WO2023010608A1

WO2023010608A1 - Cross-domain secure interaction method and system, terminal, and storage medium

Info

Publication number: WO2023010608A1
Application number: PCT/CN2021/112257
Authority: WO
Inventors: 戴思佳; 宁立; 张涌
Original assignee: 中国科学院深圳先进技术研究院
Priority date: 2021-08-02
Filing date: 2021-08-12
Publication date: 2023-02-09
Also published as: CN113612770A

Abstract

The present application relates to a cross-domain secure interaction method and system, a terminal, and a storage medium. The method comprises: constructing a third-party proxy authentication center, issuing, by means of the third-party proxy authentication center, a digital certificate to a system supporting cross-domain access, and issuing an endorsement credential to a device under the system; by means of the third-party proxy authentication center, generating, by using an attribute mapping method, an attribute certificate of a system requesting access in a source domain, the system requesting access sending, by using the attribute certificate, an access request to a system requested in a target domain for access; by means of the third-party proxy authentication center, performing, according to the access request and the attribute certificate, identity verification on the system requesting access, and if verified, establishing a cross-domain security interaction between the system requesting access in the source domain and the system requested in the target domain for access. The embodiments of the present application achieves one-to-many cross-domain identity verification between heterogeneous systems, and improves access efficiency and the security of cross-domain access control.

Description

A cross-domain secure interaction method, system, terminal and storage medium

technical field

The present application belongs to the technical field of network security, and in particular relates to a cross-domain secure interaction method, system, terminal and storage medium.

Background technique

In recent years, in order to eliminate isolated information islands, implement interconnection, and promote intensive construction, the integration and sharing of government information has been highly valued by governments at all levels. The user registration database is uniformly established on the provincial government service platform, and user registration is uniformly provided by the provincial government service platform, and the government service pages of various cities and departments no longer provide user registration functions. Similarly, the user login interface is also uniformly provided by the provincial government service platform, and each city and department only provides corresponding jump links. Although the government affairs service systems of various departments do not provide user registration and login verification functions, a unified user authentication docking management module must be established to uniformly handle the mutual calls between the user authentication subsystems of the provincial government service platform.

A heterogeneous system refers to a system structure in which nodes are distributed in different security domains. Cross-domain authentication refers to identity verification for users in different trust domains when conducting cross-domain access and communication. In a common network security solution, the server generally verifies the identity of the client through an agreed authentication protocol. Due to the wide variety of devices and application systems in the Internet of Things, this traditional security model has various drawbacks. First of all, if the number of devices is too large, it may lead to difficulties in device identity management, resulting in high performance requirements for system servers and high cost of identity management; secondly, different application systems independently store device identity information and complete identity verification independently. Independent mode, each system will be an isolated island of trust, resources and information between systems cannot be shared and used, resulting in waste of resources; finally, authentication mechanisms between different independent systems may be different, different types of The security of the devices is also different, which also leads to many uncertain factors in the authentication of the identity of the client.

In addition, in order to protect the privacy of users, the data needs to be encrypted when it is transmitted in the domain. The traditional method is to use symmetric or asymmetric encryption algorithms, but this method is not suitable for complex scenarios of government affairs systems.

Based on the above, how to construct a safe and efficient cross-domain access control model for an originally independent and secure single domain in a distributed multi-domain environment, and then conduct secure interactions with external domains has become a research difficulty.

Contents of the invention

The present application provides a cross-domain secure interaction method, system, terminal and storage medium, aiming to solve one of the above-mentioned technical problems in the prior art at least to a certain extent.

In order to solve the above problems, the application provides the following technical solutions:

A cross-domain secure interaction method, comprising:

Build a third-party proxy certification center, issue digital certificates to systems that support cross-domain access through the third-party proxy certification center, and issue endorsement certificates to devices under the system;

The third-party proxy authentication center uses the attribute mapping method to generate the attribute certificate of the system requesting access in the source domain, and the system requesting access uses the attribute certificate to send an access request to the system requested to access in the target domain; the access request includes endorsement certificate;

The third-party proxy authentication center authenticates the system requesting access according to the access request and the attribute certificate, and if the verification passes, establishes cross-domain security interaction between the system requesting access in the source domain and the system requested access in the target domain.

The technical solution adopted in the embodiment of the present application also includes: issuing a digital certificate to a system that supports cross-domain access, and issuing an endorsement certificate to a device under the system is specifically:

Identify the system information that requests access to the third-party proxy authentication center, and issue a digital certificate to the system that supports cross-domain access;

Receive the registration request sent by the device under the system, and after analyzing the registration request, issue an endorsement certificate to the device according to the authentication mode of the system.

The technical solution adopted in the embodiment of the present application further includes: the issuing of the endorsement certificate to the device specifically includes:

Parse the registration request of the device, verify the user identity information of the device and whether the registration request is legal and how legal, query the target domain information that the device expects to access, and generate a pair of keys, according to the key and user identity information Generate an endorsement certificate;

digitally sign the endorsement certificate using the key in said digital certificate;

Issue the endorsement certificate, digital signature and private key to the device, and write the endorsement certificate issuance record into a third-party agency certification center;

The endorsement certificate includes the unique identity of the device, the identifier of the certificate issuing system, the name of the certificate issuing system, the authentication method of the certificate issuing system, the device authentication result, the valid time and timestamp of the certificate, digital signature, and the target domain expected to be accessed The system identifier, the attribute operations supported by the requested system in the target domain, and the key for encrypted communication with the device.

The technical solution adopted in the embodiment of the present application also includes: the attribute certificate includes the identity information of the device, key information, the unique serial number of the certificate, the valid period of use of the certificate, attribute information, the domain of use, the issuing unit, and the issuing unit’s Public key information and certificate type;

The access request includes the unique identity of the device, the content requested to be accessed, the operation requested to be supported, the validity period and time stamp of the requested access, and the endorsement certificate.

The technical solution adopted in the embodiment of the present application also includes: the generation of the attribute certificate of the system requesting access in the source domain through the third-party proxy authentication center using the attribute mapping method specifically includes:

Constructing an attribute table storage module, the attribute table storage module is used to store the attribute conversion relationship between domains;

Constructing an attribute mapping table, the attribute mapping table is used to record all attributes of the source domain and the target domain, and the mutual mapping relationship between the attributes;

A buffer is constructed in the attribute mapping service module, and the attribute mapping table between common domains is stored through the buffer;

Use the attribute mapping table to perform attribute mapping on the attribute certificate. If the corresponding attribute mapping table can be completely mapped, it means that cross-domain access and synchronous modification operations are supported; if the corresponding attribute mapping table cannot be mapped, it means that cross-domain access cannot be performed; if If the attribute mapping table is partially mapped, it means that it can be accessed across domains but cannot be modified.

The technical solution adopted in the embodiment of the present application further includes: the identity verification of the system requesting access through the third-party proxy authentication center according to the access request and the attribute certificate further includes:

Analyzing the access request and the attribute certificate through the requested access system in the target domain; the parsing process includes:

Analyzing the access request, checking the timestamp and request content of the access request;

Query the information of the issuer of the endorsement certificate through the third-party agency certification center, verify the digital signature, and verify whether the endorsement certificate is complete;

Check the validity period of the endorsement certificate and the status of the issuer, verify whether the access request is compliant, and check whether the issuer of the endorsement certificate is in the trust list of the domain.

The technical solution adopted in the embodiment of the present application further includes: if the verification is passed, establishing cross-domain security interaction between the system requesting access in the source domain and the system requested access in the target domain specifically includes:

Opening a data sharing domain that can support read and write operations in the data domain of the system that is requested to access in the target domain, and the data sharing domain supports devices under the system that requests access in the source domain to perform synchronous modification operations;

The data sharing domain is indicated to the target domain by the third-party proxy authentication center.

Another technical solution adopted by the embodiment of the present application is: a cross-domain security interaction system, including:

Certification center building module: used to build a third-party proxy certification center, issue digital certificates to systems supporting cross-domain access through the third-party proxy certification center, and issue endorsement certificates to devices under the system;

The request sending module: used to generate the attribute certificate of the system requesting access in the source domain by using the attribute mapping method through the third-party proxy authentication center, and the system requesting access uses the attribute certificate to send an access request to the system requested to access in the target domain; The access request includes an endorsement credential;

System verification module: used to verify the identity of the system requesting access through the third-party proxy authentication center according to the access request and the attribute certificate, and if the verification is passed, establish the system requesting access in the source domain and the system requested access in the target domain Cross-domain security interaction.

Another technical solution adopted by the embodiment of the present application is: a terminal, the terminal includes a processor and a memory coupled to the processor, wherein,

The memory stores program instructions for implementing the cross-domain secure interaction method;

The processor is configured to execute the program instructions stored in the memory to control cross-domain security interaction.

Another technical solution adopted by the embodiment of the present application is: a storage medium storing program instructions executable by a processor, and the program instructions are used to execute the cross-domain security interaction method.

Compared with the prior art, the beneficial effect produced by the embodiment of the present application lies in that the cross-domain secure interaction method, system, terminal and storage medium of the embodiment of the present application establish a trusted third-party agent authentication center, and through the third-party agent The certification center builds a unified identity for different systems and devices under the system, uses digital certificates to verify the cross-domain identity of different systems in the Internet of Things environment, and realizes one-to-many cross-domain identity verification between heterogeneous systems; and After the identity verification is successful, a data sharing domain that supports read and write operations is divided in the data domain of the requested system to achieve safe interoperability between different domains, while ensuring the security of some data domains that cannot be modified and accessed and avoid wastage of resources. The invention adopts the data transmission mode based on the attribute certificate encryption algorithm in the cross-domain access process, which improves the access efficiency and the security of the cross-domain access control.

Description of drawings

FIG. 1 is a flowchart of a cross-domain security interaction method according to the first embodiment of the present application;

FIG. 2 is a flowchart of a cross-domain security interaction method according to a second embodiment of the present application;

FIG. 3 is a schematic diagram of an attribute certificate in an embodiment of the present application;

FIG. 4 is a schematic structural diagram of a cross-domain security interaction system according to an embodiment of the present application;

FIG. 5 is a schematic structural diagram of a terminal according to an embodiment of the present application;

FIG. 6 is a schematic structural diagram of a storage medium according to an embodiment of the present application.

Detailed ways

In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present application, not to limit the present application.

Please refer to FIG. 1 , which is a flowchart of a cross-domain secure interaction method according to the first embodiment of the present application. The cross-domain security interaction method in the first embodiment of the present application includes the following steps:

S100: Build a third-party proxy certification center, issue digital certificates to systems that support cross-domain access through the third-party proxy certification center, and issue endorsement certificates to devices under the system;

Among them, the third-party proxy certification center includes a digital certification center, an attribute mapping center, and a data operation record cache center. It has information about all systems that support cross-domain access, and has a private key generation function to assist the system and devices under the system. Negotiate the key between them. Through the third-party proxy authentication center, a unified identity is built for different systems and devices under the system, and one-to-many cross-domain authentication between heterogeneous identity systems is realized.

S110: Generate the attribute certificate of the system requesting access in the source domain by using the attribute mapping method through the third-party proxy authentication center, and the system requesting access sends an access request to the system requesting access in the target domain using the attribute certificate;

Among them, the attribute certificate includes the identity information of the device, key information, unique certificate serial number, valid period of the certificate, information about attributes, domain of use, issuing unit, public key information of the issuing unit, and certificate type and other information. The access request specifically includes information such as the unique identity of the device, the content requested to be accessed, the operation requested to be supported, the validity period and time stamp of the requested access, and the endorsement certificate.

S120: Use the third-party proxy authentication center to verify the identity of the system requesting access according to the access request and the attribute certificate. If the verification is passed, establish cross-domain security interaction between the system requesting access in the source domain and the system requested access in the target domain;

Among them, if the verification is passed, it means that the system requesting access is trustworthy, and a data sharing domain that supports read and write operations is opened in the data domain of the system that is requested to access. This data sharing domain can support data reading and writing by devices in the source domain system and other modification operations, while being able to support the modification operation of the source domain system, it also ensures the confidentiality of the target domain system.

Please refer to FIG. 2 , which is a flowchart of a cross-domain secure interaction method according to the second embodiment of the present application. The cross-domain security interaction method in the second embodiment of the present application includes the following steps:

S200: Build a third-party agency certification center;

In this step, by establishing an authentication center trusted by different systems in the third-party system or cloud server, different systems access the authentication center, register in the system through the device, and log in to the registered system. The third-party proxy certification center includes a digital certification center, an attribute mapping center, and a data operation record cache center. It has information about all systems that support cross-domain access, and has a private key generation function to assist in the communication between the system and the devices under the system. Key negotiation. Through the third-party proxy authentication center, a unified identity is built for different systems and devices under the system, and one-to-many cross-domain authentication between heterogeneous identity systems is realized.

S210: Use a third-party proxy authentication center to identify system information that requests access to the authentication center, and issue a digital certificate to a system that supports cross-domain access;

In this step, digital certificates are used to verify whether system access with endorsement credentials is supported.

S220: Receive the registration request sent by the device under the system supporting cross-domain access through the third-party proxy authentication center, and after analyzing the registration request, issue an endorsement certificate to the corresponding device according to the authentication methods of different systems;

Specifically, the endorsement certificate is a type of digital certificate. Each device under the system only needs to register once with the third-party proxy certification center to directly access other systems that support the proxy with the issued endorsement certificate, without cross-domain access. And cause additional burden to equipment. The process of issuing the endorsement certificate to the device by the third-party agency certification center specifically includes: parsing the registration request of the device, verifying the identity information of the device and whether the registration request is legal, and if so, querying the system information of the target domain that the device expects to access, and generating a pair of passwords. key, and generate an endorsement certificate based on the key and device identity information; then, use the key in the digital certificate issued by a third-party proxy certification center to digitally sign the endorsement certificate; finally, send the endorsement certificate, digital signature and private key to the device , and at the same time write the endorsement certificate issuance record to the data operation record cache center of the third-party agency certification center. Among them, the endorsement certificate includes the unique identity of the device, the identity of the certificate issuing system, the name of the certificate issuing system, the authentication method of the certificate issuing system, the device authentication result, the valid time and timestamp of the certificate, the digital signature issued by the certificate, and the expected access Information such as the system identifier of the target domain, the attribute operations supported by the requested system in the target domain, and the key for encrypted communication with the device.

S230: Generate the attribute certificate of the system requesting access in the source domain by using the attribute mapping method through the third-party proxy authentication center, and the system requesting access in the source domain sends an access request to the system requesting access in the target domain by using the attribute certificate;

In this step, as shown in FIG. 3 , it is a schematic diagram of the attribute certificate in this embodiment of the application. The attribute certificate is generated by the attribute mapping center in the third-party agency authentication center and the user key. The user key refers to the corresponding key accessed by different systems, that is, the identification number of different systems. The attribute mapping center uses hybrid encryption to encrypt the key and attribute access rights before putting them on the link for transmission to ensure safe transmission during the generation of attribute certificates. The attribute certificate includes the identity information of the device, the key information, the unique certificate serial number, the validity period of the certificate, the relevant information of the attribute, the domain of use, the issuing unit, the public key information of the issuing unit, and the type of the certificate. The access request specifically includes information such as the unique identity of the device, the content requested to be accessed, the operation requested to be supported, the validity period and time stamp of the requested access, and the endorsement certificate.

In the embodiment of this application, the attribute mapping method specifically includes:

S231: Construct an attribute table storage module; the attribute table storage module is used to store the attribute conversion relationship between domains, and the attribute table storage module adopts an index structure of a hash table to facilitate extraction of corresponding attributes supported by the requested access system.

S232: Construct an attribute mapping table; the attribute mapping table is a two-dimensional matrix, the first column and the first row respectively record all attributes in the source domain and the target domain; the numbers in the table record the mutual mapping relationship between attributes; 1 means full mapping, 0 means no mapping, and a number between 0 and 1 means partial mapping.

S233: Construct a buffer in the attribute mapping service module, and store the attribute mapping table between commonly used domains through the buffer; since in a multi-domain environment, it is often fixed several commonly used domains for cross-domain access control, therefore, in the attribute mapping The service module constructs a buffer and stores the attribute mapping table between common domains through the buffer, so that the attribute mapping table of the common domain can be found in the buffer first when performing attribute mapping.

S234: Use the attribute mapping table to perform attribute mapping on the attribute certificate. If the attribute mapping table can be completely mapped, it means that cross-domain access and synchronous modification operations are supported; if the attribute mapping table cannot be mapped, it means that cross-domain access is not possible; if Partial mapping of the attribute mapping table means that cross-domain access can be performed but modification operations cannot be performed; among them, the embodiment of this application adds the operation of attribute mapping to the attribute certificate, which ensures the security of data while realizing cross-domain system identity verification , and to a certain extent reduces the difficulty of data reading. The method of attribute mapping can be applied to multiple control domain environments, which improves the performance of the entire data network in processing data.

Through the above operations, the source domain system with the attribute certificate can directly use the attribute certificate to request data access from the target domain system, and obtain the plaintext through data decryption, which improves the access efficiency and the security of cross-domain access control.

S240: Analyze the access request and the attribute certificate through the requested access system in the target domain, verify whether the requested access system is trustworthy according to the parsed access request and attribute certificate through the third-party proxy authentication center, and return the verification result to the target the domain's system to which access is requested;

In this step, the parsing process of the access request and the attribute certificate specifically includes: first, the requested system parses the access request, checks the time stamp and request content of the access request; then queries the endorsement certificate issuer through the third-party proxy certification center information, verify the digital signature, and verify the integrity of the endorsement certificate; finally check the validity period of the endorsement certificate and the status of the issuer, verify whether the access request is compliant, and check whether the issuer of the endorsement certificate is in the trust list of the domain.

S250: Open up a data sharing domain in the data domain of the requested access system according to the verification result returned by the third-party proxy authentication center, and establish a secure connection between the source domain system and the target domain system and data sharing operations;

In this step, the target domain system opens up a data sharing domain based on the security considerations of its own system and according to the verification results returned by the third-party proxy authentication center. The operation records are transmitted to the third-party agency authentication center for maintenance, which can support the modification operation of the source domain system and at the same time ensure the privacy of the target domain system, realize the safe interaction of cross-domain access, and solve the difficulty of cross-domain operation in the existing technology Implementation and cross-domain operations are requested to access the system's low security technical flaws. The data sharing domain is indicated to the target domain by the third-party proxy authentication center.

Based on the above, the cross-domain security interaction method of the embodiment of the present application establishes a trusted third-party proxy authentication center, and uses the third-party proxy authentication center to construct a unified identity for different systems and devices under the system, and use digital certificates to Verify the cross-domain identity of different systems in the Internet of Things environment to realize one-to-many cross-domain identity verification between heterogeneous systems; The data sharing domain of the write operation realizes safe interoperability between different domains, and at the same time ensures the security of some data domains that cannot be modified and accessed, and avoids the waste of resources. The invention adopts the data transmission mode based on the attribute certificate encryption algorithm in the cross-domain access process, which improves the access efficiency and the security of the cross-domain access control.

Please refer to FIG. 4 , which is a schematic structural diagram of a cross-domain secure interaction system according to an embodiment of the present application. The cross-domain security interaction system 40 of the embodiment of the present application includes:

Certification center building module 41: used to build a third-party proxy certification center, issue digital certificates to systems that support cross-domain access through the third-party proxy certification center, and issue endorsement certificates to devices under the system;

Request sending module 42: used to generate the attribute certificate of the system requesting access in the source domain through the attribute mapping method through the third-party proxy authentication center, and the system requesting access uses the attribute certificate to send an access request to the system requested to access in the target domain; including endorsement certificates;

System verification module 43: used to verify the identity of the system requesting access through the third-party proxy authentication center according to the access request and the attribute certificate, and if the verification is passed, establish a cross-domain connection between the system requesting access in the source domain and the system requested to access in the target domain Safe interaction.

Please refer to FIG. 5 , which is a schematic diagram of a terminal structure in an embodiment of the present application. The terminal 50 includes a processor 51 and a memory 52 coupled to the processor 51 .

The memory 52 stores program instructions for realizing the above cross-domain secure interaction method.

The processor 51 is configured to execute program instructions stored in the memory 52 to control cross-domain security interaction.

Wherein, the processor 51 may also be referred to as a CPU (Central Processing Unit, central processing unit). The processor 51 may be an integrated circuit chip with signal processing capability. The processor 51 can also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components . A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.

Please refer to FIG. 6 , which is a schematic structural diagram of a storage medium according to an embodiment of the present application. The storage medium of the embodiment of the present application stores a program file 61 capable of realizing all the above-mentioned methods, wherein the program file 61 can be stored in the above-mentioned storage medium in the form of a software product, and includes several instructions to make a computer device (which can It is a personal computer, a server, or a network device, etc.) or a processor (processor) that executes all or part of the steps of the methods in various embodiments of the present invention. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disc, etc., which can store program codes. , or terminal devices such as computers, servers, mobile phones, and tablets.

The above description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined in this invention may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention will not be limited to these embodiments shown in the present invention, but will conform to the widest scope consistent with the principles and novel features disclosed in the present invention.

Claims

A cross-domain secure interaction method, characterized in that it includes:

Build a third-party proxy certification center, issue digital certificates to systems that support cross-domain access through the third-party proxy certification center, and issue endorsement certificates to devices under the system;

The third-party proxy authentication center uses the attribute mapping method to generate the attribute certificate of the system requesting access in the source domain, and the system requesting access uses the attribute certificate to send an access request to the system requested to access in the target domain; the access request includes endorsement certificate;

The third-party proxy authentication center authenticates the system requesting access according to the access request and the attribute certificate, and if the verification passes, establishes cross-domain security interaction between the system requesting access in the source domain and the system requested access in the target domain.
The cross-domain security interaction method according to claim 1, wherein the issuing of a digital certificate to a system supporting cross-domain access, and issuing an endorsement certificate to a device under the system is specifically:

Identify the system information that requests access to the third-party proxy authentication center, and issue a digital certificate to the system that supports cross-domain access;

Receive the registration request sent by the device under the system, and after analyzing the registration request, issue an endorsement certificate to the device according to the authentication mode of the system.
The cross-domain security interaction method according to claim 2, wherein the issuing of the endorsement certificate to the device specifically includes:

Parse the registration request of the device, verify the user identity information of the device and whether the registration request is legal and how legal, query the target domain information that the device expects to access, and generate a pair of keys, according to the key and user identity information Generate endorsement certificate;

digitally sign the endorsement certificate using the key in said digital certificate;

Issue the endorsement certificate, digital signature and private key to the device, and write the endorsement certificate issuance record into a third-party agency certification center;

The endorsement certificate includes the unique identity of the device, the identifier of the certificate issuing system, the name of the certificate issuing system, the authentication method of the certificate issuing system, the device authentication result, the valid time and timestamp of the certificate, digital signature, and the target domain expected to be accessed The system identifier, the attribute operations supported by the requested system in the target domain, and the key for encrypted communication with the device.
The cross-domain secure interaction method according to any one of claims 1 to 3, wherein the attribute certificate includes device identity information, key information, unique certificate serial number, valid period of use of the certificate, and attribute Information, use domain, issuing unit, public key information of the issuing unit, and certificate type;

The access request includes the unique identity of the device, the content requested to be accessed, the operation requested to be supported, the validity period and time stamp of the requested access, and the endorsement certificate.
The cross-domain secure interaction method according to claim 4, wherein the generating the attribute certificate of the system requesting access in the source domain through the third-party proxy authentication center using the attribute mapping method specifically includes:

Constructing an attribute table storage module, the attribute table storage module is used to store the attribute conversion relationship between domains;

Constructing an attribute mapping table, the attribute mapping table is used to record all attributes of the source domain and the target domain, and the mutual mapping relationship between the attributes;

A buffer is constructed in the attribute mapping service module, and the attribute mapping table between common domains is stored through the buffer;

Use the attribute mapping table to perform attribute mapping on the attribute certificate. If the corresponding attribute mapping table can be completely mapped, it means that cross-domain access and synchronous modification operations are supported; if the corresponding attribute mapping table cannot be mapped, it means that cross-domain access cannot be performed; if If the attribute mapping table is partially mapped, it means that it can be accessed across domains but cannot be modified.
The cross-domain secure interaction method according to claim 5, wherein the authentication of the system requesting access by the third-party proxy authentication center according to the access request and the attribute certificate further includes:

Analyzing the access request and the attribute certificate through the requested access system in the target domain; the parsing process includes:

Analyzing the access request, checking the timestamp and request content of the access request;

Query the information of the issuer of the endorsement certificate through the third-party agency certification center, verify the digital signature, and verify whether the endorsement certificate is complete;

Check the validity period of the endorsement certificate and the status of the issuer, verify whether the access request is compliant, and check whether the issuer of the endorsement certificate is in the trust list of the domain.
The cross-domain security interaction method according to claim 6, wherein if the verification is passed, establishing the cross-domain security interaction between the system requesting access in the source domain and the system requested access in the target domain specifically includes:

Opening a data sharing domain that can support read and write operations in the data domain of the system that is requested to access in the target domain, and the data sharing domain supports devices under the system that requests access in the source domain to perform synchronous modification operations;

The data sharing domain is indicated to the target domain by the third-party proxy authentication center.
A cross-domain security interaction system is characterized in that it includes:

Certification center building module: used to build a third-party proxy certification center, issue digital certificates to systems supporting cross-domain access through the third-party proxy certification center, and issue endorsement certificates to devices under the system;

The request sending module: used to generate the attribute certificate of the system requesting access in the source domain by using the attribute mapping method through the third-party proxy authentication center, and the system requesting access uses the attribute certificate to send an access request to the system requested to access in the target domain; The access request includes an endorsement credential;

System verification module: used to verify the identity of the system requesting access through the third-party proxy authentication center according to the access request and the attribute certificate, and if the verification is passed, establish the system requesting access in the source domain and the system requested access in the target domain Cross-domain secure interaction.
A terminal, characterized in that the terminal includes a processor and a memory coupled to the processor, wherein,

The memory stores program instructions for realizing the cross-domain secure interaction method according to any one of claims 1-7;

The processor is configured to execute the program instructions stored in the memory to control cross-domain security interaction.
A storage medium, characterized in that it stores program instructions executable by a processor, and the program instructions are used to execute the cross-domain secure interaction method according to any one of claims 1 to 7.