CN116599700A - Access control authorization method based on security context and resource hierarchy - Google Patents

Abstract

The invention discloses an access control authorization method based on security context and resource classification, which introduces the concept of security context based on role-based access control (RBAC), firstly, after collecting context information of cloud environment, the context information is converted into quantitative numerical values through a security context function, and the security level of the current user is calculated. Secondly, considering the differentiation of resource protection requirements, a security object is defined according to the privacy degree of the resource, the security level of data of different parts of the resource is specified, the resource can be accessed when the security level of a user meets the requirements, and the partial access of the resource is realized according to the value of the security level, so that the access granularity is finer. Therefore, the context privacy is protected, the fine granularity access of resources with different protection requirements is realized, and the cloud computing system has higher safety and better flexibility in a dynamic and changeable cloud computing environment.

Description

Access control authorization method based on security context and resource hierarchy

Technical Field

The invention belongs to the field of computer software development, and particularly relates to a safe and flexible user authorization method in a cloud computing environment.

Background

The access control is an indispensable important part of an information security system, and is also an important aspect for guaranteeing the security of cloud computing services. Access control makes protected information resources accessible only to a legal extent by imposing constraints on the access principals. Along with the increase of the number of cloud users and the change of operation storage modes, resources become difficult to manage and control in a centralized way, and how to innovate and research an access control model suitable for a cloud computing environment becomes a key for solving cloud security threat.

The access control model with the fixed host-guest attribute and role obviously cannot meet the dynamic requirements of cloud computing. Aiming at the dynamic change problem of the access control model caused by the elasticity and virtualization characteristics of cloud computing, some new cloud computing access control models introduce the concept of context, and the constraint on users is realized through real-time context update.

Role-based access control models (RBACs) are widely used in cloud computing environments as the most common access control, however, the existing RBAC models have the problems of inflexibility of authorization, insufficient granularity of access to resources and the like. And the user's context information in the cloud environment is at risk of leakage.

In summary, how to improve the RBAC model, protect the privacy of the context, implement fine-grained management of resources in the cloud computing environment, and increase the flexibility while guaranteeing the privacy. Has become a problem to be solved in the art.

Disclosure of Invention

In order to solve the technical problems mentioned in the background art, the invention provides an access control authorization method based on security context and resource hierarchy.

In order to achieve the technical purpose, the technical scheme of the invention is as follows:

an access control authorization method based on security context and resource hierarchy, comprising the steps of:

(1) Defining a security object, and dividing the resources in the system into data with different security levels according to different protection requirements;

(2) Context information in the cloud environment is collected by a context analyzer, and the context information is updated in real time. When a user enters a system to apply for accessing resources, entering a step (3);

(3) When the user is assigned the role, the corresponding numerical value is calculated by the security context function, so that whether the role assigned by the user is activated or not is determined. After the user is activated by the assigned role, entering step (4);

(4) When the user accesses the resource, the security level of the user is calculated by the value of the security context, so that the user can only access a part of the original resource, and the partial access to the resource is realized.

Further, in step (1), the method of resource classification is as follows:

(101) Carrying out security level division on the resources, wherein the security level division comprises a level 0 and other levels, the security data of the level 0 of the certain resource represents that a user can freely access, and the data of the other levels realize partial access according to the value of the security context function;

(102) Generally, the 0 level comprises non-confidential public documents and public resources, the system can assign insensitive resources to the 0 level, and the security levels are distinguished according to the privacy degree of the resources, and the more sensitive the data is, the higher the security level is.

Further, in step (2), the workflow of the context resolver is as follows: the context analyzer collects context information in the cloud environment, such as time context, space context, temporary context and the like, and updates the context information in real time, so that the influence of the change of the context on the authorization process is fully considered.

Further, in step (3), the user role assignment method is as follows:

(301) When a user applies for a certain role, the role distributed according to personal information of the user becomes a session role;

(302) If the user meets the context constraint condition of the system on the role, the corresponding value is calculated by the security context function to meet the value specified by the system, the role is started, and the session role is activated. Otherwise, access is denied.

Further, in step (4), the specific process of accessing the resource by the user is as follows:

(401) When a user applies for accessing resources, calculating the security level of the user according to the value of the security context;

(402) If the security level of the user is smaller than the minimum security level required by the applied resource, directly returning to refusal;

(403) The user security level is compared with the security level of each piece of data of the requested resource, and the user is allowed to access the piece of data only when the user security level is equal to or greater than the security level of the data.

The beneficial effects brought by adopting the technical scheme are that:

(1) And through the defined security context, the context information of the user finally passes through a context analyzer, a corresponding numerical value is calculated by a security context function, and subsequent operations are carried out according to the numerical value. The user's context privacy is protected.

(2) Through the defined security object, the corresponding security level is designated according to the privacy degree of the resource, and when the security level of the user and the resource are matched, the corresponding resource can be accessed, so that the security access of the resource is ensured. Specifically, when the security level of the user is less than the minimum security level required by the resource, a rejection is returned directly; according to the size of the user security level, partial data of the resource is accessed, fine granularity access to the resource is realized, and compared with the traditional RBAC model, the privacy is ensured and the flexibility is increased.

Drawings

FIG. 1 is a general flow chart of the present invention;

FIG. 2 is a diagram of the access control architecture in the present invention;

fig. 3 is a resource hierarchy diagram in the present invention.

Fig. 4 is a resource hierarchy diagram in the present invention.

Detailed Description

It is easy to understand that, according to the technical solution of the present invention, those skilled in the art can imagine various embodiments of the access control authorization method of the present invention based on security context and resource hierarchy without changing the true spirit of the present invention. Accordingly, the following detailed description and drawings are merely illustrative of the invention and are not intended to be exhaustive or to limit or restrict the invention.

The technical scheme of the present invention will be described in detail below with reference to the accompanying drawings.

The basic idea of the invention is that the context analyzer monitors the context information in the cloud computing in real time, when the user applies for accessing the resources of the system, the security context function calculates the current security level of the user, and if the user meets the context constraint condition of the system to the role, the role is started, and the session role is activated. Otherwise, access is refused, the access control flow of the whole system is shown in figure 1, and the access control framework is shown in figure 3. And when the user applies for accessing the resource, calculating the security level of the user according to the value of the security context. If the security level of the user is smaller than the minimum security level required by the applied resource, directly returning to refusal; if yes, the security level of the user is compared with the security level of each part of data of the applied resource, and the user is allowed to access the part of data only when the security level of the user is greater than or equal to the security level of the data. Thereby, the user's context privacy is protected. The fine granularity access to the resources is realized, and compared with the traditional RBAC model, the privacy is ensured and the flexibility is also improved.

An access control authorization method based on security context and resource hierarchy, comprising the steps of:

step 1: a security object is defined, which is an extension of the concept of a conventional RBAC object, as shown in fig. 3. Dividing the resources in the system into data with different security levels according to different protection requirements, as shown in fig. 4;

step 2: the context information in the cloud environment is collected by a context resolver, and updated in real time, as shown in fig. 2. When a user enters a system to apply for accessing resources, entering a step 3;

step 3: when the user is assigned the role, the corresponding numerical value is calculated by the security context function, so that whether the role assigned by the user is activated or not is determined. After the user is activated by the assigned role, entering step 4;

step 4: when the user accesses the resource, the security level of the user is calculated by the value of the security context, so that the user can only access a part of the original resource, and the partial access to the resource is realized.

In this embodiment, the following preferred scheme may be adopted to implement the step 1:

(101) Carrying out security level division on the resources, wherein the security level division comprises a level 0 and other levels, the security data of the level 0 of the certain resource represents that a user can freely access, and the data of the other levels realize partial access according to the value of the security context function;

(102) Generally, the 0 level comprises non-confidential public documents and public resources, the system can assign insensitive resources to the 0 level, and the security levels are distinguished according to the privacy degree of the resources, and the more sensitive the data is, the higher the security level is.

In this embodiment, the following preferred scheme may be adopted to implement the step 2:

the workflow of the context resolver is as follows: the context analyzer collects context information in the cloud environment, such as time context, space context, temporary context and the like, and updates the context information in real time, so that the influence of the change of the context on the authorization process is fully considered.

In this embodiment, the following preferred scheme may be adopted to implement the step 3:

(301) When a user applies for a certain role, the role distributed according to personal information of the user becomes a session role;

(302) If the user meets the context constraint condition of the system on the role, the corresponding value is calculated by the security context function to meet the value specified by the system, the role is started, and the session role is activated. Otherwise, access is denied.

In this embodiment, the following preferred scheme may be adopted to implement the step 4:

(401) When a user applies for accessing resources, calculating the security level of the user according to the value of the security context;

(402) If the security level of the user is smaller than the minimum security level required by the applied resource, directly returning to refusal;

(403) The user security level is compared with the security level of each piece of data of the requested resource, and the user is allowed to access the piece of data only when the user security level is equal to or greater than the security level of the data.

Claims (5)

Translated fromChinese

1.基于安全上下文和资源分级的访问控制授权方法，包括以下步骤：1. An access control authorization method based on security context and resource classification, comprising the following steps:(1)定义安全对象，将系统中的资源按照其保护需求的不同，划分为不同安全级别的数据；(1) Define security objects, and divide resources in the system into data of different security levels according to their different protection requirements;(2)由上下文解析器收集云环境中的上下文信息，对上下文信息进行实时的更新。当用户进入系统申请访问资源时，进入步骤(3)；(2) The context information in the cloud environment is collected by the context parser, and the context information is updated in real time. When the user enters the system to apply for access to resources, enter step (3);(3)用户在被分配角色时，由安全上下文函数计算得出对应的数值，从而决定用户被分配的角色是否激活。当用户被分配角色激活后，进入步骤(4)；(3) When a user is assigned a role, the corresponding value is calculated by the security context function to determine whether the assigned role of the user is activated. When the user is activated by the assigned role, enter step (4);(4)当用户访问资源时，此时由安全上下文的值，计算出用户的安全级别，从而使用户只能访问原资源的一部分，实现对资源的部分访问。(4) When a user accesses a resource, the user's security level is calculated from the value of the security context, so that the user can only access a part of the original resource and realize partial access to the resource.2.根据权利要求1所述基于安全上下文和资源分级的访问控制授权方法，其特征在于，步骤(1)的具体过程如下：2. The access control authorization method based on security context and resource classification according to claim 1, wherein the specific process of step (1) is as follows:(101)进行资源的安全等级划分，其中包括了0级别和其他级别，某资源0级别安全数据代表用户可以自由访问，其他级别的数据根据安全上下文函数的值来实现部分访问；(101) divide the security level of resources, which includes level 0 and other levels, the level 0 security data of a certain resource means that the user can freely access, and the data of other levels can be partially accessed according to the value of the security context function;(102)一般来说，0级别包括非涉密的公共文档与公共资源，系统可以将不敏感的资源赋值为0级别，按照资源隐私程度区分安全级别，数据越敏感安全级别越高。(102) Generally speaking, level 0 includes non-confidential public documents and public resources. The system can assign insensitive resources to level 0, and differentiate security levels according to the degree of resource privacy. The more sensitive the data, the higher the security level.3.根据权利要求1所述基于安全上下文和资源分级的访问控制授权方法，其特征在于，在步骤(2)中，上下文解析器实时地搜集云环境中的上下文信息，如时间上下文、空间上下文、临时上下文等，并进行实时更新，充分考虑上下文的变化对授权过程的影响。3. The access control authorization method based on security context and resource classification according to claim 1, characterized in that, in step (2), the context resolver collects context information in the cloud environment in real time, such as time context, space context , temporary context, etc., and update them in real time, fully considering the impact of context changes on the authorization process.4.根据权利要求1所述基于安全上下文和资源分级的访问控制授权方法，其特征在于，在步骤(3)中的具体过程如下：4. The access control authorization method based on security context and resource classification according to claim 1, wherein the specific process in step (3) is as follows:(301)当用户申请某一角色时，根据用户的个人信息分配的角色就成为了会话角色；(301) When a user applies for a certain role, the role allocated according to the user's personal information becomes a session role;(302)如果用户满足系统对角色的上下文约束条件，由安全上下文函数计算得出对应的数值满足系统规定的数值，则启用该角色，此会话角色才被激活。否则拒绝访问。(302) If the user satisfies the system's context constraints on the role, and the corresponding value calculated by the security context function satisfies the value specified by the system, the role is enabled, and the session role is activated. Otherwise access is denied.5.根据权利要求1所述基于安全上下文和资源分级的访问控制授权方法，其特征在于，步骤(4)的具体过程如下：5. The access control authorization method based on security context and resource classification according to claim 1, wherein the specific process of step (4) is as follows:(401)用户申请访问资源时，根据安全上下文的数值，计算出用户的安全级别；(401) When a user applies for accessing a resource, calculate the user's security level according to the value of the security context;(402)若用户的安全级别小于所申请资源要求的最小安全级别，则直接返回拒绝；(402) If the security level of the user is less than the minimum security level required by the applied resource, then directly return rejection;(403)将用户安全级别与所申请资源的各个部分数据的安全级别进行比较，只有当用户的安全级别大于等于数据的安全级别时，才允许用户访问该部分数据。(403) Compare the security level of the user with the security level of each part of the applied resource data, and only when the security level of the user is greater than or equal to the security level of the data, the user is allowed to access the part of the data.