CN101984627B - Method for mapping authority in access control based on trust - Google Patents

Abstract

The invention relates to a permission mapping method in trust-based access control, which belongs to the field of computer network security. In an open system, there is no centralized management authority to rely on, and entities are often strangers to each other, so authority assignments cannot be made based on their identities. The purpose of the present invention is to assign corresponding authority to an entity according to its trust value. When an entity's trust value changes, the permissions assigned to it also change. The invention can solve the problem that authority cannot be assigned according to the user's identity in an open environment, can ensure safe access to resources, and has strong flexibility.

Description

Permission Mapping Method in Trust-Based Access Control

technical field

The present invention relates to an access control authority mapping method, in particular to a trust-based access control authority mapping method, which is used to solve the problem of how to assign authority according to its trust value when an entity accesses resources in an open environment, and belongs to computer The field of cyber security.

Background technique

In an open environment, the behavior and status of entities are determined by themselves, and they can join a network at any time, exit the network at any time, and even rejoin another network after changing their identity. Moreover, in an open environment, there is no centralized management authority to rely on. This feature makes it impossible for an entity to obtain all the information of another entity, or the entities do not know each other at all.

Centralized access control methods such as mandatory access control, discretionary access control, and role-based access control cannot meet the characteristics of an open environment, such as openness, heterogeneity, and dynamics. In an open environment, since users often need to face unfamiliar entities, the role of trust is very important. Trust management provides a new way of thinking to solve access control problems in open environments, and it is of great significance to use trust to provide secure access control mechanisms for open environments.

In trust-based access control, how to map between the entity's trust value and access rights is a key issue. That is to say, when the trust value of an entity is evaluated, what permissions should be assigned to the entity.

Contents of the invention

The purpose of the present invention is to provide a permission mapping method in trust-based access control. The method can assign corresponding access rights to the entity according to the trust value of each access to the resource, and as the trust value of the entity changes each time, the assigned rights also change accordingly. Using this method can flexibly implement access control to resources.

This method maps the trust value and the access right of the resource, and can dynamically adjust the corresponding access right according to the change of the subject's trust value.

The permission mapping method in trust-based access control is characterized in that the steps are as follows:

(1) The trust interval of the subject is set to [0, 1], and the resource has N different non-empty permission sets. According to the trust value of the subject, the corresponding access permission is assigned to the subject, and the mapping between the trust value and the permission is established ;

Read N non-empty permission sets of resources, together with the empty set φ, construct a binary sorting tree of permission sets according to the security level requirements of each permission set;

(2) According to the trust value of the subject, calculate the authority quantification function value M corresponding to the trust value;

任意给定信任值T∈[0，1]，均有唯一的x＝arcsinT与之对应，其中， x=arcsin y is a monotonically increasing function; Evenly divided into N small intervals equal to the number of permission sets of resources, corresponding to the permission sets one by one, then each small interval is

For any given trust value T∈[0,1], there is a unique x=arcsinT corresponding to it, where,

且M∈[0，N]    (1)Construct permission quantification function

And M ∈ [0, N] (1)

(3) According to the authority quantification function value M, obtain the sequential position F of the subject's authority in the ordered authority set;

In formula (1), M∈[0, N], and each permission set is expressed as a discrete quantity, and the permission set mapping function is further constructed:

Wherein, F represents the permission set corresponding to the quantified permission value M;

For any given trust value T∈[0, 1], there is a unique integer in F∈[0, N] corresponding to it; according to the correspondence between the integer and the permission set, the corresponding permission is assigned to the subject; where, when F = 0, it means that the access right assigned to the subject is φ, that is, the subject’s access request is rejected;

(4) In-order traversal of the constructed binary sorting tree to find the Fth node;

(5) Output the permission set stored in the Fth node, which is the permission assigned to the subject;

(6) If there are subjects that need permission mapping, turn to (2); otherwise, end.

The technical solution of the present invention is described as follows:

The trust interval of the subject is set to [0, 1], and the resource has N different non-empty permission sets. According to the trust value of the subject, the corresponding access permission is assigned to it, and the mapping between the trust value and the permission is established.

且y∈[0，1]。其反函数：x＝arcsiny也是单调递增函数。The function y=f(x)=sin x is a monotonically increasing function. in,

And y ∈ [0, 1]. Its inverse function: x=arcsiny is also a monotonically increasing function.

平均分割为与资源的权限集合个数相等的N个小区间，与权限集合一一对应，那么每个小区间为

任意给定信任值T∈[0，1]，均有唯一的x＝arcsinT与之对应，其中，

if will

Evenly divided into N small intervals equal to the number of permission sets of resources, corresponding to the permission sets one by one, then each small interval is

For any given trust value T∈[0,1], there is a unique x=arcsinT corresponding to it, where,

Thus, the authority quantification function is constructed T ∈ [0, 1], and M ∈ [0, N] (1)

为单位区间的中所对应的区间数。因为公式(1)中M∈[0，N]，而每个权限集合的表示为离散量，由此对其进行扩充，进一步构造权限集合映射函数：Calculate the trust value T by formula (1) in

for the unit interval The number of intervals corresponding to . Because M∈[0, N] in formula (1), and each permission set is expressed as a discrete quantity, it is expanded to further construct the permission set mapping function:

Wherein, F represents the permission set corresponding to the quantized permission value M. It can be seen from formula (1) and formula (2) that any given trust value T ∈ [0, 1] has a unique integer in F ∈ [0, N] corresponding to it. According to the corresponding relationship between the integer and the permission set, assign the corresponding permission to the subject. Wherein, when F=0, it means that the access right assigned to the subject is φ, that is, the subject's access request is rejected.

For the N different permission sets owned by the resource, each permission set of the resource has different requirements for the subject trust value according to the security management requirements. Therefore, they can be arranged in ascending order according to the trust degree of the subject required by the authority set, and stored in the authority set array R[N], and R[0]=φ. Assuming a subject with a trust value of T′, its function value is calculated by formula (2) to be t, where t=0, 1, ..., N, then the authority set assigned to this subject is R(t).

There are many methods for sorting the N+1 permission sets (including empty sets) in ascending order. In order to improve the sorting efficiency of permission sets, we adopt the following method. First construct a binary sorting tree with N+1 permission sets, and then perform an in-order traversal on it to obtain the ascending order of the permission sets.

The steps of the permission mapping method based on arcsine function are as follows:

(1) Read N+1 permission sets (including empty sets) of resources, and construct a binary sorting tree of permission sets according to the security level requirements of each permission set;

(2) According to the trust value of the subject, apply the formula (1) to calculate its corresponding function value M.

(3) Apply the formula (2), according to the function value M, obtain the sequence position F of the subject's authority in the ordered authority set.

(4) In-order traversal of the constructed binary sorting tree to find the Fth node.

(5) Output the permission set stored in the Fth node, which is the permission assigned to the subject.

(6) If there are subjects that need permission mapping, turn to (2); otherwise, end.

The invention proposes a permission mapping method in access control based on trust, which can solve the problem of permission allocation according to the trust value when an entity accesses resources. It satisfies the characteristics of resource access control in an open environment, and can be flexibly applied to various open network environments.

Description of drawings

Fig. 1 application process flowchart of the present invention

Figure 2 Permission Set Binary Sorting Tree

Detailed ways

The specific embodiment of the present invention takes a user's request to access a resource in a peer-to-peer network as an example, and assigns rights to the user according to the user's trust value.

User a and user b are users of the peer-to-peer network, and they want to access file c. The trust value of user a is T _a =0.5, and the trust value of user b is T _b =0.9. Next, assign access rights to users according to the trust values of user a and user b. Among them, the calculation process of the trust value will not be introduced in detail, only concerned with how to assign permissions according to the trust value after the trust value is known.

(1) Assume that the resource has five non-empty permission sets that can be allocated, namely: A={read}, B={write}, C={modify}, D={read, write, modify, execute}, E = {read, write, modify, execute, own}. And the trust requirements of each permission of the file to the user are arranged as follows from low to high: read, write, modify, execute, and own. Combine these 5 permission sets and the empty set φ which means access is denied, and construct a binary sorting tree together, as shown in Figure 2.

(2) Perform authority mapping on user a first. Applying formula (1), calculate the function value

$\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; =</span>\frac{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; \&times;</span>\mathrm{<span\; class="notranslate">\; 5</span>}<span\; class="notranslate">\; )</span>\mathrm{<span\; class="notranslate">\; arcsin</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 0.5</span>}<span\; class="notranslate">\; )</span>}{\mathrm{<span\; class="notranslate">\; \&pi;</span>}}<span\; class="notranslate">\; =</span>\frac{\mathrm{<span\; class="notranslate">\; 5</span>}}{\mathrm{<span\; class="notranslate">\; 3</span>}}<span\; class="notranslate">\; .</span>$

(3) According to formula (2), calculate

(4) In-order traversal of the binary sorting tree in Figure 2, and the mapped permission is the second non-empty permission set B.

(5) Read permission set B={write} stored in node B, that is, the permission assigned to user a to access file c is write.

(6) Next, perform authority mapping for user b. Applying formula (1), calculate the function value

$\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; =</span>\frac{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; \&times;</span>\mathrm{<span\; class="notranslate">\; 5</span>}<span\; class="notranslate">\; )</span>\mathrm{<span\; class="notranslate">\; arcsin</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 0.9</span>}<span\; class="notranslate">\; )</span>}{\mathrm{<span\; class="notranslate">\; \&pi;</span>}}<span\; class="notranslate">\; \&ap;</span>\mathrm{<span\; class="notranslate">\; 3.56</span>}<span\; class="notranslate">\; .</span>$

(7) According to formula (2), calculate

(8) In-order traversal of the binary sorting tree in Figure 2, and the mapped authority is the fourth non-empty authority set D.

(9) Read permission set D={read, write, modify, execute} stored in node D, that is, the permissions assigned to user b to access file c are: read, write, modify, execute.

Through the above example, it can be concluded that it is feasible to use the trust value of the subject to assign corresponding access rights to it. By using the invention, it is possible to assign appropriate access rights to subjects and ensure the security of resource access. The invention can be flexibly applied in various open network environments and has good applicability.

Claims (1)

1. The authority mapping method in the trust-based access control, according to the trust value of the subject, assigns the corresponding access authority to the subject, and establishes the mapping between the trust value and the authority; it is characterized in that the steps are as follows: (1) The trust interval of the subject is set to [0, 1], and the resource has N different non-empty permission sets; Read N non-empty permission sets of resources, together with the empty set φ, sort the trust value requirements from high to low according to each permission set, and construct a binary sorting tree of permission sets; (2) According to the trust value of the subject, calculate the authority quantification function value M corresponding to the trust value; x=arcsin y is a monotonically increasing function;

Evenly divided into N small intervals equal to the number of permission sets of resources, corresponding to the permission sets one by one, then each small interval is

For any given trust value T∈[0,1], there is a unique x=arcsinT corresponding to it, where,

Construct permission quantification function

T ∈ [0, 1], and M ∈ [0, N] 1) (3) According to the authority quantification function value M, obtain the sequential position F of the subject's authority in the ordered authority set; In formula 1), M∈[0, N], and each permission set is expressed as a discrete quantity, and the permission set mapping function is further constructed:

Wherein, F represents the permission set corresponding to the quantified permission value M; For any given trust value T∈[0, 1], there is a unique integer in F∈[0, N] corresponding to it; according to the correspondence between the integer and the permission set, the corresponding permission is assigned to the subject; where, when F = 0, it means that the access right assigned to the subject is φ, that is, the subject’s access request is rejected; (4) In-order traversal of the constructed binary sorting tree to find the Fth node; (5) Output the permission set stored in the Fth node, which is the permission assigned to the subject; (6) If there are subjects that need permission mapping, turn to (2); otherwise, end.

Images