Data space secure-access control method based on dynamic attribute configuration service

Abstract

The present application belongs to the technical field of access control. Disclosed is a data space secure-access control method based on a dynamic attribute configuration service. The method in the present invention significantly improves the security of a data space by means of a series of rigorous steps and mechanisms, can effectively prevent security problems such as unauthorized access, data leakage and malicious tampering, and provides reliable protection for data and resources of users, thereby enhancing the user's trust in systems, and facilitating the wide application and development of data spaces. The method improves the efficiency and flexibility of access control, can quickly adapt to changes in service requirements and environments, and reduces the waste of time caused by cumbersome authentication and authorization processes, thereby improving the response speed and service quality of systems, and providing more convenient and efficient access experience for users.

Description

A data space security access control method based on dynamic attribute configuration service TECHNICAL FIELD

[0001] The present application relates to the technical field of access control, more particularly to a data space security access control method based on dynamic attribute configuration service. BACKGROUND

[0002] In modern data exchange environments, it is crucial to ensure the identity authentication of participants and the secure access of resources; in traditional access control mechanisms, static certificate mechanisms are usually used for permission management. TECHNICAL PROBLEM

[0003] When the attributes of users or entities change, such as position adjustment, permission range change, etc., it is necessary to frequently revoke old certificates and reissue new certificates, which not only is inefficient, but also consumes a lot of time and resource cost.

[0004] In terms of access control policy, traditional methods are not flexible and fine enough, and it is difficult to adapt to rapidly changing business needs and complex technical environments. When the system faces changing access requests, it cannot make accurate decisions in a timely and effective manner, resulting in slow response speed and poor service quality.

[0005] Due to the cumbersome operation of static certificate mechanism in attribute update, the workload of operation and maintenance is greatly increased, the maintenance cost is high, and at the same time, it also brings certain hidden dangers to the overall security of the system.

[0006] Therefore, the present application provides a data space security access control method based on dynamic attribute configuration service to solve the above problems. TECHNICAL SOLUTION

[0007] In order to solve the above problems, the present application provides a data space security access control method based on dynamic attribute configuration service.

[0008] The data space security access control method based on dynamic attribute configuration service provided by the present application adopts the following technical scheme:

[0009] A data space security access control method based on dynamic attribute configuration service, the method comprising the following steps:

[0010] Step one: initialization phase, participants obtain necessary authentication and deploy digital certificates to their components, and after success, register with the dynamic attribute configuration service and obtain the initial attribute set;

[0011] Step two: attribute update phase, when new attributes need to be added or existing attributes change, the dynamic attribute configuration service receives the notification and generates the corresponding dynamic attribute token;

[0012] Step three: continuous monitoring phase, dynamic trust monitoring regularly checks the status of all data space components, and feeds back the results to the dynamic attribute configuration service;

[0013] Step four: access request processing phase, when the participant tries to access the resource, first establish an encrypted communication channel, then use the same digital certificate to establish a tunnel under the protocol, and on this basis, remote authentication and metadata exchange are carried out, and then the attribute is verified on the CA according to the specified verification strategy;

[0014] Step five: finally send access request to policy decision point, with dynamic attribute token, and the policy decision point makes the final decision according to the preset policy.

[0015] Further, the digital certificate deployed in step one is X.509 certificate.

[0016] Through the above technical solution, X.509 certificate has wide recognition and high security, which can provide reliable identity authentication for participants, and ensure that only legal users can enter the system; The standardized format and encryption mechanism help to interact and verify between different systems and platforms, enhance the compatibility and interoperability of the system, and improve the security and stability of the whole access control system.

[0017] Further, the dynamic attribute token generated in step two and the X.509 certificate are used as credentials in subsequent identity verification and authorization.

[0018] Through the above technical solution, this combination greatly enhances the flexibility and accuracy of authentication and authorization; Dynamic attribute token can reflect the change of attribute in time, and X.509 certificate provides a stable authentication framework; The combination of the two can not only adapt to the rapid change of business demand, but also guarantee the authority and credibility of authentication, effectively prevent illegal access and abuse of rights, and improve the security and service quality of the system.

[0019] Further, the encrypted communication channel in step four complies with strict encryption standards including TLS.

[0020] Through the above technical solution, high confidentiality and integrity protection are provided for data transmission. TLS encryption standard can effectively prevent data from being stolen, tampered or forged during transmission, ensuring the safety and reliability of communication between participants; Even in complex network environment, sensitive information can not be leaked, and the trust of users to the system is enhanced, which provides solid technical support for secure access control.

[0021] Further, in step three, when the dynamic trust monitoring discovers abnormal activities or potential risks, the related parties are immediately notified and further security measures are triggered.

[0022] By the above technical solution, when the dynamic trust monitoring discovers abnormal activities or potential risks, the related parties can be immediately notified and further security measures can be triggered, which greatly improves the risk response capability of the system; the potential security threat can be controlled in the embryonic state at the first time of the problem, effectively reducing the loss caused by security vulnerabilities; at the same time, the timely notification and response mechanism also helps the related parties to quickly take remedial measures, enhancing the stability and security of the system.

[0023] Further, in step four, the access request is sent to the PDP (Policy Decision Point) with DAT and / or AT (AccessToken), and the final decision is made by the PDP according to the preset XACML policy.

[0024] By the above technical solution, the access decision is more accurate and flexible. XACML policy can perform fine-grained access control according to rich attributes and conditions, and DAT and / or AT provide real-time and accurate access credentials; the two work together to quickly and accurately determine whether to allow access according to different scenarios and needs, improving the efficiency and accuracy of access control and ensuring the safe and reasonable use of system resources. Advantages

[0025] In summary, the present application includes at least one of the following beneficial technical effects:

[0026] (1) The traditional static certificate mechanism is inefficient and costly when attributes are modified. The present application reduces the need for frequent revocation and reissue of certificates due to attribute changes by introducing DAPS;

[0027] (2) Enhance the flexibility of access control: by combining dynamic attributes with XACML policy, a more fine-grained and flexible access control means is provided, enabling the system to quickly respond to changing business needs and technical environment;

[0028] (3) Improve the response speed and service quality of the system: using real-time attribute information provided by DAPS, the speed and accuracy of access decision are optimized, improving user experience;

[0029] (4) Reduce operation and maintenance costs: reduce the additional workload caused by attribute updates, reduce maintenance costs, and also enhance the overall security. BRIEF DESCRIPTION OF DRAWINGS

[0030] Figure 1 is a step flowchart of the present application. Embodiments of the present invention

[0031] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application. Embodiments:

[0032] The present application will be further described in detail below with reference to the accompanying drawings 1.

[0033] The embodiments of the present application disclose a data space security access control method based on dynamic attribute configuration service, the method comprising the following steps:

[0034] Step one: initialization phase, participants obtain necessary authentication and deploy digital certificates to their components, and after success, register with the dynamic attribute configuration service and obtain the initial attribute set;

[0035] Step two: attribute update phase, when new attributes need to be added or existing attributes change, the dynamic attribute configuration service receives the notification and generates the corresponding dynamic attribute token;

[0036] Step three: continuous monitoring phase, the dynamic trust monitoring regularly checks the status of all data space components, and feeds back the results to the dynamic attribute configuration service;

[0037] Step four: access request processing phase, when participants try to access resources, first establish an encrypted communication channel, then use the same digital certificate to establish a tunnel under the protocol, and on this basis, perform remote authentication and metadata exchange, and then verify the attributes on the CA according to the specified verification strategy;

[0038] Step five: finally send an access request to the policy decision point, with a dynamic attribute token, and the policy decision point makes a final decision according to the preset policy.

[0039] Referring to FIG. 1, the digital certificate deployed in step one of the initialization process is an X.509 certificate; the X.509 certificate has wide recognition and high security, which can provide reliable identity authentication for participants and ensure that only legitimate users can enter the system; its standardized format and encryption mechanism help to interact and verify between different systems and platforms, enhancing the compatibility and interoperability of the system, thereby improving the security and stability of the entire access control system.

[0040] Referring to FIG. 1, the dynamic attribute token generated in step two and the X.509 certificate are used as credentials in subsequent identity verification and authorization; this combination greatly enhances the flexibility and accuracy of authentication and authorization; the dynamic attribute token can reflect changes in attributes in a timely manner, while the X.509 certificate provides a stable authentication framework; the combination of the two can adapt to rapidly changing business needs while ensuring the authority and credibility of authentication, effectively preventing illegal access and abuse of rights, and improving the security and quality of service of the system.

[0041] Referring to FIG. 1, the encrypted communication channel in step four follows strict encryption standards including TLS; providing high confidentiality and integrity protection for data transmission; the TLS encryption standard can effectively prevent data from being stolen, tampered with, or forged during transmission, ensuring the safety and reliability of communication between participants; even in complex network environments, sensitive information can be protected from being leaked, enhancing user trust in the system and providing solid technical support for secure access control.

[0042] Referring to FIG. 1, in step three, when the dynamic trust monitoring discovers abnormal activities or potential risks, it immediately notifies the relevant parties and triggers further security measures; when the dynamic trust monitoring discovers abnormal activities or potential risks, it can immediately notify the relevant parties and trigger further security measures, greatly improving the system's risk response capabilities; it can take action at the first time of the problem, control potential security threats in the embryonic state, and effectively reduce losses caused by security vulnerabilities; at the same time, timely notification and response mechanisms also help relevant parties to quickly take remedial measures, enhancing the stability and security of the system.

[0043] Referring to FIG. 1, in step four, the access request is sent to the PDP (Policy Decision Point) with DAT and / or AT (AccessToken), and the final decision is made by the PDP according to the pre-set XACML policy; making access decisions more accurate and flexible. XACML policy can perform fine-grained access control according to rich attributes and conditions, while DAT and / or AT provide real-time and accurate access credentials; the two work together to quickly and accurately determine whether to allow access according to different scenarios and needs, improving the efficiency and accuracy of access control and ensuring the safe and reasonable use of system resources.

[0044] The implementation principle of the data space security access control method based on dynamic attribute configuration service according to an embodiment of the present application is as follows:

[0045] The application first establishes a legitimate identity and initial attributes for the participants in the initialization phase, then generates dynamic attribute tokens in response to attribute changes in the attribute update phase. The continuous monitoring phase periodically checks and feeds back the state of the data space components. In the access request processing phase, encrypted communication establishment, tunnel establishment, remote authentication and metadata exchange, attribute verification are carried out in turn, and finally the policy decision point makes a decision according to the preset policy.

[0046] The whole process realizes safe and efficient access control of data space through dynamic attribute configuration service, strict encryption standard and accurate policy decision.

[0047] In the initialization phase, participants not only need to complete the necessary authentication steps, but also need to fill in a series of information related to identity and authority in detail. These information will go through strict audit and verification process to ensure its authenticity and legality. For example, participants may need to provide scanned copies of identity documents, relevant authorization documents, etc.; in the process of deploying digital certificates to components, the system will automatically detect the compatibility and security of the components, and if any potential risks or incompatibility problems are found, it will issue an alarm and provide corresponding solutions in time.

[0048] The implementation of attribute update phase depends on efficient notification mechanism and fast token generation algorithm. When new attributes need to be added, the relevant business department or management system will send detailed change request to dynamic attribute configuration service, including the type, value and applicable range of the attribute. After receiving the request, dynamic attribute configuration service will immediately start the internal processing flow, use advanced encryption technology and data processing algorithm to generate accurate dynamic attribute token in a very short time, and ensure its safe transmission to the corresponding participants.

[0049] The continuous monitoring phase uses advanced monitoring technology and intelligent analysis algorithm. The dynamic trust monitoring system will collect state information from each component of the data space in real time, including but not limited to the running state of the component, network connection, resource usage, etc. These information will be transmitted to the central monitoring server, where they will be analyzed and processed by complex algorithms. Once any abnormal activity or potential risk is found, the system will trigger the early warning mechanism immediately and send emergency notification to the relevant administrators and security personnel.

[0050] At the same time, the system will automatically start a series of preset security measures, such as temporarily limiting some suspicious access requests, isolating affected components, etc., to minimize potential security threats.

[0051] In the encryption communication channel establishment process of the access request processing stage, the system will first re-verify the identity of the participants to ensure that both parties of the communication are legal and authorized. In the process of establishing the tunnel, multiple encryption and authentication technologies are used to prevent communication data from being stolen or tampered with. In the remote authentication and metadata exchange link, strict format checking and content verification are performed on the exchanged data to ensure the integrity and accuracy of the data.

[0052] When verifying attributes on the CA according to the specified verification policy, multiple authoritative databases and verification services are called to obtain the most accurate and up-to-date verification results.

[0053] Finally, when sending an access request to the policy decision point, detailed access context information and dynamic attribute tokens are attached to enable the policy decision point to make the most accurate decisions

[0054] The method of the present application significantly improves the security of the data space through a series of rigorous steps and mechanisms; it can effectively prevent unauthorized access, data leakage and malicious tampering, and other security problems, providing reliable protection for users' data and resources, enhancing users' trust in the system, and helping to promote the widespread application and development of data space; the method improves the efficiency and flexibility of access control. It can quickly adapt to changes in business requirements and environment, reducing the time wasted due to cumbersome authentication and authorization processes, improving the system's response speed and service quality, and providing users with a more convenient and efficient access experience.

[0055] The above are preferred embodiments of the present application, and are not intended to limit the protection scope of the present application, therefore: any equivalent changes made in terms of structure, shape, principle, etc. according to the present application should be covered within the protection scope of the present application.

Claims

1. A data space security access control method based on dynamic attribute configuration service, characterized in that, The method includes the following steps: Step 1: Initialization phase. Participants obtain the necessary authentication and deploy digital certificates to their components. After successful deployment, they register with the dynamic property configuration service and obtain the initial property set. Step 2: Attribute update phase. When a new attribute needs to be added or an existing attribute changes, the dynamic attribute configuration service receives a notification and generates a corresponding dynamic attribute token. Step 3: Continuous monitoring phase. Dynamic trust monitoring periodically checks the status of all data space components and feeds the results back to the dynamic attribute configuration service. Step 4: Access Request Processing Phase. When a participant attempts to access a resource, an encrypted communication channel is first established. Then, a tunnel under the same protocol is established using the same digital certificate. Remote authentication and metadata exchange are performed on this basis. Finally, the attribute is verified on the CA according to the specified verification policy. Step 5: Finally, send an access request to the policy decision point, along with a dynamic attribute token, and the policy decision point will make the final decision based on the preset policy.

2. The data space security access control method based on dynamic attribute configuration service according to claim 1, characterized in that: The digital certificate deployed in the initialization process of step one is an X.509 certificate.

3. The data space security access control method based on dynamic attribute configuration service according to claim 2, characterized in that: The dynamic attribute token generated in step two, along with the X.509 certificate, serves as credentials in subsequent identity verification and authorization.

4. The data space security access control method based on dynamic attribute configuration service according to claim 1, characterized in that: The encrypted communication channel in step four follows strict encryption standards, including TLS.

5. A data space security access control method based on dynamic attribute configuration service according to claim 1, characterized in that: In step three, when dynamic trust monitoring detects abnormal activity or potential risks, it immediately notifies the relevant parties and triggers further security measures.

6. A data space security access control method based on dynamic attribute configuration service according to claim 1, characterized in that: In step four, an access request is sent to the PDP, along with DAT and / or AT, and the PDP makes the final decision based on the preset XACML policy.

Images