Research And Application Of Access Control Model Based On Trust And Risk

With the arrival of the era of big data,the data information resources on the Internet have a large scale of explosive growth.While users enjoy the fast and personalized services brought by big data,a variety of data security problems emerge at the historic moment,posing a serious threat to the information security of users.How to guarantee the information security of massive data has become a key issue that has been widely concerned in the era of big data.Access control,as a commonly used key system information security technology in modern times,effectively prevents the system from being illegally invaded by authorization,restriction and other control operations on the access of users,and fully guarantees the integrity and security of data information resources.To achieve the balance between authorization and restricted access,a dynamic adaptive access control model based on trust and risk is constructed.The trust control mechanism is added in the user authorization stage to build the basic framework of information interaction between entities.The risk control mechanism is added in the user access stage to control the user behavior.The access control management system designed and implemented on this basis is applied to the integrated personnel and personnel platform in Jiangxi Province to provide security for the project system and data information.The specific work contents are as follows:(1)This thesis analyzes the advantages and disadvantages of the commonly used access control models,focuses on the research of role-based access control model,trust,risk and their correlation,and constructs a dynamic adaptive access control model based on trust and risk by comprehensively considering trust and risk.(2)In the user role authorization stage,trust is divided into five trust indexes:direct trust,historical trust,recommended trust,authorization intention and risk limit.The weight is obtained by entropy weight method to calculate the trust value.The application whose trust value does not meet the role trust threshold is denied authorization to improve the role authorization requirements and prevent illegal authorization.(3)In the user access stage,the risk control mechanism is added.The user behavior attribute and object basic attribute are regarded as the input of neuron,and the user risk value is predicted by BP neural network.The risk value and risk factor are used to dynamically change the risk limit of users,and the users whose risk limit is not enough to support access are intercepted to realize the dynamic and fine-grained control of role permissions.(4)Design the access control management system that can meet the system security and functional requirements in conjunction with the integrated personnel and personnel platform in Jiangxi Province,test the improved model functions and system performance in this thesis,and give the test results and user operation examples.