Mechanism for dynamic authorization
Example embodiments of the present disclosure relate to dynamic authorization. According to embodiments of the present disclosure, a solution for dynamic access control to data is proposed. On receiving data registration from a data source, a first device checks the data types to be produced by the data source and adds policies for the data or updates existing policies for the data according to its property. It also serves as access control decision point to determine consumers' access rights based on centrally managed policies. Authorization for data access is granted/denied according to local attributes/policies. In this way, it achieves a dynamic, context-aware and risk-intelligent access control to different kind of data from various data sources (i.e., service producers).
1. A first device comprising:
at least one processor; and
at least one memory including computer program codes;
the at least one memory and the computer program codes are configured to, with the at least one processor, cause the first device, which is an authorization policy management entity, to:
receive, from a second device which is an authorization server or a third device which is a service producer, an authorization request for authorizing a fourth device which is a service consumer to access at least a data service and data provided by the third device, the authorization request at least indicating an identity of the fourth device;
obtain a profile of the fourth device based on the identity of the fourth device, wherein the profile of the fourth device comprises at least:
a group identity of the fourth device,
a role of the fourth device, and
a context of the fourth device;
receive, from the second device or the third device, a register request for registering the third device with the first device, the register request comprising an identity of the third device;
determine a type of the data to be provided by the third device;
determine a property of the data based on the type of the data;
determine an authorization policy of the data based on the property of the data, wherein the authorization policy comprises at least:
a security requirement for accessing the data service or the data,
a service type of the data, and
a required region for accessing the data service or the data;
transmit a register response to the second device or the third device;
determine, based on the profile of the fourth device and the authorization policy of the data service or the data, authorization information of the fourth device,
wherein when the authorization request is received from the second device, the first device is caused to determine the authorization information by:
determining at least one type of data related to the data service which is accessible to the fourth device,
wherein when the authorization request is received from the third device, the first device is caused to determine the authorization information by:
determining the authorization information of the fourth device indicating whether the fourth device is to be authorized to access the data provided by the third device; or
determining whether a context of the fourth device satisfies a security requirement for accessing the data based on the authorization policy; and
in accordance with a determination that the context of the fourth device satisfies the security requirement, determining the fourth device is authorized to access the data;
based on the authorization information, authorize the fourth device to access the data;
transmit the authorization information to the second device or the third device;
receive, from the third device, a request for access control information of the data, the access control information at least comprising the authorization policy;
receive, from the third device, an update request for updating the authorization policy; and
update the authorization policy of the data based on the profile of the fourth device and a new requirement from the third device.