Data access control method of DDS distributed system

Abstract

The invention discloses a data access control method for a DDS distributed system, which is used for performing theme-level fine-grained access control on data publishing and subscribing processes. The method comprises the following steps: firstly, decomposing an access control permission of theme data into a publishing permission and a subscribing permission from the perspective of data resources; secondly, distributing permission key pairs according to the correlation between the theme access control permission and user attributes; then adding release permission signature authentication in the DDS discovery matching process; and finally, limiting a theme subscription range by utilizing a CP-ABE technology in a DDS publishing and subscribing process to form a flexibly-defined one-to-many data sharing authority control scheme. According to the invention, a DDS communication process is combined with attribute-based encryption and signature authentication technologies, a secure communication scheme which is matched with loose coupling and one-to-many characteristics of DDS publishing / subscribing and ensures confidentiality and authenticity of a data distribution service is designed, and the security problem of unauthorized publishing and unauthorized subscribing between components in the message publishing / subscribing process is solved.

Description

technical field [0001] The invention relates to access control technology in the field of information security, in particular to a data access control method of a DDS distributed system. Background technique [0002] In a distributed system based on DDS (Data Distribution Service), each component transmits data in real time through topic-based publish / subscribe. Due to the loosely coupled nature of DDS, the data transfer relationship between components becomes flexible, but it also brings The security issues of data interaction come, such as unauthorized publishing and unauthorized subscription, which seriously threaten the security of communication middleware and its upper-layer applications. Therefore, it is necessary to control data access in the DDS system. [0003] Traditional DDS access control methods often only implement user-level access control, and the configuration of access control permissions is also complicated and cumbersome. It is necessary to define the ac...

AI Technical Summary

Problems solved by technology

However, traditional DDS access control often implements one-to-one authority control between entities in the data domain based on identity. On the one hand, the identity of the legal publisher or subscriber needs to be determined in advance; For different subscribers, the data needs to be encrypted separately for different subscribers, and then sent to subscribers one-to-one, resulting in high message complexity

Images