GB/T 47697-2026Cybersecurity technology - Authentication and authorization - Specification for the attribute-based access control model and its management (English PDF)

6.2 Attribute Classification

6.2.1 Main Attributes A subject refers to the initiator of an access control action, which can be a natural person or a non-natural person entity. Each subject is assigned a set of subject attributes. Subject attributes are a collection of characteristic information describing a subject, and can be divided into two categories. natural subject attributes and authorized subject attributes.

a) Natural Subject Attributes. These describe attributes inherent to a subject that do not change with the context of access control operations. For example, an individual. Identity information, personal biometric information, etc.

b) Authorized Subject Attributes. A set of attributes describing the access permissions assigned to a subject in a given access control operation context, along with the permissions granted... It changes dynamically depending on the context. For example, the role, job function, employee number, domain name, or URL assigned to the subject. Authorizing the subject... Subject attributes reflect a subject's role, permission level, and temporary state within a specific access control environment. These attributes change with the subject's characteristics and access permissions. The system is dynamically adjusted in response to changes in the environment and business needs.

6.2.2 Object Attributes An object is the target of access control behavior, and each object is assigned a set of object attributes. Object attributes are a collection of characteristic information describing an object, and can be divided into two categories. natural object attributes and authorized object attributes.

a) Natural object attributes. Describe attributes that are inherent to the object after its creation and do not change or change infrequently with a given access control operation context. Attributes typically describe basic information or physical characteristics of an object. Examples include database primary keys, timestamps, file extensions, and encoding methods. And digital fingerprints, etc.

b) Authorized Object Attributes. Describes a set of attributes assigned to an object for access within a given access control context, depending on the given context. These parameters change dynamically depending on the object. Examples include the object's assigned number, owner, creation and deletion dates and times, and authorization level. These attributes reflect the state, permission settings, and temporary characteristics of objects under different access control environments, and are typically based on management systems. It is set according to the degree and business needs.

6.2.3 Environmental Attributes Environmental attributes refer to access environment status information that is independent of any specific subject or object and participates in determining access control operations. For example... Current date, time, location, threat type, and system status, etc. Environmental attributes are not passively created and managed, but are intrinsic and can be... ABAC system detection. When an authorized access request is made, the environment attributes are evaluated based on the currently matched environment variables. The environment attribute is access control. The definition of special or dynamic rules specified in the strategy provides a basis for this.

Note. When environment attributes are used to form access control rules, the environment attribute variables and their values are tamper-proof.

6.3 Attribute Metadata Before implementing access control, ABAC identifies, defines, and describes a standardized set of metadata. The metadata for an attribute is the metadata for each attribute. Basic information elements mainly include attribute value information, attribute creation information, and attribute source information.

a) Attribute value information. such as update frequency, validity period, etc.

b) Property creation information. For example, whether the property is self-asserted or retrieved from the property authorization system.

c) Attribute source information. such as the identifier of the attribute source. In the access control decision-making process, standardized attribute metadata is used to assess the credibility of attributes by evaluating the authority of the attribute's source. Metadata of attributes such as sex, timeliness of attribute information, and accuracy of attribute information verification frequency are used to score the credibility of attributes, defining attributes. The authenticity, security, and timeliness of attributes. The assessment results of attribute credibility can be used as part of the input for access control decisions, enabling fine-grained decision-making. Access control. In attribute management, attribute metadata is used to group and classify attributes, avoiding the need to assign a specific attribute to each subject or object. Similar attributes can be used to improve the flexibility of access control and the convenience of attribute management. For example, based on the common characteristics of subjects or objects in the system, Subjects or objects are divided into different groups, and each "group" is the metadata of the attribute.

7.2 Strategy Expression

7.2.1 Strategy Expression Form Strategy expression is the process of transforming natural language, which is understandable to humans from a business and management perspective, into a formal language that can be executed by machines. The forms of expression include two types. natural language strategies and digital strategies.

a) Natural language policies are the natural language expression of access control policies and should conform to the principles of policy definition. For example, condition-result logic... It describes access control policies, but cannot be directly executed by the machine.

b) A numeric policy is an access control policy expression that can be directly encoded into machine-readable and executable code. Numeric policy statements It consists of subject and object attributes, as well as environmental attributes that satisfy the access control operation. The transition from natural language strategies to digital strategies involves two stages.

a) Phase One. Transform the natural language policy into a set of access control rules that are still described in natural language and are deployable and enforceable. In this phase, the combination of subject attributes and object attributes in the strategy and the permitted operations should be determined.

b) Phase Two. Using technical means, convert access control rules into machine-executable digital policies.

7.2.2 Strategy Expression Language A policy expression language is a programming language used to describe access control policies. The basic requirements of ABAC for a policy expression language are primarily... include.

a) Provide a method for making authorization decisions based on the attributes of the subject and the object;

b) Provides a set of logical and mathematical operators to handle the attributes of subjects, objects, and environments;

c) Provide a method to combine individual rules and policies into a policy set so that it can be applied to a given decision request;

d) Provide a method for defining the process of combining strategies and rules;

e) Provide a method for handling multivalued attributes.

9.1 Attribute Management

9.1.1 General Requirements The general requirements for attribute management include the following.

a) Authorized attributes should be provided by an attribute licensing authority. In scenarios where multiple attribute licensing authorities coexist, each authority should provide the attributes it needs. Subjective attributes and object attributes each possess authority;

b) The attribute authorization body should identify all attribute information and compile it into an attribute list so that when defining each access control policy, it can be used to identify all attributes. It has corresponding attributes;

c) The attribute licensing body shall name, define, and assign a set of allowed values to attributes in accordance with the requirements of the digital policy, and specify attribute naming, Define and assign permitted values to the data schema, and make it public to all participants;

Note. The naming, definition, and assignment of allowed values for attributes refer to the description of the content, structure, and constraints of the attribute information.

d) After an attribute is named, defined, and assigned a set of allowed values, the attribute licensing authority shall establish the attribute and appropriate attributes for the subject and object. Value assignment method;

e) The attribute licensing authority shall evaluate the attribute's storage mechanism and protection mechanism. The evaluation shall include, but is not limited to, the following factors. Property integrity verification, security policies for attribute update, copy, and undo operations, defense measures for attribute storage environments, and attributes. Change and audit logs, etc.

9.1.2 Subject Attribute Management Subject attribute management requirements include the following.

a) The attribute authorization body should adopt technical measures to ensure that the integrity, accuracy, and change records of the subject attributes can be verified;

b) Check whether the attribute licensing body provides a list of attributes used internally by the organization and identifies the source of the attributes.

9.1.3 Object Attribute Management The requirements for object attribute management include the following.

a) Attribute authorization bodies should adopt technical measures to ensure that object attributes can only be allocated or verified through compliant processes; (b) The attribute authorization body shall employ technical measures to ensure that the integrity, accuracy, and change records of object attributes can be verified, and Integrated into the mechanism or framework of object attribute management;

c) When making policy decisions, the attribute granting authority should ensure that object attributes are searchable.

9.1.4 Environmental Attribute Management Environmental attribute management requirements include the following.

10.1 Attribute Management Testing Methods

10.1.1 General Requirements The general requirements include the following.

a) Testing method. 1) Check whether all attribute information has been identified and compiled into an attribute list by the attribute licensing authority; 2) Check whether the attribute licensing authority has named, defined, and assigned a set of allowed values to the attributes in accordance with the requirements of the digital policy. Whether the data schema for the attributes is specified and made public to all participants; 3) Check whether the attribute authorization authority has established attributes and appropriate attribute value allocation methods for subjects and objects; 4) Check whether the subject and object attributes are provided by an attribute licensing agency. In scenarios where multiple attribute licensing agencies coexist, Does each institution possess authority over different subject and object attributes? 5) Check whether the attribute licensing authority has evaluated the attribute storage and protection mechanisms. This includes checking whether they are implemented. The encryption method was used; whether security policies were adopted for attribute update, copy, and undo operations; and the protection measures of the attribute storage environment. Control methods, attribute changes, and audit logs, etc.

b) Expected results. 1) All attribute information is identified and compiled into an attribute list by the attribute licensing authority; 2) The attribute licensing body named, defined, and assigned a set of allowed values to the attributes in accordance with the requirements of the digital policy, and specified the attributes. The data pattern is sexual and made public to all participants; 3) Subject attributes and object attributes are provided by attribute licensing agencies. In scenarios where multiple attribute licensing agencies coexist, each agency... It possesses authority over different subject attributes and object attributes respectively; 4) The attribute authorization agency has established methods for allocating attributes and appropriate attribute values for both the subject and the object; 5) The attribute licensing body evaluated the attribute storage and protection mechanisms, including the use of encryption methods. The law, used for security policies related to attribute updates, copies, and undoes, defenses for attribute storage environments, and attribute changes. And audit logs, etc.

c) Result determination. If all the above expected results are met, it is determined to be compliant; otherwise, it is determined to be non-compliant or partially compliant.

10.1.2 Subject Attribute Management The requirements for subject attribute management testing include the following.

a) Testing method. 1) Check whether the attribute authorization agency has adopted technical measures to ensure the integrity, accuracy, usability, and privacy of the subject's attributes. Protect; 2) Check whether the attribute licensing body provides a list of attributes used internally by the organization and identifies the source of the attributes.

b) Expected results. 1) The attribute licensing authority has adopted relevant technical measures to ensure the integrity, accuracy, usability, and privacy of the subject's attributes. Protect; 2) There is a list of attributes used internally by the organization, and the source of the attributes is identified.

c) Result determination. If all the above expected results are met, it is determined to be compliant; otherwise, it is determined to be non-compliant or partially compliant.

10.1.3 Object Attribute Management The requirements for object attribute management testing include the following.

a) Testing method. 1) Check whether the attribute authorization body has adopted technical measures to ensure that object attributes are allocated or verified through compliant processes; 2) Check whether the attribute authorization agency has adopted technical measures to ensure the completeness, accuracy, and change records of the object attributes. The verification process was conducted to determine whether relevant technical measures were integrated into the mechanism or framework for object attribute management. 3) Check whether object attributes can be retrieved when calculating strategy decisions.

b) Expected results. 1) The attribute authorization agency has adopted technical measures to ensure that object attributes are allocated or verified through compliant processes; 2) The attribute authorization agency adopted technical measures to verify the completeness, accuracy, and change records of the object attributes. The attribute management mechanism or framework integrates relevant technical measures; 3) When making calculation strategy decisions, object attributes can be retrieved and the retrieval results can be displayed.

c) Result determination. If all the above expected results are met, it is determined to be compliant; otherwise, it is determined to be non-compliant or partially compliant.

10.1.4 Environmental Attribute Management Environmental attribute management testing requirements include the following.

a) Testing method. 1) Check whether all relevant components in ABAC can obtain the environment attribute variables and their values provided by the attribute authorization authority; 2) Check whether the attribute authorization agency has adopted technical measures to ensure the reliability of environmental attribute variables and their values; 3) Check whether the environment attribute variables and their values provided by the attribute authorization authority are consistent with the current access control operation being determined. It is related to the environment.