CN101321064A - Information system access control method and apparatus based on digital certificate technique - Google Patents

Information system access control method and apparatus based on digital certificate technique Download PDF

Info

Publication number
CN101321064A
CN101321064A CNA2008100406749A CN200810040674A CN101321064A CN 101321064 A CN101321064 A CN 101321064A CN A2008100406749 A CNA2008100406749 A CN A2008100406749A CN 200810040674 A CN200810040674 A CN 200810040674A CN 101321064 A CN101321064 A CN 101321064A
Authority
CN
China
Prior art keywords
user
access control
random number
access
digital certificate
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CNA2008100406749A
Other languages
Chinese (zh)
Inventor
高建强
顾国强
王占宏
孙圭宁
高念高
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
SHANGHAI ZHONGHENG INFORMATION TECHNOLOGY Co Ltd
Original Assignee
SHANGHAI ZHONGHENG INFORMATION TECHNOLOGY Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by SHANGHAI ZHONGHENG INFORMATION TECHNOLOGY Co Ltd filed Critical SHANGHAI ZHONGHENG INFORMATION TECHNOLOGY Co Ltd
Priority to CNA2008100406749A priority Critical patent/CN101321064A/en
Publication of CN101321064A publication Critical patent/CN101321064A/en
Pending legal-status Critical Current

Links

Images

Landscapes

  • Storage Device Security (AREA)

Abstract

The invention discloses an information system access control method based on the digital certificate technology and a method, including: setting the digital certificate, defining the access role, establishing the identity identification and endowing the access role with the identity identification, performing the certification on the user requesting to log in and building the access control table through the certificated user. According to method and the device of the invention, on one hand, the digital certificate technology better ensures the safety of the data exchange between the user and the system through the public key and the private key, on the other hand, the method and the device are based on the access control model of the access pole, which establishes the new registering user to the access pole defined without appointing the resource and the operation for the user.

Description

A kind of access control method and device of the information system based on digital certificate technique
Technical field
The present invention relates to the safe practice of data information system, more particularly, relate to a kind of access control method and device of the information system based on digital certificate technique.
Background technology
At present increasing need of work uses various information systems, and the fail safe of information system more and more obtains people's attention, for example aspect the access control of information system, just need to pay attention to its fail safe, in an information system, have the different various users of rank, specific user can only visit specific data, if and safety measure is not in place, the user can be occurred so and the data that it should not be visited can be had access to, thereby cause accident such as divulge a secret, cause the loss that is difficult to retrieve just may for country and enterprise.An information system can be supplied with different departments and use with different people, these different departments and different people's demand data is different, this has just determined will create different access rights for the user of different stage, and the visiting demand that so just can satisfy each user can guarantee that also secret data is not leaked.As seen need carry out the design of related security policies for the user capture of information system, thereby reach the purpose that the visit of different user is controlled.
Summary of the invention
The object of the present invention is to provide a kind of access control method and device of the information system based on digital certificate technique, with the purpose that realizes the visit of different user is controlled.
According to a first aspect of the invention, provide a kind of access control method of the information system based on digital certificate technique, may further comprise the steps:
A, initialization system server numeral certificate and customer digital certificate;
The access role of b, the described information system of definition, described access role is the set of described information system different access authority;
C, create identify label, give described identify label the access role of described b step definition to the user of registration;
D, the user who request is landed according to the digital certificate of described a step authenticate;
E, according to the User Identity of described c step, the user by authentication is set up access control list, described user's access control is carried out in described access control list.
Described d step comprises:
1) to the user's send server digital certificate and the random number of asking debarkation authentication, the user's signature random number, and, customer digital certificate, signature random number and encrypted random number are returned to system server with server numeral certificate encrypted random number;
2) system server is deciphered described random number, and random number after will deciphering and the comparison of former random number, if then authentification of user success of unanimity, if the authentication of inconsistent then refusal.
Described a step has also defined the security classification of the data of described information system database, described data and the described access role coupling that has defined security classification.
The key of the described customer digital certificate of described a step is stored in the memory of client, and the key of described system server digital certificate is stored in the memory of system server.
Described access control list comprises described access role and the described data of security classification and the association rule between the described identify label three of having defined, and described access control list is stored in the database of described information system.
The legitimacy of the access destination of described identify label and described identify label is verified in described access control list.
According to a second aspect of the invention, provide a kind of access control apparatus of the information system based on digital certificate technique, comprising:
Registering modules, described Registering modules provides registration and initialization system server numeral certificate and customer digital certificate for the user of described information system;
Definition module defines the access role of described information system, creates identify label to the user of registration, gives described identify label with described access role, and described access role is the set of described information system different access authority;
Control module, the user that the digital certificate that described control module is set according to described Registering modules lands request authenticates, and according to described identify label to by the authentication the user set up access control list, described user's access control is carried out in described access control list.
The user that described control module is landed request authenticates and may further comprise the steps:
1) to the user's send server digital certificate and the random number of asking debarkation authentication, the user's signature random number, and, customer digital certificate, signature random number and encrypted random number are returned to system server with server numeral certificate encrypted random number;
2) system server is deciphered described random number, and random number after will deciphering and the comparison of former random number, if then authentification of user success of unanimity, if the authentication of inconsistent then refusal.
Described definition module has also defined the security classification of the data of described information system database, described data and the described access role coupling that has defined security classification.
Described access control list comprises described access role and the described data of security classification and the association rule between the described identify label three of having defined, and described access control list is stored in the database of described information system.
Adopt the access control method and the device of a kind of information system based on digital certificate technique of the present invention, method of the present invention and device are based on digital certificate technique on the one hand, digital certificate technique can better guarantee the fail safe of exchanges data between user and the system by its PKI and key, this method and device are based on the access control model of access role on the other hand, promptly define access role earlier, give the validated user of registration with this visit role then, set up user's access control list again, " user capture role operating data " is associated, realize non-from the principal mode access control policy, use can alleviate safety management work based on the access control model of access role, this mode only need be created new registered user to defined access role and get final product, need not to the user reassigns resource and operation, thereby simplified empowerment management work.
Description of drawings
Fig. 1 is the schematic flow sheet of access control method of the present invention;
Fig. 2 is the principle schematic of access control apparatus of the present invention;
Fig. 3 is the workflow schematic diagram of access control method of the present invention and device.
Embodiment
Further specify technical scheme of the present invention below in conjunction with drawings and Examples.
With reference to figure 1, Fig. 1 is the schematic flow sheet of access control method 100 of the present invention, may further comprise the steps:
101, initialization system server and user's digital certificate.
PKI (open key system) is application PKI notion and public key cryptography technology extensively implemented and provided informatization security and trust service for the whole society a security infrastructure.In PKI, in order to ensure the user and hold the correctness of key, need one credible and also independently the third-party institution serve as ca authentication center (Certification Authority), the real identity of confirming to claim the entity that has public-key cryptography.Confirm a public-key cryptography, CA at first makes one " digital certificate ", it comprises the partial information of user identity and the public-key cryptography that the user held, the key of CA utilization itself adds digital signature for digital certificate then, the key of described customer digital certificate (private key) is stored in the memory of client, the key of described system server digital certificate (private key) is stored in the memory of system server, and such digital certificate that belongs to this entity has just been finished.
102, the access role of the described information system of definition.Described access role is the set of described information system different access authority, also defined the security classification of the data of described information system database in one embodiment, these have been defined the data and the access role coupling of security classification, and promptly which type of access role can be visited the data of which type of security classification.
103, create identify label and give access role.User to registration creates identify label, gives described identify label with described access role, and the identify label of establishment is unique existence.Give identify label with access role, make the corresponding corresponding access role of each identify label, each identify label has just had the access rights to described information system access like this.
104, according to digital certificate the user is authenticated.May further comprise the steps:
1) to the user's send server digital certificate and the random number of asking debarkation authentication, the user's signature random number, and, customer digital certificate, signature random number and encrypted random number are returned to system server with server numeral certificate encrypted random number;
2) system server is deciphered described random number, and random number after will deciphering and the comparison of former random number, if then authentification of user success of unanimity, if the authentication of inconsistent then refusal.
For system server, at first, system server will be accepted the service request of a lot of clients, and this will set up the suitable data storehouse, so that preserve user's data information, and maintains easily and manages, and functions such as searching modification is provided.Also to provide Database Backup equipment, in case data are destroyed.Secondly, the webpage of server end will carry out suitable modification, the interface that provides the user to land, and the information after the explicit user login satisfies some basic demands of user.Once more, server end will be registered COM dynamic link file, and the digital certificate management device is installed, to guarantee the landing ground webpage and program can correctly be called built-in functions such as SafeEngine.
For user (client), the digital certificate management device is installed, private key can be packed into and correctly to obtain certificate.To use hardware encipher equipment for level of security than the highland user, for example bright magnificent USB rod etc.The digital certificate management device can download and install from webpage by the CAB bag.
When the user side game server, the server end initialization obtains server numeral certificate, and produces a random number, then server certificate and random number is issued client.Client initiating hardware encryption device, obtain the customer digital certificate and the described random number of client, the authentication server digital certificate, checking by the back user with the described random number of its private key signature, and encrypt described random number with server numeral certificate, then customer digital certificate, random number signature and random number encryption are issued server.
After server is received the data of returning,, and take out server numeral certificate with its private key initialization.Checking client digital certificate then, checking is by the private key decrypted random number of back with oneself, and the random number signature of receiving is verified with client numeral certificate, whether the random number that reexamines deciphering is consistent with the original random number that sends, if then authentification of user success of unanimity, if inconsistent then refusal authentication.
105, set up access control list.The user according to described user's identify label, sets up access control list to the user by authentication by after authenticating, and described access control list is carried out described user's access control and verified the legitimacy of the access destination of described identify label and described identify label.Described access control list comprises described access role and the described data of security classification and the association rule between the described identify label three of having defined, and described access control list is stored in the database of described information system.
With reference to figure 2, described access control apparatus comprises with lower module:
Registering modules 201, described Registering modules 201 provides registration and initialization system server numeral certificate and customer digital certificate for the user of described information system;
Definition module 202 defines the access role of described information system, creates identify label to the user of registration, gives described identify label with described access role, and described access role is the set of described information system different access authority; Described definition module has also defined the security classification of the data of described information system database, described data and the described access role coupling that has defined security classification.
Control module 203, the user that the digital certificate that described control module 203 is set according to described Registering modules 201 lands request authenticates, and according to described identify label to by the authentication the user set up access control list, described user's access control is carried out in described access control list.Described access control list comprises described access role and the described data of security classification and the association rule between the described identify label three of having defined, and described access control list is stored in the database of described information system.
The user that 203 pairs of requests of described control module are landed carries out the step 104 that verification process is same as described access control method 100, may further comprise the steps:
1) to the user's send server digital certificate and the random number of asking debarkation authentication, the user's signature random number, and, customer digital certificate, signature random number and encrypted random number are returned to system server with server numeral certificate encrypted random number;
2) system server is deciphered described random number, and random number after will deciphering and the comparison of former random number, if then authentification of user success of unanimity, if the authentication of inconsistent then refusal.
Below in conjunction with Fig. 3 the workflow of a specific embodiment of technical scheme of the present invention once is described:
301, user's login (comprising by modes such as IC-cards): system verifies to have only by checking just can enter next step to it.
302, the query interface by browser or foreground system sends query requests.
303, the role of retrieval user forms and relative role authority (user capture role), organizes user's permissions list (access control list).
304, check the target (tables of data) of inquiry, check simultaneously the user business, Domain Properties whether meet business, the region restriction of query aim, do not satisfy the prompting of then returning " not having authority ", and block the field that this user does not have the authority retrieval.
305, the record level authority restriction that will be correlated with (as addressable record level of confidentiality restriction) is organized query statement as the restrictive condition of inquiry, submits to the integrated information database and inquires about.
306, result of querying database is returned to the user.
In addition, except data locking, when the user carried out each operation, system also will check this user's authority, and determined which function open to this user according to the operating function that this authority had, and which function can not be carried out.
Those of ordinary skill in the art will be appreciated that, above embodiment is used for illustrating the present invention, and be not to be used as limitation of the invention, as long as in connotation scope of the present invention, all will drop in claims scope of the present invention variation, the modification of above embodiment.

Claims (10)

1, a kind of information system access control method based on digital certificate technique is characterized in that, may further comprise the steps:
A, initialization system server numeral certificate and customer digital certificate;
The access role of b, the described information system of definition, described access role is the set of described information system different access authority;
C, create identify label, give described identify label the access role of described b step definition to the user of registration;
D, the user who request is landed according to the digital certificate of described a step authenticate;
E, according to the User Identity of described c step, the user by authentication is set up access control list, described user's access control is carried out in described access control list.
2, access control method as claimed in claim 1 is characterized in that, described d step comprises:
1) to the user's send server digital certificate and the random number of asking debarkation authentication, the user's signature random number, and, customer digital certificate, signature random number and encrypted random number are returned to system server with server numeral certificate encrypted random number;
2) system server is deciphered described random number, and random number after will deciphering and the comparison of former random number, if then authentification of user success of unanimity, if the authentication of inconsistent then refusal.
3. access control method as claimed in claim 2 is characterized in that described a step has also defined the security classification of the data of described information system database, described data and the described access role coupling that has defined security classification.
4, access control method as claimed in claim 2 is characterized in that, the key of the described customer digital certificate of described a step is stored in the memory of client, and described system server digital certificate store is in the memory of system server.
5. access control method as claimed in claim 1, it is characterized in that, described access control list comprises described access role and the described data of security classification and the association rule between the described identify label three of having defined, and described access control list is stored in the database of described information system.
6. access control method as claimed in claim 1 is characterized in that the legitimacy of the access destination of described identify label and described identify label is verified in described access control list.
7. the access control apparatus based on the information system of digital certificate technique is characterized in that, comprising:
Registering modules, described Registering modules provides registration and initialization system server numeral certificate and customer digital certificate for the user of described information system;
Definition module defines the access role of described information system, creates identify label to the user of registration, gives described identify label with described access role, and described access role is the set of described information system different access authority;
Control module, the user that the digital certificate that described control module is set according to described Registering modules lands request authenticates, and according to described identify label to by the authentication the user set up access control list, described user's access control is carried out in described access control list.
8. access control apparatus as claimed in claim 7 is characterized in that, the user that described control module is landed request authenticates and may further comprise the steps:
1) to the user's send server digital certificate and the random number of asking debarkation authentication, the user's signature random number, and, customer digital certificate, signature random number and encrypted random number are returned to system server with server numeral certificate encrypted random number;
2) system server is deciphered described random number, and random number after will deciphering and the comparison of former random number, if then authentification of user success of unanimity, if the authentication of inconsistent then refusal.
9. access control apparatus as claimed in claim 8 is characterized in that described definition module has also defined the security classification of the data of described information system database, described data and the described access role coupling that has defined security classification.
10. access control apparatus as claimed in claim 7, it is characterized in that, described access control list comprises described access role and the described data of security classification and the association rule between the described identify label three of having defined, and described access control list is stored in the database of described information system.
CNA2008100406749A 2008-07-17 2008-07-17 Information system access control method and apparatus based on digital certificate technique Pending CN101321064A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CNA2008100406749A CN101321064A (en) 2008-07-17 2008-07-17 Information system access control method and apparatus based on digital certificate technique

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CNA2008100406749A CN101321064A (en) 2008-07-17 2008-07-17 Information system access control method and apparatus based on digital certificate technique

Publications (1)

Publication Number Publication Date
CN101321064A true CN101321064A (en) 2008-12-10

Family

ID=40180918

Family Applications (1)

Application Number Title Priority Date Filing Date
CNA2008100406749A Pending CN101321064A (en) 2008-07-17 2008-07-17 Information system access control method and apparatus based on digital certificate technique

Country Status (1)

Country Link
CN (1) CN101321064A (en)

Cited By (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101994648A (en) * 2009-08-12 2011-03-30 再生动力系统股份公司 Method and apparatus for access control to installation control systems of wind energy installations
CN102148819A (en) * 2010-12-31 2011-08-10 无锡华御信息技术有限公司 Information leakage-prevention collaborative office security system and method
CN102420690A (en) * 2010-09-28 2012-04-18 上海可鲁系统软件有限公司 Fusion and authentication method and system of identity and authority in industrial control system
CN102571873A (en) * 2010-12-31 2012-07-11 上海可鲁系统软件有限公司 Bidirectional security audit method and device in distributed system
CN102665205A (en) * 2012-04-26 2012-09-12 暨南大学 Access control method for protecting access privacy of user in mobile value-added service system
CN102968599A (en) * 2012-10-25 2013-03-13 北京邮电大学 User-defined access control system and method based on resource publisher
CN103095694A (en) * 2013-01-09 2013-05-08 深圳市文鼎创数据科技有限公司 Control method and device for digital certificate
CN105100044A (en) * 2014-05-09 2015-11-25 通用电气公司 System and method for controlled device access
CN105915535A (en) * 2016-05-24 2016-08-31 北京朋创天地科技有限公司 Virtual resource access control method based on user identity
CN107194269A (en) * 2017-04-01 2017-09-22 山东超越数控电子有限公司 A kind of cipher machine and access control method based on RBAC
CN108390874A (en) * 2018-02-12 2018-08-10 北京工业大学 Access control model and access method based on certificate in network structure
CN109246089A (en) * 2018-08-20 2019-01-18 北京交通大学 A kind of the front and back end separation architecture access control system and method for based role
CN109872238A (en) * 2019-02-26 2019-06-11 重庆大数美联科技有限公司 Transaction in assets system access control method and system based on block chain
CN112182522A (en) * 2019-07-05 2021-01-05 北京地平线机器人技术研发有限公司 Access control method and device
CN114598473A (en) * 2020-11-19 2022-06-07 上海铠射信息科技有限公司 A novel method and device for authentication of networked equipment
CN114650160A (en) * 2020-12-21 2022-06-21 航天信息股份有限公司 Digital certificate processing method and device, storage medium and electronic equipment

Cited By (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101994648B (en) * 2009-08-12 2013-08-21 再生动力系统欧洲公司 Method and apparatus for access control to installation control systems of wind energy installations
CN101994648A (en) * 2009-08-12 2011-03-30 再生动力系统股份公司 Method and apparatus for access control to installation control systems of wind energy installations
CN102420690A (en) * 2010-09-28 2012-04-18 上海可鲁系统软件有限公司 Fusion and authentication method and system of identity and authority in industrial control system
CN102420690B (en) * 2010-09-28 2014-05-21 上海可鲁系统软件有限公司 Fusion and authentication method and system of identity and authority in industrial control system
CN102571873A (en) * 2010-12-31 2012-07-11 上海可鲁系统软件有限公司 Bidirectional security audit method and device in distributed system
CN102148819B (en) * 2010-12-31 2013-12-11 无锡华御信息技术有限公司 Information leakage-prevention collaborative office security system and method
CN102571873B (en) * 2010-12-31 2015-01-28 上海可鲁系统软件有限公司 Bidirectional security audit method and device in distributed system
CN102148819A (en) * 2010-12-31 2011-08-10 无锡华御信息技术有限公司 Information leakage-prevention collaborative office security system and method
CN102665205A (en) * 2012-04-26 2012-09-12 暨南大学 Access control method for protecting access privacy of user in mobile value-added service system
CN102665205B (en) * 2012-04-26 2015-06-24 暨南大学 Access control method for protecting access privacy of user in mobile value-added service system
CN102968599A (en) * 2012-10-25 2013-03-13 北京邮电大学 User-defined access control system and method based on resource publisher
CN102968599B (en) * 2012-10-25 2016-05-04 北京邮电大学 Based on the self-defining access control system of resource publisher and method
CN103095694A (en) * 2013-01-09 2013-05-08 深圳市文鼎创数据科技有限公司 Control method and device for digital certificate
CN105100044A (en) * 2014-05-09 2015-11-25 通用电气公司 System and method for controlled device access
CN105915535A (en) * 2016-05-24 2016-08-31 北京朋创天地科技有限公司 Virtual resource access control method based on user identity
CN107194269A (en) * 2017-04-01 2017-09-22 山东超越数控电子有限公司 A kind of cipher machine and access control method based on RBAC
CN108390874A (en) * 2018-02-12 2018-08-10 北京工业大学 Access control model and access method based on certificate in network structure
CN108390874B (en) * 2018-02-12 2020-08-07 北京工业大学 Certificate-based access control system and access method in network structure
CN109246089A (en) * 2018-08-20 2019-01-18 北京交通大学 A kind of the front and back end separation architecture access control system and method for based role
CN109246089B (en) * 2018-08-20 2020-06-30 北京交通大学 A role-based front-end and back-end separation architecture access control system and method
CN109872238A (en) * 2019-02-26 2019-06-11 重庆大数美联科技有限公司 Transaction in assets system access control method and system based on block chain
CN112182522A (en) * 2019-07-05 2021-01-05 北京地平线机器人技术研发有限公司 Access control method and device
CN114598473A (en) * 2020-11-19 2022-06-07 上海铠射信息科技有限公司 A novel method and device for authentication of networked equipment
CN114650160A (en) * 2020-12-21 2022-06-21 航天信息股份有限公司 Digital certificate processing method and device, storage medium and electronic equipment
CN114650160B (en) * 2020-12-21 2024-05-10 航天信息股份有限公司 Digital certificate processing method and device, storage medium and electronic equipment

Similar Documents

Publication Publication Date Title
CN101321064A (en) Information system access control method and apparatus based on digital certificate technique
US11770261B2 (en) Digital credentials for user device authentication
KR102390108B1 (en) Information processing system and control method therefor
CN103067399B (en) Wireless transmitter/receiver unit
WO2019191214A1 (en) Digital credentials for primary factor authentication
WO2019191213A1 (en) Digital credential authentication
CN103220141B (en) A kind of protecting sensitive data method and system based on group key strategy
KR20170106515A (en) Multi-factor certificate authority
US8700909B2 (en) Revocation of a biometric reference template
CN103152179A (en) Uniform identity authentication method suitable for multiple application systems
CN103986584A (en) Double-factor identity verification method based on intelligent equipment
EP3776421A1 (en) System for credential storage and verification
JP2017225054A (en) Profile data distribution control device, profile data distribution control method, and profile data distribution control program
KR101817152B1 (en) Method for providing trusted right information, method for issuing user credential including trusted right information, and method for obtaining user credential
KR20060032888A (en) Identity information management device through internet and service providing method using same
CN114666168A (en) Decentralized identity certificate verification method and device, and electronic equipment
WO2019191215A1 (en) Digital credentials for secondary factor authentication
CN101321063A (en) System user access management system and method based on digital certificate technique
CN106533693B (en) Access method and device of railway vehicle monitoring and overhauling system
CN102571873A (en) Bidirectional security audit method and device in distributed system
JP2024501326A (en) Access control methods, devices, network equipment, terminals and blockchain nodes
CN104125230A (en) Short message authentication service system and authentication method
CN114036490A (en) Plug-in software interface calls security authentication method, USBKey drive device and authentication system
CN104506480A (en) Cross-domain access control method and system based on marking and auditing combination
JP2023548415A (en) How to stop the protection of objects achieved by protective devices

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C12 Rejection of a patent application after its publication
RJ01 Rejection of invention patent application after publication

Open date: 20081210