Abstract:

Cross-organizational data application programming interface (API) calls frequently involve sensitive identity and authorization information of individuals and legal entities. Account credentials, Internet Protocol (IP) allowlists, and ordinary access tokens mainly authenticate callers, but cannot prove that each call has obtained valid authorization from the data subject, constrain critical business parameters, or support end-to-end traceability. To address these problems, this paper proposes a trusted access mechanism coordinated by a trusted access agent (TAA), a trusted access platform (TAP), and a trusted access gateway (TAG). Referring to attribute-based access control (ABAC) and the extensible access control markup language (XACML), the mechanism models trusted data access as six-dimensional constraint matching across subjects, applications, terminals, resources, purposes, and validity periods. A trusted access token, which can be represented using a format such as JSON web token (JWT), binds authorization evidence to access claims, while the resource-side TAG performs signature verification, validity checking, scope matching, replay prevention, and audit logging. Taking the socialized application of electronic certificates as a typical scenario, this paper analyzes component mapping, cross-network deployment paths, and typical abnormal access conditions. The analytical results demonstrate that the mechanism strengthens subject-authorization binding, request-consistency verification, least-privilege control, and end-to-end traceability for protected data API calls.

Key words: data resources, API access control, trusted access, data compliance