CN111107099B - Self-adaptive access control method suitable for mixed cloud environment - Google Patents
Self-adaptive access control method suitable for mixed cloud environment Download PDFInfo
- Publication number
- CN111107099B CN111107099B CN201911384979.6A CN201911384979A CN111107099B CN 111107099 B CN111107099 B CN 111107099B CN 201911384979 A CN201911384979 A CN 201911384979A CN 111107099 B CN111107099 B CN 111107099B
- Authority
- CN
- China
- Prior art keywords
- stage
- data
- access control
- life cycle
- attributes
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer And Data Communications (AREA)
Abstract
The invention discloses a self-adaptive access control method suitable for a mixed cloud environment, and belongs to the technical field of cloud computing safety. Aiming at the problems that the existing hybrid cloud mostly adopts a boundary security technology which takes a main body as a center to make a security strategy, cannot meet the security requirements of fine granularity and dynamic data resources, and the existing access control mechanism needs larger manpower, and the like, a self-adaptive access control method is disclosed. The method combines the life cycle characteristics of data and subdivides the access control strategies of all life cycle stages. When data flows among multiple clouds, if the life cycle stage of the data changes, the access control strategy corresponding to the stage can be adjusted in a self-adaptive mode, and the dynamic property and the flexibility of the access control method are embodied.
Description
Technical Field
The invention belongs to the technical field of cloud computing security, and particularly relates to a self-adaptive access control method suitable for a cloud environment.
Background
With the continuous development of cloud computing technology, cloud systems and business modes are continuously changed and innovated, and compared with a single cloud deployment mode of public cloud and private cloud, the hybrid cloud combines the elasticity of the public cloud and the security of the private cloud, and provides an optimal cloud strategy scheme for users, so that more and more enterprises select the hybrid cloud as a main deployment mode. The data types deployed by enterprises generally include structured data, unstructured data and semi-structured data, the data can be deployed to different cloud ends according to purposes, and different cloud platforms are responsible for carrying out staged management on the data, so that the data can flow among multiple clouds in the whole life cycle through modes of VPN (virtual private network), private line and the like, and users and environments where the data face in different life cycle stages are complex and variable. In addition, the life cycle stage of data possession is not invariable, and it will change with the change of the service scene, and the data security requirement of the corresponding stage will also change. Therefore, data in the mixed cloud environment has higher dynamic and fine-grained security requirements compared with data in the single cloud environment. However, most of the existing hybrid clouds adopt a boundary security technology which makes a security policy by taking a main body as a center, the dynamic security requirement of fine granularity of data at each stage of a life cycle cannot be met, and the current mechanism needs a large amount of manpower to effectively operate, and is time-consuming and labor-consuming. Meanwhile, the existing access control strategy languages are not enough to express the diversified requirements of different life cycle stages of data in a mixed cloud environment, and the languages are multi-sided to improve the expressive force of the strategy, so that the problems of complex grammar, high implementation complexity and the like exist mostly. In addition, in the current hybrid cloud environment, different cloud service providers respectively determine access control strategies of data, relevance and consistency of security requirements at different stages in the whole period of the data are not considered, and security holes are easy to generate. Therefore, how to realize adaptive access control facing to a data lifecycle becomes an important problem in cloud computing development and application in a hybrid cloud environment.
Disclosure of Invention
The invention provides a self-adaptive access control method in a hybrid cloud environment, aiming at the requirements of data stage-wise dynamic and fine-grained security in the hybrid cloud environment.
A self-adaptive access control method suitable for a mixed cloud environment is characterized by comprising the following steps:
the method comprises the steps of firstly, uniformly storing access control strategies of the same data in different cloud service components into a strategy library, then carrying out strategy lightweight description on all heterogeneous strategies, then dividing life cycle stages and the access control strategies corresponding to the stages by applying a hierarchical clustering algorithm based on the access control strategies, and finally realizing access control in a self-adaptive mode through dynamically monitoring data states and relevant matching values when the data flow in the stages.
The self-adaptive access control method comprises the following steps of realizing three modules of a strategy lightweight description module, a data life cycle stage division module and a data life cycle stage self-adaptive adjustment module and realizing data interaction among the modules:
step 1: the strategy lightweight description module is used for carrying out unification and lightweight processing on all access control strategies in the strategy library, converting the access control strategies in different formats into strategies consisting of subject attributes, object resource attributes, action attributes, environment attributes, utility attributes and stage identification attributes, wherein the stage identification attributes are added by considering the relevance of a life cycle stage and mainly comprise the resource environment attributes of the previous stage, the resource environment attributes of the next stage, time attributes and the subject environment attributes. The phase identifier is also unique to the phase and can be used as an adaptive matching condition in step 3. And (4) transmitting the converted strategy set to the data life cycle stage division module in the step (2).
Step 2: and the data life cycle phase dividing module divides the data life cycle phases based on the strategy set processed in the step 1. In the module, each strategy is regarded as a cluster, the distance between every two clusters is calculated firstly, then the cluster with the closest distance is merged, the process is repeated continuously until the optimal cluster number is reached, and finally the produced cluster result is the life cycle stage. To ensure the best classification result, the number of clusters is evaluated by the ARI index. After the phases are divided, a resource owner defines a 'phase identifier' attribute corresponding to each phase according to a service scene, and the attribute is used as a matching condition of the step 3 phase self-adaptive adjusting module.
And step 3: the data lifecycle stage adaptive adjustment module adapts the stage policy based on the data flow state and the subject access request.
Step 3.1: aiming at the condition that the phases are changed when data flow in different cloud components, the method monitors the data state by deploying a probe at a cloud component server gateway, and when the data are found to be about to flow between clouds, the relevant attributes of the data are matched with the 'phase identification' attributes of each phase defined in the step 2.
Step 3.2: aiming at the stage change condition of the data in the cloud, the method extracts relevant attributes such as the data, the main body and the like by analyzing the access request, and the relevant attributes are matched with the 'stage identification' attributes of each stage defined in the step 2.
Step 3.3: and if the matching stage is successful, updating the matching stage into the access control strategy set of the corresponding stage. The set of other phase access control policies for which a match was unsuccessful will be disabled. If no stage meeting the matching condition exists, updating is not needed.
Compared with the prior art, the invention has the following advantages:
in the cross-cloud service interaction process under the mixed cloud environment, the life cycle of data relates to multiple stages of services, the environments of the data in different stages are different, and users have different security protection requirements on the data, so that the access control strategy of the data changes along with the change of the stages, and the access control strategy corresponding to the data in a certain stage has certain similarity. However, most of the current hybrid clouds adopt a boundary security technology which makes a security policy by taking a main body as a center, and cannot meet the dynamic security requirement of fine granularity of data in each stage of a life cycle. Therefore, the invention provides a self-adaptive access control method suitable for a mixed cloud environment, which starts from data, takes the data life cycle stage as a main part, and re-divides an access control strategy according to the stages, thereby meeting the security requirement of fine granularity of the data. In addition, the dynamic change of the data is monitored in real time, and the access control strategy of the corresponding stage is activated/deactivated according to the index, so that the self-adaptive access control based on the data is realized. Compared with other methods, the method meets the requirement of data security in fine granularity, and effectively improves the access control efficiency.
Drawings
Fig. 1 is a topological diagram of an adaptive access control method.
Fig. 2 is a diagram of an adaptive access control method architecture.
Detailed Description
The invention will be further described with reference to the accompanying drawings and detailed description.
Fig. 1 is a topological diagram of the method, and three modules of the method are deployed in an authorization server and include a policy lightweight description module, a life cycle stage division module, and a life cycle stage adjustment module. The self-adaptive access control method comprises the following specific processes:
step 1: and (6) initializing the strategy.
Step 1.1: the authorization server collects access control strategies from resource servers of related cloud service providers, which can store the same resource in the whole life cycle, to form a strategy set, describes the access control strategies with different description modes in a unified and lightweight format through a strategy lightweight description module, and then transmits the processed strategy set to a life cycle stage division module.
Step 1.2: and the life cycle stage division module divides the life cycle stage and the access control strategy set corresponding to each stage through a clustering algorithm based on the distance between the strategies. And implementing corresponding access control strategies according to different stages of the data.
Step 2: and the data life cycle stage and the access control strategy are adaptively adjusted.
Step 2.1: when a probe deployed at each resource server gateway of the cloud environment detects that data needs to flow, a life cycle stage adjusting module is called, and whether to adjust a life cycle stage and an access control strategy is judged according to the evaluation value by evaluating the data attribute and each stage attribute.
Step 2.2: when data flows in a resource server of the cloud service, relevant attributes such as the data and the main body are extracted by analyzing the access request, the life cycle stage adjusting module is responsible for matching the life cycle stage and the main body with the attributes of each stage, and whether the life cycle stage and the access control strategy are adjusted or not is judged according to a matching result.
And step 3: user access request response
Step 3.1: when a user initiates a cloud service access request, identity authentication is firstly required to be performed through an authentication server. After the authentication is passed, the authentication server gives Token to the user. The user can access the relevant cloud service by means of Token.
And 3.2, after receiving the cloud service access request of the user, the authorization server decides whether the user can access according to the access control strategy of the current data stage.
Fig. 2 is an architecture diagram of the adaptive access control method in the hybrid cloud environment, in which three modules, namely a policy lightweight description module, a lifecycle stage division module, and a lifecycle stage adjustment module, are added on the basis of a policy-based access control architecture. The method comprises the following specific steps:
step 1: firstly, initializing the strategy, collecting all heterogeneous access control strategies from each cloud service component to form a strategy set, and transmitting the strategy set to a strategy lightweight module. The strategy lightweight description module extracts attributes such as a main body attribute, a resource attribute, an action attribute, an environment attribute and a utility attribute from each strategy. And then adding a stage identifier attribute to the strategy attribute group to form a strategy attribute group { SA, RA, AA, ENA, E, StageMark }, wherein the stage identifier comprises the resource environment attribute of the previous stage, the resource environment attribute of the next stage, the time attribute and the main body environment attribute. When a certain attribute type in the strategy has no corresponding attribute value, filling is carried out by using a null value. And transmitting the processed strategy set to a life cycle stage division module.
Step 2: the life cycle stage division module is used for carrying out stage division on the strategy set based on a hierarchical clustering algorithm.
Step 2.1: the distance between the strategies is first calculated. The inter-policy distance calculation is equivalent to the distance calculation of the policy attributes. The method defines the strategy attribute as character type, numerical value type and category type, and the character type attribute, such as utility attribute, can calculate the distance by means of character matching. Numerical attributes, such as temporal attributes, may be computed by the sum and sum of differences between values. The category type attribute refers to an attribute having a hierarchical relationship, such as a body attribute, and can be calculated by calculating a hierarchical relationship distance. And respectively calculating the distances of the strategy attributes belonging to various types according to different types, and finally obtaining the distances among the strategies by combining the weights of the attributes.
Step 2.2: and storing the distances among the strategies through a two-dimensional matrix to establish a distance table. In the initial stage of hierarchical clustering, each strategy is regarded as a class and can be regarded as one point on a coordinate axis, the distance between the strategies is the distance between the points, then clustering is carried out according to different average distances between the points, a new layer of stage is generated after clustering, the process is circulated until the clustering number is reached (the clustering number is calculated by ARI index in advance), and finally, a life cycle stage hierarchical clustering tree is generated, namely, each stage of a life cycle and an access control strategy set corresponding to each stage are generated. After the life cycle stage is determined, the resource manager needs to define the stage identifier attribute in the policy attribute group according to the service scenario.
The technical scheme for adjusting the data life cycle stage is divided into two cases: if the phase is changed due to data flowing between clouds, executing step 3; if the phase is changed due to the data flowing in the cloud, step 4 is executed.
And step 3: when a probe deployed at a cloud component server gateway monitors that data flows between clouds, the probe can adapt an adjustment strategy based on the data state.
Step 3.1: when a probe monitors that data flows between clouds, a request Req (RA) is sent to a PEP (Policy enforcement point)i)。
Step 3.2: the PEP receives the request and sends the request to the context processor, the context processor analyzes the req and extracts the data information to form a Stage adjustment request Stage _ adjust _ Req (RA)iAjust _ con) to the lifecycle phase adjustment module.
Step 3.3: the life cycle stage adjusting module receives and analyzes the request to obtain data RAiAccording to RAiThe life cycle stage division module inquires corresponding stage strategy information Policy ═ { SA, RA, AA, RNA, R, StageMark }, according to RAiExtracting all policies and generating a Policy set Policy _ RAiAnd meanwhile, assigning the corresponding adjustment condition to ajust _ con and feeding back the adjustment condition to the context processor.
Step 3.4: the context handler sets Stage _ adjust _ Req (RA)iCon) to the PIP. PIP condition and RA according to adjustment conditioniData information, such as data environment information (e.g., network environment), temporal information, etc., is obtained, and a data attribute set Object is generated. And fed back to the context processor.
Step 3.5: the context handler sends the data attribute set Object to the lifecycle stage adjustment module for stage adjustment determination.
Step 3.6: the lifecycle phase adjustment module matches Object with Policy _ RAiThe StageMark attribute in the data is used for judging the adjustment result, if the matching is successful, the corresponding strategy is activated, and if the matching is failed, the corresponding strategy is forbidden. And will beThe results are fed back to the PAP.
Step 3.7: the PAP updates and adjusts the access control strategy according to the result fed back by the life cycle stage adjusting module.
And 4, step 4: when the data flows in the cloud, whether the data life cycle stage is adjusted or not is judged by analyzing the access request. The technical scheme of the lifecycle stage adjustment when the data flows between clouds can be replaced.
Step 4.1: main body SAiFor data RAJAccess request req acting as AA (SA)i,RAj,AA)。
Step 4.2: after receiving the request, the PEP sends a context handler, and the context handler parses req to extract data information, and forms a Stage adjustment request Stage _ adjust _ Req (RA)j,SAiAjust _ con) to the lifecycle phase adjustment module.
Step 4.3: the life cycle stage adjusting module receives and analyzes the request to obtain data RAjAccording to RAjThe life cycle stage division module inquires corresponding stage strategy information Policy { SA, RA, AA, ENA, E, StageMark }, and according to RAiExtracting all policies and generating a Policy set Policy _ RAiAnd meanwhile, assigning the corresponding adjustment condition to ajust _ con and feeding back the adjustment condition to the context processor.
Step 4.4: the context handler sets Stage _ adjust _ Req (RA)j,SAiCon) to the PIP. PIP Condition, RA Condition based on Regulation of PIPjAnd SAiData information, such as data environment information (e.g., network environment, etc.), subject environment information, temporal information, etc., is obtained, and a data attribute set Object is generated. And fed back to the context processor.
The subsequent steps are the same as steps 3.5-3.7.
Claims (1)
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911384979.6A CN111107099B (en) | 2019-12-28 | 2019-12-28 | Self-adaptive access control method suitable for mixed cloud environment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911384979.6A CN111107099B (en) | 2019-12-28 | 2019-12-28 | Self-adaptive access control method suitable for mixed cloud environment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111107099A CN111107099A (en) | 2020-05-05 |
| CN111107099B true CN111107099B (en) | 2021-12-03 |
Family
ID=70424036
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201911384979.6A Active CN111107099B (en) | 2019-12-28 | 2019-12-28 | Self-adaptive access control method suitable for mixed cloud environment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111107099B (en) |
Families Citing this family (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114422808B (en) * | 2022-01-07 | 2024-06-28 | 北京百度网讯科技有限公司 | Cloud phone interaction method, device, electronic device and storage medium |
| CN114519196B (en) * | 2022-01-18 | 2024-12-17 | 北京工业大学 | Dynamic access control strategy evaluation method for micro-service |
| CN121037127B (en) * | 2025-10-30 | 2026-01-06 | 台州市数字集团有限公司 | A method and system for hierarchical access control of data elements in a cloud computing environment |
Family Cites Families (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20150363724A1 (en) * | 2012-09-07 | 2015-12-17 | Oracle International Corporation | Reusable anonymous subscription |
| CN105871854B (en) * | 2016-04-11 | 2018-11-20 | 浙江工业大学 | Adaptive cloud access control method based on dynamic authorization mechanism |
| CN106572120A (en) * | 2016-11-11 | 2017-04-19 | 中国南方电网有限责任公司 | Access control method and system based on mixed cloud |
| CN107483491A (en) * | 2017-09-19 | 2017-12-15 | 山东大学 | An access control method for distributed storage in cloud environment |
| EP3511820A1 (en) * | 2018-01-15 | 2019-07-17 | Siemens Aktiengesellschaft | Cloud based artifact lifecycle management system and method thereof |
| CN109246096B (en) * | 2018-08-30 | 2021-05-18 | 西安电子科技大学 | A Versatile Fine-Grained Access Control Approach for Cloud Storage |
-
2019
- 2019-12-28 CN CN201911384979.6A patent/CN111107099B/en active Active
Also Published As
| Publication number | Publication date |
|---|---|
| CN111107099A (en) | 2020-05-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Jararweh et al. | Trustworthy and sustainable smart city services at the edge | |
| CN111107099B (en) | Self-adaptive access control method suitable for mixed cloud environment | |
| KR101703446B1 (en) | Network capable of detection DoS attacks and Method for controlling thereof, Gateway and Managing server comprising the network | |
| JP6380110B2 (en) | Resource control system, control pattern generation device, control device, resource control method, and program | |
| US20240320049A1 (en) | Artificial Intelligence-Based Data Processing Method, Electronic Device and Computer-Readable Storage Medium | |
| CN103179052A (en) | A virtual resource allocation method and system based on proximity centrality | |
| Mishra et al. | Fed-RAC: Resource-aware clustering for tackling heterogeneity of participants in federated learning | |
| CN105991596B (en) | An access control method and system | |
| Imdoukh et al. | Optimizing scheduling decisions of container management tool using many‐objective genetic algorithm | |
| Al Ridhawi et al. | Location-aware data replication in cloud computing systems | |
| Chen et al. | Agile services provisioning for learning-based applications in fog computing networks | |
| Zhang | Cloud Trust‐Driven Hierarchical Sharing Method of Internet of Things Information Resources | |
| CN113157435B (en) | Virtual machine deployment method and system targeting energy efficiency in cloud data center | |
| CN114143060B (en) | Information security prediction method based on artificial intelligence prediction and big data security system | |
| CN115714724A (en) | 5G network resource management and control method based on service function chain mapping | |
| Yuejuan et al. | Task scheduling algorithm based on reliability perception in cloud computing | |
| CN110224847A (en) | Group dividing method, device, storage medium and equipment based on social networks | |
| CN104104611A (en) | Method and device for achieving cluster load balancing dispatching | |
| AlHadid et al. | Web services composition using dynamic classification and simulated annealing | |
| CN113037805A (en) | Multi-instance micro-service migration method facing mobile edge calculation | |
| Han et al. | Opportunistic coded distributed computing: An evolutionary game approach | |
| Li et al. | An adaptive task scheduling method for networked UAV combat cloud system based on virtual machine and task migration | |
| Wang et al. | Multi-granularity decomposition for componentized multimedia applications based on graph clustering | |
| CN112906745B (en) | Integrity intelligent network training method based on edge collaboration | |
| Khwaldeh et al. | Dyorch: dynamic orchestrator for Improving web services composition |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |