffer resources and establishing dedicated access channels according to predefined resource allocation policies, closed-loop management and efficient utilization from access control policies to underlying network resources are achieved. This not only improves the determinism of buffer resource allocation and the level of security isolation but also ensures the reliability and stability of the overall system performance.

[0093] Figure 1 The embodiments shown are merely basic examples of the method of the present invention. Other preferred embodiments of the method can be obtained by making certain optimizations and extensions based on them.

[0094] like Figure 2 The image shows another specific embodiment of a trusted buffer data access control method based on two-way authentication according to the present invention. This embodiment further describes the method based on the foregoing embodiments, and includes the following steps:

[0095] Step 201: Forward the data access request to the corresponding physical buffer through the logical buffer access channel;

[0096] Specifically, this embodiment provides a further explanation of the operation to access data in the physical buffer. This step is the directed routing phase for the data access request. The logical buffer access channel refers to the channel established in step 105, based on the buffer network resource allocation strategy, for the second authentication token ( A virtual data transmission path with a unique session identifier is established between a data access request and a specific logical buffer partition. This channel is not a physical link, but a logical construct encapsulating routing information, traffic shaping policies, and security context. A data access request is a structured message initiated by an authorized entity, containing specific operation commands (such as SQL statements or API calls) and the target data identifier. A physical buffer refers to the physical storage area or computing resource that actually carries the data on server memory, solid-state drives, or dedicated storage devices. When an access request is generated, the request is forcibly bound to its physical buffer. The system uses the associated logical channel and, based on the pre-defined routing rules within that channel, forwards requests to pre-mapped physical buffer locations. This process ensures a strict correspondence between the request flow and the resource, preventing unauthorized path access.

[0097] Step 202: Perform permission verification on the data access request based on the dynamic access permission and timeliness parameters in the second authentication token;

[0098] Furthermore, this step is a real-time security decision made before the final operation is performed. Dynamic access permissions are encapsulated within... A structured set of permissions (denoted as) Timeliness parameter is A specific time window is bound to it, usually an expiration timestamp. Permission verification is a real-time policy decision function. The system parses the specific operation (Op_request) and target resource (Res_request) in the current data access request, and then compares them with... Middle permission set Each permission rule is matched and validated. Each rule is typically a triple, containing: the set of allowed operations (Op_allowed), the range of allowed resources (Res_allowed), and the constraints that must be met (Conditions).

[0099] The verification logic includes the following core judgments:

[0100] Operation and resource matching: The requested operation (Op_request) must be within the set of operations allowed by the rule (Op_allowed), and the target resource (Res_request) must be a subset or instance of the resource range allowed by the rule (Res_allowed).

[0101] Conditions must be met: The context information of the request must satisfy all constraints defined in the rules (e.g., value filtering conditions for data fields).

[0102] Timeliness verification: Check if the current system time is earlier than the expiration timestamp defined in the token. .

[0103] Step 203: After the permission verification passes, perform data read or write operations on the physical buffer.

[0104] Further, this step is the final fulfillment of the authorization, executing the specific data interaction. Execution refers to the system calling the interface of the underlying storage or computing engine. Data read operations involve retrieving data from a specified location in the physical buffer and returning it to the accessing subject through a secure channel. Data write operations involve storing or updating verified data to a specified location in the physical buffer. Before execution, the system typically performs a final integrity check, such as verifying the data format or based on... The system grants the authority to apply the final row-level or column-level data filtering (such as dynamically applying WHERE conditions to query results). After the operation is complete, the system will record a detailed audit log, which will include at least the following: the operation subject (via...). (Associated identity), time, usage The system identifies the actions performed, the resources accessed, and the result summary to ensure full traceability and auditability. This completes a trusted closed loop from authentication and authorization to resource access.

[0105] As can be seen from the above technical solutions, the beneficial effects of this embodiment are as follows: by forcibly routing data access requests to a pre-established dedicated logical channel, the determinism, isolation, and non-bypassability of the access path are ensured; by performing real-time permission verification based on dynamic access permissions and timeliness parameters, immediate and fine-grained authorization decisions are made for each specific operation, effectively preventing abuse of permissions and unauthorized access; finally, after strict verification, physical data operations are executed and a complete audit log is recorded, constructing a secure closed loop of "request-decision-execution-traceability," thereby ensuring the efficiency of data access in the buffer while achieving precise control and full auditability of the operation.

[0106] This invention also provides a trusted buffer data access control device based on two-way authentication. See also Figure 3 The image shows a specific embodiment of a trusted buffer data access control device based on two-way authentication provided by the present invention. This embodiment of the device is used to execute... Figures 1-2 The physical apparatus of the method. Its technical solution is essentially the same as the above embodiments, and the corresponding descriptions in the above embodiments also apply to this embodiment. The apparatus includes:

[0107] The attribute two-way authentication process execution module 301 is configured to execute the attribute two-way authentication process based on the attribute information of the access subject and the access environment information.

[0108] The first authentication token generation module 302 is configured to generate a first authentication token containing identity and role information after the attribute two-way authentication process is passed.

[0109] The identity two-way authentication process execution module 303 is configured to execute the identity two-way authentication process based on the identity identifier of the access subject and the first authentication token.

[0110] The second authentication token generation module 304 is configured to generate a second authentication token containing dynamic access permissions after the identity two-way authentication process is completed.

[0111] The mapping module 305 is configured to map the logical buffer access channel corresponding to the second authentication token according to the pre-allocated buffer network resource policy.

[0112] Execution module 306 is configured to perform access operations on physical buffer data through a logical buffer access channel.

[0113] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include main memory, such as high-speed random-access memory (RAM), or it may also include non-volatile memory, such as at least one disk storage device. Of course, the electronic device may also include other hardware required for other services.

[0114] The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. Buses can be categorized as address buses, data buses, and other types. For ease of representation, Figure 4 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0115] Memory is used to store instructions for execution. Specifically, instructions for execution are computer programs that can be executed. Memory can include main memory and non-volatile memory, and it provides the processor with execution instructions and data.

[0116] In one possible implementation, the processor reads the corresponding execution instructions from non-volatile memory into memory and then executes them. Alternatively, it may obtain the corresponding execution instructions from other devices to form a trusted buffer data access control device based on two-way authentication at the logical level. The processor executes the execution instructions stored in memory to implement the trusted buffer data access control method based on two-way authentication provided in any embodiment of the present invention.

[0117] The above is as described in the present invention. Figure 3 The method for executing a trusted buffer data access control device based on two-way authentication provided in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor.

[0118] The steps of the method disclosed in the embodiments of this invention can be directly manifested as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0119] This invention also proposes a readable medium storing execution instructions. When these instructions are executed by a processor of an electronic device, the device can perform a trusted buffer data access control method based on two-way authentication provided in any embodiment of this invention, specifically for executing, for example... Figure 1 , Figure 2 The method shown.

[0120] The electronic devices in the foregoing embodiments may be computers.

[0121] Those skilled in the art will understand that embodiments of the present invention can be provided as methods or computer program products. Therefore, the present invention can be implemented in a completely hardware embodiment, a completely software embodiment, or a combination of software and hardware.

[0122] The various embodiments in this invention are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0123] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0124] The above are merely embodiments of the present invention and are not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the present invention should be included within the scope of the claims of the present invention.

Claims

1. A trusted buffer data access control method based on two-way authentication, characterized in that, The method includes: Based on the attribute information of the accessing subject and the access environment information, perform a two-way attribute authentication process; After the attribute two-way authentication process is completed, a first authentication token containing identity and role information is generated; Based on the identity identifier of the accessing subject and the first authentication token, a two-way identity authentication process is performed; After the two-way identity authentication process is completed, a second authentication token containing dynamic access permissions is generated; According to the pre-allocated buffer network resource policy, map the logical buffer access channel corresponding to the second authentication token; Access to physical buffer data is performed through the logical buffer access channel.

2. The trusted buffer data access control method based on two-way authentication according to claim 1, characterized in that, The attribute two-way authentication process includes: Verify whether the attribute information of the access subject meets the attribute requirements of the current access task; Verify whether the access environment information meets the predefined security context requirements; Two-way confirmation and judgment: When both the attribute requirements and the security context requirements are met, the attribute two-way authentication process is deemed to be successful.

3. The trusted buffer data access control method based on two-way authentication according to claim 1, characterized in that, The process of performing two-way identity authentication includes: Verify the integrity and validity of the first authentication token; Verify whether the identity identifier of the access subject has a legitimate binding relationship with the identity role information encapsulated in the first authentication token; When the integrity and validity verification passes and the legitimate binding relationship is established, the two-way identity authentication process is deemed to have passed.

4. The trusted buffer data access control method based on two-way authentication according to claim 1, characterized in that, The generation of the first authentication token containing identity and role information includes: The role of the accessing entity is determined based on its identity identifier; Based on the polynomial function corresponding to the assigned role, the output of the attribute two-way authentication process is encrypted to generate a token digest. The token digest is encapsulated with the identifier corresponding to the assigned role to obtain the first authentication token.

5. The trusted buffer data access control method based on two-way authentication according to claim 1, characterized in that, Generating a second authentication token that includes dynamic access permissions includes: Based on the identity and role information in the first authentication token and the current security policy, dynamically calculate the access permission set; The access permission set is bound to the timeliness parameter to generate the second authentication token.

6. The trusted buffer data access control method based on two-way authentication according to claim 1, characterized in that, The logical buffer access channels corresponding to the second authentication token mapping include: Based on the pre-allocated buffer network resource policy, determine a logical buffer partition that matches the dynamic access permissions in the second authentication token; A unique access channel is established between the second authentication token and the logical buffer partition, forming the logical buffer access channel.

7. The trusted buffer data access control method based on two-way authentication according to claim 5, characterized in that, Performing access operations on physical buffer data includes: Data access requests are forwarded to the corresponding physical buffers through the logical buffer access channel. Based on the dynamic access permission and the timeliness parameter in the second authentication token, the data access request is validated for permission. After the permission verification passes, data read or write operations are performed on the physical buffer.

8. A trusted buffer data access control device based on two-way authentication, characterized in that, include: The attribute two-way authentication process execution module is configured to perform the attribute two-way authentication process based on the attribute information of the access subject and the access environment information; The first authentication token generation module is configured to generate a first authentication token containing identity and role information after the attribute two-way authentication process is passed. The identity two-way authentication process execution module is configured to perform an identity two-way authentication process based on the identity identifier of the access subject and the first authentication token; The second authentication token generation module is configured to generate a second authentication token containing dynamic access permissions after the identity two-way authentication process is completed. The mapping module is configured to map the logical buffer access channel corresponding to the second authentication token according to a pre-allocated buffer network resource policy. The execution module is configured to perform access operations on physical buffer data through the logical buffer access channel.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein the program, when executed, performs a trusted buffer data access control method based on two-way authentication as described in any one of claims 1 to 7.

10. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store the processor's executable instructions; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the trusted buffer data access control method based on two-way authentication as described in any one of claims 1 to 7.

Images