WO2016141783A1

WO2016141783A1 - Method for access control, policy acquisition, attribute acquisition and related apparatus

Info

Publication number: WO2016141783A1
Application number: PCT/CN2016/072206
Authority: WO
Inventors: 周巍
Original assignee: 电信科学技术研究院
Priority date: 2015-03-12
Filing date: 2016-01-26
Publication date: 2016-09-15
Also published as: CN106034112B; CN106034112A

Abstract

Disclosed are a method for access control, policy acquisition, attribute acquisition and a related apparatus. The method is used to provide a particular access control mechanism for the oneM2M.The access control method includes: acquiring a first resource read request of a CSE for a policy decision point resource under access control resources, wherein the first resource read request carries information about a request of a sponsor for an access control decision for a target resource in the CSE; according to the first resource read request, sending a second resource read request for the bound policy acquisition point resource, and acquiring an access control policy corresponding to the target resource, wherein the second resource read request carries information about a request for the access control policy of the target resource; and according to the acquired access control policy, determining the access control decision of the sponsor for the target resource and returning the access control decision to the CSE.

Description

Access control, policy acquisition, attribute acquisition method, and related device

This application claims priority from the Chinese Patent Application filed on March 12, 2015, the application number is 201510109267.9, and the application name is "access control, policy acquisition, attribute acquisition method and related devices", the entire contents of which are incorporated by reference. Combined in this application.

Technical field

The present application relates to the field of communications technologies, and in particular, to an access control, a policy acquisition, an attribute acquisition method, and related devices.

Background technique

OneM2M, the Internet of Things standardization organization, is dedicated to developing technical specifications for constructing a common Machine-To-Machine (M2M) Service Layer.

oneM2M implements service layer resource sharing and interaction by employing operations on standard resource trees.

According to the definition of the functional architecture in oneM2M TS-0001, the form of oneM2M resource tree is shown in Figure 1. Among them, CSEBase1 represents a CSE root resource <CSEBase>, CSE1 represents a resource <remoteCSE>, APP1 represents a resource <AE>, CONT1 and CONT2 respectively represent a resource <container>, and ACP1 and ACP2 respectively represent a resource <accessControlPolice>.

Create, query, modify, and delete operations for oneM2M resources.

The resource related to the authorization defined by oneM2M is the access control policy resource <accessControlPolicy>, which defines an Access Control Policy, and the <accessControlPolicy> resource is uniquely identified by the resource identity (ID).

Other resources specify the applicable access control policy through the accessControlPolicyIDs attribute in the resource.

The oneM2M definition has two basic entities:

First, the Application Entity (AE) is located at the application layer, and the entity can implement an M2M application service logic. An application service logic can reside in multiple M2M nodes, or multiple execution instances in a single node. Each execution instance of the application service logic is referred to as an application entity, and each application entity is identified by a unique AE identity (AE-ID).

For example, a fleet tracking application instance, a remote blood glucose monitoring application instance, a remote power metering instance, or a control application instance are all application entities.

Second, Common Service Entity (CSE), a public service entity consists of a set of common service functions in an M2M environment. Public service function through reference point Mca And the reference point Mcc is disclosed to other entities.

The reference point Mcn is used to access the underlying network service entity.

Each public service entity is identified by a unique Public Service Entity Identity (CSE-ID).

The resource tree exists in the CSE defined by the oneM2M system.

OneM2M defines three resource types:

Normal Resource, with specific resource structure and resource attributes;

A virtual resource (Virtual Resource) does not have a specific resource structure and resource attributes, and is mainly used to trigger a specific process;

Announced Resource has a specific resource structure and resource attributes. This resource is a copy of some content in common resources on other entities. The main purpose is to facilitate resource discovery.

The oneM2M TS-0001 defines only the resource structure of the <accessControlPolicy> resource and the structure of the access control policy. The evaluation of the authorization architecture and access control policy is provided in oneM2M TS-0003.

In the authorization architecture shown in Figure 2, the functions of each authorization component are:

Policy Enforcement Point (PEP) coexists with an application system that requires access control and is called by the application system. The PEP generates a corresponding access control decision request according to the user's access request, sends it to a Policy Decision Point (PDP), and determines whether to perform the user's access request according to the access control decision response of the PDP.

A Policy Decision Point (PDP) is responsible for evaluating whether to approve the access control decision request sent by the PEP according to the access control policy, and returning the evaluation result to the PEP through the access control decision response.

The Policy Retrieval Point (PRP) obtains the applicable access control policy according to the policy request provided by the PDP, and returns the obtained access control policy to the PDP.

Policy Information Point (PIP), which acquires attributes related to users, resources, or environments according to PDP requests, such as accessing the user's Internet Protocol (IP) address, resource creator, current time, etc., and then obtaining Various properties are returned to the PDP.

The basic authorization process for oneM2M is as follows:

1. The PEP generates an access control decision request (Access Control Decision Request) according to the user's access request and sends it to the PDP.

2. The PDP sends an Access Control Policy Request to the PRP according to the access control decision request of the PEP;

3. The PDP analyzes the content provided by the access control policy returned by the PRP and the access control decision request of the PEP. If other attributes are required, the Access Control Attribute Request is sent to the PIP, Then go to step 5.

4. The PIP requests to obtain the corresponding access control related attribute according to the access control attribute of the PDP, and returns it to the PDP.

5. The PDP returns to the PEP according to the determined access control policy and through the Access Control Attribute Response.

6. The PEP determines whether to perform the user's access request according to the access control policy in the access control decision response.

OneM2M TS-0003 only gives a high-level description and basic authorization process for the authorization architecture, and does not give a specific access control mechanism, implementation principle or method.

Summary of the invention

The embodiment of the present application provides an access control, a policy acquisition, an attribute acquisition method, and related devices, to provide a specific access control mechanism for oneM2M.

The specific technical solutions provided by the embodiments of the present application are as follows:

In a first aspect, an access control method is provided, including:

Acquiring a first resource read request of the public service entity CSE to the policy decision point resource under the access control resource, where the first resource read request carries the request of the initiator to the access control decision of the target resource in the CSE information;

Sending, by the first resource read request, a second resource read request for the bound policy acquisition point resource, to obtain an access control policy corresponding to the target resource, where the second resource read request carries the right Request information of an access control policy of the target resource;

Determining, by the acquired access control policy, an access control decision of the initiator to the target resource, and returning the access control decision to the CSE;

The access control resource is a common resource under the CSE root resource, and the policy decision point resource and the policy acquisition point resource are respectively virtual resources under the corresponding access control resource.

Optionally, the access control resource has a common attribute of a common resource and a public attribute that specifies an access control policy.

Optionally, after the obtaining the access control policy corresponding to the target resource, determining the access control decision of the initiator to the target resource, the method further includes:

And sending the third resource read request to the bound policy information point resource, and acquiring the attribute information corresponding to the access control policy, where the third resource read request carries the request information of the access control attribute of the access control policy ;

The policy information point resource is a virtual resource under the corresponding access control resource.

Optionally, after acquiring the first resource read request of the public service entity CSE for the policy decision point resource under the access control resource, sending the second resource read of the bound policy acquisition point resource according to the first resource read request Before the request, the method further includes:

And determining, according to the access control policy specified by the access control resource to which the policy decision point resource belongs, to allow the CSE to access the policy decision point resource.

Optionally, after the second resource read request for the bound policy acquisition point resource is sent according to the first resource read request, and the access control policy corresponding to the target resource is obtained, the method further includes:

Obtaining an access control policy specified by the access control resource to which the point resource belongs according to the policy, and determining that the CSE is allowed to access the policy to acquire a point resource.

Optionally, after the third resource read request is sent to the bound policy information point resource, and the attribute information corresponding to the access control policy is obtained, the method further includes:

And determining, according to the access control policy specified by the access control resource to which the policy information point resource belongs, to allow the CSE to access the policy information point resource.

Specifically, determining, by the initiator, an access control decision on the target resource, including:

And determining, according to the access control policy and attribute information corresponding to the access control policy, an access control decision of the initiator to the target resource.

The policy decision point resource, the policy acquisition point resource, and the policy information point resource are respectively located under access control resources under different CSE root nodes;

or,

At least two of the policy decision point resource, the policy acquisition point resource, and the policy information point resource are located under different access control resources under the same CSE root node;

or,

The policy decision point resource, the policy acquisition point resource, and the policy information point resource belong to the same access control resource under the same CSE root node.

In a second aspect, a method for obtaining an access control policy is provided, including:

Obtaining, by the public service entity CSE, a resource read request for a policy acquisition point resource under the access control resource, where the resource read request carries request information of an access control policy of the target resource that the initiator requests to access;

Obtaining an access control policy corresponding to the target resource, and returning to the CSE;

The access control resource is a common resource under the CSE root resource, and the policy acquisition point resource is a virtual resource under the corresponding access control resource.

Optionally, the access control resource has a common attribute of a common resource, and also has a public that specifies an access control policy. Common attribute.

Optionally, the method further includes: after acquiring the resource read request of the policy acquisition point resource of the access control resource by the public service entity CSE, and obtaining the access control policy corresponding to the target resource, the method further includes:

In a third aspect, a method for obtaining an access control attribute is provided, including:

Acquiring a resource read request of the public service entity CSE to the policy information point resource under the access control resource, where the resource read request carries the request information of the access control attribute of the access control policy;

Obtaining attribute information corresponding to the access control policy, and returning the information to the CSE;

The access control resource is a common resource under the CSE root resource, and the policy information point resource is a virtual resource under the corresponding access control resource.

Optionally, the method further includes: after acquiring the resource reading request of the policy information point resource of the access control resource by the public service entity CSE, and obtaining the attribute information corresponding to the access control policy, the method further includes:

In a fourth aspect, a public service entity CSE is provided, including:

a first acquiring module, configured to acquire a first resource reading request of a public service entity CSE for a policy decision point resource under an access control resource, where the first resource reading request carries an initiator to a target in the CSE Resource access control decision request information;

a second acquiring module, configured to send a second resource read request for the bound policy acquisition point resource according to the first resource read request, to obtain an access control policy corresponding to the target resource, where the second resource is read The request carries request information of an access control policy for the target resource;

a processing module, configured to determine, according to the obtained access control policy, an access control decision of the initiator to the target resource, and return the access control decision to the CSE;

Optionally, the third obtaining module is configured to acquire, by the second acquiring module, the access corresponding to the target resource After the control module determines the access control decision of the initiator to the target resource, the third resource read request is sent to the bound policy information point resource, and the attribute information corresponding to the access control policy is obtained. The third resource read request carries request information of an access control attribute of the access control policy;

Optionally, the processing module is further configured to:

After the first obtaining module acquires the first resource reading request of the public service entity CSE to the policy decision point resource under the access control resource, the second obtaining module sends the binding to the second resource according to the first resource reading request. Before the policy acquires the second resource read request for the point resource,

Optionally, the second obtaining module is further configured to:

After the second resource read request for the bound policy acquisition point resource is sent according to the first resource read request, and the access control policy corresponding to the target resource is obtained,

Optionally, the third obtaining module is further configured to:

After the third resource read request is sent to the bound policy information point resource, and the attribute information corresponding to the access control policy is obtained,

Specifically, the processing module is specifically configured to:

or,

In a fifth aspect, a public service entity CSE is provided, including:

An obtaining module, configured to obtain a resource reading request of a policy acquisition point resource of the public service entity CSE to the access control resource, where the resource reading request carries request information of an access control policy of the target resource that the initiator requests to access;

a processing module, configured to acquire an access control policy corresponding to the target resource, and return the policy to the CSE;

Optionally, the processing module is further configured to:

After the obtaining module acquires the resource reading request of the policy acquisition point resource of the access control resource by the public service entity CSE, before acquiring the access control policy corresponding to the target resource,

In a sixth aspect, a public service entity CSE is provided, including:

An obtaining module, configured to obtain a resource reading request of a policy information point resource of the access control resource by the public service entity CSE, where the resource reading request carries request information of an access control attribute of the access control policy;

a processing module, configured to acquire attribute information corresponding to the access control policy, and return the information to the CSE;

Optionally, the processing module is further configured to:

After the acquiring module acquires the resource reading request of the policy information point resource of the access control resource by the public service entity CSE, before acquiring the attribute information corresponding to the access control policy,

Based on the foregoing technical solution, in the embodiment of the present application, by defining a common resource access control resource under the CSE root resource, defining a policy decision point resource and/or a policy acquisition point resource under the access control resource, and defining a policy decision point resource as a trigger The virtual resource of the PDP processing process defines the policy acquisition point resource as the virtual resource that triggers the PRP processing process, thereby triggering the resource reading request of the policy decision point resource under the access control resource to trigger the PDP function. The CSE obtains the access control policy of the target resource by reading the bound policy, and performs an access control decision on the access request of the target resource according to the obtained access control policy.

DRAWINGS

1 is a schematic diagram of a structure of a oneM2M resource tree;

2 is a schematic diagram of a oneM2M authorization architecture;

3 is a schematic structural diagram of access control resources in an embodiment of the present application;

4a is a schematic diagram of interaction between a CSE having a PEP function and a CSE1 having a PDP function according to an embodiment of the present application;

4b is a schematic diagram of a process for performing access control by a CSE1 having a PDP function according to an embodiment of the present application;

FIG. 5a is a schematic diagram of interaction between a CSE1 having a PDP function and a CSE2 having a PRP function according to an embodiment of the present application;

FIG. 5b is a schematic diagram of a process for acquiring an access control policy by a function CSE2 having a PRP according to an embodiment of the present application;

6a is a schematic diagram of interaction between a CSE1 having a PDP function and a CSE3 having a PIP function according to an embodiment of the present application;

FIG. 6b is a schematic diagram of a process for acquiring access control attributes of a CSE 3 having a PIP function according to an embodiment of the present disclosure;

7 is a schematic structural diagram of a CSE in an embodiment of the present application;

8 is a schematic structural diagram of another CSE in the embodiment of the present application;

9 is a schematic structural diagram of another CSE in the embodiment of the present application;

10 is a schematic structural diagram of another CSE in the embodiment of the present application;

11 is a schematic structural diagram of another CSE in the embodiment of the present application;

FIG. 12 is a schematic structural diagram of another CSE in the embodiment of the present application.

detailed description

The present invention will be further described in detail with reference to the accompanying drawings, in which FIG. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present application without departing from the inventive scope are the scope of the present application.

In the embodiment of the present application, four oneM2M resources are defined to implement a specific access control mechanism.

The four oneM2M resources defined are: access control resource <accessControl>, policy decision point resource <policyDecisionPoint>, policy acquisition point resource <policyRetrievalPoint>, and policy information point resource <policyInformationPoint>.

The access control resource <accessControl> is defined as a common resource located under the CSE root resource <CSEBase>. At least one generic attribute of oneM2M common resource.

The policy decision point resource <policyDecisionPoint>, the policy acquisition point resource <policyRetrievalPoint>, and the policy information point resource <policyInformationPoint> are defined as virtual resources located under the access control resource <accessControl>.

Specifically, the read operation of the policy decision point resource <policyDecisionPoint> triggers a PDP process;

A read operation of the policy acquisition point resource <policyRetrievalPoint> will trigger a PRP process;

A read operation on the policy information point resource <policyInformationPoint> will trigger a PIP process.

A CSE root node may have one or more access control resources <accessControl>, and a CSE root node may also not contain access control resources.

The relationship between the access control resource <accessControl> and the defined virtual resource is as shown in FIG. 3, that is, an access control resource <accessControl> may have a policy decision point resource <policyDecisionPoint>, a policy acquisition point resource <policyRetrievalPoint>, and A combination of any one or more of the policy information point resources <policyInformationPoint> may or may not contain any defined virtual resources.

Optionally, the access control resource <accessControl> further has a public attribute specifying an access control policy, and the public attribute is used to specify an access control policy applicable to the access control resource <accessControl>, under the access control resource <accessControl> The access control of the virtual resource is determined by the public attribute, that is, the access control policy specified by the public attribute defines a CSE that allows access to the access control resource <accessControl> and the virtual resource under it.

A virtual resource does not have a resource attribute and no sub-resource. The access control for the virtual resource is responsible for the specified access control policy of the parent resource to which the virtual resource belongs.

Based on the resources defined above, as shown in FIG. 4a, the process of the CSE intercepting initiator's access request to its own target resource and the CSE1 having the PDP function are as follows:

The CSE sends a first resource read request for the policy decision point resource under the access control resource under the CSE1 root resource, where the first resource read request carries the request information of the initiator's access control decision on the target resource in the CSE;

The CSE1 triggers the PDP process corresponding to the policy decision point resource according to the first resource read request of the policy decision point resource under the access control resource: acquiring the access control policy corresponding to the target resource, and optionally obtaining the access control policy corresponding to the access control policy The attribute information is subjected to an access control decision according to the access control policy or according to the access control policy and its corresponding attribute information, and the access control decision is returned to the CSE through the access control decision response.

Specifically, the content parameter in the first resource read request carries: request information of the initiator's access control decision on the target resource in the CSE, and the resource read request is a request conforming to the oneM2M standard.

Specifically, the Content parameter in the access control decision response carries an access control decision, and the access control decision The response is a response that meets the oneM2M standard.

The CSE and the CSE1 can be the same CSE. The CSE integrates the functions of the PEP and the PDP, and can also be two independent CSEs.

Based on the resources defined above, in the embodiment of the present application, the root resource of the CSE1 includes an access control resource, and the access control resource has at least one policy decision point resource, as shown in FIG. 4b, the detailed method for implementing the access control by the CSE1. The process is as follows:

Step 401: Acquire a first resource read request of the CSE to the policy decision point resource in the access control resource, where the first resource read request carries the request information of the initiator's access control decision on the target resource in the CSE.

Among them, the initiator is AE or CSE.

The CSE that issues the first resource read request for the policy decision point resource has the function of the PEP; the root resource of the CSE1 with the access control function includes the access control resource, and the access control resource has the policy decision point resource, that is, The CSE1 of the access control function has the function of a PDP.

The CSE with the PEP function and the CSE1 with the PDP function may be the same CSE or two independent CSEs.

Optionally, the access control resource to which the policy decision point resource belongs also has a public attribute that specifies the access control policy.

Correspondingly, after acquiring the first resource read request of the CSE for the policy decision point resource under the access control resource, the CSE1 sends the second resource read request for the bound policy acquisition point resource according to the first resource read request. And determining, according to the access control policy specified by the access control resource to which the policy decision point resource belongs, to allow the CSE to access the policy decision point resource.

Step 402: Send a second resource read request for the bound policy acquisition point resource according to the first resource read request, to obtain an access control policy corresponding to the target resource, where the second resource read request carries the target resource Request information for the access control policy.

Optionally, if the access control resource to which the policy acquisition point resource belongs has a public attribute of the specified access control policy.

Correspondingly, if the access control resource to which the policy acquisition point resource belongs is located under the root resource of the CSE1, the CSE1 obtains the second resource read request for the bound policy acquisition point resource according to the first resource read request, and obtains the target resource. Before the corresponding access control policy, the access control policy specified by the access control resource to which the point resource belongs is obtained according to the policy, and the CSE is allowed to access the policy to acquire the point resource.

Step 403: Determine an initiator access control decision on the target resource according to the obtained access control policy, and return an access control decision to the CSE.

Optionally, if the CSE1 determines the initiator's access control decision on the target resource according to the obtained access control policy. In the process, the attribute information corresponding to the access control policy is also obtained, and the third resource read request is sent to the bound policy information point resource, and the attribute information corresponding to the access control policy is obtained, where the third resource read request is Request information carrying the access control attribute of the access control policy.

After obtaining the attribute information corresponding to the access control policy, the CSE1 determines the access control decision of the initiator to the target resource according to the access control policy and the attribute information corresponding to the access control policy.

Optionally, if the access control resource to which the policy information point resource belongs has a public attribute that specifies the access control policy.

Correspondingly, if the access control resource to which the policy information point resource belongs is located under the root resource of the CSE1, the CSE1 sends the third resource read request to the bound policy information point resource, and obtains the attribute information corresponding to the access control policy according to the The access control policy specified by the access control resource to which the policy information point resource belongs determines that the CSE is allowed to access the policy information point resource.

In this embodiment, the policy decision point resource, the policy acquisition point resource, and the policy information point resource are respectively located under access control resources under different CSE root nodes;

or,

Based on the above definition, as shown in FIG. 5a, the interaction process between the CSE1 with PDP function and the CSE2 with PRP function is as follows:

The CSE1 sends a second resource read request to the policy acquisition point resource of the access control resource of the CSE2, where the second resource read request carries the request information of the access control policy for the target resource;

The CSE2 triggers the PRP process according to the second resource read request for obtaining the point resource from the policy under the access control resource: the access control policy of the target resource is obtained, and the access control policy is returned to the CSE1 by the access control policy response.

Specifically, the content parameter in the second resource read request carries: request information of an access control policy for the target resource, and the resource read request is a request conforming to the oneM2M standard.

Specifically, the Content parameter in the access control policy response carries an access control policy, and the access control policy response is a response that conforms to the oneM2M standard.

Among them, CSE1 and CSE2 can be the same CSE, and the CSE integrates the functions of PDP and PRP, and can also be two. Independent CSE.

In a specific embodiment, if the request information of the access control policy for the target resource carried in the second resource read request is carried by the CSE1, and the access control token is carried, the CSE1 may also obtain the access from the access control token. Control Strategy.

The CSE1 combines the access control policy acquired from the CSE2 with the access control policy obtained from the access control token according to a preset policy, and evaluates the initiator's access control to the target resource based on the merged access control policy.

Based on the resources defined above, in the embodiment of the present application, the root resource of the CSE2 includes an access control resource, and the access control resource has at least a policy acquisition point resource, that is, the CSE2 has a PRP function, as shown in FIG. 5b. The process for CSE2 to obtain an access control policy is as follows:

Step 501: Acquire a second resource read request of the CSE1 for the policy acquisition point resource under the access control resource, where the second resource read request carries the request information of the access control policy of the target resource that the initiator requests to access.

Step 502: Acquire an access control policy corresponding to the target resource, and return it to the CSE1.

Optionally, the access control resource to which the policy acquisition point resource belongs also has a public attribute that specifies an access control policy.

Correspondingly, after acquiring the second resource read request of the policy acquisition point resource of the access control resource by the CSE1, the CSE1 obtains the access control policy corresponding to the access control resource to which the point resource belongs according to the policy before acquiring the access control policy corresponding to the target resource. The policy determines that CSE1 is allowed to access the policy to obtain point resources.

Among them, the CSE2 with the PRP function and the CSE1 that issues the resource read request may be the same CSE or two independent CSEs.

Based on the above definition, as shown in FIG. 6a, if the CSE1 having the PDP function determines the attribute information corresponding to the access control policy in the process of determining the access control decision of the initiator to the target resource according to the obtained access control policy, The CSE1 with PDP function needs to interact with the CSE3 with PIP function to obtain the attribute information. The interaction process is as follows:

The CSE1 sends a third resource read request to the policy information point resource of the CSE3 access control resource, where the third resource read request carries the request information of the access control attribute of the access control policy;

The CSE3 triggers the PIP process according to the third resource read request of the policy information point resource under the access control resource: the attribute information corresponding to the access control policy is obtained, and the attribute information is returned to the CSE1 by the access control attribute response.

Specifically, the content parameter in the third resource read request carries: request information of an access control attribute of the access control policy, and the resource read request is a request conforming to the oneM2M standard.

Specifically, the Content parameter in the access control attribute response carries the attribute information, and the access control attribute response is a response that conforms to the oneM2M standard.

The CSE1 and the CSE3 may be the same CSE. The CSE integrates the functions of the PDP and the PIP, and may also be two independent CSEs.

Specifically, the attribute information of the access control policy may be a creation time of the access control policy, a creator, a visitor of the access control policy, a subscription information of the visitor, a role of the visitor in the access control policy, and the like.

Based on the resources defined above, in the embodiment of the present application, the root resource of the CSE3 includes an access control resource, and the access control resource has at least a policy information point resource, as shown in FIG. 6b, that is, the CSE3 has a PIP function, and the CSE3 The process of obtaining access control attributes is as follows:

Step 601: Acquire a third resource read request of the CSE1 for the policy information point resource under the access control resource, where the third resource read request carries the request information of the access control attribute of the access control policy.

Step 602: Acquire attribute information corresponding to the access control policy, and return it to the CSE1.

Optionally, the access control resource to which the policy information point resource belongs also has a public attribute that specifies an access control policy.

Correspondingly, after acquiring the third resource read request of the policy information point resource of the access control resource by the CSE1, the CSE1 obtains the access control corresponding to the access control resource to which the policy information point belongs according to the attribute information corresponding to the access control policy. The policy determines that the CSE1 is allowed to access the policy information point resource.

Among them, the CSE3 with the PIP function and the CSE1 that issues the resource read request may be the same CSE or two independent CSEs.

The access control process provided in the embodiment of the present application is exemplified by a specific embodiment.

The following assumptions are made in this particular embodiment:

The functions of PEP, PDP, PRP, and PIP are respectively integrated in different CSEs, where PEP is located in CSE-0, PDP is located in CSE-1, PRP is located in CSE-2, and PIP is located in CSE-3;

The initiator of the resource access is: AE-1, and the target resource for access is CSE-1: CSE-1\Group-1\memberIDs;

An access control policy for the CSE-1\Group-1\memberIDs resource is stored on the CSE-3: RBAC-Policy;

The role of AE-1 is stored in the CSE-4\m2mServiceSubscriptionProfile-1\serviceRoles resource on CSE-4. The role of AE-1 is: Administrator (Administrator);

The virtual resource that triggers the PDP function on CSE-2 is: CSE-2\AccessControl-2\policyDecisionPoint;

The virtual resource that triggers the PRP function on CSE-3 is: CSE-3\AccessControl-3\policyRetrievalPoint;

The virtual resource that triggers the PIP function on the CSE-4 is: CSE-4\AccessControl-4\policyInformationPoint;

On CSE-2, the access control policy of CSE-2\AccessControl-2 allows resource read requests from CSE-1;

On CSE-3, the access control policy of CSE-3\AccessControl-3 allows resource read requests from CSE-2;

On CSE-4, the access control policy of CSE-4\AccessControl-4 allows resource read requests from CSE-2.

In the first step, the AE-1 sends a read request to the target resource in the CSE-1, specifically: the initiator is AE-1, the target resource is CSE-1\Group-1\memberIDs, and the action is read (Retrieve). .

In the second step, the PEP in CSE-1 intercepts the request and sends an access control decision request to the pre-configured PDP, specifically:

The initiator is CSE-1, the target resource is CSE-2\AccessControl-2\policyDecisionPoint, the action is read, and the content of the parameter Content is the content of the access control decision request:

{Initiator = AE-1, target resource = CSE-1\Group-1\memberIDs, action = read}.

In the third step, CSE-2 receives the access control decision request of CSE-1.

First, check the access control policy specified by CSE-2\AccessControl-2, determine that the specified access control policy allows access from CSE-1, and then send an access control policy request to the pre-configured PRP, specifically:

The initiator is CSE-2, the target resource is CSE-3\AccessControl-3\policyRetrievalPoint, the action is read, and the content of the parameter Content is the content of the access control decision request:

{To=CSE-1\Group-1\memberIDs}.

In the fourth step, CSE-3 receives the access control policy request of CSE-2.

First, check the access control policy specified by CSE-3\AccessControl-3, determine that the specified access control policy allows access requests from CSE-2, and then obtain the applicable access control policy based on the target resources accessed by AE-1.

In the fifth step, the CSE-3 returns the obtained access control policy to the CSE-2 through the oneM2M response, and the oneM2M response is the access control policy response, specifically: the response code (Response Code) is successfully obtained, and the content of the parameter Content is Obtained access control policy:

{Access Control Policy=RBAC-Policy}.

In the sixth step, the CSE-2 receives the access control policy response of the CSE-3, and analyzes the obtained role-based access control policy: RBAC-Policy, and knows that the role of the AE-1 (Role) needs to be acquired to perform the policy evaluation. The CSE-2 sends an access control attribute request to the pre-configured PIP, specifically:

The initiator is CSE-2, the target resource is CSE-4\AccessControl-4\policyInformationPoint, and the action is read. The content of the parameter Content is: {user=AE-1, requested attribute information=Role}.

In the seventh step, CSE-4 receives the access control attribute request of CSE-2. First check the access control policy specified by CSE-4\AccessControl-4, determine that the specified access control policy allows access requests from CSE-2, and then The user information obtains the role of the user from the subscription information of the user as: Administrator.

In the eighth step, the CSE-4 returns the obtained attribute information to the CSE-2 through the oneM2M response, and the oneM2M response is the access control attribute response, specifically: the response code is successfully obtained, and the content of the parameter Content is the obtained attribute information:

{role=Administrator}.

In the ninth step, the CSE-2 receives the access control attribute response of the CSE-4, acquires the role of the AE-1, and then evaluates the resource access request of the user AE-1 by using the obtained role-based access control policy and the role of the AE-1. Determine the evaluation result, that is, the access control decision is: Allow AE-1 resource access request.

In the tenth step, the CSE-2 returns the access control decision to the CSE-1 through the oneM2M response, and the oneM2M response is the access control decision response, specifically:

The response code is successfully obtained, and the content of the parameter Content is the access control decision:

{Access Control Decision = Allow}.

Based on the same inventive concept, the embodiment of the present application further provides a CSE. For the specific implementation of the CSE, refer to the description of the CSE1 with the PDP function. The repeated description is not repeated. As shown in FIG. 7, the CSE mainly includes :

The first obtaining module 701 is configured to obtain a first resource reading request of the public service entity CSE for the policy decision point resource under the access control resource, where the first resource reading request carries the initiator to the CSE Request information for access control decisions of the target resource;

The second obtaining module 702 is configured to send a second resource read request for the bound policy acquisition point resource according to the first resource read request, to obtain an access control policy corresponding to the target resource, where the second resource is read. The request request carries the request information of the access control policy for the target resource;

The processing module 703 is configured to determine, according to the obtained access control policy, an access control decision of the initiator to the target resource, and return the access control decision to the CSE;

Optionally, the third obtaining module 704 is further configured to: after the second obtaining module 702 acquires an access control policy corresponding to the target resource, the processing module 703 determines the initiator to access the target resource. Before the control decision, the third resource read request is sent to the bound policy information point resource, and the attribute information corresponding to the access control policy is obtained, where the third resource read request carries the access control to the access control policy. Request information for the attribute;

Specifically, the processing module 703 is further configured to:

Specifically, the second obtaining module is further configured to:

Specifically, the third obtaining module is further configured to:

Specifically, if the attribute information corresponding to the access control policy is obtained, the processing module is specifically configured to:

Specifically, the policy decision point resource, the policy acquisition point resource, and the policy information point resource are respectively located under access control resources under different CSE root nodes;

or,

Based on the same inventive concept, the embodiment of the present application further provides a CSE. For the specific implementation of the CSE, refer to the description of the CSE1 with the PDP function. The repeated description is not repeated. As shown in FIG. 8, the CSE mainly includes The processor 801 and the memory 802, wherein the memory 802 stores a preset program, and the processor 801 is configured to read a preset program in the memory 802, and execute the following process according to the program:

Transmitting, by the first resource read request, a second resource read request for the bound policy acquisition point resource, to obtain an access control policy corresponding to the target resource, where the second resource read request carries the target Request information for the access control policy of the resource;

Optionally, after acquiring the access control policy corresponding to the target resource, the processor 801, before determining that the initiator performs an access control decision on the target resource, sends a third resource read request to the bound policy information point resource. Obtaining the attribute information corresponding to the access control policy, where the third resource read request carries the request information of the access control attribute of the access control policy;

Optionally, the access control resource has a common attribute of a common resource and also has a common attribute that specifies an access control policy.

Specifically, after acquiring the first resource read request of the public service entity CSE to the policy decision point resource under the access control resource, the processor 801 sends the second resource to the bound policy acquisition point resource according to the first resource read request. Before the resource reads the request,

Specifically, after the processor 801 sends the second resource read request for the bound policy acquisition point resource according to the first resource read request, and before acquiring the access control policy corresponding to the target resource,

Specifically, after the processor 801 sends the third resource read request to the bound policy information point resource, and obtains the attribute information corresponding to the access control policy,

Specifically, the processor 801 obtains the attribute information corresponding to the access control policy, according to the access control policy. And the attribute information corresponding to the access control policy, and determining, by the initiator, an access control decision on the target resource.

or,

Based on the same inventive concept, the embodiment of the present application further provides a CSE. For the specific implementation of the CSE, refer to the description of the CSE2 with the PRP function. The repeated description is not repeated. As shown in FIG. 9, the CSE2 mainly includes :

The obtaining module 901 is configured to obtain a resource read request of the public service entity CSE for the policy acquisition point resource under the access control resource, where the resource read request carries the request information of the access control policy of the target resource that the initiator requests to access. ;

The processing module 902 is configured to obtain an access control policy corresponding to the target resource, and return the policy to the CSE.

The access control resource has a common attribute of a common resource and a public attribute that specifies an access control policy.

Optionally, the processing module 902 is further configured to:

Based on the same inventive concept, the embodiment of the present application further provides a CSE. For the specific implementation of the CSE, refer to the description of the CSE2 with the PRP function. The repeated description is not repeated. As shown in FIG. 10, the CSE mainly includes The processor 1001 and the memory 1002, wherein the memory 1002 stores a preset program, and the processor 1001 is configured to read a preset program in the memory 1002, and execute the following process according to the program:

Specifically, after acquiring the resource read request of the policy acquisition point resource of the access control resource by the public service entity CSE, the processor 1001 obtains the access control policy corresponding to the target resource,

Based on the same inventive concept, the embodiment of the present application further provides a CSE. For the specific implementation of the CSE, refer to the description of the CSE3 with the PIP function. The repeated description is not repeated. As shown in FIG. 11, the CSE3 mainly includes :

The obtaining module 1101 is configured to obtain a resource reading request of the public information entity CSE for the policy information point resource under the access control resource, where the resource reading request carries the request information of the access control attribute of the access control policy;

The processing module 1102 is configured to obtain attribute information corresponding to the access control policy, and return the information to the CSE;

Specifically, the processing module is further configured to:

Based on the same inventive concept, the embodiment of the present application further provides a CSE. For the specific implementation of the CSE, refer to the description of the CSE3 with the PIP function. The repeated description is not repeated. As shown in FIG. 12, the CSE mainly includes The processor 1201 and the memory 1202, wherein the memory 1202 stores a preset program, and the processor 1201 is configured to read a preset program in the memory 1202, and execute the following process according to the program:

The access control resource is a common resource under the CSE root resource, and the policy information point resource is The virtual resource under the corresponding access control resource.

Specifically, after acquiring the resource reading request of the policy information point resource of the access control resource by the public service entity CSE, the processor 1201 obtains the attribute information corresponding to the access control policy,

Based on the foregoing technical solution, in the embodiment of the present application, by defining a common resource access control resource under the CSE root resource, defining a policy decision point resource and/or a policy acquisition point resource under the access control resource, and defining a policy decision point resource as a trigger The virtual resource of the PDP process, the policy acquisition point resource is a virtual resource that triggers the PRP process, and the CSE with the PDP function is triggered to read the binding by using the resource read request of the policy decision point resource under the access control resource. The policy acquisition point resource obtains the access control policy of the target resource, and performs access control decision on the access request of the target resource according to the obtained access control policy.

Further, the policy information point resource is defined under the access control resource, and the policy information point resource is defined as a virtual resource that triggers the PIP processing process, and the CSE with the PDP function triggers the access by reading the bound policy information point resource. The process of acquiring the attribute information of the control policy enables the access control decision to be made in combination with the access control policy and its attribute information.

It will be apparent to those skilled in the art that various modifications and changes can be made in the present application without departing from the spirit and scope of the application. Thus, it is intended that the present invention cover the modifications and variations of the present invention.

Claims

An access control method, comprising:

Acquiring a first resource read request of the public service entity CSE to the policy decision point resource under the access control resource, where the first resource read request carries the request of the initiator to the access control decision of the target resource in the CSE information;

Sending, by the first resource read request, a second resource read request for the bound policy acquisition point resource, to obtain an access control policy corresponding to the target resource, where the second resource read request carries the right Request information of an access control policy of the target resource;

Determining, according to the obtained access control policy, an access control decision of the initiator to the target resource, and returning the access control decision to the CSE;

The access control resource is a common resource under the CSE root resource, and the policy decision point resource and the policy acquisition point resource are respectively virtual resources under the corresponding access control resource.
The method of claim 1 wherein said access control resource has a common attribute of a common resource and also has a common attribute that specifies an access control policy.
The access control method according to claim 2, wherein after the obtaining the access control policy corresponding to the target resource, determining the access control decision of the initiator to the target resource, the method further includes :

And sending the third resource read request to the bound policy information point resource, and acquiring the attribute information corresponding to the access control policy, where the third resource read request carries the request information of the access control attribute of the access control policy ;

The policy information point resource is a virtual resource under the corresponding access control resource.
The method according to claim 2, wherein after obtaining the first resource read request of the public service entity CSE for the policy decision point resource under the access control resource, the binding is sent according to the first resource read request. Before the policy acquires the second resource read request of the point resource, the method further includes:

And determining, according to the access control policy specified by the access control resource to which the policy decision point resource belongs, to allow the CSE to access the policy decision point resource.
The method according to claim 2, wherein after the second resource read request for the bound policy acquisition point resource is sent according to the first resource read request, the access control policy corresponding to the target resource is acquired Previously, the method further includes:

Obtaining an access control policy specified by the access control resource to which the point resource belongs according to the policy, and determining that the CSE is allowed to access the policy to acquire a point resource.
The method according to claim 3, wherein the method further includes: after the third-resource read request is sent to the bound policy information point resource, and the attribute information corresponding to the access control policy is acquired, the method further includes:

And determining, according to the access control policy specified by the access control resource to which the policy information point resource belongs, to allow the CSE to access the policy information point resource.
The method of claim 3, wherein the determining the access control decision of the initiator to the target resource comprises:

And determining, according to the access control policy and attribute information corresponding to the access control policy, an access control decision of the initiator to the target resource.
The method according to claim 3, wherein the policy decision point resource, the policy acquisition point resource, and the policy information point resource are respectively located under access control resources under different CSE root nodes;

or,

At least two of the policy decision point resource, the policy acquisition point resource, and the policy information point resource are located under different access control resources under the same CSE root node;

or,

The policy decision point resource, the policy acquisition point resource, and the policy information point resource belong to the same access control resource under the same CSE root node.
A method for obtaining an access control policy, comprising:

Obtaining, by the public service entity CSE, a resource read request for a policy acquisition point resource under the access control resource, where the resource read request carries request information of an access control policy of the target resource that the initiator requests to access;

Obtaining an access control policy corresponding to the target resource, and returning to the CSE;

The access control resource is a common resource under the CSE root resource, and the policy acquisition point resource is a virtual resource under the corresponding access control resource.
The method of claim 9, wherein the access control resource has a common attribute of a common resource and also has a common attribute that specifies an access control policy.
The method according to claim 10, wherein after obtaining the resource read request of the public service entity CSE for the policy acquisition point resource under the access control resource, before obtaining the access control policy corresponding to the target resource, The method also includes:

Obtaining an access control policy specified by the access control resource to which the point resource belongs according to the policy, and determining that the CSE is allowed to access the policy to acquire a point resource.
A method for obtaining an access control attribute, comprising:

Acquiring a resource read request of the public service entity CSE to the policy information point resource under the access control resource, where the resource read request carries the request information of the access control attribute of the access control policy;

Obtaining attribute information corresponding to the access control policy, and returning the information to the CSE;

The access control resource is a common resource under the CSE root resource, and the policy information point resource is a virtual resource under the corresponding access control resource.
The method of claim 12, wherein the access control resource has a common attribute of a common resource and also has a common attribute that specifies an access control policy.
The method according to claim 13, wherein after obtaining the resource reading request of the policy information point resource under the access control resource by the public service entity CSE, obtaining the attribute information corresponding to the access control policy, The method also includes:

And determining, according to the access control policy specified by the access control resource to which the policy information point resource belongs, to allow the CSE to access the policy information point resource.
A public service entity CSE, comprising:

a first acquiring module, configured to acquire a first resource reading request of a public service entity CSE for a policy decision point resource under an access control resource, where the first resource reading request carries an initiator to a target in the CSE Resource access control decision request information;

a second acquiring module, configured to send a second resource read request for the bound policy acquisition point resource according to the first resource read request, to obtain an access control policy corresponding to the target resource, and the second resource read request Carrying request information of an access control policy for the target resource;

a processing module, configured to determine, according to the obtained access control policy, an access control decision of the initiator to the target resource, and return the access control decision to the CSE;

The access control resource is a common resource under the CSE root resource, and the policy decision point resource and the policy acquisition point resource are respectively virtual resources under the corresponding access control resource.
The CSE of claim 15 wherein said access control resource has a common attribute of a common resource and also has a common attribute that specifies an access control policy.
The CSE according to claim 16, further comprising a third obtaining module, after the second obtaining module acquires an access control policy corresponding to the target resource, the processing module determines the initiator pair Before the access control decision of the target resource, the third resource read request is sent to the bound policy information point resource, and the attribute information corresponding to the access control policy is obtained, where the third resource read request carries the Request information for access control attributes of the access control policy;

The policy information point resource is a virtual resource under the corresponding access control resource.
The CSE of claim 16, wherein the processing module is further configured to:

After the first obtaining module acquires the first resource reading request of the public service entity CSE to the policy decision point resource under the access control resource, the second obtaining module sends the binding to the second resource according to the first resource reading request. Strategy acquisition Before taking the second resource read request for the resource,

And determining, according to the access control policy specified by the access control resource to which the policy decision point resource belongs, to allow the CSE to access the policy decision point resource.
The CSE of claim 16, wherein the second obtaining module is further configured to:

After the second resource read request for the bound policy acquisition point resource is sent according to the first resource read request, and the access control policy corresponding to the target resource is obtained,

Obtaining an access control policy specified by the access control resource to which the point resource belongs according to the policy, and determining that the CSE is allowed to access the policy to acquire a point resource.
The CSE of claim 17, wherein the third obtaining module is further configured to:

After the third resource read request is sent to the bound policy information point resource, and the attribute information corresponding to the access control policy is obtained,

And determining, according to the access control policy specified by the access control resource to which the policy information point resource belongs, to allow the CSE to access the policy information point resource.
The CSE of claim 17, wherein the processing module is specifically configured to:

And determining, according to the access control policy and attribute information corresponding to the access control policy, an access control decision of the initiator to the target resource.
The CSE according to claim 17, wherein the policy decision point resource, the policy acquisition point resource, and the policy information point resource are respectively located under access control resources under different CSE root nodes;

or,

At least two of the policy decision point resource, the policy acquisition point resource, and the policy information point resource are located under different access control resources under the same CSE root node;

or,

The policy decision point resource, the policy acquisition point resource, and the policy information point resource belong to the same access control resource under the same CSE root node.
A public service entity CSE, comprising:

An obtaining module, configured to obtain a resource reading request of a policy acquisition point resource of the public service entity CSE to the access control resource, where the resource reading request carries request information of an access control policy of the target resource that the initiator requests to access;

a processing module, configured to acquire an access control policy corresponding to the target resource, and return the policy to the CSE;

The access control resource is a common resource under the CSE root resource, and the policy acquisition point resource is a virtual resource under the corresponding access control resource.
The CSE of claim 23, wherein the access control resource has a common attribute of a common resource and also has a common attribute that specifies an access control policy.
The CSE of claim 24, wherein the processing module is further configured to:

After the obtaining module acquires the resource reading request of the policy acquisition point resource of the access control resource by the public service entity CSE, before acquiring the access control policy corresponding to the target resource,

Obtaining an access control policy specified by the access control resource to which the point resource belongs according to the policy, and determining that the CSE is allowed to access the policy to acquire a point resource.
A public service entity CSE, comprising:

An obtaining module, configured to obtain a resource reading request of a policy information point resource of the access control resource by the public service entity CSE, where the resource reading request carries request information of an access control attribute of the access control policy;

a processing module, configured to acquire attribute information corresponding to the access control policy, and return the information to the CSE;

The access control resource is a common resource under the CSE root resource, and the policy information point resource is a virtual resource under the corresponding access control resource.
The CSE of claim 26, wherein said access control resource has a common attribute of a common resource and also has a common attribute that specifies an access control policy.
The CSE of claim 27, wherein the processing module is further configured to:

After the obtaining module acquires the resource reading request of the policy information point resource of the access control resource by the public service entity CSE, before acquiring the attribute information corresponding to the access control policy, according to the access control of the resource information point resource The resource-specific access control policy determines that the CSE is allowed to access the policy information point resource.