Extensible access control markup language strategy searching method based on matching tree

Abstract

The invention discloses an extensible access control markup language strategy searching method based on a matching tree structure. The extensible access control markup language strategy searching method mainly solves the problems that in the prior art, strategy searching efficiency is low, and node information in a matching tree and a combination tree is repeated. According to the implementation scheme, the method includes forming an initial matching tree according to the structure and information of an original strategy, and removing repeated attributes under the same path in the initial matching tree; generating a path identifier according to the path of the initial matching tree, replacing the path information in the initial matching leaf node with the path identifier to obtain a simplified matching tree, and storing the path information and the corresponding path identifier in a mapping table; according to an access request sent by a user, searching a path identifier suitable for arule path on the matching tree, and finding a suitable strategy of the request in a strategy library by utilizing the mapping table. By optimizing the matching tree structure, the strategy migrationcost is reduced, the strategy search efficiency is improved, and the method can be used in the access control process using large-scale strategies.

Description

technical field [0001] The invention belongs to the technical field of information security, and further relates to a policy search method of Extensible Access Control Markup Language XACML, which can be used in the access control process using large-scale policies and improve search efficiency. Background technique [0002] In the environment of cloud computing and Internet of Things, the system is in an open environment, and security is more threatened. Access control guarantees the security of the system by granting permissions, which is one of the currently recognized methods to ensure the security of computing systems. Most of the existing access control is to evaluate the user's request through the preset strategy, and finally decide whether to authorize the specific resource requested by the user. [0003] XACML 3.0, as a general policy language standard approved by OASIS, has become the main language for describing security policies in access control systems with ri...

AI Technical Summary

Problems solved by technology

However, due to the similar structure of the matching tree and the merging tree, and the problems of space redundancy and duplication of node information, some computing resources are wasted in the strategy search stage, which affects the evaluation efficiency of the strategy evaluation engine

Images