WO2020007132A1 - 一种资源访问控制方法及装置 - Google Patents

一种资源访问控制方法及装置 Download PDF

Info

Publication number
WO2020007132A1
WO2020007132A1 PCT/CN2019/087658 CN2019087658W WO2020007132A1 WO 2020007132 A1 WO2020007132 A1 WO 2020007132A1 CN 2019087658 W CN2019087658 W CN 2019087658W WO 2020007132 A1 WO2020007132 A1 WO 2020007132A1
Authority
WO
WIPO (PCT)
Prior art keywords
rule
access control
operand
resource
decision
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2019/087658
Other languages
English (en)
French (fr)
Inventor
周巍
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Academy of Telecommunications Technology CATT
Original Assignee
China Academy of Telecommunications Technology CATT
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Academy of Telecommunications Technology CATT filed Critical China Academy of Telecommunications Technology CATT
Publication of WO2020007132A1 publication Critical patent/WO2020007132A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a method and a device for controlling resource access.
  • OneM2M The Internet of Things Standardization Organization (oneM2M) is committed to developing a series of technical specifications for constructing a common Machine-To-Machine (M2M) service layer.
  • M2M Machine-To-Machine
  • the core of oneM2M is data sharing, which is implemented by sharing data items on the resource tree defined in oneM2M common service entity (CSE).
  • CSE common service entity
  • OneM2M realizes the sharing and interaction of service layer resources by operating on a standardized resource tree.
  • OneM2M resource tree exists in the CSE defined by oneM2M system.
  • the oneM2M functional architecture specification oneM2M TS-0001: "Functional Architecture"
  • OneM2M resources can be created (created), queried (retrieve), modified (updated) and deleted (deleted).
  • the resource related to authorization among the resources defined by oneM2M is an access control policy resource ⁇ accessControlPolicy>, which defines an access control policy (Access Control Policy) (ACP).
  • ACP access control policy
  • the ⁇ accessControlPolicy> resource is uniquely identified by a resource ID (identity).
  • the resource can be directly assigned to some resource types of oneM2M, or indirectly to the target resource through the accessControlPolicyID attribute of the target resource (that is, other resources specify the access control policy applicable to the resource through the accessControlPolicyIDs attribute in the resource).
  • the access control policy stored in the ⁇ accessControlPolicy> resource describing the access control in units of the target resource.
  • Various policy rules for the target resource will apply to all attributes and sub-resources of the target resource.
  • the security specification (oneM2M TS-0003: "Security Solutions”) in the oneM2M series of specifications gives a high-level description of the oneM2M authorization architecture, specifically the main components and basic processes of the authorization architecture, but how to describe the access control policy The relevant rules have not been given a specific implementation plan.
  • the embodiments of the present application provide a method and a device for controlling resource access.
  • a resource access control method includes: receiving an access control decision request, the access control decision request being used to request an access control policy decision on a resource access request initiated by an initiator; obtaining an access control policy; According to the access control policy, an access control policy decision is performed on the resource access request; an access control decision response is returned, and the access control decision response carries an access control policy decision result for the resource access request.
  • the access control policy includes one or more access control rules, and the one or more access control rules are used to describe rules that should be satisfied if the target resource rule and the initiator rule are satisfied, and each access control rule Use at least one access control rule primitive set for description, the access control rule primitive set includes one or more rule primitives, and one rule primitive in the access control rule primitive set is used to describe the access control rule One of the judgment conditions.
  • the access control rule is further described using a context restriction rule primitive set
  • the context restriction rule primitive set includes one or more rule primitives for describing the context restriction Whether the access control rule to which the rule primitive collection belongs is available.
  • the access control policy further includes a target resource rule for describing a target resource applicable to the access control policy, and the target resource rule is performed using one or more rule primitives. description.
  • the access control policy further includes: an initiator rule for describing a resource access request initiator applicable to the access control policy, and the initiator rule uses one or more rules Primitive description.
  • the rule primitive includes: a first operand, a second operand, and a logical operator for the first operand and the second operand.
  • the output result of the rule primitive is a logical operation result obtained by the first operand and the second operand based on the logical operator, and the logical operation result includes: true or false; wherein, the logical operation result If it is true, it means that the decision condition described by the rule primitive is met, and if the logical operation result is false, it means that it does not meet the decision condition described by the rule primitive.
  • the first operand is represented as a parameter or a parameter set or is represented as a first function, and the first function is used to obtain a parameter or a parameter set as the first operand; and / or
  • the second operand is represented as a parameter or a parameter set or as a second function, and the second function is used to obtain the parameter or the parameter set as the second operand.
  • the first function is used to obtain a parameter or a parameter set that is a first operand, and includes: the first function is used to obtain a first operand from the resource access request. Parameter or parameter set, or used to obtain the target resource attribute value or property value set as the first operand, or used to obtain the initiator attribute value or property value set as the first operand, or used to obtain as the first operand Context information of an operand; the second function is used to obtain a parameter or a parameter set that is a second operand, and includes: the second function is used to obtain a parameter that is a second operand from the resource access request Or parameter set, or used to obtain the target resource attribute value or property value set as the second operand, or used to obtain the initiator attribute value or property value set as the second operand, or used to obtain as the second operation Number of contextual information.
  • the logical operator is a logical comparison operator or a set operator.
  • the logical operation relationship includes a logical AND operation relationship or a logical OR operation relationship.
  • the access control rule further includes: a rule impact identifier; the rule impact identifier is used to indicate that when the output results of all rule primitives in the access control rule are true, all The decision result of the access control rule is allowed or denied.
  • a resource access control device in a second aspect, includes a receiving module for receiving an access control decision request, where the access control decision request is used to request an access control policy decision on a resource access request initiated by an initiator; An acquisition module for obtaining an access control policy; a decision module for determining an access control policy for the resource access request according to the access control policy; a sending module for returning an access control decision response, the access control decision The response carries an access control policy decision result for the resource access request.
  • the access control policy includes one or more access control rules, and the one or more access control rules are used to describe rules that should be satisfied if the target resource rule and the initiator rule are satisfied, and each access control rule Use at least one access control rule primitive set for description, the access control rule primitive set includes one or more rule primitives, and one rule primitive in the access control rule primitive set is used to describe the access control rule One of the judgment conditions.
  • the access control rule is further described using a context restriction rule primitive set
  • the context restriction rule primitive set includes one or more rule primitives for describing the context restriction Whether the access control rule to which the rule primitive collection belongs is available.
  • the access control policy further includes a target resource rule for describing a target resource applicable to the access control policy, and the target resource rule is performed using one or more rule primitives. description.
  • the access control policy further includes: an initiator rule for describing a resource access request initiator applicable to the access control policy, and the initiator rule uses one or more rules Primitive description.
  • the rule primitive includes: a first operand, a second operand, and a logical operator used for the first operand and the second operand; the rule primitive
  • the output result of the language is a logical operation result obtained by the first operand and the second operand based on the logical operator.
  • the logical operation result includes: true or false; where the logical operation result is true, indicating The decision condition described by the rule primitive is met, and the logical operation result is false, which indicates that the decision condition described by the rule primitive is not met.
  • a communication device includes a processor and a memory.
  • the processor is configured to read a program in the memory and execute: receive an access control decision request, and the access control decision request is used for Requesting an access control policy decision on a resource access request initiated by an initiator; obtaining an access control policy; performing an access control policy decision on the resource access request according to the access control policy; returning an access control decision response, the access control
  • the decision response carries an access control policy decision result for the resource access request.
  • the access control policy includes one or more access control rules, and the one or more access control rules are used to describe rules that should be satisfied if the target resource rule and the initiator rule are satisfied, and each access control rule Use at least one access control rule primitive set for description, the access control rule primitive set includes one or more rule primitives, and one rule primitive in the access control rule primitive set is used to describe the access control rule One of the judgment conditions.
  • the access control rule is further described using a context restriction rule primitive set
  • the context restriction rule primitive set includes one or more rule primitives for describing the context restriction Whether the access control rule to which the rule primitive collection belongs is available.
  • the access control policy further includes a target resource rule for describing a target resource applicable to the access control policy, and the target resource rule is performed using one or more rule primitives. description.
  • the access control policy further includes: an initiator rule for describing a resource access request initiator applicable to the access control policy, and the initiator rule uses one or more rules Primitive description.
  • the rule primitive includes: a first operand, a second operand, and a logical operator used for the first operand and the second operand; the rule primitive
  • the output result of the language is a logical operation result obtained by the first operand and the second operand based on the logical operator.
  • the logical operation result includes: true or false; where the logical operation result is true, indicating The decision condition described by the rule primitive is met, and the logical operation result is false, which indicates that the decision condition described by the rule primitive is not met.
  • the first operand is represented as a parameter or a parameter set or is represented as a first function, and the first function is used to obtain a parameter or a parameter set as the first operand; and / or
  • the second operand is represented as a parameter or a parameter set or as a second function, and the second function is used to obtain the parameter or the parameter set as the second operand.
  • the first function is used to obtain a parameter or a parameter set that is a first operand, and includes: the first function is used to obtain a first operand from the resource access request. Parameter or parameter set, or used to obtain the target resource attribute value or property value set as the first operand, or used to obtain the initiator attribute value or property value set as the first operand, or used to obtain as the first operand Context information of an operand; the second function is used to obtain a parameter or a parameter set that is a second operand, and includes: the second function is used to obtain a parameter that is a second operand from the resource access request Or parameter set, or used to obtain the target resource attribute value or property value set as the second operand, or used to obtain the initiator attribute value or property value set as the second operand, or used to obtain as the second operation Number of contextual information.
  • the logical operator is a logical comparison operator or a set operator.
  • the logical operation relationship includes a logical AND operation relationship or a logical OR operation relationship.
  • the access control rule further includes: a rule impact identifier; the rule impact identifier is used to indicate that when the output results of all rule primitives in the access control rule are true, all The decision result of the access control rule is allowed or denied.
  • a computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to cause the computer to execute the operations described in any one of the first aspects. The method described.
  • an access control policy decision is performed on the resource access request according to the access control policy and returned Access control decision response.
  • the access control policy includes one or more access control rules, and each access control rule is described by using at least one access control rule primitive set.
  • the access control rule primitive set includes one or more rule primitives.
  • a rule primitive is used to describe a decision condition in an access control rule. It can be seen that the description manner of the access control rules in the embodiments of the present application is rule primitives, so a solution is provided for how to describe the rules in the access control policy.
  • FIG. 1 is a schematic diagram of a oneM2M resource tree in the prior art
  • FIG. 2 is a schematic diagram of a system architecture applicable to an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of a resource access control process according to an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of an access control policy decision process in an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of a resource access control apparatus according to an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a communication device according to an embodiment of the present application.
  • the embodiments of the present application provide a method and a device for controlling resource access. Through the embodiments of the present application, a new description manner is proposed for the relevant rules of the access control policy.
  • the embodiments of the present application can be applied to oneM2M system or other systems.
  • the system architecture may include a resource server, a resource access control device, an access control policy providing device, and an information providing device. These components can be independent logical entities or hardware devices that are independent of each other. Several logically independent entities can also be integrated into one hardware device.
  • the resource server coexists with the application system requiring access control and is called by the application system.
  • the resource server generates an access control decision request according to the resource access request of the resource access initiator, sends it to the resource access control device, and then determines whether to execute the resource access request according to the access control decision response returned by the resource access control device.
  • the resource access control device is responsible for judging whether to agree to access the target resource requested by the access control decision request sent by the resource server according to the access control policy, and returns the decision result to the resource server through the access control decision response.
  • the resource access control device can obtain the access control policy from the local, or from the access control policy providing device, and can also obtain information related to the user, resource, or environment from the information providing device, such as accessing the user's IP address, creator of the resource, current time, etc.
  • the resource server may be a Policy Enforcement Point (PEP) entity in the oneM2M system
  • the access decision device may be a Policy Decision Point (PDP) entity in the oneM2M system
  • the access control policy providing device may be a Policy Retrieval Point (PRP) entity in the oneM2M system
  • the foregoing information providing device may be a Policy Information Point (PIP) entity in the oneM2M system.
  • an access control policy used to determine an access control policy for a resource access request initiated by an initiator is mainly embodied in various rules, and these rules may include rules in the following three aspects:
  • Target resource rule The target resource rule in the access control policy is used to describe the target resource applicable to the access control policy. That is, according to the target resource rule, it can be determined whether the target resource requested to be accessed by the resource access request is allowed to be accessed.
  • an access control policy decision is performed on the target resource requested by the resource access request, and the following decision results can be obtained:
  • Applicable Indicates that the access control policy is applicable to the target resource requested by the resource access request, that is, the target resource meets the requirements of the target resource rule, and the target resource is allowed to be accessed.
  • Not applicable indicates that the access control policy is not applicable to the target resource requested by the resource access request, that is, the target resource does not meet the requirements of the target resource rule, and the target resource is not allowed to be accessed.
  • the following judgment result may be obtained: uncertain.
  • the judgment result indicates that an error occurred during the judgment process, and it is impossible to judge whether the access control policy is applicable to the target resource.
  • Initiator rule An initiator rule in an access control policy is used to describe the initiator of a resource access request that is applicable to the access control policy. That is, according to the rules of the initiator, it can be determined whether the initiator of the resource access request allows it to perform resource access.
  • the access control policy decision of the resource access request initiator can obtain the following judgment results:
  • Applicable Indicates that the access control policy is applicable to the initiator of the resource access request, that is, the initiator of the resource access request is allowed to perform resource access.
  • Not applicable indicates that the access control policy is not applicable to the initiator of the resource access request, that is, the initiator of the resource access request is denied access to the resource.
  • the following judgment result may be obtained: uncertain.
  • the judgment result indicates that an error occurred during the judgment process, and it is impossible to judge whether the access control policy is applicable to the initiator of the resource access request.
  • Access control rules are used to describe other rules that should be satisfied if the target resource rules and initiator rules are met. That is, when the resource access request meets the target resource rules and the initiator rules, according to the access control rules, it can be determined whether the resource access request is allowed or denied.
  • the access control rule may be defined based on information such as resource attributes, user attributes, and context attributes, that is, the rules that need to be satisfied are described based on these attributes.
  • Allow indicates that the access control policy allows a resource access request, that is, the resource access request meets the requirements of the access control rule, and the resource access request is allowed.
  • Rejected Indicates that the access control policy does not allow the resource access request, that is, the resource access request does not meet the requirements of the abandonment control rule, and the resource access request is denied.
  • the decision result indicates that the access control policy is not applicable to the resource access request.
  • the access control rule includes a context restriction rule. If it is determined that the resource access request is not allowed according to the context restriction rule, the obtained judgment result is "not applicable”.
  • the target resource rule in the access control policy may be described using one or more rule primitives. If multiple rule primitives are used for description, there is a logical operation relationship between the multiple rule primitives. According to the logical operation relationship between the multiple rule primitives, it can be obtained based on the combined result of the multiple rule primitives. The judgment result of the target resource rule is obtained.
  • the rule primitive can be composed of one or more instructions to describe a decision condition.
  • Rule primitives are indivisible.
  • the output of a rule primitive can indicate whether the decision conditions described by the rule primitive are met.
  • the output result of a rule primitive may include:
  • True indicates that the logical operation result of the rule primitive is true, that is, the decision condition described by the rule primitive is met.
  • False indicates that the logical operation result of the rule primitive is false, that is, it indicates that the decision condition described by the rule primitive is not met.
  • error This output indicates that an error occurred during the execution of the rule primitive, and no "true” or "false” output result can be obtained.
  • a structure of the rule primitive may be: (operand 1, operator, operand 2).
  • operand 1 can be a single value, or a set containing multiple values, and can also be expressed in the form of a function. If operand 1 is represented by a function, when the access control policy is determined, the return value of the function can be obtained as operand 1 according to the function. The return value of this function can be the value of a single parameter or a collection containing multiple parameter values. Operand 2 can be a single value, a collection containing multiple values, or a function. If operand 2 is represented by a function, when the access control policy is determined, the return value of the function can be obtained as operand 2 according to the function. The return value of this function can be the value of a single parameter or a collection containing multiple parameter values.
  • the function may be divided into the following two function sets:
  • a function set for obtaining resource access request parameters can be used to obtain the parameters carried in the resource access request.
  • the functions in this function set can include:
  • This function can be named request.get ("to"), where "to" indicates that the parameter requested by the function is the target resource address. Accordingly, the function returns Value is the destination resource address;
  • the function can be named request.get ("operation"), where "operation” indicates that the parameter requested by the function is the type of operation required for the target resource.
  • the return value of this function is the requested operation type, such as the operation type of create, query, modify, or delete;
  • -A function to obtain a role in a resource access request, which may be named request.get ("role IDs"), where "role IDs" indicates that the parameter requested by this function is the identity of the permitted initiator role, and accordingly, The return value of this function is the allowed initiator role ID.
  • a function set for obtaining resource attributes can be used to obtain the attributes of the target resource.
  • the functions in this function set can include:
  • the function can be named resource.get ("resourceType"), where "resourceType” indicates that the parameter requested by the function is the resource type of the target resource. Accordingly, the return value of the function is The resource type of the target resource;
  • the function can be named resource.get (“resourceID”), where "resourceID” indicates that the parameter requested by the function is the identifier of the target resource. Accordingly, the return value of the function is the target. Identification of resources;
  • the function can be named resource.get ("creationTime"), where "creationTime” indicates that the parameter requested by the function is the creation time of the target resource. Accordingly, the return value of the function Creation time for the target resource.
  • Logical operation operator Based on this logical operation operator, it is possible to perform a logical comparison operation on operand 1 and operand 2. For example, the logical operation operators can be: greater than, less than or equal to, etc.
  • Set operator Based on the set operator, it is possible to perform set comparison operations on operand 1 and operand 2. For example, based on the set operator, you can determine whether operand 1 is equal to operand 2 or whether operand 1 is included in operand 2 and so on.
  • the logical operation relationship between the rule primitives in the target resource rule may be a "logical AND".
  • the requested target resource meets the decision conditions defined by all the rule primitives in the target resource rule. Only then can the decision result of the target resource rule be "applicable”. That is, when the output results of all rule primitives in the target resource rule are "true", the decision result of the target resource rule is "applicable”.
  • the logical operation relationship between the rule primitives in the target resource rule may also be a "logical OR".
  • the requested target resource conforms to the definition of at least one rule primitive in the target resource rule.
  • the initiator rules in the access control policy can be described using one or more rule primitives. If multiple rule primitives are used for description, there is a logical operation relationship between the multiple rule primitives. According to the logical operation relationship between the multiple rule primitives, it can be obtained based on the combined result of the multiple rule primitives The result of the decision of the initiator.
  • the logical operation relationship between the rule primitives in the initiator rules may be a "logical AND".
  • the resource access request initiator meets the decision conditions defined by all the rule primitives in the initiator rules. Only then can the judgment result of the initiator rule be "applicable”. In other words, the decision result of the initiator rule is "applicable" when the output results of all rule primitives in the initiator rule are "true”.
  • the logical operation relationship between the rule primitives in the initiator rules may also be a "logical OR".
  • the resource access request initiator meets the definition of at least one rule primitive in the initiator rules.
  • the judgment result of the initiator rule can be "applicable”. That is, as long as the output result of one rule primitive in the initiator rule is "true", the decision result of the initiator rule is "applicable”.
  • the number of access control rules in an access control policy can be one or more. If there are multiple access control rules, there is a logical operation relationship between the multiple access control rules. According to the logical operation relationship between the multiple access control rules, based on the combined result of the multiple access control rules, Unique decision result of all access control rules. Optionally, the logical operation relationship between the access control rules may be allowed first, or negative, or other logical operation relationships. Among them, allow priority indicates that at least one of the access control rules has a decision result of “allowed”, and the only decision result based on all access control rules is “allow”; a negative priority indicates that: There is an access control rule whose decision result is "denied”, and the only decision result based on all access control rules is "denied”.
  • an access control rule is described using at least one set of access control rule primitives, the set including one or more rule primitives, and one rule primitive in the set is used to describe one of the access control rules Judgment conditions.
  • the structure of the rule primitives please refer to the foregoing embodiments, and will not be repeated here.
  • the logical operation relationship between the rule primitives in the set of access control rule primitives may be a "logical AND”.
  • the resource access request meets the decision conditions defined by all the rule primitives in the set.
  • the judgment result based on the set can be “applicable”. That is, when the output results of all rule primitives in the set are "true”, the decision result based on the set is "applicable”.
  • the logical operation relationship between the rule primitives in the set of access control rule primitives may also be a "logical OR".
  • the resource access request conforms to the definition of at least one rule primitive in the set.
  • the judgment result based on the set can be “applicable”. That is, as long as the output result of one rule primitive in the set is "true”, the decision result based on the set is "applicable”.
  • an access control rule may further include a context restriction rule primitive set, the set includes one or more rule primitives, and one rule primitive in the set is used to describe one of the access control rules Context judgment conditions. Based on these conditions, it can be judged whether the access control rule is available.
  • the context decision condition may specifically be a decision condition regarding access time, access location, IP address, and the like.
  • the logical operation relationship between the rule primitives in the context-restricted rule primitive set may be "logical AND". In this case, as long as the output of one rule primitive in the set is "false”, then The decision result of the corresponding access control rule is "not applicable” or "uncertain”.
  • the logical operation relationship between the rule primitives in the context-restricted rule primitive set may also be a "logical OR".
  • the output of all rule primitives in the set is "false”
  • the decision result of the corresponding access control rule is "not applicable” or “not sure”.
  • an access control rule it may be defaulted that when the result of merging based on rule primitives in the set of access control rule primitives is "true” and the result of merging based on rule primitives in the set of context restriction rule primitives is When "true”, the decision result of the access control rule is "allowed”; it can be assumed that when the combined result of the rule primitives in the access control rule primitive set is "true” and the rules in the rule primitive set are restricted based on the context When the combined result of the primitives is "true”, the decision result of the access control rule is "rejected".
  • an identifier can also be set in the access control rule, which can be called a rule impact identifier, which is used to indicate that when the combination result of the rule primitives in the access control rule primitive set is "true” and the rule primitive is restricted based on the context When the combined result of the rule primitives in the set is "true", the decision result of the access control rule is "allow” or “deny”.
  • the access control rule describes that the initiator (AE2, AE3, AE4, AE5) can create a ⁇ container> resource under the ⁇ CSEBase> ⁇ ⁇ AE1> resource.
  • the rule primitives in this access control rule include:
  • the rule primitive Rule1 describes the target resource as CSEBase ⁇ AE1.
  • the rule primitive can also be placed in the target resource rule.
  • Rule primitive 2 describes the initiator (AE2, AE3, AE4, AE5) as the applicable resource access request initiator.
  • the rule primitive can also be placed in the initiator rule.
  • Rule primitive Primitive describes the allowed resource operations: create, read, modify.
  • Rule 5 describes the resource attributes that can be operated on: "maxNrOfInstances”, “maxByteSize”, “maxInstanceAge”.
  • the access control rule describes that the initiator (CSE2, CSE3, CSE4) can obtain the attribute value of the resource attribute (resourceType) of the ⁇ CSEBase> ⁇ ⁇ AE1> resource.
  • the rule primitive Rule1 describes the target resource as CSEBase ⁇ AE1.
  • the rule primitive can also be placed in the target resource rule.
  • the rule primitive Rule2 describes the initiator (CSE2, CSE3, CSE4) as the applicable resource access request initiator.
  • the rule primitive can also be placed in the initiator rule.
  • Rule 4 describes the allowed resource attributes: "resourceType”.
  • the access control rule describes: Role-Based Access Control (RBAC).
  • RBAC Role-Based Access Control
  • the role "Admin” can create ⁇ AE> resources under the ⁇ CSEBase> resource.
  • Rule1 describes that the target resource is a sub-resource under CSEBase.
  • Rule primitive can also be placed in the target resource rule.
  • the rule primitive Rule2 describes the initiator (AE1, AE2, AE3) as the applicable resource access request initiator.
  • the rule primitive can also be placed in the initiator rule.
  • Rule 3 describes the allowed roles: "admin”.
  • Rule primitive Rule 4 describes the allowed resource operations: create.
  • Rule primitive Primitive 5 describes the type of resource allowed for operation: "AE”.
  • the access control rule describes: Role-Based Access Control (RBAC).
  • RBAC Role-Based Access Control
  • the role "Admin” can read the AE IDs and App IDs of the ⁇ AE> resources created under the ⁇ CSEBase> resource in 2017.
  • Rule1 describes that the target resource is a sub-resource under CSEBase.
  • Rule primitive can also be placed in the target resource rule.
  • Rule 2 describes the allowed roles as: "admin”.
  • Rule primitive primitive 3 describes the allowed resource operations as: acquisition.
  • Rule 4 describes the type of resources allowed for operation: "AE”.
  • Rule 5 describes the allowed resource attributes: "AE-ID”, "App-ID”.
  • the rule primitive Rule 6 describes that the allowed creation time of the resource is between 2017.01.01 and 2017.12.31.
  • the access control rule describes: blacklist-based access control.
  • the initiator (AE1, AE2, AE3) cannot read the ⁇ CSEBase> ⁇ ⁇ AE1> resource, that is, the initiator (AE1, AE2, AE3) is on the blacklist of access control.
  • Rule1 describes the target resource as: CSEBase ⁇ AE1.
  • the rule primitive Rule2 describes the initiator (AE1, AE2, AE3) as the applicable resource access request initiator.
  • Rule primitive Effect "deny" describes that when the rule primitive Rule 1, primitive rule 2 and rule primitive 3 are satisfied, the decision result is "rejected".
  • FIG. 3 it is a schematic diagram of a resource access control process according to an embodiment of the present application. This process may be performed by a resource access control device in the system architecture shown in FIG. 2.
  • the process can include:
  • S301 Receive an access control decision request, where the access control decision request is used to request an access control policy decision on a resource access request initiated by an initiator.
  • the initiator sends a resource access request to request access to the target resource.
  • the resource access request can be intercepted by the resource server.
  • the resource server generates an access control decision request according to the resource access request, and sends the request to the resource access control device to request the resource access control device to make an access control decision on the resource access request.
  • the access control policy includes one or more access control rules, and the one or more access control rules are used to describe rules that should be satisfied if the target resource rule and the initiator rule are satisfied, and each access control rule Use at least one access control rule primitive set for description, the access control rule primitive set includes one or more rule primitives, and one rule primitive in the access control rule primitive set is used to describe the access control rule One of the access control conditions.
  • the access control rule Use at least one access control rule primitive set for description, the access control rule primitive set includes one or more rule primitives, and one rule primitive in the access control rule primitive set is used to describe the access control rule One of the access control conditions.
  • the access control rule is further described using a context restriction rule primitive set, and the context restriction rule primitive set includes one or more rule primitives, which are used to describe the context restriction rule primitive set to which it belongs. Whether the access control rules are available.
  • the access control policy further includes a target resource rule for describing a target resource applicable to the access control policy, and the target resource rule is described using one or more rule primitives.
  • the access control policy further includes: an initiator rule for describing a resource access request initiator applicable to the access control policy, and the initiator rule is described using one or more rule primitives.
  • the resource access control device may obtain the resource access control policy locally, or may obtain the resource access control policy from the access control policy providing device. Further, the resource access control device may also obtain related information, such as resource attributes and context information, from the information providing device.
  • S303 Perform an access control policy decision on the resource access request according to the access control policy.
  • the resource access control device can make access control decisions in the order of the target resource rule, the initiator rule, and the access control rule.
  • the access control rule makes a decision, and the decision result of the access control rule is used as the decision result of the access control policy.
  • the decision result of the access control policy is "not applicable”.
  • FIG. 4 exemplarily shows an access control policy decision flow.
  • S304 Return an access control decision response, where the access control decision response carries an access control policy decision result of the resource access request.
  • the resource access control device may send the access control policy decision result to the resource server through the access control policy response, and the resource server may perform resource access according to the access control policy decision result or reject the resource access request of the initiator.
  • an access control policy decision process according to an embodiment of the present application is shown. As shown in the figure, the process may include:
  • S401 Determine whether the target resource requested by the resource access request matches the target resource rule according to the target resource rule. If the target resource rule does not match, go to S402, and if it matches, go to S403.
  • the input parameters for the decision based on the target resource rule may include the address of the target resource accessed by the initiator.
  • the decision process of the target resource rule may include: first determining whether the target resource rule is empty. If it is empty, it indicates that the default target resource rule is applicable to any target resource, so the decision result of the target resource rule is "applicable", that is, the target resource matches the target resource rule; otherwise, the target resource address in the resource access request is obtained. And determine whether the target resource address is within the allowed resource address range described by the target resource rule. If the target resource address is within the allowed resource address range described by the target resource rule, the decision result of the target resource rule is "applicable ", If the target resource address is not within the allowed target resource address range described by the target resource rule, the decision result of the target resource rule is" not applicable ".
  • the decision result of the target resource is "indefinite".
  • S402 Set the decision result of the access control policy to "not applicable", that is, the access control policy is not applicable to the target resource requested by the resource access request.
  • S403 According to the rules of the initiator, determine whether the initiator of the resource access request matches the rules of the initiator. If they do not match, go to S404. If they match, go to S404.
  • the input parameters for the decision based on the initiator rules may include the initiator identification.
  • the decision process of the initiator rule may include: first determining whether the initiator rule is empty, if it is empty, it indicates that the default initiator rule is applicable to any initiator, so the decision result of the initiator rule is "applicable", That is, the originator of the resource request matches the originator rules; otherwise, the originator ID in the resource access request is obtained and it is determined whether the originator ID is within the allowed originator range described by the originator rules; if the originator ID Within the permitted initiators described by the initiator rules, the decision of the initiator rules is "applicable"; if the initiator identification is not within the permitted initiators described by the initiator rules, the initiator rules are judged The result is "not applicable".
  • the decision result of the initiator rules is "indefinite".
  • S404 Set the decision result of the access control policy to "not applicable", that is, the access control policy is not applicable to the initiator of the resource access request.
  • S405 Determine whether the resource access request matches the access control rule according to the access control rule. If they match, go to S406; otherwise, go to S407 or S408 according to the situation.
  • the decision process of the access control rules may include:
  • the rule merging algorithm may include allowing first or negative first.
  • rule primitives By using rule primitives to describe rules in an access control policy, it is convenient to extend the access control policy. Since multiple rule primitives can be used, complex rule definitions can also be supported. For example, the following rule is not supported in the prior art: "Initiator AE with role A accesses target resources", because the description of the initiator is either based on the identity of the initiator or based on the role, and cannot support the combination of the two.
  • the access control policies in the prior art only support a single rule, that is, there is only one rule in an access control policy, so it cannot describe a slightly more complicated access control rule.
  • multiple rule primitives are used to describe the rules in the access control policy, which can support more complex rules.
  • the access control policy in the prior art is only applicable to describing a white list, that is, a case where access is allowed, but not a black list, that is, a case where access is not allowed.
  • a black list that is, a case where access is not allowed.
  • the description of the blacklist can be implemented.
  • At least one rule primitive is used to describe the attribute or sub-resource decision conditions that need to be met, so that in the prior art, the access control policy application can only be compared with the entire resource , Can reduce the granularity of access control policies, so that it can be applied to the sub-components of the resource, for example, can be applied to the attributes or sub-resources under the resource, which can increase the granularity of access control, improve flexibility, and also Reduce the risk of information leakage.
  • the embodiment of the present application further provides a resource access control device, which can implement the resource access control method described in the foregoing embodiment.
  • the device may include a receiving module 501, an obtaining module 502, a decision module 503, and a sending module 504.
  • the receiving module 501 is configured to receive an access control decision request, where the access control decision request is used to request an access control policy decision on a resource access request initiated by an initiator.
  • the obtaining module 502 is configured to obtain an access control policy.
  • the access control policy includes one or more access control rules, and the one or more access control rules are used to describe rules that should be satisfied if the target resource rule and the initiator rule are satisfied, and each access control rule Use at least one access control rule primitive set for description, the access control rule primitive set includes one or more rule primitives, and one rule primitive in the access control rule primitive set is used to describe the access control rule One of the judgment conditions.
  • the decision module 503 is configured to perform an access control policy decision on the resource access request according to the access control policy.
  • the sending module 504 is configured to return an access control decision response, and the access control decision response carries an access control policy decision result for the resource access request.
  • the access control rule is further described using a context restriction rule primitive set, and the context restriction rule primitive set includes one or more rule primitives, which are used to describe the context restriction rule primitive set to which it belongs. Whether the access control rules are available.
  • the access control policy further includes a target resource rule for describing a target resource applicable to the access control policy, and the target resource rule is described using one or more rule primitives.
  • the access control policy further includes: an initiator rule for describing a resource access request initiator applicable to the access control policy, and the initiator rule is described using one or more rule primitives.
  • the rule primitive includes: a first operand, a second operand, and a logical operator for the first operand and the second operand; an output result of the rule primitive is The first operand and the second operand are based on a logical operation result obtained by the logical operator, and the logical operation result includes: true or false; wherein the logical operation result is true, which indicates that the rule is met.
  • the judgment condition described by the language, and the logical operation result is false, indicating that the judgment condition described by the rule primitive is not met.
  • an embodiment of the present application further provides a communication device, which can implement the resource access control method described in the foregoing embodiment.
  • the communication device may include a processor 601, a memory 602, and a bus interface 604. Further, the communication device may further include a network interface 603.
  • the processor 601 is responsible for managing the bus architecture and general processing, and the memory 602 may store data used by the processor 601 when performing operations.
  • the network interface 603 is configured to receive and send data under the control of the processor 601.
  • the bus architecture may include any number of interconnected buses and bridges, and one or more processors specifically represented by the processor 601 and various circuits of the memory represented by the memory 602 are linked together.
  • the bus architecture can also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art, so they are not further described herein.
  • the bus interface 604 provides an interface.
  • the processor 601 is responsible for managing the bus architecture and general processing, and the memory 602 may store data used by the processor 601 when performing operations.
  • the processes disclosed in the embodiments of the present application may be applied to the processor 601, or implemented by the processor 601.
  • each step of the processing flow may be completed by an integrated logic circuit of hardware in the processor 601 or an instruction in the form of software.
  • the processor 601 may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the embodiments in this application.
  • a general-purpose processor may be a microprocessor or any conventional processor.
  • a software module may be located in a mature storage medium such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, and the like.
  • the storage medium is located in the memory 602, and the processor 601 reads the information in the memory 602 and completes the steps of the signal processing flow in combination with its hardware.
  • the processor 601 is configured to read a program in the memory 602 and execute a resource access control process described in the foregoing embodiment.
  • an embodiment of the present application further provides a computer-readable storage medium.
  • the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to cause the computer to execute a resource access control process in the foregoing embodiment.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to work in a specific manner such that the instructions stored in the computer-readable memory produce a manufactured article including an instruction device, the instructions
  • the device implements the functions specified in one or more flowcharts and / or one or more blocks of the block diagram.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of steps can be performed on the computer or other programmable device to produce a computer-implemented process, which can be executed on the computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more flowcharts and / or one or more blocks of the block diagrams.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

本申请公开了一种资源访问控制方法及装置。该方法中，接收到用于请求对发起方发起的资源访问请求进行访问控制策略判决的访问控制决策请求后，根据访问控制策略对所述资源访问请求进行访问控制策略判决，并返回访问控制决策响应。其中，所述访问控制策略包括一个或多个访问控制规则，所述一个或多个访问控制规则用于描述在满足目标资源规则以及发起方规则的情况下应满足的规则，每个访问控制规则使用至少一个访问控制规则原语集合进行描述，所述访问控制规则原语集合中包括一个或多个规则原语，所述访问控制规则原语集合中的一个规则原语用于描述访问控制规则中的一个判决条件。

Description

一种资源访问控制方法及装置
相关申请的交叉引用
本申请要求在2018年07月06日提交中国专利局、申请号为201810738533.8、申请名称为“一种资源访问控制方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种资源访问控制方法及装置。
背景技术
物联网标准化组织(oneM2M)致力于开发一系列用于构造公共的机器对机器通信(Machine-To-Machine，M2M)服务层的技术规范。oneM2M的核心是数据共享，具体是通过oneM2M公共服务实体(Common Services Entity，CSE)内定义的资源树上的数据项的共享实现的。
oneM2M通过对标准化的资源树进行操作来实现服务层资源的共享和交互，oneM2M资源树存在于oneM2M系统所定义的CSE中。根据oneM2M功能架构规范(oneM2M TS-0001:"Functional Architecture")中的定义，oneM2M资源树的形式如图1所示。对oneM2M资源可进行创建(Create)、查询(Retrieve)、修改(Update)和删除(Delete)等操作。
oneM2M所定义的资源中与授权相关的资源是访问控制策略资源<accessControlPolicy>，其中定义有访问控制策略(Access Control Policy，ACP)。<accessControlPolicy>资源由资源ID(identity，身份)唯一标识。
<accessControlPolicy>资源可以直接赋给oneM2M的某些资源类型，或者通过目标资源的accessControlPolicyID属性间接赋给目标资源(即，其他资源通过资源中的accessControlPolicyIDs属性指定适用于该资源的访问控制策略)。存储在<accessControlPolicy>资源中的访问控制策略，以目标资源为单位描述 访问控制。针对目标资源的各种策略规则将适用于目标资源的所有属性和子资源。
目前，oneM2M系列规范中的安全规范(oneM2M TS-0003:"Security Solutions")给出了oneM2M授权架构的高层描述，具体给出了授权架构的主要组成部分和基本流程，但如何描述访问控制策略的相关规则，尚未给出具体的实现方案。
发明内容
本申请实施例提供一种资源访问控制方法及装置。
第一方面，提供一种资源访问控制方法，该方法包括：接收访问控制决策请求，所述访问控制决策请求用于请求对发起方发起的资源访问请求进行访问控制策略判决；获取访问控制策略；根据所述访问控制策略，对所述资源访问请求进行访问控制策略判决；返回访问控制决策响应，所述访问控制决策响应携带对所述资源访问请求的访问控制策略判决结果。其中，所述访问控制策略包括一个或多个访问控制规则，所述一个或多个访问控制规则用于描述在满足目标资源规则以及发起方规则的情况下应满足的规则，每个访问控制规则使用至少一个访问控制规则原语集合进行描述，所述访问控制规则原语集合中包括一个或多个规则原语，所述访问控制规则原语集合中的一个规则原语用于描述访问控制规则中的一个判决条件。
在一种可能的实现方式中，所述访问控制规则还使用上下文限制规则原语集合进行描述，所述上下文限制规则原语集合中包括一个或多个规则原语，用于描述所述上下文限制规则原语集合所属的访问控制规则是否可用。
在一种可能的实现方式中，所述访问控制策略，还包括：目标资源规则，用于描述适用于所述访问控制策略的目标资源，所述目标资源规则使用一个或多个规则原语进行描述。
在一种可能的实现方式中，所述访问控制策略，还包括：发起方规则，用于描述适用于所述访问控制策略的资源访问请求发起方，所述发起方规则 使用一个或多个规则原语进行描述。
在一种可能的实现方式中，所述规则原语包括：第一操作数、第二操作数以及用于所述第一操作数和所述第二操作数的逻辑运算符。所述规则原语的输出结果为所述第一操作数和所述第二操作数基于所述逻辑运算符得到的逻辑运算结果，所述逻辑运算结果包括：真或假；其中，逻辑运算结果为真，表示符合所述规则原语描述的判决条件，逻辑运算结果为假，表示不符合所述规则原语描述的判决条件。
在一种可能的实现方式中，所述第一操作数表示为参数或参数集合或表示为第一函数，所述第一函数用于获取作为第一操作数的参数或参数集合；和/或，所述第二操作数表示为参数或参数集合或表示为第二函数，所述第二函数用于获取作为第二操作数的参数或参数集合。
在一种可能的实现方式中，所述第一函数用于获取作为第一操作数的参数或参数集合，包括：所述第一函数用于从所述资源访问请求中获取作为第一操作数的参数或参数集合，或用于获取作为第一操作数的目标资源属性值或属性值集合，或用于获取作为第一操作数的发起方属性值或属性值集合，或用于获取作为第一操作数的上下文信息；所述第二函数用于获取作为第二操作数的参数或参数集合，包括：所述第二函数用于从所述资源访问请求中获取作为第二操作数的参数或参数集合，或用于获取作为第二操作数的目标资源属性值或属性值集合，或用于获取作为第二操作数的发起方属性值或属性值集合，或用于获取作为第二操作数的上下文信息。
在一种可能的实现方式中，所述逻辑运算符为逻辑比较运算符或集合运算符。
在一种可能的实现方式中，所述多个规则原语之间存在逻辑运算关系，所述逻辑运算关系包括：逻辑与运算关系，或者逻辑或运算关系。
在一种可能的实现方式中，所述多个访问控制规则之间存在逻辑运算关系。
在一种可能的实现方式中，所述访问控制规则，还包括：规则影响标识； 所述规则影响标识用于指示当所述访问控制规则中的所有规则原语的输出结果为真时，所述访问控制规则的判决结果为允许还是拒绝。
第二方面，提供一种资源访问控制装置，该装置包括：接收模块，用于接收访问控制决策请求，所述访问控制决策请求用于请求对发起方发起的资源访问请求进行访问控制策略判决；获取模块，用于获取访问控制策略；判决模块，用于根据所述访问控制策略，对所述资源访问请求进行访问控制策略判决；发送模块，用于返回访问控制决策响应，所述访问控制决策响应携带对所述资源访问请求的访问控制策略判决结果。其中，所述访问控制策略包括一个或多个访问控制规则，所述一个或多个访问控制规则用于描述在满足目标资源规则以及发起方规则的情况下应满足的规则，每个访问控制规则使用至少一个访问控制规则原语集合进行描述，所述访问控制规则原语集合中包括一个或多个规则原语，所述访问控制规则原语集合中的一个规则原语用于描述访问控制规则中的一个判决条件。
在一种可能的实现方式中，所述访问控制规则还使用上下文限制规则原语集合进行描述，所述上下文限制规则原语集合中包括一个或多个规则原语，用于描述所述上下文限制规则原语集合所属的访问控制规则是否可用。
在一种可能的实现方式中，所述访问控制策略，还包括：目标资源规则，用于描述适用于所述访问控制策略的目标资源，所述目标资源规则使用一个或多个规则原语进行描述。
在一种可能的实现方式中，所述访问控制策略，还包括：发起方规则，用于描述适用于所述访问控制策略的资源访问请求发起方，所述发起方规则使用一个或多个规则原语进行描述。
在一种可能的实现方式中，所述规则原语包括：第一操作数、第二操作数以及用于所述第一操作数和所述第二操作数的逻辑运算符；所述规则原语的输出结果为所述第一操作数和所述第二操作数基于所述逻辑运算符得到的逻辑运算结果，所述逻辑运算结果包括：真或假；其中，逻辑运算结果为真，表示符合所述规则原语描述的判决条件，逻辑运算结果为假，表示不符合所 述规则原语描述的判决条件。
第三方面，提供一种通信装置，该装置包括：处理器、存储器；所述处理器，用于读取所述存储器中的程序，执行：接收访问控制决策请求，所述访问控制决策请求用于请求对发起方发起的资源访问请求进行访问控制策略判决；获取访问控制策略；根据所述访问控制策略，对所述资源访问请求进行访问控制策略判决；返回访问控制决策响应，所述访问控制决策响应携带对所述资源访问请求的访问控制策略判决结果。其中，所述访问控制策略包括一个或多个访问控制规则，所述一个或多个访问控制规则用于描述在满足目标资源规则以及发起方规则的情况下应满足的规则，每个访问控制规则使用至少一个访问控制规则原语集合进行描述，所述访问控制规则原语集合中包括一个或多个规则原语，所述访问控制规则原语集合中的一个规则原语用于描述访问控制规则中的一个判决条件。
在一种可能的实现方式中，所述访问控制规则还使用上下文限制规则原语集合进行描述，所述上下文限制规则原语集合中包括一个或多个规则原语，用于描述所述上下文限制规则原语集合所属的访问控制规则是否可用。
在一种可能的实现方式中，所述访问控制策略，还包括：目标资源规则，用于描述适用于所述访问控制策略的目标资源，所述目标资源规则使用一个或多个规则原语进行描述。
在一种可能的实现方式中，所述访问控制策略，还包括：发起方规则，用于描述适用于所述访问控制策略的资源访问请求发起方，所述发起方规则使用一个或多个规则原语进行描述。
在一种可能的实现方式中，所述规则原语包括：第一操作数、第二操作数以及用于所述第一操作数和所述第二操作数的逻辑运算符；所述规则原语的输出结果为所述第一操作数和所述第二操作数基于所述逻辑运算符得到的逻辑运算结果，所述逻辑运算结果包括：真或假；其中，逻辑运算结果为真，表示符合所述规则原语描述的判决条件，逻辑运算结果为假，表示不符合所述规则原语描述的判决条件。
在一种可能的实现方式中，所述第一操作数表示为参数或参数集合或表示为第一函数，所述第一函数用于获取作为第一操作数的参数或参数集合；和/或，所述第二操作数表示为参数或参数集合或表示为第二函数，所述第二函数用于获取作为第二操作数的参数或参数集合。
在一种可能的实现方式中，所述第一函数用于获取作为第一操作数的参数或参数集合，包括：所述第一函数用于从所述资源访问请求中获取作为第一操作数的参数或参数集合，或用于获取作为第一操作数的目标资源属性值或属性值集合，或用于获取作为第一操作数的发起方属性值或属性值集合，或用于获取作为第一操作数的上下文信息；所述第二函数用于获取作为第二操作数的参数或参数集合，包括：所述第二函数用于从所述资源访问请求中获取作为第二操作数的参数或参数集合，或用于获取作为第二操作数的目标资源属性值或属性值集合，或用于获取作为第二操作数的发起方属性值或属性值集合，或用于获取作为第二操作数的上下文信息。
在一种可能的实现方式中，所述逻辑运算符为逻辑比较运算符或集合运算符。
在一种可能的实现方式中，所述多个规则原语之间存在逻辑运算关系，所述逻辑运算关系包括：逻辑与运算关系，或者逻辑或运算关系。
在一种可能的实现方式中，所述多个访问控制规则之间存在逻辑运算关系。
在一种可能的实现方式中，所述访问控制规则，还包括：规则影响标识；所述规则影响标识用于指示当所述访问控制规则中的所有规则原语的输出结果为真时，所述访问控制规则的判决结果为允许还是拒绝。
第四方面，提供一种计算机可读存储介质，所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令用于使所述计算机执行如上述第一方面中任一项所述的方法。
本申请的上述实施例中，接收到用于请求对发起方发起的资源访问请求进行访问控制策略判决的访问控制决策请求后，根据访问控制策略对该资源 访问请求进行访问控制策略判决，并返回访问控制决策响应。其中，访问控制策略包括一个或多个访问控制规则，每个访问控制规则使用至少一个访问控制规则原语集合进行描述，所述访问控制规则原语集合中包括一个或多个规则原语，一个规则原语用于描述访问控制规则中的一个判决条件。可以看出，本申请实施例中的访问控制规则的描述方式为规则原语，从而针对如何描述访问控制策略中的规则，给出了解决方案。
附图说明
图1为现有技术中的oneM2M资源树示意图；
图2为本申请实施例适用的一种系统架构示意图；
图3为本申请实施例提供的资源访问控制流程示意图；
图4为本申请实施例中的访问控制策略判决流程示意图；
图5为本申请实施例提供的资源访问控制装置的结构示意图；
图6为本申请实施例提供的通信装置的结构示意图。
具体实施方式
本申请实施例提供了一种资源访问控制方法及装置。通过本申请实施例，针对访问控制策略的相关规则提出了新的描述方式。
本申请实施例可以适用于oneM2M系统或者其他系统。
下面结合附图对本申请实施例进行详细描述。
参见图2，为本申请实施例所适用的一种系统架构示意图，如图所示，该系统架构可包括：资源服务器、资源访问控制装置、访问控制策略提供装置、信息提供装置。这些组成部分可以是彼此独立的逻辑实体，也可以是彼此独立的硬件设备，还可以将其中的几个逻辑上独立的实体集成在一个硬件设备中。
资源服务器与需要访问控制的应用系统共存，并由应用系统调用。资源服务器根据资源访问发起方的资源访问请求生成访问控制决策请求，并发送 给资源访问控制装置，然后根据资源访问控制装置返回的访问控制决策响应确定是否执行该资源访问请求。
资源访问控制装置负责根据访问控制策略判决是否同意对由资源服务器发送来的访问控制决策请求所请求的目标资源进行访问，并将判决结果通过访问控制决策响应返回给资源服务器。此过程中，资源访问控制装置可以从本地获取访问控制策略，也可以从访问控制策略提供装置获取访问控制策略，还可以从信息提供装置获取与用户、资源或环境相关的信息，例如访问用户的IP地址，资源的创建者，当前的时间等。
以oneM2M系统为例，上述资源服务器可以是oneM2M系统中的策略执行点(Policy Enforcement Point，PEP)实体，上述访问决策装置可以是oneM2M系统中的策略决策点(Policy Decision Point，PDP)实体，上述访问控制策略提供装置可以是oneM2M系统中的策略获取点(Policy Retrieval Point，PRP)实体，上述信息提供装置可以是oneM2M系统中的策略信息点(Policy Information Point，PIP)实体。
本申请实施例中，用于对发起方发起的资源访问请求进行访问控制策略判决的访问控制策略，主要体现为各种规则，这些规则可包括以下3个方面的规则：
(1)目标资源规则：访问控制策略中的目标资源规则，用于描述适用于该访问控制策略的目标资源。也就是说，根据目标资源规则，可以判断资源访问请求所请求访问的目标资源是否被允许访问。
根据目标资源规则对资源访问请求所请求访问的目标资源进行访问控制策略判决，可以得到以下判决结果：
适用：表示访问控制策略适用于资源访问请求所请求的目标资源，即，该目标资源符合目标资源规则的要求，该目标资源允许被访问。
不适用：表示访问控制策略不适用于资源访问请求所请求访问的目标资源，即该目标资源不符合目标资源规则的要求，该目标资源不允许被访问。
进一步地，考虑到在访问控制策略判决过程中，可能发生错误(比如系 统异常引起的错误或其他原因引起的错误)，以至于无法判断访问控制策略是否适用于资源访问请求所请求访问的目标资源，因此针对这种情况，还可能得到以下判决结果：不确定。该判决结果表示在判决过程中发生错误，无法判断访问控制策略是否适用于该目标资源。
(2)发起方规则：访问控制策略中的发起方规则，用于描述适用于该访问控制策略的资源访问请求发起方。也就是说，根据发起方规则，可以判断针对资源访问请求的发起方，是否允许其进行资源访问。
根据发起方规则对资源访问请求发起方进行访问控制策略判决，可以得到以下判决结果：
适用：表示访问控制策略适用于资源访问请求的发起方，即，该资源访问请求的发起方被允许进行资源访问。
不适用：表示访问控制策略不适用于资源访问请求的发起方，即该资源访问请求的发起方被拒绝进行资源访问。
进一步地，考虑到在访问控制策略判决过程中，可能发生错误(比如系统异常引起的错误或其他原因引起的错误)，以至于无法判断访问控制策略是否适用于资源访问请求的发起方，因此针对这种情况，还可能得到以下判决结果：不确定。该判决结果表示在判决过程中发生错误，无法判断访问控制策略是否适用于该资源访问请求的发起方。
(3)访问控制规则：访问控制规则用于描述在满足目标资源规则以及发起方规则的情况下应满足的其他规则。也就是说，在资源访问请求满足目标资源规则以及发起方规则的情况下，根据访问控制规则，可以判断该资源访问请求是被允许还是被拒绝。可选地，访问控制规则可以基于资源属性、用户属性、上下文属性等信息进行定义，即基于这些属性描述需要满足的规则。
根据访问控制规则对资源访问请求进行访问控制策略判决，可以得到以下判决结果：
允许：表示访问控制策略允许资源访问请求，即，资源访问请求符合访问控制规则的要求，该资源访问请求被允许。
拒绝：表示访问控制策略不允许资源访问请求，即，资源访问请求不符合放弃控制规则的要求，该资源访问请求被拒绝。
进一步地，还可能得到以下判决结果：不适用。该判决结果表示访问控制策略不适用于资源访问请求。出现该判决结果的一种可能情况为：访问控制规则中包括上下文限制规则，如果根据该上下文限制规则判断该资源访问请求不被允许，则得到的判决结果为“不适用”。
进一步地，考虑到在访问控制策略判决过程中可能发生错误(比如系统异常引起的错误或其他原因引起的错误)，以至于无法判断是否允许资源访问请求，因此针对这种情况，还可能得到以下判决结果：不确定。该判决结果表示在判决过程中发生错误，无法判断是否允许该资源访问请求。
可选地，访问控制策略中的目标资源规则，可以使用一个或多个规则原语进行描述。如果使用多个规则原语进行描述，则该多个规则原语之间存在逻辑运算关系，根据该多个规则原语之间的逻辑运算关系，可以基于该多个规则原语的合并结果得出目标资源规则的判决结果。
其中，规则原语可以由一个或多个指令组成，用于描述一个判决条件。规则原语具有不可分割性。
对于一个规则原语，将输入参数输入该规则原语进行逻辑运算，可以得到一个输出结果。一个规则原语的输出结果能够表明是否符合该规则原语所描述的判决条件。具体地，一个规则原语的输出结果可包括：
真(true)：表示规则原语的逻辑运算结果为真，即，符合该规则原语所描述的判决条件。
假(false)：表示规则原语的逻辑运算结果为假，即，表示不符合该规则原语所描述的判决条件。
进一步地，考虑到在规则原语的逻辑运算过程中，可能发生错误(比如系统异常引起的错误或其他原因引起的错误)，以至于无法得到“真”或“假”的输出结果，因此针对这种情况，还可能得到以下输出结果：错误。该输出结果表示在规则原语的执行过程中发生错误，无法得出“真”或“假”的输 出结果。
可选地，规则原语的一种结构可以是：(操作数1，操作符，操作数2)。
其中，操作数1可以为单个数值，也可以是包含多个数值的集合，还可以以函数形式表示。如果操作数1用函数表示，则在访问控制策略判决时，可根据该函数获取该函数的返回值作为操作数1。该函数的返回值可以是单个参数的数值，也可以是包含多个参数数值的集合。操作数2可以为单个数值，也可以是包含多个数值的集合，还可以以函数形式表示。如果操作数2用函数表示，则在访问控制策略判决时，可根据该函数获取该函数的返回值作为操作数2。该函数的返回值可以是单个参数的数值，也可以是包含多个参数数值的集合。
可选地，所述函数可被划分为以下两个函数集：
(1)获取资源访问请求参数的函数集，该函数集中的函数可以用来获取资源访问请求中携带的参数。例如，该函数集中的函数可包括：
-获取资源访问请求中目标资源地址的函数，该函数可命名为request.get(“to”)，其中的“to”表示该函数所请求的参数为目标资源地址，相应地，该函数的返回值为目标资源地址；
-获取资源访问请求中所请求的操作类型的函数，该函数可命名为request.get(“operation”)，其中的“operation”表示该函数所请求的参数为针对目标资源需要进行的操作类型，相应地，该函数的返回值为所请求的操作类型，比如可以是创建、查询、修改或删除等操作类型；
-获取资源访问请求中角色的函数，该可命名为request.get(“role ids”)，其中的“role ids”表示该函数所请求的参数为被允许的发起方角色的标识，相应地，该函数的返回值为被允许的发起方角色ID。
(2)获取资源属性的函数集，该函数集中的函数可以用来获取目标资源的属性。例如，该函数集中的函数可包括：
-获取目标资源类型的函数，该函数可命名为resource.get(“resourceType”)，其中的“resourceType”表示该函数所请求的参数为目标资源的资源类型，相应 地，该函数的返回值为目标资源的资源类型；
-获取目标资源标识的函数，该函数可命名为resource.get(“resourceID”)，其中的“resourceID”表示该函数所请求的参数为目标资源的标识，相应地，该函数的返回值为目标资源的标识；
-获取目标资源创建时间的函数，该函数可命名为resource.get(“creationTime”)，其中的“creationTime”表示该函数所请求的参数为目标资源的创建时间，相应地，该函数的返回值为目标资源的创建时间。
可选地，上述规则原语中的操作符，可分为以下两类：
逻辑运算操作符：基于该逻辑运算操作符，能够实现对操作数1和操作数2进行逻辑比较运算。举例来说，逻辑运算操作符可以是：大于，小于或等于等。
集合运算操作符：基于集合运算操作符，能够实现对操作数1和操作数2进行集合比较运算。举例来说，基于集合运算操作符，可以判断：操作数1与操作数2是否相等，或者操作数1是否包含于操作数2等。
可选地，目标资源规则中的规则原语之间的逻辑运算关系可以是“逻辑与”，这种情况下，所请求的目标资源符合目标资源规则中的所有规则原语所定义的判决条件时，目标资源规则的判决结果才能为“适用”。也就是说，目标资源规则中的所有规则原语的输出结果均为“真”时，目标资源规则的判决结果才为“适用”。
可选地，目标资源规则中的规则原语之间的逻辑运算关系也可以是“逻辑或”，这种情况下，所请求的目标资源符合目标资源规则中的至少一个规则原语所定义的判决条件时，目标资源规则的判决结果就可以为“适用”。也就是说，目标资源规则中只要有一个规则原语的输出结果为“真”，则目标资源规则的判决结果就为“适用”。
可选地，访问控制策略中的发起方规则可以使用一个或多个规则原语进行描述。如果使用多个规则原语进行描述，则该多个规则原语之间存在逻辑运算关系，根据该多个规则原语之间的逻辑运算关系，可以基于该多个规则 原语的合并结果得出发起方规则的判决结果。
其中，规则原语的结构等相关描述，可参见前述实施例，在此不再重复。
可选地，发起方规则中的规则原语之间的逻辑运算关系可以是“逻辑与”，这种情况下，资源访问请求发起方符合发起方规则中的所有规则原语所定义的判决条件时，发起方规则的判决结果才能为“适用”。也就是说，发起方规则中的所有规则原语的输出结果均为“真”时，发起方规则的判决结果才为“适用”。
可选地，发起方规则中的规则原语之间的逻辑运算关系也可以是“逻辑或”，这种情况下，资源访问请求发起方符合发起方规则中的至少一个规则原语所定义的判决条件时，发起方规则的判决结果就可以为“适用”。也就是说，发起方规则中只要有一个规则原语的输出结果为“真”，则发起方规则的判决结果就为“适用”。
访问控制策略中的访问控制规则，其数量可以是一个或多个。如果访问控制规则为多个，则该多个访问控制规则之间存在逻辑运算关系，根据该多个访问控制规则之间的逻辑运算关系，可以基于该多个访问控制规则的合并结果得出基于所有访问控制规则的唯一判决结果。可选地，访问控制规则之间的逻辑运算关系可以是允许优先，也可以是否定优先，或者其他逻辑运算关系。其中，允许优先表示：所有访问控制规则中至少有一个访问控制规则的判决结果为“允许”，则基于所有访问控制规则的唯一判决结果为“允许”；否定优先表示：所有访问控制规则中只要有一个访问控制规则的判决结果为“拒绝”，则基于所有访问控制规则的唯一判决结果为“拒绝”。
可选地，一个访问控制规则使用至少一个访问控制规则原语集合进行描述，该集合中包括一个或多个规则原语，该集合中的一个规则原语用于描述该访问控制规则中的一个判决条件。其中，规则原语的结构等相关描述，可参见前述实施例，在此不再重复。
可选地，访问控制规则原语集合中的规则原语之间的逻辑运算关系可以是“逻辑与”，这种情况下，资源访问请求符合该集合中的所有规则原语所定 义的判决条件时，基于该集合的判决结果才能为“适用”。也就是说，该集合中的所有规则原语的输出结果均为“真”时，基于该集合的判决结果才为“适用”。
可选地，访问控制规则原语集合中的规则原语之间的逻辑运算关系也可以是“逻辑或”，这种情况下，资源访问请求符合该集合中的至少一个规则原语所定义的判决条件时，基于该集合的判决结果就可以为“适用”。也就是说，该集合中只要有一个规则原语的输出结果为“真”，则基于该集合的判决结果就为“适用”。
可选地，一个访问控制规则中还可以进一步包括一个上下文限制规则原语集合，该集合中包括一个或多个规则原语，该集合中一个规则原语用于描述该访问控制规则中的一个上下文判决条件，基于这些条件可以判断该访问控制规则是否可用。上下文判决条件具体可以是有关访问时间、访问位置、IP地址等的判决条件。其中，规则原语的结构等相关描述，可参见前述实施例，在此不再重复。
可选地，上下文限制规则原语集合中的规则原语之间的逻辑运算关系可以是“逻辑与”，这种情况下，该集合中只要有一个规则原语的输出为“假”，则对应的访问控制规则的判决结果就为“不适用”或“不确定”。
可选地，上下文限制规则原语集合中的规则原语之间的逻辑运算关系也可以是“逻辑或”，这种情况下，该集合中的所有规则原语的输出均为“假”时，对应的访问控制规则的判决结果才为“不适用”或“不确定”。
可选地，在一个访问控制规则中，可以默认当基于访问控制规则原语集合中的规则原语的合并结果为“真”以及基于上下文限制规则原语集合中的规则原语的合并结果为“真”时，该访问控制规则的判决结果为“允许”；可以默认当基于访问控制规则原语集合中的规则原语的合并结果为“真”以及基于上下文限制规则原语集合中的规则原语的合并结果为“真”时，该访问控制规则的判决结果为“拒绝”。当然，也可以在访问控制规则中设置一个标识，可称为规则影响标识，用于指示当基于访问控制规则原语集合中的规则 原语的合并结果为“真”以及基于上下文限制规则原语集合中的规则原语的合并结果为“真”时，该访问控制规则的判决结果是“允许”还是“拒绝”。
进一步地，在一个访问控制规则中，若基于访问控制规则原语集合中的规则原语的合并结果为“错误”，或者基于上下文限制规则原语集合中的规则原语的合并结果为“错误”，则该访问控制规则的判决结果为“不适用”或“不确定”。
下面示例性地示出几个访问控制规则的例子，以便更好地理解本申请实施例。
访问控制规则的示例一：
该访问控制规则描述：发起方(AE2,AE3,AE4,AE5)能够在<CSEBase>\<AE1>资源下创建<container>资源。该访问控制规则中的规则原语包括：
Rule effect＝”permit”
Rule primitive合并规则：“and”
Rule primitive 1:request.get(“to”)＝＝“CSEBase\AE1”//
Rule primitive 2:request.get(“from”)in“AE2,AE3,AE4,AE5”
Rule primitive 3:request.get(“operation”)＝＝{”create”,”retrieve”,”update”}
Rule primitive 4:request.get(“resource type”)＝＝”container”
Rule primitive 5:request.get(“content”)in{“maxNrOfInstances”,“maxByteSize”,“maxInstanceAge”}
说明：
规则原语Rule primitive 1描述目标资源为CSEBase\AE1。该规则原语也可以放在目标资源规则中。
规则原语Rule primitive 2描述发起方(AE2,AE3,AE4,AE5)为适用的资源访问请求发起方。该规则原语也可以放在发起方规则中。
规则原语Rule primitive 3描述允许的资源操作为：创建，读取，修改。
规则原语Rule primitive4描述允许操作的目标资源类型为”container”。
规则原语Rule primitive 5描述能够操作的资源属性为：“maxNrOfInstances”,“maxByteSize”,“maxInstanceAge”。
访问控制规则示例二：
该访问控制规则描述：发起方(CSE2,CSE3,CSE4)能够获取<CSEBase>\<AE1>资源的资源属性(resourceType)的属性值。
Rule effect＝”permit”
Rule primitive合并规则：“and”
Rule primitive 1:request.get(“to”)＝＝“CSEBase\AE1”
Rule primitive 2:request.get(“from”)in“CSE2,CSE3,CSE4”
Rule primitive 3:request.get(“operation”)＝＝”retrieve”
Rule primitive 4:request.get(“content”)in{“resourceType”}
说明：
规则原语Rule primitive 1描述目标资源为CSEBase\AE1。该规则原语也可以放在目标资源规则中。
规则原语Rule primitive 2描述发起方(CSE2,CSE3,CSE4)为适用的资源访问请求发起方。该规则原语也可以放在发起方规则中。
规则原语Rule primitive 3描述允许的资源操作为：读取。
规则原语Rule primitive 4描述允许操作的资源属性为：“resourceType”。
访问控制规则示例三：
该访问控制规则描述：基于角色的访问控制(Role-Based Access Control，RBAC)。角色“Admin”可在<CSEBase>资源下创建<AE>资源。
Rule effect＝”permit”
Rule primitive合并规则：“and”
Rule effect＝”Permit”
Rule primitive 1:request.getParents(“to”)＝＝“CSEBase”
Rule primitive 2:request.get(“from”)in“AE1,AE2,AE3”
Rule primitive 3:request.get(“role ids”)in“admin”
Rule primitive 4:request.get(“operation”)＝＝”create”
Rule primitive 5:request.get(“resource type”)＝＝”AE”
说明：
规则原语Rule primitive 1描述目标资源为CSEBase下的子资源。该规则原语也可以放在目标资源规则中。
规则原语Rule primitive 2描述发起方(AE1,AE2,AE3)为适用的资源访问请求发起方。该规则原语也可以放在发起方规则中。
规则原语Rule primitive 3描述允许的角色为：“admin”。
规则原语Rule primitive 4描述允许的资源操作为：创建。
规则原语Rule primitive 5描述允许操作的资源类型为：“AE”。
访问控制规则示例四：
该访问控制规则描述：基于角色的访问控制(Role-Based Access Control，RBAC)。角色“Admin”可以读取<CSEBase>资源下于2017年创建的<AE>资源的AE IDs和App IDs。
Rule effect＝”permit”
Rule primitive合并规则：“and”
Rule effect＝”Permit”
Rule primitive 1:request.getParents(“to”)＝＝“CSEBase”
Rule primitive 2:request.get(“role ids”)in“admin”
Rule primitive 3:request.get(“operation”)＝＝”retrieve”
Rule primitive 4:resource.get(“resourceType”)＝＝”AE”
Rule primitive 5:request.get(“content”)in{“AE-ID”,“App-ID”}
Rule primitive 6:resource.get(“creationTime”)>＝2017.01.01&&resource.get(“creationTime”)<＝”2017.12.31”
说明：
规则原语Rule primitive 1描述目标资源为CSEBase下的子资源。该规则原语也可以放在目标资源规则中。
规则原语Rule primitive 2描述允许的角色为：“admin”。
规则原语Rule primitive 3描述允许的资源操作为：获取。
规则原语Rule primitive 4描述允许操作的资源类型为：“AE”。
规则原语Rule primitive 5描述允许操作的资源属性为：“AE-ID”,“App-ID”。
规则原语Rule primitive 6描述允许操作的资源的创建时间为2017.01.01至2017.12.31之间。
访问控制规则示例五：
该访问控制规则描述：基于黑名单(Black list)的访问控制。发起方(AE1,AE2,AE3)不能读取<CSEBase>\<AE1>资源，也即发起方(AE1,AE2,AE3)在访问控制的黑名单上。
Rule effect＝”deny”
Rule primitive合并规则：“and”
Rule primitive 1:request.get(“to”)＝＝“CSEBase\AE1”
Rule primitive 2:request.get(“from”)in“AE1,AE2,AE3”
Rule primitive 3:request.get(“operation”)＝＝”retrieve”
说明：
规则原语Rule primitive 1描述目标资源为：CSEBase\AE1。
规则原语Rule primitive 2描述发起方(AE1,AE2,AE3)为适用的资源访问请求发起方。
规则原语Rule primitive 3描述允许的资源操作为：读取。
规则原语Rule effect＝”deny”描述当满足规则原语Rule primitive 1，规则原语Rule primitive 2和规则原语Rule primitive 3时，判决结果为“拒绝”。
参见图3，为本申请实施例提供的资源访问控制流程示意图。该流程可由图2所示的系统架构中的资源访问控制装置执行。
如图所示，该流程可包括：
S301：接收访问控制决策请求，所述访问控制决策请求用于请求对发起方发起的资源访问请求进行访问控制策略判决。
该步骤中，发起方发送资源访问请求，用以请求对目标资源进行访问。 该资源访问请求可被资源服务器截取。资源服务器根据该资源访问请求生成访问控制决策请求，并发送给资源访问控制装置，以请求资源访问控制装置对该资源访问请求进行访问控制判决。
S302：获取访问控制策略。
其中，所述访问控制策略包括一个或多个访问控制规则，所述一个或多个访问控制规则用于描述在满足目标资源规则以及发起方规则的情况下应满足的规则，每个访问控制规则使用至少一个访问控制规则原语集合进行描述，所述访问控制规则原语集合中包括一个或多个规则原语，所述访问控制规则原语集合中的一个规则原语用于描述访问控制规则中的一个访问控制条件。关于访问控制规则的相关描述，可参见前述实施例，在此不再重复。
可选地，所述访问控制规则还使用上下文限制规则原语集合进行描述，所述上下文限制规则原语集合中包括一个或多个规则原语，用于描述所述上下文限制规则原语集合所属的访问控制规则是否可用。
可选地，所述访问控制策略还包括：目标资源规则，用于描述适用于所述访问控制策略的目标资源，所述目标资源规则使用一个或多个规则原语进行描述。
可选地，所述访问控制策略还包括：发起方规则，用于描述适用于所述访问控制策略的资源访问请求发起方，所述发起方规则使用一个或多个规则原语进行描述。
上述访问控制策略中的规则原语的结构以及相关描述，可参见前述实施例，在此不再重复。
在具体实施时，资源访问控制装置可以从本地获取资源访问控制策略，也可以从访问控制策略提供装置获取资源访问控制策略。进一步地，资源访问控制装置还可以从信息提供装置获取相关信息，比如资源属性、上下文信息等。
S303：根据所述访问控制策略，对所述资源访问请求进行访问控制策略判决。
该步骤中，资源访问控制装置可以按照目标资源规则、发起方规则和访问控制规则的顺序进行访问控制判决，只有当目标资源规则和发起方规则的判决结果均为“适用”时，才会对访问控制规则进行判决，并将访问控制规则的判决结果作为访问控制策略的判决结果。只要目标资源规则的判决结果和发起方规则的判决结果中有一个为“不适用”，则访问控制策略的判决结果为“不适用”。图4示例性地示出了访问控制策略判决流程。
S304：返回访问控制决策响应，所述访问控制决策响应携带所述资源访问请求的访问控制策略判决结果。
该步骤中，资源访问控制装置可以将访问控制策略判决结果通过访问控制策略响应发送给资源服务器，资源服务器可依据访问控制策略判决结果进行资源访问，或拒绝发起方的资源访问请求。
参见图4，为本申请实施例提供的访问控制策略判决流程，如图所示，该流程可包括：
S401：根据目标资源规则，判断资源访问请求所请求访问的目标资源与该目标资源规则是否匹配，若不匹配，则转入S402，若匹配则转入S403。
基于目标资源规则进行判决的输入参数可以包括发起方访问的目标资源的地址。
作为一个例子，目标资源规则的判决过程可包括：首先判断目标资源规则是否为空。如果为空，则表明默认目标资源规则适用于任何目标资源，因此目标资源规则的判决结果为“适用”，即目标资源与目标资源规则相匹配；否则，获取资源访问请求中的目标资源地址，并判断该目标资源地址是否在目标资源规则所描述的被允许的资源地址范围内，若目标资源地址在目标资源规则描述的被允许的资源地址范围内，则目标资源规则的判决结果为“适用”，若目标资源地址不在目标资源规则描述的被允许的目标资源地址范围内，则目标资源规则的判决结果为“不适用”。
可选地，若目标资源规则判决过程中出现错误，则目标资源的判决结果为“不确定”。
S402：将访问控制策略的判决结果设置为“不适用”，即，访问控制策略不适用于该资源访问请求所请求的目标资源。
S403：根据发起方规则，判断资源访问请求的发起方与该发起方规则是否匹配，若不匹配，则转入S404，若匹配则转入S404。
基于发起方规则进行判决的输入参数可以包括发起方标识。
作为一个例子，发起方规则的判决过程可包括：首先判断发起方规则是否为空，如果为空，则表明默认发起方规则适用于任何发起方，因此发起方规则的判决结果为“适用”，即资源请求的发起方与发起方规则相匹配；否则，获取资源访问请求中的发起方标识，并判断该发起方标识是否在发起方规则描述的被允许的发起方范围内；若发起方标识在发起方规则描述的被允许的发起方范围内，则发起方规则的判决结果为“适用”；若发起方标识不在发起方规则描述的被允许的发起方范围内，则发起方规则的判决结果为“不适用”。
进一步地，若发起方规则判决过程中出现错误，则发起方规则的判决结果为“不确定”。
S404：将访问控制策略的判决结果设置为“不适用”，即，访问控制策略不适用于该资源访问请求的发起方。
S405：根据访问控制规则，判断资源访问请求是否与该访问控制规则相匹配，若匹配，则转入S406，否则，根据情况转入S407或S408。
作为一个例子，访问控制规则的判决过程可包括：
首先，判断访问控制规则中是否存在上下文限制规则原语集合，如果存在，则根据上下文限制规则原语集合中的规则原语，对该访问控制规则的可用状态进行判决，若判决为该访问控制规则可用，则进行后续的访问控制规则判决，若判决为该访问控制规则不可用，则转入S407，将访问控制策略的判决结果设置为“不适用”，若判决为该访问控制规则的可用状态为不确定，则将访问控制策略的判决结果设置为“不确定”；若访问控制规则中不存在上下文限制规则原语集合，则可认为基于上下文限制规则原语集合的判决结果为“真”，并进行后续的访问控制规则判决。
在基于上下文限制规则原语集合进行判决的过程中，若该规则原语集合中的规则原语的合并结果为“真”，则表明该访问控制规则可用，若该规则原语集合中的规则原语的合并结果为“假”，则表明该访问控制规则不可用。进一步地，若判决过程中出现错误，则表明该访问控制规则的可用状态为“不确定”。
在基于访问控制规则进行判决的过程中，根据访问控制规则中的访问控制规则原语集合，若判断该规则原语集合中的规则原语的合并结果为“真”，则转入S406，访问控制规则的判决结果为“允许”，若判断该规则原语集合中的规则原语的合并结果为“假”，则转入S408，访问控制规则的判决结果为“拒绝”，若判决过程中出现错误，则访问控制规则的判决结果为“不确定”。
进一步地，如果访问控制规则有多个，则针对每个访问控制规则进行判决，得到该访问控制规则的判决结果，然后，根据各个访问控制规则的判决结果，基于规则合并算法，确定基于所有访问控制规则的最终判决结果。其中，规则合并算法可包括允许优先或否定优先。
通过以上描述可以看出，访问控制策略中的目标资源规则、发起方规则、访问控制规则中的一个或多个，可以使用规则原语进行描述。从而针对如何描述访问控制策略中的规则，给出了解决方案。
通过使用规则原语对访问控制策略中的规则进行描述，可以方便对访问控制策略进行扩展。由于可以使用多个规则原语，因此还可以支持复杂的规则定义。例如，现有技术中不支持以下规则：“具有角色A的发起方AE访问目标资源”，因为对发起方的描述要么基于发起方标识，要么基于角色，不能支持两者的结合使用，即现有技术中的访问控制策略只支持单一的规则，也即一个访问控制策略内只有一个规则，因此不能描述稍微复杂一些的访问控制规则。而本申请实施例中，使用多个规则原语描述访问控制策略中的规则，可以支持较为复杂的规则。
进一步地，现有技术中的访问控制策略只适用于描述白名单，也即允许访问的情况，而不能描述黑名单，也即不允许访问的情况。而本申请实施例， 则可以实现黑名单的描述。
可选地，在一些实施例中，至少有一个规则原语用于描述资源下的属性或子资源需要满足的判决条件，这样与现有技术中只能将访问控制策略应用与整个资源相比，可以减小访问控制策略的颗粒度，使其能够应用到资源下级的组成部分，比如，能够应用到资源下的属性或子资源，进而可以提高访问控制的颗粒度，提高灵活性，还可以降低信息泄露的风险。
基于相同的技术构思，本申请实施例还提供了一种资源访问控制装置，该资源访问控制装置可以实现前述实施例描述的资源访问控制方法。
参见图5，为本申请实施例提供的资源访问控制装置的结构示意图。该装置可包括：接收模块501、获取模块502、判决模块503、发送模块504。
接收模块501用于接收访问控制决策请求，所述访问控制决策请求用于请求对发起方发起的资源访问请求进行访问控制策略判决。
获取模块502用于获取访问控制策略。其中，所述访问控制策略包括一个或多个访问控制规则，所述一个或多个访问控制规则用于描述在满足目标资源规则以及发起方规则的情况下应满足的规则，每个访问控制规则使用至少一个访问控制规则原语集合进行描述，所述访问控制规则原语集合中包括一个或多个规则原语，所述访问控制规则原语集合中的一个规则原语用于描述访问控制规则中的一个判决条件。
判决模块503用于根据所述访问控制策略，对所述资源访问请求进行访问控制策略判决。
发送模块504用于返回访问控制决策响应，所述访问控制决策响应携带对所述资源访问请求的访问控制策略判决结果。
可选地，所述访问控制规则还使用上下文限制规则原语集合进行描述，所述上下文限制规则原语集合中包括一个或多个规则原语，用于描述所述上下文限制规则原语集合所属的访问控制规则是否可用。
可选地，所述访问控制策略，还包括：目标资源规则，用于描述适用于所述访问控制策略的目标资源，所述目标资源规则使用一个或多个规则原语 进行描述。
可选地，所述访问控制策略，还包括：发起方规则，用于描述适用于所述访问控制策略的资源访问请求发起方，所述发起方规则使用一个或多个规则原语进行描述。
可选地，所述规则原语包括：第一操作数、第二操作数以及用于所述第一操作数和所述第二操作数的逻辑运算符；所述规则原语的输出结果为所述第一操作数和所述第二操作数基于所述逻辑运算符得到的逻辑运算结果，所述逻辑运算结果包括：真或假；其中，逻辑运算结果为真，表示符合所述规则原语描述的判决条件，逻辑运算结果为假，表示不符合所述规则原语描述的判决条件。
上述资源访问控制装置中，涉及访问控制策略以及规则原语的相关描述，可参见前述实施例，在此不再重复。
基于相同的技术构思，本申请实施例还提供了一种通信装置，该通信装置可以实现前述实施例描述的资源访问控制方法。
参见图6，为本申请实施例提供的通信装置的结构示意图。如图所示，该通信装置可包括：处理器601、存储器602以及总线接口604。进一步地，该通信装置还可包括网络接口603。
处理器601负责管理总线架构和通常的处理，存储器602可以存储处理器601在执行操作时所使用的数据。网络接口603用于在处理器601的控制下接收和发送数据。
总线架构可以包括任意数量的互联的总线和桥，具体由处理器601代表的一个或多个处理器和存储器602代表的存储器的各种电路链接在一起。总线架构还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口604提供接口。处理器601负责管理总线架构和通常的处理，存储器602可以存储处理器601在执行操作时所使用的数据。
本申请实施例揭示的流程，可以应用于处理器601中，或者由处理器601 实现。在实现过程中，处理流程的各步骤可以通过处理器601中的硬件的集成逻辑电路或者软件形式的指令完成。处理器601可以是通用处理器、数字信号处理器、专用集成电路、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件，可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器602，处理器601读取存储器602中的信息，结合其硬件完成信号处理流程的步骤。
具体地，处理器601，用于读取存储器602中的程序并执行前述实施例描述的资源访问控制流程。
基于相同的技术构思，本申请实施例还提供了一种计算机可读存储介质。所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令用于使所述计算机执行前述实施例中的资源访问控制流程。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或 多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本申请的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本申请范围的所有变更和修改。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (28)

  1. 一种资源访问控制方法，其特征在于，包括：
    接收访问控制决策请求，所述访问控制决策请求用于请求对发起方发起的资源访问请求进行访问控制策略判决；
    获取访问控制策略；其中，所述访问控制策略包括一个或多个访问控制规则，所述一个或多个访问控制规则用于描述在满足目标资源规则以及发起方规则的情况下应满足的规则，每个访问控制规则使用至少一个访问控制规则原语集合进行描述，所述访问控制规则原语集合中包括一个或多个规则原语，所述访问控制规则原语集合中的一个规则原语用于描述访问控制规则中的一个判决条件；
    根据所述访问控制策略，对所述资源访问请求进行访问控制策略判决；
    返回访问控制决策响应，所述访问控制决策响应携带对所述资源访问请求的访问控制策略判决结果。
  2. 如权利要求1所述的方法，其特征在于，所述访问控制规则还使用上下文限制规则原语集合进行描述，所述上下文限制规则原语集合中包括一个或多个规则原语，用于描述所述上下文限制规则原语集合所属的访问控制规则是否可用。
  3. 如权利要求1所述的方法，其特征在于，所述访问控制策略，还包括：目标资源规则，用于描述适用于所述访问控制策略的目标资源，所述目标资源规则使用一个或多个规则原语进行描述。
  4. 如权利要求1所述的方法，其特征在于，所述访问控制策略，还包括：发起方规则，用于描述适用于所述访问控制策略的资源访问请求发起方，所述发起方规则使用一个或多个规则原语进行描述。
  5. 如权利要求1至4中任一项所述的方法，其特征在于，所述规则原语包括：第一操作数、第二操作数以及用于所述第一操作数和所述第二操作数的逻辑运算符；
    所述规则原语的输出结果为所述第一操作数和所述第二操作数基于所述逻辑运算符得到的逻辑运算结果，所述逻辑运算结果包括：真或假；其中，逻辑运算结果为真，表示符合所述规则原语描述的判决条件，逻辑运算结果为假，表示不符合所述规则原语描述的判决条件。
  6. 如权利要求5所述的方法，其特征在于：
    所述第一操作数表示为参数或参数集合或表示为第一函数，所述第一函数用于获取作为第一操作数的参数或参数集合；和/或，
    所述第二操作数表示为参数或参数集合或表示为第二函数，所述第二函数用于获取作为第二操作数的参数或参数集合。
  7. 如权利要求6所述的方法，其特征在于：
    所述第一函数用于获取作为第一操作数的参数或参数集合，包括：
    所述第一函数用于从所述资源访问请求中获取作为第一操作数的参数或参数集合，或用于获取作为第一操作数的目标资源属性值或属性值集合，或用于获取作为第一操作数的发起方属性值或属性值集合，或用于获取作为第一操作数的上下文信息；
    所述第二函数用于获取作为第二操作数的参数或参数集合，包括：
    所述第二函数用于从所述资源访问请求中获取作为第二操作数的参数或参数集合，或用于获取作为第二操作数的目标资源属性值或属性值集合，或用于获取作为第二操作数的发起方属性值或属性值集合，或用于获取作为第二操作数的上下文信息。
  8. 如权利要求5所述的方法，其特征在于，所述逻辑运算符为逻辑比较运算符或集合运算符。
  9. 如权利要求1至4中任一项所述的方法，其特征在于，所述多个规则原语之间存在逻辑运算关系，所述逻辑运算关系包括：逻辑与运算关系，或者逻辑或运算关系。
  10. 如权利要求1至4中任一项所述的方法，其特征在于，所述多个访问控制规则之间存在逻辑运算关系。
  11. 如权利要求1至4中任一项所述的方法，其特征在于，所述访问控制规则，还包括：规则影响标识；
    所述规则影响标识用于指示当所述访问控制规则中的所有规则原语的输出结果为真时，所述访问控制规则的判决结果为允许还是拒绝。
  12. 一种资源访问控制装置，其特征在于，包括：
    接收模块，用于接收访问控制决策请求，所述访问控制决策请求用于请求对发起方发起的资源访问请求进行访问控制策略判决；
    获取模块，用于获取访问控制策略；其中，所述访问控制策略包括一个或多个访问控制规则，所述一个或多个访问控制规则用于描述在满足目标资源规则以及发起方规则的情况下应满足的规则，每个访问控制规则使用至少一个访问控制规则原语集合进行描述，所述访问控制规则原语集合中包括一个或多个规则原语，所述访问控制规则原语集合中的一个规则原语用于描述访问控制规则中的一个判决条件；
    判决模块，用于根据所述访问控制策略，对所述资源访问请求进行访问控制策略判决；
    发送模块，用于返回访问控制决策响应，所述访问控制决策响应携带对所述资源访问请求的访问控制策略判决结果。
  13. 如权利要求12所述的装置，其特征在于，所述访问控制规则还使用上下文限制规则原语集合进行描述，所述上下文限制规则原语集合中包括一个或多个规则原语，用于描述所述上下文限制规则原语集合所属的访问控制规则是否可用。
  14. 如权利要求12所述的装置，其特征在于，所述访问控制策略，还包括：目标资源规则，用于描述适用于所述访问控制策略的目标资源，所述目标资源规则使用一个或多个规则原语进行描述。
  15. 如权利要求12所述的装置，其特征在于，所述访问控制策略，还包括：发起方规则，用于描述适用于所述访问控制策略的资源访问请求发起方，所述发起方规则使用一个或多个规则原语进行描述。
  16. 如权利要求12至15中任一项所述的装置，其特征在于，所述规则原语包括：第一操作数、第二操作数以及用于所述第一操作数和所述第二操作数的逻辑运算符；
    所述规则原语的输出结果为所述第一操作数和所述第二操作数基于所述逻辑运算符得到的逻辑运算结果，所述逻辑运算结果包括：真或假；其中，逻辑运算结果为真，表示符合所述规则原语描述的判决条件，逻辑运算结果为假，表示不符合所述规则原语描述的判决条件。
  17. 一种通信装置，其特征在于，包括：处理器、存储器；所述处理器，用于读取所述存储器中的程序，执行：
    接收访问控制决策请求，所述访问控制决策请求用于请求对发起方发起的资源访问请求进行访问控制策略判决；
    获取访问控制策略；其中，所述访问控制策略包括一个或多个访问控制规则，所述一个或多个访问控制规则用于描述在满足目标资源规则以及发起方规则的情况下应满足的规则，每个访问控制规则使用至少一个访问控制规则原语集合进行描述，所述访问控制规则原语集合中包括一个或多个规则原语，所述访问控制规则原语集合中的一个规则原语用于描述访问控制规则中的一个判决条件；
    根据所述访问控制策略，对所述资源访问请求进行访问控制策略判决；
    返回访问控制决策响应，所述访问控制决策响应携带对所述资源访问请求的访问控制策略判决结果。
  18. 如权利要求17所述的装置，其特征在于，所述访问控制规则还使用上下文限制规则原语集合进行描述，所述上下文限制规则原语集合中包括一个或多个规则原语，用于描述所述上下文限制规则原语集合所属的访问控制规则是否可用。
  19. 如权利要求17所述的装置，其特征在于，所述访问控制策略，还包括：目标资源规则，用于描述适用于所述访问控制策略的目标资源，所述目标资源规则使用一个或多个规则原语进行描述。
  20. 如权利要求17所述的装置，其特征在于，所述访问控制策略，还包括：发起方规则，用于描述适用于所述访问控制策略的资源访问请求发起方，所述发起方规则使用一个或多个规则原语进行描述。
  21. 如权利要求17至20中任一项所述的装置，其特征在于，所述规则原语包括：第一操作数、第二操作数以及用于所述第一操作数和所述第二操作数的逻辑运算符；
    所述规则原语的输出结果为所述第一操作数和所述第二操作数基于所述逻辑运算符得到的逻辑运算结果，所述逻辑运算结果包括：真或假；其中，逻辑运算结果为真，表示符合所述规则原语描述的判决条件，逻辑运算结果为假，表示不符合所述规则原语描述的判决条件。
  22. 如权利要求21所述的装置，其特征在于：
    所述第一操作数表示为参数或参数集合或表示为第一函数，所述第一函数用于获取作为第一操作数的参数或参数集合；和/或，
    所述第二操作数表示为参数或参数集合或表示为第二函数，所述第二函数用于获取作为第二操作数的参数或参数集合。
  23. 如权利要求22所述的装置，其特征在于：
    所述第一函数用于获取作为第一操作数的参数或参数集合，包括：
    所述第一函数用于从所述资源访问请求中获取作为第一操作数的参数或参数集合，或用于获取作为第一操作数的目标资源属性值或属性值集合，或用于获取作为第一操作数的发起方属性值或属性值集合，或用于获取作为第一操作数的上下文信息；
    所述第二函数用于获取作为第二操作数的参数或参数集合，包括：
    所述第二函数用于从所述资源访问请求中获取作为第二操作数的参数或参数集合，或用于获取作为第二操作数的目标资源属性值或属性值集合，或用于获取作为第二操作数的发起方属性值或属性值集合，或用于获取作为第二操作数的上下文信息。
  24. 如权利要求21所述的装置，其特征在于，所述逻辑运算符为逻辑比 较运算符或集合运算符。
  25. 如权利要求17至20中任一项所述的装置，其特征在于，所述多个规则原语之间存在逻辑运算关系，所述逻辑运算关系包括：逻辑与运算关系，或者逻辑或运算关系。
  26. 如权利要求17至20中任一项所述的装置，其特征在于，所述多个访问控制规则之间存在逻辑运算关系。
  27. 如权利要求17至20中任一项所述的装置，其特征在于，所述访问控制规则，还包括：规则影响标识；
    所述规则影响标识用于指示当所述访问控制规则中的所有规则原语的输出结果为真时，所述访问控制规则的判决结果为允许还是拒绝。
  28. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令用于使所述计算机执行如权利要求1至11中任一项所述的方法。
PCT/CN2019/087658 2018-07-06 2019-05-20 一种资源访问控制方法及装置 Ceased WO2020007132A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810738533.8A CN110691061B (zh) 2018-07-06 2018-07-06 一种资源访问控制方法及装置
CN201810738533.8 2018-07-06

Publications (1)

Publication Number Publication Date
WO2020007132A1 true WO2020007132A1 (zh) 2020-01-09

Family

ID=69060571

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/087658 Ceased WO2020007132A1 (zh) 2018-07-06 2019-05-20 一种资源访问控制方法及装置

Country Status (2)

Country Link
CN (1) CN110691061B (zh)
WO (1) WO2020007132A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113949664A (zh) * 2020-07-15 2022-01-18 瑞昱半导体股份有限公司 用于网络装置中的电路及分组处理方法
CN118672580A (zh) * 2024-08-26 2024-09-20 西安热工研究院有限公司 监控画面图元显示决策实现方法、系统、设备及存储介质

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114826629A (zh) * 2021-01-22 2022-07-29 北京京东方技术开发有限公司 数据共享方法、装置、系统、服务器和计算机存储介质
CN113329011B (zh) * 2021-05-27 2022-07-08 北京天空卫士网络安全技术有限公司 一种安全访问控制方法和装置
CN114465763A (zh) * 2021-12-24 2022-05-10 天翼云科技有限公司 一种资源访问控制方法、装置和存储介质
CN115333815A (zh) * 2022-08-02 2022-11-11 北京天空卫士网络安全技术有限公司 一种访问控制方法和装置
CN115563653B (zh) * 2022-11-03 2026-02-03 江苏易安联网络技术有限公司 一种网络访问控制策略的设计及存储方法
CN115865439A (zh) * 2022-11-22 2023-03-28 浙江中控技术股份有限公司 一种分布式工业控制系统及该系统的访问权限控制方法
CN116132198B (zh) * 2023-04-07 2023-07-25 杭州海康威视数字技术股份有限公司 基于轻量化上下文语义的物联网隐私行为感知方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150101014A1 (en) * 2012-02-27 2015-04-09 Axiomatics Ab Provisioning authorization claims using attribute-based access-control policies
CN104811465A (zh) * 2014-01-27 2015-07-29 电信科学技术研究院 一种访问控制的决策方法和设备
CN105635931A (zh) * 2014-11-04 2016-06-01 华为技术有限公司 一种资源访问的方法和装置
CN106973031A (zh) * 2016-01-13 2017-07-21 电信科学技术研究院 一种资源访问控制方法、装置及系统

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101876994B (zh) * 2009-12-22 2012-02-15 中国科学院软件研究所 一种多层次优化的策略评估引擎的建立方法及其实施方法
CN103745161B (zh) * 2013-12-23 2016-08-24 东软集团股份有限公司 访问安全控制方法及装置
US9948682B2 (en) * 2015-08-11 2018-04-17 Vescel, Llc Data resource control through a control policy defining an authorized context for utilization of a protected data resource
CN105577399A (zh) * 2014-10-09 2016-05-11 中兴通讯股份有限公司 一种网络设备的访问控制列表管理方法和装置
CN106326760B (zh) * 2016-08-31 2019-03-15 清华大学 一种用于数据分析的访问控制规则描述方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150101014A1 (en) * 2012-02-27 2015-04-09 Axiomatics Ab Provisioning authorization claims using attribute-based access-control policies
CN104811465A (zh) * 2014-01-27 2015-07-29 电信科学技术研究院 一种访问控制的决策方法和设备
CN105635931A (zh) * 2014-11-04 2016-06-01 华为技术有限公司 一种资源访问的方法和装置
CN106973031A (zh) * 2016-01-13 2017-07-21 电信科学技术研究院 一种资源访问控制方法、装置及系统

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113949664A (zh) * 2020-07-15 2022-01-18 瑞昱半导体股份有限公司 用于网络装置中的电路及分组处理方法
CN113949664B (zh) * 2020-07-15 2023-04-07 瑞昱半导体股份有限公司 用于网络装置中的电路及分组处理方法
CN118672580A (zh) * 2024-08-26 2024-09-20 西安热工研究院有限公司 监控画面图元显示决策实现方法、系统、设备及存储介质

Also Published As

Publication number Publication date
CN110691061B (zh) 2020-12-08
CN110691061A (zh) 2020-01-14

Similar Documents

Publication Publication Date Title
CN110691061B (zh) 一种资源访问控制方法及装置
CN106973031B (zh) 一种资源访问控制方法、装置及系统
US11902279B2 (en) Method, apparatus, system and storage medium for access control policy configuration
US8516249B2 (en) Cloud services layer
US12106253B2 (en) Container management method, apparatus, and device
US11095518B2 (en) Determining violation of a network invariant
CN111464487A (zh) 访问控制方法、装置及系统
CN106034112B (zh) 访问控制、策略获取、属性获取方法及相关装置
US10380367B2 (en) Dynamic access control of resources in a computing environment
CN107306247B (zh) 资源访问控制方法及装置
WO2020253344A1 (zh) 一种授权控制的方法、装置以及存储介质
CN117633828A (zh) 一种基于语义支持的数据访问控制方法、设备及介质
CN109743202B (zh) 数据的管理方法、装置、设备及可读存储介质
CN108763963B (zh) 基于数据访问权限的分布式处理方法、装置及系统
US12474902B2 (en) Annotation driven just in time and state-based RBAC policy control
CN111124591B (zh) 一种镜像传输方法、装置、电子设备及存储介质
CN116302424A (zh) 分布式系统的数据处理方法、节点及分布式系统
CN118200054B (zh) 一种安全检测方法、装置、存储介质及电子设备
CN115514506A (zh) 云平台资源管理方法、装置及可读存储介质
WO2021008569A1 (zh) 一种集群中资源管理的方法及装置
WO2019006998A1 (zh) Node.js权限控制方法、存储介质、电子设备及系统
CN121326445A (zh) 授权表维护及接口调用方法、装置、设备、终端及介质
CN118838609A (zh) 一种接口授权表的维护方法
CN116628724A (zh) 用户访问控制方法、装置、设备及存储介质
CN117149402A (zh) 微内核操作系统下任务响应方法、装置及设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19829968

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19829968

Country of ref document: EP

Kind code of ref document: A1