CN104333542A - Cloud computing access control system and method - Google Patents

Cloud computing access control system and method Download PDF

Info

Publication number
CN104333542A
CN104333542A CN201410570687.2A CN201410570687A CN104333542A CN 104333542 A CN104333542 A CN 104333542A CN 201410570687 A CN201410570687 A CN 201410570687A CN 104333542 A CN104333542 A CN 104333542A
Authority
CN
China
Prior art keywords
user
module
access control
request
access
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201410570687.2A
Other languages
Chinese (zh)
Inventor
张勇平
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Individual
Original Assignee
Individual
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Individual filed Critical Individual
Priority to CN201410570687.2A priority Critical patent/CN104333542A/en
Publication of CN104333542A publication Critical patent/CN104333542A/en
Pending legal-status Critical Current

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101Access control lists [ACL]
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for authentication of entities
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network arrangements or protocols for supporting network services or applications
    • H04L67/01Protocols
    • H04L67/10Protocols in which an application is distributed across nodes in the network
    • H04L67/1097Protocols in which an application is distributed across nodes in the network for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)

Abstract

The invention relates to a cloud computing access control system and method. The cloud computing access control system comprises a user access module which is used for realizing that a user sends a login request to a server of a cloud computing provider, the server responding to the login request of the user, and comprises an identity authentication module and a user management module; an access control module which is used for converting the login request of the user into an XACML format request and controlling and managing access right; a resource service management module which is used for managing different user access resources and monitoring and recording information of the user in the using process for log management; and an application service management module which is for initiating a call request to the resource service management module through a public interface, and comprises a resource service login module, a resource service deleting module and a resource service calling module. Through the organic integration of the monitoring mechanism and the XACML, flexibility of the authorization is enhanced; and the cloud computing access control system has fine grain performance, dynamic nature, extendibility and more security.

Description

A kind of cloud computing access control system and method
Technical field
The present invention relates to cloud computing, particularly a kind of cloud computing access control system and method.
Background technology
Along with the development of cloud computing; cloud security problem becomes more and more important; very crucial to safeguard protections such as the confidentiality of user data, integrality, isolations in cloud computing environment; high in the clouds will realize the security protection of user side mass data; wherein access control technology is crucial; the flexible shape of mandate of existing access control system and extensibility are not strong, limit the extensive use of cloud computing.
Summary of the invention
The invention provides a kind of cloud computing access control system and method, with the flexible shape of the mandate improving access control system and extensibility.
In order to solve the problems of the technologies described above, a kind of cloud computing access control system, comprising:
User Access Module: for realizing the server transmission logging request of user to cloud computing provider, server responds the logging request of this user;
Access control module: for the logging request of described user is converted into XACML formatted request, and control and management access rights;
Resource service administration module: for managing different user access resources, the information log management of monitoring record user use procedure;
Application service management module: initiate call request to resource service administration module by an open Interface realization.
The invention has the beneficial effects as follows: application monitoring mechanism and XACML organically blend to strengthen the flexibility of mandate, and this cloud computing access control system has fine granularity, dynamic, extensibility and has more fail safe.
Further, described User Access Module comprises:
Authentication module: for verifying the identity of log on request user;
User management module: for management and the control of the information to user.
Further, described access control module comprises:
Access control policy implements module: for XACML formatted request is sent to access control decision module;
Access control decision module: for inquiring about the attribute of described user to tactical management point module according to XACML formatted request;
Tactical management point module: for providing strategy support to access control decision module, by the assessment of access control decision module to strategy, return assessment result and implement resume module to access control policy;
Access control information management point module: for providing the attribute query result of user to access control decision module.
Further, described access control policy enforcement module comprises:
Monitor module: for implementing to process the request of user, whether the environmental information of check system, the authorization value of user are consistent with authorising conditional, as found change, again sending request to access control decision module, requiring that access control decision module is reappraised to decision-making;
Update module: for the change of real-time supervisory user attribute, if when the authority of user does not meet the requirement of authority execution, announcement server suspends subscriber authorisation, and corresponding information is issued user.
Further, described access control decision module comprises:
Authorization rule module: for according to the attribute of user and service regeulations inspection access whether legal;
Condition module: utilize service regeulations and contextual information to determine whether the condition of authorization requests meets;
Evaluation module: together with condition module, Policy evaluation is carried out to the access request of main body in conjunction with authorization rule module.
Further, described application service management module comprises:
Application service Registering modules: for the application service information of the reference address of user's registration resource management service, functional description, access mode;
Application service removing module: for deleting the application service information of user;
Application service invocation module: for initiating call request by application service information to resource service administration module.
Adopting the beneficial effect of above-mentioned further scheme to be: by monitoring module access control authority more neatly, reminding and guiding user to provide the condition of necessity to meet access rights; Carrying out Policy evaluation to the access request of main body by authorization rule module, condition module together with voluntary module, is that access control is more safe and reliable.
The present invention also provides a kind of cloud computing access control method, comprises user access control step and user access control step:
User access control step comprises:
Step S1: user states a key proving identity, is stored in described key K EY in the USB Key of user side with in the server of cloud computing provider;
Step S2: user sends logging request to the server of cloud computing provider, and server responds the request of this user, and described server returns to described user random number X, X and a KEY and obtains informative abstract f through MD5 algorithm;
Step S3: informative abstract f is returned to described server, described server carries out MD5 computing by being stored in local random number X with the secret key KEY stored in the server;
Step S4: if when the operation result of described server end is identical with the informative abstract f of described user side, then think that user side is a legal user, otherwise be disabled user;
Access control step comprises:
Conduct interviews the enforcement of control strategy, user's logging request is converted into XACML formatted request, described XACML formatted request is sent to access decision control point, implements corresponding permission or refusal according to the result returned after many Policy evaluations.
Further, the enforcement of control strategy of conducting interviews described in also comprises access and monitors:
The request of real-time process user, whether the environmental information of check system, the authorization value of user are consistent with authorising conditional, as found change, again send request to access decision control point, require to ask that Decision Control point is reappraised to decision-making.
The invention has the beneficial effects as follows: by the double verification of user identity, enhance the fail safe of access control system, application monitoring mechanism and XACML organically blend the flexibility strengthening mandate, and this cloud computing access control system has fine granularity, dynamic, extensibility; By monitoring module access control authority more neatly, reminding and guiding user to provide the condition of necessity to meet access rights.
Accompanying drawing explanation
Fig. 1 is cloud computing access control system the general frame of the present invention,
Fig. 2 is the flow chart of user access control of the present invention.
Embodiment
Below in conjunction with drawings and Examples, the present invention is further illustrated.
Fig. 1 is cloud computing access control system the general frame of the present invention, comprising:
User Access Module: for realizing the server transmission logging request of user to cloud computing provider, server responds the logging request of this user;
Access control module: for the logging request of described user is converted into XACML formatted request, and control and management access rights;
Resource service administration module: for managing different user access resources, the information log management of monitoring record user use procedure;
Application service management module: initiate call request to resource service administration module by an open Interface realization.
User Access Module comprises:
Authentication module: for verifying the identity of log on request user;
User management module: for management and the control of the information to user.
Access control module comprises:
Access control policy implements module: for XACML formatted request is sent to access control decision module;
Access control decision module: for inquiring about the attribute of described user to tactical management point module according to XACML formatted request;
Tactical management point module: for providing strategy support to access control decision module, by the assessment of access control decision module to strategy, return assessment result and implement resume module to access control policy;
Access control information management point module: for providing the attribute query result of user to access control decision module.
Access control policy is implemented module and is comprised:
Monitor module: for implementing to process the request of user, whether the environmental information of check system, the authorization value of user are consistent with authorising conditional, as found change, again sending request to access control decision module, requiring that access control decision module is reappraised to decision-making;
Update module: for the change of real-time supervisory user attribute, if when the authority of user does not meet the requirement of authority execution, announcement server suspends subscriber authorisation, and corresponding information is issued user.
Access control decision module comprises:
Authorization rule module: for according to the attribute of user and service regeulations inspection access whether legal;
Condition module: utilize service regeulations and contextual information to determine whether the condition of authorization requests meets;
Evaluation module: together with condition module, Policy evaluation is carried out to the access request of main body in conjunction with authorization rule module.
Application service management module comprises:
Resource service Registering modules: for the application service information of the reference address of user's registration resource management service, functional description, access mode;
Resource service removing module: for deleting the application service information of user;
Resource service calling module: for initiating call request by application service information to resource service administration module.
The invention has the beneficial effects as follows: application monitoring mechanism and XACML organically blend to strengthen the flexibility of mandate, and this cloud computing access control system has fine granularity, dynamic, extensibility and has more fail safe; By monitoring module access control authority more neatly, reminding and guiding user to provide the condition of necessity to meet access rights; Carrying out Policy evaluation to the access request of main body by authorization rule module, condition module together with voluntary module, is that access control is more safe and reliable.
The present invention also provides a kind of cloud computing access control method, comprises user access control step and user access control step:
Fig. 2 is the flow chart of user access control of the present invention,
User access control step comprises:
Step S1: user states a key proving identity, is stored in described secret key KEY in the USB Key of user side with in the server of cloud computing provider;
Step S2: user sends logging request to the server of cloud computing provider, and server responds the request of this user, and described server returns to described user random number X, X and a KEY and obtains informative abstract f through MD5 algorithm;
Step S3: informative abstract f is returned to described server, described server carries out MD5 computing by being stored in local random number X with the secret key KEY stored in the server;
Step S4: if when the operation result of described server end is identical with the informative abstract f of described user side, then think that user side is a legal user, otherwise be disabled user;
Access control step comprises:
Conduct interviews the enforcement of control strategy, user's logging request is converted into XACML formatted request, described XACML formatted request is sent to access decision control point, implements corresponding permission or refusal according to the result returned after many Policy evaluations.
Further, the enforcement of control strategy of conducting interviews described in also comprises access and monitors:
The request of real-time process user, whether the environmental information of check system, the authorization value of user are consistent with authorising conditional, as found change, again send request to access decision control point, require to ask that Decision Control point is reappraised to decision-making.
The invention has the beneficial effects as follows: by the double verification of user identity, enhance the fail safe of access control system, application monitoring mechanism and XACML organically blend the flexibility strengthening mandate, and this cloud computing access control system has fine granularity, dynamic, extensibility; By monitoring module access control authority more neatly, reminding and guiding user to provide the condition of necessity to meet access rights.
Be described in detail cloud computing access control system of the present invention and method above, apply specific case herein and set forth principle of the present invention and execution mode, the explanation of above embodiment just understands core concept of the present invention for helping; Meanwhile, for one of ordinary skill in the art, according to thought of the present invention, all will change in specific embodiments and applications, in sum, this description should not be construed as limitation of the present invention.

Claims (8)

1. a cloud computing access control system, is characterized in that, comprising:
User Access Module: for realizing the server transmission logging request of user to cloud computing provider, server responds the logging request of this user;
Access control module: for the logging request of described user is converted into XACML formatted request, and control and management access rights;
Resource service administration module: for managing different user access resources, the information log management of monitoring record user use procedure;
Application service management module: for initiating call request by an open Interface realization to resource service administration module.
2. cloud computing access control system according to claim 1, is characterized in that, described User Access Module comprises:
Authentication module: for verifying the identity of log on request user;
User management module: for management and the control of the information to user.
3. cloud computing access control system according to claim 1, is characterized in that, described access control module comprises:
Access control policy implements module: for XACML formatted request is sent to access control decision module;
Access control decision module: for inquiring about the attribute of described user to tactical management point module according to XACML formatted request;
Tactical management point module: for providing strategy support to access control decision module, by the assessment of access control decision module to strategy, return assessment result and implement resume module to access control policy;
Access control information management point module: for providing the attribute query result of user to access control decision module.
4. cloud computing access control system according to claim 3, is characterized in that, described access control policy is implemented module and comprised:
Monitor module: for implementing to process the request of user, whether the environmental information of check system, the authorization value of user are consistent with authorising conditional, as found change, again sending request to access control decision module, requiring that access control decision module is reappraised to decision-making;
Update module: for the change of real-time supervisory user attribute, if when the authority of user does not meet the requirement of authority execution, announcement server suspends subscriber authorisation, and corresponding information is issued user.
5. cloud computing access control system according to claim 1, is characterized in that, described access control decision module comprises:
Authorization rule module: for according to the attribute of user and service regeulations inspection access whether legal;
Condition module: utilize service regeulations and contextual information to determine whether the condition of authorization requests meets;
Evaluation module: together with condition module, Policy evaluation is carried out to the access request of main body in conjunction with authorization rule module.
6. cloud computing access control system according to claim 1, is characterized in that, described application service management module comprises:
Application service Registering modules: for the application service information of the reference address of user's registration resource management service, functional description, access mode;
Application service removing module: for deleting the application service information of user;
Application service invocation module: for initiating call request by application service information to resource service administration module.
7. a cloud computing access control method, is characterized in that, comprises user access control step and user access control step:
User access control step comprises:
Step S1: user states a key proving identity, is stored in described key K EY in the USB Key of user side with in the server of cloud computing provider;
Step S2: user sends logging request to the server of cloud computing provider, and server responds the request of this user, and described server returns to described user random number X, X and a KEY and obtains informative abstract f through MD5 algorithm;
Step S3: informative abstract f is returned to described server, described server carries out MD5 computing by being stored in local random number X with the secret key KEY stored in the server;
Step S4: if when the operation result of described server end is identical with the informative abstract f of described user side, then think that user side is a legal user, otherwise be disabled user;
Access control step comprises: the enforcement of the control strategy that conducts interviews, user's logging request is converted into XACML formatted request, described XACML formatted request is sent to access decision control point, implements corresponding permission or refusal according to the result returned after many Policy evaluations.
8. cloud computing access control method according to claim 7, is characterized in that, described in the conduct interviews enforcement of control strategy also comprise access and monitor:
The request of real-time process user, whether the environmental information of check system, the authorization value of user are consistent with authorising conditional, as found change, again send request to access decision control point, require to ask that Decision Control point is reappraised to decision-making.
CN201410570687.2A 2014-10-23 2014-10-23 Cloud computing access control system and method Pending CN104333542A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201410570687.2A CN104333542A (en) 2014-10-23 2014-10-23 Cloud computing access control system and method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201410570687.2A CN104333542A (en) 2014-10-23 2014-10-23 Cloud computing access control system and method

Publications (1)

Publication Number Publication Date
CN104333542A true CN104333542A (en) 2015-02-04

Family

ID=52408194

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201410570687.2A Pending CN104333542A (en) 2014-10-23 2014-10-23 Cloud computing access control system and method

Country Status (1)

Country Link
CN (1) CN104333542A (en)

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106295357A (en) * 2016-08-29 2017-01-04 安徽云图信息技术有限公司 Information security evaluation and service cloud platform
CN106790134A (en) * 2016-12-28 2017-05-31 浙江宇视科技有限公司 The access control method and Security Policy Server of a kind of video monitoring system
CN106850686A (en) * 2017-03-25 2017-06-13 广州硕点电子科技有限公司 A kind of cloud computing system
US9733922B2 (en) 2015-07-06 2017-08-15 International Business Machines Corporation Smarter operating systems: file system events
CN107241345A (en) * 2017-06-30 2017-10-10 西安电子科技大学 Cloud computing resources management method based on UKey
CN108737393A (en) * 2018-05-07 2018-11-02 萍乡学院 A kind of cloud computing access control system and method
CN108924120A (en) * 2018-06-28 2018-11-30 电子科技大学 A kind of dynamic accesses control method of multi-dimensional state perception
CN109450919A (en) * 2018-11-29 2019-03-08 景小洲 A kind of data safety reinforcing platform
CN109495500A (en) * 2018-12-14 2019-03-19 北京威努特技术有限公司 A kind of double factor authentication method based on smart phone
CN114422183A (en) * 2021-12-13 2022-04-29 北京思特奇信息技术股份有限公司 Micro-service access control method, system and device based on security attribute
CN114422183B (en) * 2021-12-13 2024-07-02 北京思特奇信息技术股份有限公司 Micro-service access control method, system and device based on security attribute

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050166260A1 (en) * 2003-07-11 2005-07-28 Christopher Betts Distributed policy enforcement using a distributed directory
CN101398771A (en) * 2008-11-18 2009-04-01 中国科学院软件研究所 Distributed system access control method based on component and access control system
CN102163267A (en) * 2010-02-22 2011-08-24 成都市华为赛门铁克科技有限公司 Solid state disk as well as method and device for secure access control thereof
CN102404347A (en) * 2011-12-28 2012-04-04 南京邮电大学 Mobile internet access authentication method based on public key infrastructure
CN103198361A (en) * 2013-03-09 2013-07-10 西安电子科技大学 Extensible access control markup language (XACML) strategy assessment engine system based on various optimization mechanisms
CN103327002A (en) * 2013-03-06 2013-09-25 西安电子科技大学 Cloud storage access control system based on attribute
CN104009959A (en) * 2013-02-22 2014-08-27 中国科学院软件研究所 XACML-based verifiable cloud access control method

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050166260A1 (en) * 2003-07-11 2005-07-28 Christopher Betts Distributed policy enforcement using a distributed directory
CN101398771A (en) * 2008-11-18 2009-04-01 中国科学院软件研究所 Distributed system access control method based on component and access control system
CN102163267A (en) * 2010-02-22 2011-08-24 成都市华为赛门铁克科技有限公司 Solid state disk as well as method and device for secure access control thereof
CN102404347A (en) * 2011-12-28 2012-04-04 南京邮电大学 Mobile internet access authentication method based on public key infrastructure
CN104009959A (en) * 2013-02-22 2014-08-27 中国科学院软件研究所 XACML-based verifiable cloud access control method
CN103327002A (en) * 2013-03-06 2013-09-25 西安电子科技大学 Cloud storage access control system based on attribute
CN103198361A (en) * 2013-03-09 2013-07-10 西安电子科技大学 Extensible access control markup language (XACML) strategy assessment engine system based on various optimization mechanisms

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
史毓达等: "基于XACML的Web服务访问控制模型", 《计算机应用研究》 *
徐晓春等: "基于XACML的Web服务访问控制模型", 《计算机工程》 *
曾骏: "《面向服务环境中基于属性和协商机制的访问控制研究及应用》", 《中国优秀硕士学位论文全文数据库 信息科技辑》 *

Cited By (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9733922B2 (en) 2015-07-06 2017-08-15 International Business Machines Corporation Smarter operating systems: file system events
CN106295357A (en) * 2016-08-29 2017-01-04 安徽云图信息技术有限公司 Information security evaluation and service cloud platform
CN106790134A (en) * 2016-12-28 2017-05-31 浙江宇视科技有限公司 The access control method and Security Policy Server of a kind of video monitoring system
CN106790134B (en) * 2016-12-28 2021-01-29 浙江宇视科技有限公司 Access control method of video monitoring system and security policy server
CN106850686A (en) * 2017-03-25 2017-06-13 广州硕点电子科技有限公司 A kind of cloud computing system
CN107241345B (en) * 2017-06-30 2020-07-17 西安电子科技大学 Cloud computing resource management method based on UKey
CN107241345A (en) * 2017-06-30 2017-10-10 西安电子科技大学 Cloud computing resources management method based on UKey
CN108737393A (en) * 2018-05-07 2018-11-02 萍乡学院 A kind of cloud computing access control system and method
CN108924120A (en) * 2018-06-28 2018-11-30 电子科技大学 A kind of dynamic accesses control method of multi-dimensional state perception
CN108924120B (en) * 2018-06-28 2020-09-25 电子科技大学 Multi-dimensional state perception dynamic access control method
CN109450919A (en) * 2018-11-29 2019-03-08 景小洲 A kind of data safety reinforcing platform
CN109495500A (en) * 2018-12-14 2019-03-19 北京威努特技术有限公司 A kind of double factor authentication method based on smart phone
CN114422183A (en) * 2021-12-13 2022-04-29 北京思特奇信息技术股份有限公司 Micro-service access control method, system and device based on security attribute
CN114422183B (en) * 2021-12-13 2024-07-02 北京思特奇信息技术股份有限公司 Micro-service access control method, system and device based on security attribute

Similar Documents

Publication Publication Date Title
CN104333542A (en) Cloud computing access control system and method
Chadwick et al. A cloud-edge based data security architecture for sharing and analysing cyber threat information
US9639678B2 (en) Identity risk score generation and implementation
Khan et al. Towards cloud based smart cities data security and privacy management
US9450945B1 (en) Unified access controls for cloud services
Alani et al. Security challenges in the industry 4.0 era
Barka et al. Securing the web of things with role-based access control
CN106341428A (en) Cross-domain access control method and system
CN104202296A (en) Trusted security enhancement method for domestic operating system
Yahya et al. Using goal-question-metric (GQM) approach to assess security in cloud storage
CN105308614A (en) Policy enforcement delays
Anand et al. Data security and privacy functions in fog computing for healthcare 4.0
Mythili et al. Trust management approach for secure and privacy data access in cloud computing
Farroha et al. Challenges of “operationalizing” dynamic system access control: Transitioning from ABAC to RAdAC
Musonda et al. Security, Privacy and Integrity in Internet of Things–A Review
US8505068B2 (en) Deriving express rights in protected content
Kaur et al. Enhancing Features of Cloud Computing Using Cloud Access Security Brokers to Avoid Data Breaches
Kim et al. Building sustainable software by preemptive architectural design using tactic-equipped patterns
Ahmadi Mehri et al. Flexible privacy and high trust in the next generation internet: The use case of a cloud-based marketplace for AI
Mir et al. Zero trust user access and identity security in smart grid based scada systems
Shibli et al. Access control as a service in cloud: challenges, impact and strategies
Zheng et al. A framework for protecting personal information and privacy
d'Aliberti et al. Privacy-Enhancing Technologies for Artificial Intelligence-Enabled Systems
Centonze Cloud auditing and compliance
Tarigonda et al. Providing data security in cloud computing using novel and mixed agent based approach

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication

Application publication date: 20150204

RJ01 Rejection of invention patent application after publication