Access control method and device

Abstract

An access control method and device. The method comprises: in a secure environment, performing identity verification on a first application on the basis of identity authentication information in a target data usage policy; and upon successful identity verification, performing access control on a first access operation of target data of the first application on the basis of an access control policy in the target data usage policy, thereby effectively preventing data security problems caused by application impersonation, and effectively improving data usage security.

Description

Access control method and device

[0001] The present application claims priority to the Chinese patent application No. 202411261789.6, filed on September 9, 2024, and entitled "Access control method and device", the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0002] Embodiments of the present application relate to the technical field of data security, in particular to an access control method and device. BACKGROUND

[0003] With the development of the technical field of data security, users have higher and higher requirements for data security. In order to prevent data leakage, misuse and other risks that may be faced in the process of data transmission, how to enhance the control of data security has become a problem to be solved. SUMMARY

[0004] The present application provides an access control method and device, which can effectively improve the data security.

[0005] In a first aspect, the present application provides an access control method. The method comprises: in a secure environment, obtaining target data and a target data usage policy, the target data usage policy comprising identity authentication information and an access control policy, the identity authentication information being used to indicate that an application identified by the identity authentication information is allowed to access the target data, and the access control policy being used to indicate that an access behavior performed by the application on the target data is allowed; wherein the identity authentication information is generated based on a computer program of the application. Obtaining first identity authentication information of a first application and a first access operation of the first application on the target data; wherein the first identity authentication information is generated based on a computer program of the first application. In a case where identity verification of the first identity authentication information based on the identity authentication information is successful, performing access control on the first access operation based on the access control policy. In this way, in the secure environment, the integrity and security of the application and the data can be ensured. In addition, modules for performing the above steps are deployed in the secure environment, without the need for other servers or media (such as a blockchain) to access, so that the deployment difficulty of the system can be reduced. In addition, in the present application, the identity authentication information is generated based on a computer program, so that an application can be uniquely identified by the identity authentication information, and the identity of a legal application (i.e., the application whose identity verification is successful) can be effectively prevented from being assumed by other illegal applications, so that the security of the data is further improved. In addition, in the present application, the access behavior is controlled based on the data usage policy, so that in a case where the identity verification of the application is successful, the access operation performed by the legal application (i.e., the application whose identity verification is successful) on the target data is further controlled, so that the legal application is prevented from performing an illegal access behavior on the target data, and the access behavior of the legal application on the target data is controlled within the access behavior range specified by the access control policy, so that the security of the data is further improved.

[0006] For example, the secure environment can be a TEE in a Trust Zone, a confidential computing environment in a CAA, or a secure environment in another architecture, which is not limited in the present application.

[0007] For example, the computer program of the first application is stored in the memory of the device. The computer program of the first application can be understood as: when the processor runs the computer program of the application, the first application can be enabled, i.e., the first application is started and the functions provided by the first application are implemented.

[0008] For example, the target data usage policy can comprise one or more identity authentication information. Each identity authentication information is used to identify an application.

[0009] For example, in the secure environment, due to the firmware interface settings of the environment, the verification of the target data usage policy is enforced, so that the application is prevented from bypassing the verification process and stealing data, and the security of the data is improved.

[0010] In a possible implementation, the first identity authentication information comprises a baseline value generated based on all or part of computer programs of the first application. In this way, the baseline value generated based on all or part of computer programs of the application can be used as the identity authentication of the application to verify the identity of the application, so as to avoid other illegal applications from impersonating the identity of a legal application (that is, the identity verification is successful), and further improve the data security.

[0011] In a possible implementation, the baseline value is a hash value calculated based on all or part of computer programs of the first application. In this way, by generating the hash value, the security of the baseline value in the transmission and storage process can be ensured based on the irreversibility of the hash value, and the integrity of the baseline value in the transmission and storage process can be ensured based on the uniqueness of the hash value, and the device can compare the stored hash value with the obtained hash value to determine whether the received baseline value is complete.

[0012] In a possible implementation, the target data and the target data usage policy are carried in an encrypted data packet, and the target data and the target data usage policy are obtained by decrypting the data packet to obtain the plaintext data of the target data and the target data usage policy. In this way, the data owner in the present application can generate a corresponding data usage policy according to the identity authentication information, so that the data user can perform access control on the access to the target data based on the data usage policy. Moreover, the present application can effectively avoid the access of illegal applications (or imitated applications) to the data and the illegal access (i.e., not within the access behavior planned by the usage policy) of the legal applications (i.e., identity authentication is successful) to the data by performing identity authentication through the identity authentication information and performing access control through the access control policy, which can sufficiently guarantee the security of the data. Therefore, the data owner only needs to simply encrypt the data packet, without using a complex algorithm to encrypt the data packet and the target data in the data packet and generating a complex key process. Moreover, the data packet and the content (including the target data and the usage policy) in the prior art are bound together with the complex key, which cannot dynamically adjust the usage policy, or in other words, if the usage policy needs to be changed, the data packet including the target data and the usage policy needs to be regenerated and bound to the corresponding key. The present application uses a simple encryption method, and the target data is stored in plaintext in the data user side. Accordingly, the data owner can update the data usage policy according to the scene requirement (for example, a new data user is added) and send it to each data user, thereby providing a dynamic adjustment method of the data usage policy. Moreover, the data user only needs to decrypt the data packet after obtaining the data, without performing a complex decryption algorithm (for example, an attribute-based encryption (ABE) algorithm) process on the data. Moreover, the data is stored in plaintext in a secure environment, which can guarantee the security of the data based on the security characteristics of the secure environment. Moreover, after the identity authentication and the access verification are successful, the plaintext can be directly obtained, without decrypting the data every time, thereby improving the access efficiency.

[0013] In a possible implementation, in a case where the identity authentication of the first identity authentication information succeeds based on the identity authentication information, the access control of the first access operation is performed based on the access control policy, including: matching the first identity authentication information with the identity authentication information. If the first identity authentication information matches the identity authentication information successfully, the identity authentication of the first application succeeds, and the first application is allowed to access the target data. If the first identity authentication information fails to match the identity authentication information, the identity authentication of the first application fails, and the first application is denied to access the target data. In this way, the identity authentication of the application is performed based on the identity authentication information, so as to avoid illegal access of the fake application and affect the security of the data. In a case where the identity authentication succeeds, the application is allowed to access the data. If the identity authentication does not succeed, the application is denied to access the data.

[0014] For example, the first identity authentication information matching the identity authentication information successfully can alternatively be that the same identity authentication information as the first identity authentication information exists in the target data usage policy. Conversely, the first identity authentication information failing to match the identity authentication information can alternatively be that the same identity authentication information as the first identity authentication information does not exist in the target data usage policy.

[0015] In a possible implementation, the access control policy includes at least one of the following: an access operation type policy and an access operation frequency policy. The access operation type policy is used to indicate a type of access operation allowed to be performed by the application on the target data. The access operation frequency policy is used to indicate a maximum access frequency of the application on the target data. In this way, the data owner can set different access control policies to perform access control on the access behavior of the application on the data, so as to avoid illegal access of the application on the data after the identity authentication succeeds, and problems such as data leakage.

[0016] In a possible implementation, performing the access control of the first access operation based on the access control policy includes: performing access operation type verification and access operation frequency verification of the first access operation based on the access control policy; in a case where the access operation type verification and the access operation frequency verification both succeed, allowing the first application to perform the first access operation on the target data; in a case where the access operation type verification or the access operation frequency verification fails, denying the first application to perform the first access operation on the target data. In this way, the data owner can set different access control policies to perform access control on the access behavior of the application on the data, so as to avoid illegal access of the application on the data after the identity authentication succeeds, and problems such as data leakage.

[0017] For example, the access control policy can include an access operation type policy. If the access operation type of the first access operation is verified successfully based on the access operation type policy, the application is allowed to access the target data. Alternatively, the access control policy can include an access operation frequency verification. If the access operation frequency of the first access operation is verified successfully based on the access operation frequency policy, the application is allowed to access the target data.

[0018] In some examples, the access control policy can further include one or more other policies for planning access behaviors, which are not limited in the present application.

[0019] In a second aspect, the present application provides an access control apparatus, comprising: a first obtaining module, configured to obtain, in a secure environment, target data and a target data usage policy, the target data usage policy including identity authentication information and an access control policy, the identity authentication information being used to indicate that an application identified by the identity authentication information is allowed to access the target data, and the access control policy being used to indicate that an access behavior performed by the application on the target data is allowed; wherein the identity authentication information is generated based on a computer program of the application; a second obtaining module, configured to obtain first identity authentication information of a first application and a first access operation of the first application on the target data; wherein the first identity authentication information is generated based on a computer program of the first application; and an executing module, configured to perform access control on the first access operation based on the access control policy, if identity verification of the first identity authentication information based on the identity authentication information is successful.

[0020] In a possible implementation, the first identity authentication information includes a baseline value generated based on all or part of the computer program of the first application.

[0021] In a possible implementation, the baseline value is a hash value calculated based on all or part of the computer program of the first application.

[0022] In a possible implementation, the target data and the target data usage policy are carried in an encrypted data packet, and the first obtaining module is specifically configured to decrypt the data packet to obtain plaintext data of the target data and the target data usage policy.

[0023] In a possible implementation, the executing module includes an authentication unit, configured to match the first identity authentication information with the identity authentication information; if the first identity authentication information matches the identity authentication information successfully, identity verification of the first application is successful, and the first application is allowed to access the target data; if the first identity authentication information fails to match the identity authentication information, identity verification of the first application fails, and the first application is denied to access the target data.

[0024] Exemplarily, the authentication unit can also be referred to as an identity authentication unit, an identity verification unit, and the like, without limitation.

[0025] In a possible implementation, the access control policy comprises at least one of the following: an access operation type policy, and an access operation frequency policy; the access operation type policy is used to indicate a type of access operation allowed to be performed on the target data by the application; and the access operation frequency policy is used to indicate a maximum access frequency allowed to be performed on the target data by the application.

[0026] In a possible implementation, the execution module comprises a policy execution unit, configured to: perform access operation type verification and access operation frequency verification on the first access operation based on the access control policy; allow the first application to perform the first access operation on the target data in a case where the access operation type verification and the access operation frequency verification are both successful; and reject the first application to perform the first access operation on the target data in a case where the access operation type verification or the access operation frequency verification fails.

[0027] Exemplarily, the policy execution unit can also be referred to as an access control unit, an access behavior verification unit, and the like, without limitation.

[0028] In a third aspect, the present application provides an access control apparatus, comprising one or more processors; a memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and when the computer programs are executed by the one or more processors, the apparatus performs the method in the first aspect or any possible implementation manner of the first aspect.

[0029] In a fourth aspect, an embodiment of the present application provides a computer device, comprising: a transceiver / transceiver pin and a processor, and optionally further comprising a memory. The transceiver / transceiver pin, the processor and the memory communicate with each other through an internal connection path; the processor is configured to execute instructions to control the transceiver / transceiver pin to send or receive signals; and the memory is configured to store instructions. When the processor executes the instructions, the processor executes the method in the first aspect or any possible implementation manner of the first aspect.

[0030] In a fifth aspect, an embodiment of the present application provides a computer readable medium for storing a computer program, the computer program comprising instructions for executing the method in the first aspect or any possible implementation manner of the first aspect.

[0031] In a sixth aspect, an embodiment of the present application provides a computer program, the computer program comprising instructions for executing the method in the first aspect or any possible implementation manner of the first aspect.

[0032] In a seventh aspect, an embodiment of the present application provides a chip, comprising a processing circuit, a transceiving pin. The transceiving pin and the processing circuit communicate with each other through an internal connection path. The processing circuit executes the method in the first aspect or any possible implementation manner of the first aspect to control the receiving pin to receive a signal and control the sending pin to send a signal. BRIEF DESCRIPTION OF DRAWINGS

[0033] FIG. 1 is a schematic diagram of a communication system;

[0034] FIG. 2 is a schematic diagram of a CCA architecture provided in an embodiment of the present application;

[0035] FIG. 3 is a schematic diagram of an access control method provided in an embodiment of the present application;

[0036] FIG. 4 is a schematic diagram of an access control method provided in an embodiment of the present application;

[0037] FIG. 5 is a schematic diagram of an access control process;

[0038] FIG. 6 is a schematic diagram of a structure of an access control apparatus;

[0039] FIG. 7 is a schematic diagram of a structure of an access control apparatus. DETAILED DESCRIPTION

[0040] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present application.

[0041] FIG. 1 is a schematic diagram of a communication system, which will be described first in combination with FIG. 1. Please refer to FIG. 1. The communication system comprises but is not limited to a first electronic device and a second electronic device.

[0042] For example, the role of the first electronic device in the embodiments of the present application can be referred to as a data owner, a data provider, a data possessor, etc., which is not limited in the present application. The role of the second electronic device in the embodiments of the present application can be referred to as a data user. It can be understood that the first electronic device and the data owner can be replaced arbitrarily in the embodiments of the present application, and the second electronic device and the data user can be replaced arbitrarily. Alternatively, in some instances, the data owner and the data user can also refer to a user using the first electronic device or the second electronic device, which is not limited in the present application.

[0043] It should be noted that the number of electronic devices contained in FIG. 1 is only an illustrative example. The system can comprise more data owners and / or data users, which can be deployed according to actual needs, which is not limited in the present application.

[0044] Optionally, the communication system can further include, but is not limited to, a remote server, etc., which can be used for data interaction between the first electronic device and the second electronic device. For example, the second electronic device can send information (for example, the baseline value involved in the embodiments of the present application, etc.) to the remote server, and the remote server can save the information sent by the second electronic device. The first electronic device can obtain the information sent by the second electronic device from the remote server.

[0045] The electronic device (including the first electronic device and the second electronic device) in the embodiments of the present application can be a mobile phone, a tablet computer, a wearable device, a vehicle-mounted device, an augmented reality (AR) / virtual reality (VR) device, a notebook computer, an ultra-mobile personal computer (UMPC), a personal digital assistant (PDA), etc., and the present application is not limited thereto.

[0046] In the embodiments of the present application, a secure environment is arranged in the system architecture of the electronic device, for example, including but not limited to a trusted execution environment (TEE) or a confidential computer environment. The electronic device can process private information or secret information in the secure environment to protect the safety of the private information or secret information of the individual or the device.

[0047] Exemplarily, an electronic device based on an ARM Trust Zone includes, but is not limited to, a TEE and a rich execution environment (REE). The electronic device isolates high-security-sensitive applications from a general software environment, provides a special trusted execution environment TEE, and protects the confidentiality, integrity and access authority of resources and data of the applications; and provides a general rich execution environment REE for a traditional operating system that is vulnerable to attacks. An application executed on the REE side is referred to as a client application (CA), such as a bank application or a third-party payment application, and an application executed on the TEE side is referred to as a trusted application (TA), such as an application that performs signature, encryption and decryption calculation and other key services. Since the TA runs in the trusted execution environment TEE, the deployment / upgrade operation of the TA needs to strictly follow the security verification specifications of the TEE issuer (usually the terminal manufacturer), such as using digital signature and other measures, to ensure that each link of the TEE is truly trusted. The trusted execution environment TEE includes a trusted execution environment internal application programming interface (TEE Internal API) and a trusted operating system component. The main function of the TEE Internal API is to provide the functions of the trusted operating system component, communicate with the client application CA, implement TA-TA communication, provide secure storage, cryptography functions, time functions and the like.

[0048] In the embodiments of the present application, the system architecture of the electronic device can be a TEE based on an ARM Trust Zone architecture, can be a confidential computing environment based on an ARM Confidential Compute Architecture (CCA) architecture, or can be a secure environment based on other architectures, which is not limited in the present application.

[0049] FIG. 2 is a schematic diagram of a CCA architecture provided in the embodiments of the present application. As shown in FIG. 2, the CCA architecture includes a privilege level, which divides the CCA system into different exception levels (EL). Optionally, the EL includes, but is not limited to, EL0, EL1, EL2 and EL3. Among them, the larger the number of EL is, the higher the privilege corresponding to the EL is.

[0050] Exemplarily, the CCA architecture includes, but is not limited to, the following states: a Realm state, a Non-secure state (also referred to as a Normal state), and a Secure state.

[0051] As shown in FIG. 2, applications and operating systems can run in the Realm state. The data processing application of the first electronic device and the data obtained by the first electronic device from the second electronic device (also referred to as confidential data or private information, which is not limited in the present application) can run or be stored in the Realm state in the embodiments of the present application. Exemplarily, the method in the embodiments of the present application can be understood as being for data that needs to be controlled in security, and can also be understood as being for data that needs to be kept confidential. Other data that is not sensitive to security can be stored or operated in the Non-secure state, which is not limited in the present application.

[0052] For example, as shown in FIG. 2, the Realm state runs Realm VM (Virtual Machine) 0 and Realm VM 1. Taking the Realm VM 0 as an example, the Realm VM includes, but is not limited to, an OS Kernel (Operating System Kernel), a data processing application 1 (also referred to as a first data processing application or a data processing program, which is not limited in the present application), a data sharing agent (DS Agent), and the like.

[0053] In the embodiments of the present application, the DS Agent is used to authenticate the application (for example, the data processing application 1) in the node or device (for example, the Realm VM) to which the DS Agent belongs, and is also used to control the access of the application to the data (for example, the target data involved in the embodiments of the present application, which can also be referred to as confidential data in the security environment), which can also be understood as performing access control (also referred to as permission control). The specific implementation will be described in detail below.

[0054] In the embodiments of the present application, the DS Agent has a mandatory access control mechanism. Specifically, due to the interface in the TEE and the firmware configuration, the reading of data in the TEE that requires confidentiality by each application in the TEE is authenticated by the DS Agent and verified by the use policy before the data can be accessed (including reading, writing, searching, etc.). It can be understood that the DS Agent provides a fixed access interface for each application, and in the scenario where the application accesses the data, the corresponding data can only be accessed through the unique fixed access interface. The DS Agent can authenticate the application based on the access request received by the interface and verify the use policy (which can be collectively referred to as access control verification or access verification, which is not limited in the present application). And after the verification is successful, the application is allowed to continue to access the data. That is, the application in the TEE cannot bypass the DS Agent to access the data, and therefore, in the embodiments of the present application, after the DS Agent authenticates the application, it can prevent the application from illegally accessing the data by imitating the application, and monitor and control the access behavior of the application through the data use policy to prevent the application itself from illegally accessing or stealing the data, thereby improving the security of the data.

[0055] Optionally, the DS Agent is configured to obtain and save the identity authentication information of the data processing application. In the embodiments of the present application, the identity authentication information is a baseline value (which can also be referred to as a reference value, a metric value, etc., which is not limited in the present application) of the data processing application, and the baseline value of the data processing application is generated based on all or part of the computer program of the data processing application. Optionally, the computer program of the data processing application can be stored in the memory, i.e., the memory space to which the data processing application belongs. The computer program of the application can be understood as enabling the application when the processor executes the computer program, or it can be understood as being able to start and run the application. Optionally, the data processing application can generate a corresponding Hash value based on all or part of the computer program corresponding to the present application as the baseline value. Of course, in some examples, the data processing application can also calculate the baseline value of the computer program by other calculation or encryption methods to obtain the identity authentication information.

[0056] Optionally, in some examples, the identity authentication information of the data processing application can also be a combination of the baseline value and at least one other information. For example, it can be a combination of the baseline value and the identification information (such as the application ID) of the data processing application, i.e., the data processing application can generate a corresponding Hash value based on the application ID and the baseline value as the identity authentication information of the data processing application.

[0057] Exemplarily, the DS Agent is further configured to perform identity authentication on the data processing application. Specifically, the DS Agent performs identity authentication on the data processing application based on the identity authentication information of the data processing application and the identity authentication information in the data usage policy, so as to determine the real identity of the data processing application and avoid data leakage caused by application impersonation.

[0058] Exemplarily, the DS Agent is further configured to perform access behavior control on the data processing application. The access behavior, which can also be referred to as an access operation, includes reading, writing, searching and other access behaviors. Specifically, the DS Agent can control the access behavior of the data processing application based on the data usage policy formulated by the data owner.

[0059] Optionally, the DS Agent can be provided with an execution submodule (or unit) corresponding to different policy contents. For example, it is assumed that the data usage policy includes an access operation type policy and an access operation frequency policy. The access operation type policy is used to indicate the type of access operation allowed on the data. The access operation frequency policy is used to indicate the maximum number of times that the application is allowed to access the data, or can also be used to indicate the maximum number of times that the application is allowed to perform the same type of access operation on the data. The number of times that the application accesses the data can be understood as the number of times that the application accesses (not limited to the type of operation) the data. The number of times corresponding to the type of access operation of the application on the data can be understood as the number of times that the application performs a specific type of access operation on the data. For example, the access operation type policy includes a read operation, and the access operation frequency policy includes a read operation frequency of 3, that is, the data usage policy allows the data processing application to perform a read operation (i.e., the data can be read, but the data cannot be modified (including adding, deleting, modifying)) on the data, and the number of times that the data processing application performs a read operation on the data is less than or equal to 3.

[0060] Exemplarily, the DS Agent can include, but is not limited to, an operation type determination submodule (or unit) and an operation frequency determination submodule (or unit). The operation type determination submodule is configured to control the type of access behavior of the data processing application based on the access operation type policy. The operation frequency determination submodule is configured to control the number of times corresponding to the access behavior of the data processing application based on the access operation frequency policy.

[0061] Exemplarily, the DS Agent Manager is configured to configure corresponding resources for each DS Agent (e.g., DS Agent0 or DS Agent1) according to the computing requirement of the node or device (e.g., Realm VM) to which the DS Agent belongs. The resources include, but are not limited to, CPU resources, memory resources, device resources (e.g., network cards), and the like, which are not limited in the present application.

[0062] Exemplarily, the RMM (Realm Management Monitor) is running in the EL2 mode and is a manager of the Realm state, and provides interface services for applications in the Realm. The RMM can be used to manage the life cycle of the Realm, including the creation and destruction of the Realm.

[0063] Exemplarily, the Hypervisor, the APP (application), the TOS (Trust Zone Operating System), the Secure Partition, the SPM, the Monitor, and other modules in FIG. 2 are also included. The descriptions of the other modules can refer to the prior art embodiments, and will not be repeated here.

[0064] It should be noted that the CCA architecture is taken as an example for description in the embodiments of the present application, and the technical solutions in the embodiments of the present application can also be applied to other secure environments, for example, can be applied to a TEE based on an ARM Trust Zone architecture, which is not limited in the present application.

[0065] In order to ensure data security, the prior art usually adopts a data encryption manner to ensure data security and data integrity in the data transmission process. In a possible implementation manner, the prior art adopts the following manner:

[0066] 1. A data owner (e.g., the first electronic device in FIG. 1) encrypts data and uploads the encrypted data to the cloud side for storage.

[0067] 2. The data owner uploads a data corresponding use policy and a decryption key to a blockchain.

[0068] 3. A data user creates a TEE instance (such as a confidential virtual machine or an Enclave (image)) on the cloud side, and deploys a data processing application inside the TEE instance.

[0069] 4. The data processing application inside the TEE instance sends a data use request to the blockchain, wherein the data use request includes a measurement value of the TEE instance and the data use request.

[0070] 5. The blockchain server sends the measurement value of the TEE instance to the verification server. The verification server verifies the measurement value of the TEE instance, and after verification, obtains the decryption key of the data from the blockchain, and returns the decryption key to the TEE instance.

[0071] 6. The TEE instance obtains the encrypted data from the cloud measurement, and decrypts the encrypted data using the obtained decryption key to obtain the plaintext data. The data processing application in the TEE instance can perform data operations (also referred to as access operations, for example, including reading, writing, searching, etc.) on the data.

[0072] However, in this way, the security of the data needs to involve the blockchain, and the key management of the data depends on the blockchain. That is, the blockchain needs to be deployed in this scenario, which increases the deployment difficulty and complexity of the system.

[0073] FIG. 3 is a flowchart of an example access control method. Referring to FIG. 3, the method includes, but is not limited to, the following steps:

[0074] S301, in a secure environment, obtaining target data and a target data usage policy.

[0075] For example, the data processing application in the secure environment (also referred to as a secure environment, a confidential environment, etc.) generates identity authentication information in response to a received user operation. Specifically, the data processing application obtains all or part of the computer program corresponding to the data processing application in the memory. The data processing application obtains all or part of the corresponding computer program from the memory, and the data processing application calculates the corresponding hash value based on a preset algorithm (for example, including MD5 (Message-Digest Algorithm, Message Digest Algorithm), SHA-1 (Secure Hash Algorithm, Secure Hash Algorithm), SHA-256, SHA-3, etc.) on the obtained computer program corresponding to the application. The value is referred to as the baseline value of the data processing application in this embodiment of the application, which can be used as the identity authentication information of the data processing application to uniquely identify the data processing application.

[0076] In one possible implementation, the data processing application can also automatically generate the identity authentication information, for example, after the installation of the data processing application is completed, the identity authentication information is generated, and the present application is not limited.

[0077] In another possible implementation, the identity authentication information of the data processing application can also be a combination of the baseline value and at least one other information. For example, it can be a combination of the identification information (for example, the application ID) of the data processing application and the baseline value, that is, the data processing application can generate a corresponding hash value based on the application ID and the baseline value as the identity authentication information of the data processing application.

[0078] For example, the data processing application as the data user sends the identity authentication information to the data owner (for example, the first electronic device shown in FIG. 1).

[0079] In one example, the data processing application in the data user (for example, the second electronic device, which can also be the Ream Vm in the second electronic device) can directly send the identity authentication information to the data owner (for example, the first electronic device). In another example, the data processing application in the data user can send the identity authentication information to a remote server. The remote server receives and saves the identity authentication information. The data owner can obtain the identity authentication information of at least one data processing application from the remote server.

[0080] For example, the data owner obtains the identity authentication information of one or more data processing applications (for example, including the first application involved in the embodiments of the present application). The data owner generates a data use policy. The data use policy includes one or more identity authentication information and an access control policy corresponding to each identity authentication information.

[0081] Optionally, the data owner can receive N identity authentication information, and the user to which the data owner belongs can determine which applications can access the target data and the corresponding access control policy according to actual needs. The data owner (for example, the first electronic device) generates a target data use policy corresponding to the target data in response to the received user instruction. The target data use policy can include M identity authentication information, and M is less than or equal to N. That is, after the data owner receives N identity authentication information, some applications can not be allowed to access the target data, and accordingly, the target data use policy can optionally not include the identity authentication information corresponding to the applications.

[0082] Optionally, the data use policy can also be provided with a blacklist and a whitelist, wherein the identity authentication information in the whitelist is used to indicate that the corresponding application is allowed to access the target data, and the identity authentication information in the blacklist is used to indicate that the corresponding application is not allowed to access the target data.

[0083] Optionally, after receiving the one or more identity authentication information and generating the corresponding data usage policy, if the data owner receives other identity authentication information sent by other applications, the data usage policy can be dynamically adjusted. The specific implementation manner can be seen from the description below.

[0084] For example, the identity authentication information in the data usage policy is used to indicate that the application identified by the identity authentication information is allowed to access the target data.

[0085] For example, the access control policy is used to indicate the access behavior allowed to be performed by the application on the target data. For example, the access control policy can further include but is not limited to: an access operation type policy and an access operation times policy, wherein the access operation type policy is used to indicate the access operation type allowed to be performed by the application on the data, and the access operation times policy is used to indicate the maximum execution times of the same access operation type. For example, the access operation type policy includes a read operation, and the access operation times policy includes a read operation times of 3, that is, the data usage policy allows the data processing application to perform a read operation on the data (that is, the data can be read, but cannot be modified (including added, deleted, modified)), and the number of times of performing the read operation on the data by the data processing application is less than or equal to 3.

[0086] In a possible implementation manner, the data usage policy can be in the form of a table, and of course, in other examples, it can also be in other forms, which are not limited in the present application. Table 1 is an example of a data usage policy, please refer to Table 1:

[0087] Table 1

[0088] As shown in Table 1, it is assumed that the data owner obtains the baseline values of the first application, the second application and the third application. The data owner decides that the target data is only allowed to be accessed by the first application and the second application. Correspondingly, the target data usage policy corresponding to the target data includes but is not limited to: the identity authentication information of the first application and the corresponding access control policy 1, and the identity authentication information of the second application and the corresponding access control policy 2. The access control policy 1 and the access control policy 2 can be the same or different, which are not limited in the present application. That is, in this example, the data owner to which the first application belongs can perform identity authentication on the first application based on the identity authentication information of the first application in the identity authentication information. And in the case of successful identity authentication, the access behavior of the first application on the target data can be further controlled based on the access control policy corresponding to the first application (which can also be understood as the identity authentication information of the first application).

[0089] Exemplarily, the data owner sends a data package to all data users (which can refer to the first electronic device or can refer to the Realm VM, and the present application does not make a limitation) that need the target data. The data package includes but is not limited to the target data and the target data use policy. Optionally, the data package can further include an access list. The access list includes but is not limited to the identification information (for example, the application ID) of at least one data processing application, and is used to indicate that the data use policy is formulated for the data processing application indicated by the identification information, that is, the application in the list (only the list is taken as an example for description, and the present application does not make a limitation) can continue to perform the subsequent access control process, and if the application is not in the list, the subsequent access control process does not need to be performed. It can also be understood that the data processing application not in the list is not allowed to access (or use) the target data. That is, in the embodiment of the present application, the data user in the use range specified by the access list is allowed to use the target data. In order to prevent illegal applications from using the identification information of the application, the identity authentication step needs to be further performed to further determine the identity authenticity of the application. That is, the identification information indicated in the access list and the identity authentication information included in the data use policy are both used to indicate the data user allowed to use the target data. The data owner that can really use the data needs the identification information and the identity authentication information to be unified, that is, only in the range of the authentication of the data owner, the target data can be used.

[0090] Optionally, after the data owner generates the data package, the data package is encrypted, and the encrypted data package is transmitted to the data user, so as to ensure the data safety in the data transmission process.

[0091] Exemplarily, the second electronic device or the Realm VM0 in the second electronic device (which can refer to FIG. 2) is taken as an example, that is, the data user in the embodiment of the present application can refer to the second electronic device or can refer to the virtual electronic device in the second electronic device, for example, the Realm VM, and the present application does not make a limitation. The data user receives the data package sent by the data owner. The data user obtains the access list, the target data and the data use policy in the data package.

[0092] In a possible implementation, if the application of the new data user needs to access the target data, the identity authentication information can be sent to the data owner. The data owner can update the data use policy of the target data, for example, the identity authentication information corresponding to the new application and the corresponding access control policy are added in Table 1. In addition, the data owner sends the new target data use policy to each data user. The data user receiving the new target data use policy can delete the old target data use policy, and uses the new target data use policy to perform the access control.

[0093] In yet another possible implementation, the data owner can also exclude the application that is allowed to access the target data by updating the data usage policy. For example, the data owner can send a new data usage policy to the data users, in which the identity authentication information of the first application and the corresponding access control policy are excluded. Accordingly, based on the new data usage policy, the electronic device to which the first application belongs can determine that the first application does not have the permission to access the target data.

[0094] S302, obtaining identity authentication information of the first application and an access operation of the first application on the target data.

[0095] For example, the data user obtains the identity authentication information of the first application and the access operation of the first application on the target data from the first application. The identity authentication information of the first application includes but is not limited to the baseline value generated by the first application based on all or part of the computer program of the first application. The first application can be any application in the secure environment that has access demand for the target data, which can be a data processing application in the embodiment of the present application.

[0096] In the embodiment of the present application, the access operation of the application on the data includes but is not limited to reading, writing, searching, deleting, etc. The present application is not limited.

[0097] S303, in the case that the identity authentication of the first identity authentication information based on the identity authentication information is successful, performing access control on the first access operation based on the access control policy.

[0098] For example, the data user can perform access control on the first application based on the target data usage policy. In the embodiment of the present application, the access control can include but is not limited to identity authentication and access behavior verification.

[0099] Specifically, the data user can perform identity authentication on the identity authentication information of the first application based on the identity authentication information in the target data usage policy.

[0100] In one example, if the identity authentication is successful, that is, the identity authentication information of the first application matches at least one identity authentication information in the target data usage policy successfully, the subsequent access behavior verification is continued.

[0101] In another example, if the identity authentication is not successful, that is, the identity authentication information of the first application fails to match at least one identity authentication information in the target data usage policy, the access of the first application on the target data is rejected.

[0102] For example, after the identity authentication is successful, the data user performs access behavior verification on the access operation of the first application on the target data based on the access control policy.

[0103] For example, the access control policy includes, but is not limited to, an access operation type policy and an access operation frequency policy. The access operation type policy is used to indicate the type of access operation allowed on the data, and the access operation frequency is used to indicate the maximum number of times of the same type of access operation. For example, the access operation type policy includes a read operation, and the access operation frequency policy includes a read operation frequency of 3, that is, the data usage policy allows the data processing application to perform a read operation on the data (that is, the data can be read, but cannot be modified (including addition, deletion, modification)), and the number of times of the read operation performed by the data processing application on the data is less than or equal to 3. For example, the data user can control the type of access behavior of the first application based on the access operation type policy. In addition, the data user can control the number of times of the access behavior of the first application based on the access operation frequency policy.

[0104] FIG. 4 is a flowchart of an access control method provided by an embodiment of the present application. The method in FIG. 3 will be described in detail below in combination with FIG. 4. Please refer to FIG. 4, which includes, but is not limited to, the following steps:

[0105] S401, the data processing application generates identity authentication information.

[0106] For example, the data processing application generates the identity authentication information in response to the received user operation. Specifically, the data processing application obtains all or part of the computer program of the data processing application corresponding to the computer program in the memory. The data processing application calculates the computer program based on a preset algorithm to obtain a corresponding hash value. The value is referred to as the baseline value of the data processing application in the embodiment of the present application, which can be used as the identity authentication information of the data processing application to uniquely identify the data processing application.

[0107] In a possible implementation manner, the data processing application can also automatically generate the identity authentication information. For example, the data processing application can generate the identity authentication information after initialization, which is not limited in the present application.

[0108] In another possible implementation manner, the identity authentication information of the data processing application can also be a combination of the baseline value and at least one other information. For example, it can be a combination of the baseline value and the identification information (such as application ID) of the data processing application. That is, the data processing application can generate a corresponding hash value based on the application ID and the baseline value as the identity authentication information of the data processing application.

[0109] In this way, in the embodiment of the present application, the identity authentication information is generated based on the computer program of the data processing application, so that the identity authentication information uniquely identifies the data processing application, thereby avoiding the problem of the counterfeit application. For example, assuming that there is a counterfeit data processing application, if the traditional method of using the data processing application ID as the identity authentication information is used, after the counterfeit data processing application obtains the application ID of the real data processing application, the counterfeit data processing application may use the ID as its own application identification information and access the confidential data based on the application ID. However, if the identity of the application is verified based on the application ID, the real identity of the application cannot be identified, so that the counterfeit data processing application illegally accesses the data. In the embodiment of the present application, the identity authentication information is generated based on the computer program of the data processing application, and the computer program of the counterfeit data processing application is different from the computer program of the real data processing application. Therefore, the data processing application cannot generate the same identity authentication information as the real data processing application, thereby ensuring the uniqueness of the identity authentication information of the data processing application. Optionally, the uniqueness refers to the uniqueness in the device (for example, the Realm VM), that is, there is no multiple applications with the same identity authentication information in the same Realm VM. Optionally, if the same application is installed in different Realm VMs, that is, in different devices, the identity authentication information of the application can be the same.

[0110] S402, the data processing application sends the identity authentication information to the first electronic device.

[0111] For example, the data processing application sends a data request message to the first electronic device in response to the received user operation. The data request message is used to request the target data. The data request message includes but is not limited to at least one of the following: identification information of the data processing application, identity authentication information of the data processing application, and data request indication information.

[0112] For example, the data processing application sends a data request message to the first electronic device in response to the received user operation. The data request message is used to request the target data. The data request message includes but is not limited to at least one of the following: identification information of the data processing application, identity authentication information of the data processing application, and data request indication information.

[0113] S403, the first electronic device acquires the data use policy based on the identity authentication information.

[0114] For example, the first electronic device (that is, the data owner) receives the data request message. Based on the data request message, it can be determined that the data processing application has a use demand for the target data.

[0115] The first electronic device generates a target data use policy in response to the received user operation. The data use policy includes the identity authentication information and the access control policy.

[0116] For example, the identity authentication information is used to indicate that the application indicated by the identity authentication information is allowed to access the target data. For example, in the present example, the identity authentication information of the data processing application is included in the data usage policy, which is used to indicate that the data processing application is allowed to use (or access) the target data.

[0117] For example, the access control policy is used to indicate the access behavior allowed to be performed on the target data. For example, the access control policy can further include, but is not limited to, an access operation type policy and an access operation times policy, wherein the access operation type policy is used to indicate the access operation type allowed to be performed on the data, and the access operation times policy is used to indicate the maximum number of times of performing the same access operation type. For example, the access operation type policy includes a read operation, and the access operation times policy includes that the number of read operations is 3, that is, the data usage policy allows the data processing application to perform the read operation on the data (that is, the data can be read, but cannot be modified (including added, deleted, or modified)), and the number of times of performing the read operation on the data by the data processing application is less than or equal to 3.

[0118] S404, the first electronic device generates an encrypted data packet (data+usage policy+access list).

[0119] For example, the first electronic device generates a data packet. The data packet includes, but is not limited to, the target data and the target data usage policy. Optionally, the data packet can further include the access list.

[0120] For example, the access list includes, but is not limited to, the identification information (for example, an application ID) of at least one data processing application, which is used to indicate that the data usage policy is formulated for the data processing application indicated by the identification information, that is, the application in the list (only the list is taken as an example, and the present application is not limited thereto) can continue to perform the subsequent access control process, and the application not in the list does not need to perform the subsequent access control process. It can also be understood that the data processing application not in the list is not allowed to access the target data. For example, in the present example, the identification information of the data processing application can be included in the access list.

[0121] Optionally, after the data owner generates the data packet, the data packet is encrypted, and the encrypted data packet is transmitted to the data user, so as to ensure the data security in the data transmission process.

[0122] It should be noted that in the embodiment of the present application, the first electronic device can receive the identity authentication information sent by multiple data users (for example, a second application, a third application, and the like). However, not every data user is allowed to use the target data, which can be set according to actual needs, and the present application is not limited thereto.

[0123] S405, the first electronic device sends the data package to the second electronic device.

[0124] For example, the data owner sends the data package to all data users (which can refer to the first electronic device or the Realm VM, and the present application does not make any limitation) who need the target data. Alternatively, the data owner can send the data package to all data processing applications which send the identity authentication information to the data owner. However, as described above, not all data users are allowed to use the target data, and the specific setting can be based on actual needs, and the present application does not make any limitation. That is, the data user who receives the data package can not be within the allowed range of the access list.

[0125] The DS Agent in the first electronic device acquires the data package from the data owner. For example, the first electronic device further includes a communication module, and based on the interface configuration, the communication module receives the data package and performs unpacking and other processing on the data package, and then transmits the data package acquired after unpacking to the DS Agent. It can be understood that, in the embodiments of the present application, based on the interface setting in the secure environment, the DS Agent has a strong supervision right on the target data, and all operations that need to access the target data need to be authenticated (i.e., identity verification and access behavior verification) by the DS Agent before accessing the target data through the interface provided by the DS Agent. Thus, it can be avoided that illegal applications bypass the authentication module to access data, which threatens the security of the data.

[0126] S406, the DS Agent decrypts the data package to acquire the plaintext data.

[0127] For example, the DS Agent decrypts the data package to obtain the plaintext data of the target data. The DS Agent saves the plaintext data in the memory of the secure environment. In this way, based on the strong authentication mechanism of the DS Agent in the embodiments of the present application, the target data can be saved in plaintext form without the need to decrypt the data every time the data is accessed, so as to improve the efficiency of data access and avoid the algorithm burden introduced by repeated decryption.

[0128] In the embodiments of the present application, the encryption and decryption process of the data package can use a simple encryption and decryption algorithm to reduce the algorithm complexity while ensuring the security in the data transmission process, and the specific algorithm can be set according to actual needs, and the present application does not make any limitation.

[0129] S407, the data processing application sends a read data request to the DS Agent.

[0130] Exemplarily, the access behavior (or access operation) of the data processing application to the target data is taken as an example of reading. Specifically, the data processing application sends a read data request to the DS Agent in response to a received user operation (which can also be triggered actively, which is not limited in the present application), for requesting to read the target data. The read data request includes but is not limited to: information of the target data (such as a storage location, etc.), identity authentication information of the data processing application, identification information (such as an application ID) of the data processing application, etc.

[0131] Optionally, the identity authentication information of the data processing application, the identification information (such as the application ID) of the data processing application, and the like can also be obtained before the corresponding verification step in FIG. 4 is performed. For example, before the identity of the data processing application needs to be verified, the DS Agent can send an identity authentication information obtaining request to the data processing application to obtain the identity authentication information of the data processing application. The data processing application feeds back the identity authentication information to the DS Agent in response to the request. Other information is similar, which is not limited in the present application.

[0132] S408, the DS Agent performs access control based on the target data usage policy.

[0133] FIG. 5 is an exemplary access control flow diagram, which specifically includes but is not limited to the following steps:

[0134] S501, it is judged whether the data processing application can use the target data based on the access list and the identification information of the data processing application.

[0135] Specifically, the DS Agent matches the identification information of the data processing application with the identification information in the access list.

[0136] In one example, if the matching is successful, that is, the data owner allows the data processing application to use (or access) the target data, S502 is continuously performed.

[0137] In another example, if the matching is not successful, for example, the identification information of the data processing application does not exist in the list, or the list can be set with a blacklist, and the identification information of the data processing application is included in the blacklist, the data processing application is rejected to use the target data. Optionally, the DS Agent sends a rejection access message to the data processing application, for indicating to reject the data processing application to access the target data.

[0138] S502, identity authentication is performed on the identity authentication information of the data processing application based on the identity authentication information.

[0139] Specifically, the DS Agent matches the identity authentication information of the data processing application with the identity authentication information in the data usage policy.

[0140] In one example, if the matching is successful, i.e., the data owner allows the data processing application to use the target data, and the data processing application is the application indicated by the identification information, i.e., the identification information is unified with the identity authentication information, and the real identity verification of the data processing application is successful, S503 is performed.

[0141] In another example, if the matching is not successful, i.e., the identification information is not unified with the identity authentication information, and the real identity verification of the data processing application fails. For example, it is an illegal application that uses the identification information of the data processing application, but the identity verification is not successful. Alternatively, the DS Agent sends a denial of access message to the data processing application, indicating that the data processing application is denied to access the target data.

[0142] S502, based on the access control policy, it is judged whether the data processing application has read permission.

[0143] Specifically, taking the access control policy including but not limited to the access operation type policy and the access operation frequency policy as an example for illustration. The access operation type policy is used to indicate the type of access operation allowed to the data, and the access operation frequency is used to indicate the maximum number of execution times of the same type of access operation. For example, the access operation type policy includes read operation, and the access operation frequency policy includes read operation frequency of 3, i.e., the data usage policy allows the data processing application to perform read operation on the data (i.e., the data can be read, but cannot be modified (including added, deleted, modified)), and the number of times the data processing application performs read operation on the data is less than or equal to 3.

[0144] Alternatively, taking the data application type policy as an example, the policy can include the correspondence between the identification information of the application and the allowed access operation. For example, if the policy includes the identification information of the data processing application, and the corresponding access operation includes but is not limited to read, the policy indicates that the data processing application is allowed to read the target data, but the data processing application is not allowed to perform other access operations such as addition, deletion, modification, etc.

[0145] For example, the DS Agent performs access behavior verification (also referred to as access behavior type verification) on the read operation of the data processing application on the target data based on the access operation type policy in the access control policy.

[0146] In one example, if the identification information matched with the data processing application in the access control policy corresponds to the read operation in the access operation, i.e., the data processing application is allowed to read the target data, S503 is performed. Otherwise, a denial of access message is sent to the data processing application, indicating that the data processing application is denied to access the target data.

[0147] For example, in some instances, the access control policy can include an access operation type policy. Accordingly, if the access operation type policy is verified successfully based on the first access operation, the application can be allowed to access the target data.

[0148] S503, judging whether the read times of the data processing application reach an upper limit based on the access control policy.

[0149] Specifically, the DS Agent performs access behavior verification (also referred to as access behavior times verification) on the read operation times of the data processing application on the target data based on the access operation times policy in the access control policy, to judge whether the read times of the data processing application reach an upper limit (for example, the read times are less than or equal to 3 as required by the policy).

[0150] In one example, if the read times of the data processing application on the target data (i.e., the read operation on the target data) do not reach the upper limit value, the data processing application is allowed to access the target data. Specifically, the DS Agent can send data indication information to the memory controller through the interface between the DS Agent and the memory controller, to indicate that the data processing application is allowed to read the target data. The memory controller sends the target data to be read by the data processing application in response to the received data indication information.

[0151] In another example, if the read operation of the data processing application on the target data exceeds the upper limit value, a rejection access message is sent to the data processing application, to indicate that the data processing application is rejected to access the target data.

[0152] The above describes the scheme provided by the embodiments of the present application mainly from the perspective of interaction between network elements. It can be understood that the access device includes hardware structures and / or software modules corresponding to the execution of various functions in order to implement the above functions. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of the examples described in the embodiments disclosed herein, the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is implemented in hardware or computer software driven hardware depends on the specific application of the technical solution and the design constraints. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0153] The embodiments of the present application can divide the functional modules of the access device according to the above method examples. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or software functional module. It should be noted that the division of modules in the embodiments of the present application is illustrative, and is only a logical functional division. Actual implementation can have another division manner.

[0154] In the case of dividing each functional module according to each function, Fig. 6 shows a possible structural schematic diagram of the access control device 600 involved in the above embodiments. As shown in Fig. 6, the access control device 600 includes: a first acquisition module 601 configured to acquire target data and a target data usage policy in a secure environment, the target data usage policy including identity authentication information and an access control policy, the identity authentication information being used to indicate that an application identified by the identity authentication information is allowed to access the target data, and the access control policy being used to indicate that an access behavior performed by the application on the target data is allowed; wherein the identity authentication information is generated based on a computer program of the application. A second acquisition module 602 is configured to acquire first identity authentication information of a first application and a first access operation of the first application on the target data; wherein the first identity authentication information is generated based on a computer program of the first application. An execution module 603 is configured to, in a case that identity verification of the first identity authentication information based on the identity authentication information is successful, perform access control on the first access operation based on the access control policy.

[0155] In a possible implementation manner, the first identity authentication information includes a baseline value generated based on all or part of the computer program of the first application.

[0156] In a possible implementation manner, the baseline value is a hash value calculated based on all or part of the computer program of the first application.

[0157] In a possible implementation, the target data and the target data usage policy are carried in an encrypted data packet, and the first obtaining module 601 is specifically configured to decrypt the data packet to obtain the plaintext data of the target data and the target data usage policy.

[0158] In a possible implementation, the execution module 603 includes an authentication unit 6031 configured to match the first identity authentication information with the identity authentication information, and if the first identity authentication information matches the identity authentication information successfully, the identity authentication of the first application is successful, and the first application is allowed to access the target data, and if the first identity authentication information fails to match the identity authentication information, the identity authentication of the first application fails, and the first application is denied to access the target data.

[0159] In a possible implementation, the access control policy includes at least one of the following: an access operation type policy and an access operation frequency policy, wherein the access operation type policy is used to indicate the type of access operation allowed to be performed by the application on the target data, and the access operation frequency policy is used to indicate the maximum access frequency of the application on the target data.

[0160] In a possible implementation, the execution module 603 includes a policy execution unit 6032 configured to perform access operation type verification and access operation frequency verification based on the access control policy, and if the access operation type verification and the access operation frequency verification are both successful, the first application is allowed to perform the first access operation on the target data, and if the access operation type verification or the access operation frequency verification fails, the first application is denied to perform the first access operation on the target data.

[0161] FIG. 7 shows a schematic block diagram of an access control apparatus 700 according to an embodiment of the present application. The access control apparatus can include a processor 701 and a transceiver / transceiver pin 702, and optionally, a memory 703. The processor 701 can be configured to execute the steps of the second electronic device, the Realm VM in the second electronic device, or the DS Agent in the methods of the foregoing embodiments, and control the receiving pin to receive signals and the sending pin to send signals.

[0162] The various components of the access control apparatus 700 are coupled through a bus system 704, which includes not only a data bus, but also a power supply bus, a control bus, and a state signal bus. However, for the sake of clarity, all the buses are marked as the bus system 704 in the figure.

[0163] Optionally, the memory 703 can be configured to store the instructions in the foregoing method embodiments.

[0164] It should be understood that the access control apparatus 700 according to the embodiments of the present application can correspond to the second electronic device in each of the methods of the foregoing embodiments, and the foregoing and other management operations and / or functions of each element in the access control apparatus 700 are respectively for implementing the corresponding steps of the foregoing methods, and for brevity, will not be repeated here.

[0165] All the related contents of each step involved in the method embodiments described above can be cited to the function description of the corresponding functional module, and will not be repeated here.

[0166] Based on the same technical concept, the embodiments of the present application further provide a computer readable storage medium, which stores a computer program, the computer program comprises at least one code, the at least one code can be executed by the access control apparatus to control the access control apparatus to implement the method embodiments described above.

[0167] Based on the same technical concept, the embodiments of the present application further provide a computer program, when the computer program is executed by the access control apparatus, to implement the method embodiments described above.

[0168] The program can be stored in the storage medium packaged with the processor in whole or in part, or in the storage medium not packaged with the processor in whole or in part.

[0169] Based on the same technical concept, the embodiments of the present application further provide a processor, which is used to implement the method embodiments described above. The processor can be a chip.

[0170] The steps of the method or algorithm described in connection with the embodiments of the present application can be implemented in hardware, or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, which can be stored in a Random Access Memory (RAM), a flash memory, a Read Only Memory (ROM), an Erasable Programmable ROM (EPROM), an Electrically EPROM (EEPROM), a register, a hard disk, a mobile hard disk, a compact disk (CD-ROM) or any other form of storage medium well known in the art. An exemplary storage medium is coupled to the processor, so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be an integral part of the processor.

[0171] Those skilled in the art should be aware that, in the above one or more examples, the functions described in the embodiments of the present application can be implemented in hardware, software, firmware or any combination thereof. When implemented in software, the functions can be stored in a computer readable medium or transmitted as one or more instructions or code on a computer readable medium. The computer readable medium includes computer storage medium and communication medium, and the communication medium includes any medium that facilitates transfer of a computer program from one place to another. The storage medium can be any available medium accessible by a general purpose or special purpose computer.

[0172] The term "and / or", used herein only describes an associated relationship, which means that there can be three relationships, for example, A and / or B, which means that there are three cases: A exists alone, A and B exist together, and B exists alone.

[0173] The terms "first" and "second" and the like in the description and claims of the present application are used for distinguishing between similar objects and are not necessarily used to describe a specific sequence or order. For example, a first target object and a second target object are used for distinguishing between two different target objects, and are not necessarily used to describe a specific sequence or order.

[0174] In the present application, the words "exemplary" and "for example" are used to help clarify the description of the present application. Any embodiment or design scheme described as "exemplary" or "for example" in the present application should not be interpreted as more preferred or advantageous than other embodiments or design schemes. Rather, the use of "exemplary" or "for example" is intended to present relevant concepts in a concrete manner.

[0175] In the description of the present application, unless otherwise specified, "a plurality of" means two or more. For example, a plurality of processing units means two or more processing units; a plurality of systems means two or more systems.

[0176] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above specific embodiments, which are only illustrative and not restrictive. Those skilled in the art can make many forms under the inspiration of the present application without departing from the scope of the present application and the scope of protection of the claims, which are all within the scope of protection of the present application.

Claims

1. An access control method characterized by, The method comprises the following steps: In a secure environment, obtaining target data and a target data usage policy, the target data usage policy comprising identity authentication information and an access control policy, the identity authentication information being used to indicate that an application identified by the identity authentication information is allowed to access the target data, and the access control policy being used to indicate that the application is allowed to perform an access behavior on the target data; wherein the identity authentication information is generated based on a computer program of the application; Obtaining first identity authentication information of a first application and a first access operation of the first application on the target data; wherein the first identity authentication information is generated based on a computer program of the first application; In a case where identity verification of the first identity authentication information based on the identity authentication information is successful, performing access control on the first access operation based on the access control policy.

2. The method of claim 1, wherein, The first identity authentication information comprises a baseline value generated based on all or part of the computer program of the first application.

3. The method of claim 2, wherein, The baseline value is a hash value calculated based on all or part of the computer program of the first application.

4. The method of claim 1, wherein, The target data and the target data usage policy are carried in an encrypted data packet, and the obtaining of the target data and the target data usage policy comprises the following steps: Decrypting the data packet to obtain plaintext data of the target data and the target data usage policy.

5. The method of claim 1, wherein, The performing of access control on the first access operation based on the access control policy in a case where identity verification of the first identity authentication information based on the identity authentication information is successful comprises the following steps: Matching the first identity authentication information with the identity authentication information; If the first identity authentication information matches the identity authentication information successfully, identity verification of the first application is successful, and the first application is allowed to access the target data; If the first identity authentication information fails to match the identity authentication information, identity verification of the first application fails, and the first application is denied to access the target data.

6. The method of claim 1, wherein, The access control policy comprises at least one of the following: An access operation type policy and an access operation frequency policy; The access operation type policy is used to indicate an access operation type that the application is allowed to perform on the target data, and the access operation frequency policy is used to indicate a maximum access frequency of the application on the target data.

7. The method of claim 6, wherein, The performing of access control on the first access operation based on the access control policy comprises the following steps: Based on the access control policy, performing access operation type verification and access operation frequency verification on the first access operation; In a case where the access operation type verification and the access operation frequency verification are both successful, the first application is allowed to perform the first access operation on the target data; In a case where the access operation type verification or the access operation frequency verification fails, the first application is denied to perform the first access operation on the target data.

8. An access control device, characterized in that The method comprises the following steps: The first obtaining module is configured to obtain target data and a target data usage policy in a secure environment, the target data usage policy including identity authentication information and an access control policy, the identity authentication information being used to indicate that an application identified by the identity authentication information is allowed to access the target data, and the access control policy being used to indicate that the application is allowed to perform an access behavior on the target data, and the identity authentication information being generated based on a computer program of the application; The second obtaining module is configured to obtain first identity authentication information of a first application and a first access operation of the first application on the target data, and the first identity authentication information being generated based on a computer program of the first application; The execution module is configured to perform access control on the first access operation based on the access control policy when the identity authentication information is successfully authenticated based on the identity authentication information.

9. The apparatus of claim 8, wherein, The first identity authentication information includes a baseline value generated based on all or part of the computer program of the first application.

10. The apparatus of claim 9, wherein, The baseline value is a hash value calculated based on all or part of the computer program of the first application.

11. The apparatus of claim 8, wherein, The target data and the target data usage policy are carried in an encrypted data packet, and the first obtaining module is specifically configured to: decrypt the data packet to obtain plaintext data of the target data and the target data usage policy.

12. The apparatus of claim 8, wherein, The execution module includes an authentication unit, and the authentication unit is configured to: match the first identity authentication information with the identity authentication information; if the first identity authentication information is successfully matched with the identity authentication information, the identity authentication of the first application is successful, and the first application is allowed to access the target data; if the first identity authentication information fails to be matched with the identity authentication information, the identity authentication of the first application fails, and the first application is denied to access the target data.

13. The apparatus of claim 8, wherein, The access control policy includes at least one of the following: an access operation type policy and an access operation frequency policy; The access operation type policy is used to indicate an access operation type that the application is allowed to perform on the target data, and the access operation frequency policy is used to indicate a maximum access frequency corresponding to the access operation type that the application is allowed to perform on the target data.

14. The apparatus of claim 13, wherein, The execution module includes a policy execution unit, and the policy execution unit is configured to: perform access operation type verification and access operation frequency verification on the first access operation based on the access control policy; allow the first application to perform the first access operation on the target data when the access operation type verification and the access operation frequency verification are both successful; deny the first application to perform the first access operation on the target data when the access operation type verification or the access operation frequency verification fails.

15. A computer device, comprising: The device includes: one or more processors; a memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and when the computer programs are executed by the one or more processors, cause the computer device to perform the method of any one of claims 1-7.

16. A computer program product, characterised in that, When the computer program product is run on a computer, it causes the computer to perform the method of any one of claims 1-7.

Images