A zero-trust access control method based on cloud-edge-end collaboration

Abstract

The present invention provides a zero-trust access control method based on cloud-edge-end collaboration, which includes deploying zero-trust agents on application servers at the cloud, edge, and end levels, collecting multi-source trust measurement indicator data at each level in real time, and encapsulating the encrypted data into a standardized data packet and transmitting it to a security assessment server through a secure communication protocol. After receiving the encrypted data packet, the security assessment server performs a refined multi-dimensional security assessment in combination with a device identifier and network attributes, and comprehensively considers various indicators and other operations through a weighted algorithm to achieve data transmission and control between application servers, security assessment servers, token generation servers, and gateways, thereby improving the security of application servers deployed on the cloud when accessing intranet data, solving the problem of traditional boundary protection methods failing due to blurred network boundaries in traditional networks, and providing a stable, secure, and reliable network environment for application servers to access intranet data.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a zero-trust access control method based on cloud-edge-end collaboration. Background Art

[0002] In the current process of accelerating digital transformation, the IT architecture of enterprises is undergoing profound changes. The widespread application of cloud computing, edge computing and terminal devices has not only greatly improved the flexibility and operational efficiency of business, but also brought unprecedented development opportunities to enterprises. However, this highly decentralized and interconnected architecture has also brought new challenges and tests to network security.

[0003] The traditional network security model, based on clear internal and external network division and boundary protection, has been unable to adapt to this dynamically changing network environment. Especially in the cloud environment, enterprise data and services are hosted on remote servers, and data storage, processing and transmission are all carried out through the network, which directly leads to the blurring of network boundaries, and thus significantly increases the risk of data leakage and unauthorized access. At the same time, with the widespread application of IoT devices and the rise of edge computing, a large number of terminal devices and edge nodes have become an important part of the network. These devices and nodes are directly exposed to the external environment, and their large number and wide distribution make it difficult for traditional centralized security protection measures to fully cover them, and security vulnerabilities and risk points increase accordingly.

[0004] In this context, the zero-trust security model has emerged as a new security concept. This model subverts the traditional trust model based on network location and advocates the principle of "never trust, always verify". In the zero-trust model, no matter where the user is, all access requests must undergo strict identity authentication and permission checks to ensure the legitimacy and security of network access. The effective implementation of this model can significantly improve the overall network security protection level and effectively respond to various security threats from both inside and outside.

[0005] However, for many companies with limited resources and relatively weak technical strength, it is not easy to fully deploy a zero-trust strategy. High deployment costs, complex technical implementation, and a shortage of professional talents have become key factors restricting its widespread application. Therefore, there is an urgent need to develop a zero-trust security solution that is both flexible and efficient and cost-controlled. This solution should make full use of advanced technologies such as cloud computing, big data, and artificial intelligence to achieve seamless integration and intelligent protection of the cloud, edge, and end, and build a dynamic and adaptive security protection system. This solution can effectively improve the overall level of network security protection without adding too much burden to the enterprise, ensure the security and stability of the enterprise's business data, and escort the enterprise's digital transformation. Summary of the invention

[0006] The purpose of the present invention is to provide a zero-trust access control method based on cloud-edge-end collaboration, which provides a stable, secure and reliable network environment for application servers deployed on the cloud to access intranet data, and solves the various problems mentioned in the above background technology.

[0007] The present invention achieves the above-mentioned purpose through the following technical solutions:

[0008] A zero-trust access control method based on cloud-edge-end collaboration includes the following steps:

[0009] Step S101, deploying zero-trust agent modules on the application servers of the cloud, edge, and terminal devices, respectively, to collect multi-source trust metric indicator data at all levels in real time;

[0010] Step S102: The zero-trust agent module uses an encryption algorithm to encrypt the collected multi-source trust metric indicator data, and encapsulates the encrypted data into a standardized data packet and transmits it to the security assessment server through a secure communication protocol;

[0011] Step S103: The security assessment server receives the encrypted multi-source trust metric data and the device information corresponding to the terminal device, performs a multi-dimensional security assessment, including IP matching assessment and credibility assessment, generates an assessment score reflecting the trustworthiness of the device, and sends the assessment score to the gateway device;

[0012] Step S104: The gateway device generates an evaluation result based on the received evaluation score, establishes a security status node for each application server requesting access, stores relevant evaluation result information and access control policies, and creates an IP table for controlling access rights of different IP addresses; wherein the IP table is configured according to the stored access control policies to allow or deny access requests from specific IP addresses;

[0013] Step S105: The application server uses the pre-installed certificate to establish a secure communication channel with the token generation server and the security assessment server, and obtains a valid access token from the token generation server; at the same time, when initiating an access request, the application server appends signature information signed by the private key to the requested URL;

[0014] Step S106, the application server carries the access token and the encrypted URL signature information, constructs a request message for accessing the internal network, and sends the request message to the gateway device;

[0015] Step S107, after receiving the request message, the gateway device first verifies the validity of the access token in the request message, then queries the IP table, and comprehensively determines whether to allow the application server to access the internal network based on the evaluation result corresponding to the IP address in the request message and the token verification result, and performs corresponding access control operations accordingly;

[0016] Wherein, in step S103, IP matching evaluation includes:

[0017] Step S201, query the IP access record of the currently accessed IP address;

[0018] Step S202, retrieving all historical time window IP access records of the currently used IP address from the database, and performing historical IP access record data preprocessing;

[0019] Step S203, extracting key features from each time window to calculate IP matching and obtain an IP score;

[0020] Step S204, make a security judgment based on the IP score. If the IP score is within the specified range of the security IP threshold, continue to identify the IP as a safe IP and perform subsequent operations.

[0021] According to a zero-trust access control method based on cloud-edge-end collaboration provided by the present invention, the IP score calculation formula is expressed as:

[0022] IPM+ TWS+ DTC+ BPS

[0023] Among them, IPM is IP matching, TWS is time window score, DTC is data type consistency, BPS is browsing mode similarity, , , , are the weight factors of IP matching, time window score, data type consistency, and browsing mode similarity, and + + + =1.

[0024] According to a zero-trust access control method based on cloud-edge-end collaboration provided by the present invention, in step S203, key features are extracted from each time window to calculate IP matching, including:

[0025] Step S301, extracting key behavior features from visited IP addresses as candidate IPs for building historical behavior models;

[0026] Step S302: for each candidate IP, divide its access record into multiple time windows by month:

[0027] Step S303, calculate the similarity between the behavior characteristics of the currently used IP address access time period and the historical time period and consider the weight of the time period, and calculate the TWS time window score using the following formula:

[0028]

[0029] Among them, Wi is the weight of the i-th exponential decay historical time window based on time gap, Si is the similarity between the current comprehensive score access behavior based on time period and duration and the historical behavior in the time window; n is the total number of time windows, = , where Δti is the time difference between the current time and the center time of the i-th time window, λ is the decay coefficient that controls the decay speed of the time weight, Δti is the time difference between the current time and the center time of the i-th time window; Si is the similarity score calculated based on the current access behavior and the historical behavior in the i-th time window.

[0030] According to a zero-trust access control method based on cloud-edge-end collaboration provided by the present invention, in step S104, the gateway device generates an evaluation result based on the received evaluation score, including:

[0031] Step S401, collect historical access data from application servers, security assessment servers and gateway devices, and clarify the evaluation scores of each dimension; wherein the evaluation scores of each dimension include IP matching, user identity trustworthiness, environment trustworthiness, user behavior trustworthiness, software trustworthiness and hardware trustworthiness;

[0032] Step S402: for each evaluation dimension, use a statistical learning algorithm to train the collected historical data to obtain the score fluctuation range of each evaluation dimension in the total evaluation score under normal circumstances and the score characteristics indicating abnormality;

[0033] Step S403, dynamically adjusting the threshold interval of access rights according to the current network environment status, the visitor's IP address, and access behavior;

[0034] Step S404, calculating the evaluation score of the current access IP in real time and comparing it with the dynamically set threshold range;

[0035] Step S405: If the evaluation score of the current access IP falls within the corresponding threshold range, the access is deemed safe and the corresponding access rights are granted; if the evaluation score deviates from the threshold range, it is regarded as an abnormal access.

[0036] According to a zero-trust access control method based on cloud-edge-end collaboration provided by the present invention, in step S102, the multi-source trust metric indicator data includes multi-source information of user identity data, account data, system log data, network log data, traffic data, application behavior data and data access behavior;

[0037] The security assessment server is configured to perform the following functions: evaluate the status of the application server and the terminal device connected to it, receive information from the application server in real time, conduct comprehensive analysis and risk assessment on the information, and generate a quantitative scoring result for each access or operation and send it to the gateway device. The scoring result reflects the trustworthiness of the access request.

[0038] According to a zero-trust access control method based on cloud-edge-end collaboration provided by the present invention, in step S104, after comparing the evaluation score calculated based on the multi-source trust metric data with a preset dynamic adjustment threshold interval, the evaluation processing result is divided into the following according to the comparison result:

[0039] Read-only mode allows users to access resources in read-only mode when the evaluation score indicates that the access request is low risk but not trustworthy enough for read-write operations;

[0040] Read-write mode: when the evaluation score indicates that the access request is highly credible and meets the security policy requirements, the user is granted full read-write permissions;

[0041] Alternatively, in the access denial mode, when the evaluation score exceeds the normal fluctuation range or there is an obvious security risk, the access request is immediately denied to ensure the security of the system and data.

[0042] According to a zero-trust access control method based on cloud-edge-end collaboration provided by the present invention, in step S105, a token generation server is introduced as a token management component to receive a secure socket layer SSL connection request from an application server. After receiving a valid token request, the token generation server generates unique token information for the application according to preset rules and algorithms.

[0043] According to a zero-trust access control method based on cloud-edge-end collaboration provided by the present invention, the data preprocessing of step S202 includes:

[0044] Clean the collected historical IP access record data to identify and remove invalid, erroneous or duplicate data;

[0045] The cleaned data is divided into monthly time periods to form a series of continuous and non-overlapping time windows. The data in each time window is sorted and divided to ensure that the data in each time window is complete and accurate.

[0046] A zero-trust access control method based on cloud-edge-end collaboration provided by the present invention also includes building a historical behavior model of IP, and the specific steps include:

[0047] For each candidate IP, set up a time window in months, starting from the current month and going forward in sequence to cover the required historical period;

[0048] In each time window, record the access time period of the IP, including the access time period and the duration of each access;

[0049] These access time periods and access duration data are stored and managed in chronological order to form a historical behavior model of the IP.

[0050] According to a zero-trust access control method based on cloud-edge-end collaboration provided by the present invention, in step S103, the calculation formula of the evaluation score is = , where n is the total number of evaluation indicators, weight i is the weight of the i-th indicator, and the specific value is set according to the actual situation. Indicator score i is the score of the i-th indicator calculated according to the evaluation logic, and the specific value is set according to the actual situation.

[0051] It can be seen that compared with the prior art, the present invention has the following beneficial effects:

[0052] 1. The present invention deploys a zero-trust agent module on the application servers of the cloud, edge and terminal devices. The method can collect multi-source trust measurement indicator data at all levels in real time. These data cover multiple dimensions of network access and provide a comprehensive and accurate information basis for security assessment.

[0053] 2. The present invention uses the geographical attributes, access time, object type, duration and browsing mode of IP address multi-dimensional information for comprehensive analysis and evaluation. By constructing an IP matching degree calculation model based on historical time windows and key features, it significantly improves the accuracy and real-time performance of IP address security judgment, enhances the system's ability to identify potential threats, and provides a solid data foundation for the formulation and implementation of security policies. At the same time, the solution is highly flexible and scalable. Through configurable weight factors and thresholds, it realizes personalized settings to adapt to the security needs of different application scenarios, showing strong adaptability and practicality while reducing misjudgment interference and improving network security and stability.

[0054] 3. The present invention extracts the key behavioral features of the IP address, the access time period and the total duration, constructs a historical behavior model, and realizes the refined management and analysis of the IP access behavior. This method not only quickly identifies frequently accessed IPs, but also refines the model granularity by dividing the time window by month, providing fine data support for security monitoring and traffic management. At the same time, the time window weight and similarity scoring mechanism are introduced to comprehensively consider the time factor and the similarity of the access behavior, accurately evaluate the current correlation with the historical behavior, and allow the attenuation coefficient and similarity algorithm to be adjusted according to demand, showing a high degree of flexibility and scalability, and has broad application prospects and practical value in cloud environments, network security, traffic analysis and other fields, reducing misjudgment interference and improving network security and stability.

[0055] 4. The dynamic threshold interval adjustment mechanism introduced in the present invention greatly improves the flexibility and adaptability of the security assessment and access control system, enabling it to intelligently adjust the threshold interval in the real-time changing network environment and user behavior, and effectively respond to the challenge of traffic surge. This mechanism not only improves the accuracy and reliability of security assessment through real-time monitoring and dynamic adjustment, distinguishes normal access from potential threats, but also enhances the robustness and fault tolerance of the system in dealing with complex and changing network environments. At the same time, setting the threshold adjustment buffer space ensures a balance between security and user experience, reduces misjudgment interference, and improves network security and stability.

[0056] 5. The security assessment server performs multi-dimensional security assessment based on the encrypted multi-source trust metric data and the device information corresponding to the terminal device, which can more accurately reflect the trustworthiness of the device, thereby effectively identifying and preventing potential security threats.

[0057] 6. This method can evaluate the trust of the device in real time and dynamically adjust the access control policy based on the evaluation results. This fine-grained access control method can more flexibly respond to changes in the network environment and ensure that only fully verified devices can access protected resources.

[0058] 7. The application server uses the pre-installed certificate to establish a secure communication channel with the token generation server and the security assessment server, and obtains a valid access token from the token generation server, which improves the efficiency and security of communication while reducing the delay and overhead caused by frequent identity authentication.

[0059] 8. This method is based on a cloud-edge-end collaborative architecture and is highly flexible and scalable. Enterprises can flexibly deploy and adjust the number and location of zero-trust agent modules and security assessment servers according to their own business needs and security policies to adapt to the ever-changing network environment.

[0060] 9. This method can achieve seamless integration and intelligent protection of cloud, edge and end, reduce the need for manual intervention and improve management efficiency. At the same time, it can also provide users with a consistent, intuitive and seamless user experience, enhancing user support and satisfaction with security policies.

[0061] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 It is a schematic diagram of an embodiment of a zero-trust access control method based on cloud-edge-end collaboration of the present invention.

[0063] Figure 2 It is a flow chart of an embodiment of a zero-trust access control method based on cloud-edge-end collaboration of the present invention.

[0064] Figure 3 It is a flow chart of calculating IP matching evaluation in an embodiment of a zero-trust access control method based on cloud-edge-end collaboration of the present invention. DETAILED DESCRIPTION

[0065] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0066] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0067] See also Figures 1 to 3 , this embodiment provides a zero-trust access control method based on cloud-edge-end collaboration, including the following steps:

[0068] Step S101, deploy zero-trust agent modules on the application servers of the cloud, edge, and terminal devices respectively, to collect multi-source trust metric indicator data at all levels in real time.

[0069] Specifically, zero-trust agents are installed and configured on application servers, edge computing nodes, and terminal devices in the cloud computing environment to ensure that all devices and users undergo strict identity authentication and permission checks when accessing resources.

[0070] Among them, the application server is the actual business server with business application software installed, and the initialization certificate, zero-trust client software, etc. have been installed.

[0071] In step S102, the zero-trust agent module uses an encryption algorithm to encrypt the collected multi-source trust metric indicator data, and encapsulates the encrypted data into a standardized data packet and transmits it to the security assessment server through a secure communication protocol. In step S102, the zero-trust agent module is used to collect multi-source trust metric indicator data, and encrypts and encodes it through a double SHA256 algorithm, and packages the encoded result into a data packet for network transmission to the security assessment server.

[0072] In this embodiment, the multi-source trust metric data includes multi-source information such as user identity data, account data, system log data, network log data, traffic data, application behavior data, and data access behavior data. The security assessment server is configured to perform the following functions: evaluate the status of the application server and the terminal device connected to it, receive information from the application server in real time, conduct comprehensive analysis and risk assessment on the information, and generate a quantitative scoring result for each access or operation and send it to the gateway device. The scoring result reflects the trustworthiness of the access request. Among them, the user identity data includes digital certificates, biometrics, user names and passwords.

[0073] Step S103, the security assessment server receives the encrypted multi-source trust metric data and the device information corresponding to the terminal device, such as the universal unique identifier, IP address, and MAC address information, performs multi-dimensional security assessments, such as IP matching assessments and credibility assessments, generates an assessment score reflecting the trustworthiness of the device, and sends the assessment score to the gateway device.

[0074] In the above step S103, the calculation formula of the evaluation score is = , where n is the total number of evaluation indicators, weight i is the weight of the i-th indicator, and the specific value is set according to the actual situation. Indicator score i is the score of the i-th indicator calculated according to the evaluation logic, and the specific value is set according to the actual situation.

[0075] The gateway device is located between the application server and the internal network and is used to decide whether to allow the application server to access the internal network. The gateway device accepts the evaluation result of the security evaluation server on the application server.

[0076] Specifically, the security assessment server first decrypts the received data packet and extracts the multi-source trust metric indicator data. Through the real-time collection, update and dynamic trust assessment of multi-source data, a multi-source dynamic security assessment strategy is determined, and the IP matching degree, user identity trustworthiness, environment trustworthiness, user behavior trustworthiness, software trustworthiness and hardware trustworthiness are evaluated. This embodiment can calculate the comprehensive evaluation score through the normalized weighted average algorithm. The evaluation score is sent to the gateway to achieve dynamic control of access and ensure the security of user access and access in a constantly changing environment.

[0077] Among them, the trustworthiness of user identity is not only the login account, but also the service resources that need to be accessed, the access ports that need to be opened, etc.; the trustworthiness of the environment can detect viruses, Trojans, and vulnerabilities in the terminal environment, forming a continuous assessment of the network environment. Once a threat is found, the unsafe connection is immediately disconnected; the trustworthiness of user behavior is based on the client's traffic characteristics and contextual information analysis to characterize the behavioral baseline of normal access, and the current behavior can be judged based on the behavioral baseline. Whether the trustworthiness of the software: the device's operating system version, application software version, etc. are combined as software information, and the software is evaluated by judging whether the current version has a published high-risk vulnerability to determine whether the software is trustworthy; hardware trustworthiness terminal hardware information, such as the device manufacturer, can be identified by the MAC address to evaluate whether the hardware is trustworthy.

[0078] Step S104: The gateway device generates an evaluation result based on the received evaluation score, establishes a security status node for each application server that requests access, stores relevant evaluation result information and access control policies, and creates an IP table for controlling access rights of different IP addresses. The IP table is configured according to the stored access control policies to allow or deny access requests from specific IP addresses.

[0079] Among them, after comparing the evaluation score with the pre-set dynamically adjusted threshold range, the evaluation processing result is divided into read-only mode, read-write mode or access denied mode according to the comparison result, so as to enhance the system's ability to identify abnormal or malicious access behavior.

[0080] Specifically, after receiving the assessment score from the security assessment server, the gateway establishes a status node for each application server (regardless of whether it is located in the cloud, edge, or end). These status nodes store key information such as IP address, MAC address information, IP matching, user identity trustworthiness, environment trustworthiness, user behavior trustworthiness, software trustworthiness, hardware trustworthiness, assessment score, assessment time, and effective duration. At the same time, the gateway establishes an IP table to associate the IP address with the corresponding assessment processing result's read-only mode, read-write mode, or denied access mode, and stores it in the network control kernel so that the network control kernel can release or intercept the access request of the application server.

[0081] Step S105, the application server uses the pre-installed certificate to establish a secure communication channel with the token generation server and the security assessment server, and obtains a valid access token from the token generation server; at the same time, when initiating an access request, the application server appends signature information signed by the private key to the requested URL.

[0082] Among them, the token generation server is a token management server used to generate token information for the application. It accepts the SSL connection of the application server, generates tokens for token requests and manages tokens.

[0083] Specifically, the application server communicates with the token generation server and the security assessment server through the SSL security protocol. During the communication process, the application server uses the pre-installed certificate for authentication and encrypted communication. The application server obtains a unique token from the token generation server and signs it in the URL when sending an access request to ensure the authenticity and integrity of the request.

[0084] Step S106: The application server carries the access token and the encrypted URL signature information, constructs a request message for accessing the internal network, and sends the request message to the gateway device.

[0085] Specifically, the application server sends a URL containing a token and signature information to the gateway, requesting access to internal network resources. After receiving the request, the gateway will first verify whether the signature in the URL is valid to ensure that the request is sent by a legitimate application server.

[0086] Step S107, after receiving the request message, the gateway device first verifies the validity of the access token in the request message, then queries the IP table, and comprehensively determines whether the application server is allowed to access the internal network based on the evaluation result corresponding to the IP address in the request message and the token verification result, and performs corresponding access control operations accordingly.

[0087] Specifically, after receiving an access request, the gateway first queries the IP table to obtain the evaluation processing result of the IP address corresponding to the read-only mode, read-write mode, or access denied mode. The gateway verifies whether the token in the request is valid. If the evaluation processing result corresponding to the IP address is read-only mode or read-write mode and the token is valid, access to the internal network in the corresponding mode is allowed; if the evaluation processing result is access denied mode or the token is invalid, the access request is denied and the relevant log is recorded.

[0088] It should be noted that in some highly sensitive or security-critical environments, the threshold may need to be set higher to ensure that only those IP addresses that are highly matched to historical behavior are considered safe. It can also be set to be configurable so that it can be adjusted as needed during system operation without modifying the code or redeploying the system. In addition, it should be noted that when performing IP matching assessments, the requirements of relevant laws, regulations and privacy policies should be strictly followed to ensure that users' personal information and access data are properly protected.

[0089] Therefore, the technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0090] 1. Comprehensive analysis and evaluation of IP access records are achieved by comprehensively using multiple dimensions such as the geographical attributes of IP addresses, access time, access object type, access duration, and browsing mode. By dividing the historical time window and extracting key features, an IP matching degree calculation model is constructed, which effectively improves the accuracy and real-time nature of IP address security judgment. This technical effect not only enhances the system's ability to identify potential security threats, but also provides strong data support for subsequent security strategy formulation and implementation.

[0091] 2. The advantage of this embodiment is its high flexibility and scalability. First, through configurable weight factors and thresholds, the system can be personalized according to the security requirements of different application scenarios, improving the adaptability and practicality of the system. Flexibility is reflected in the tunability of the weight factors, allowing personalized settings according to the needs of specific application scenarios, thereby adapting to different security environments and requirements.

[0092] In the above step S103, if Figure 3 As shown, IP matching evaluation includes:

[0093] Step S201, query the IP access record of the currently accessed IP address.

[0094] Among them, access records include IP address and geographical attributes of IP address, access time, access object type, access duration, browsing mode, etc.

[0095] Step S202, retrieving all historical time window IP access records of the currently used IP address from the database, and performing historical IP access record data preprocessing.

[0096] Among them, preprocessing includes cleaning and organizing historical data to ensure the accuracy and consistency of IP access record data. The historical IP access record data is divided into monthly time windows.

[0097] Step S203, extract key features from each time window to calculate the IP matching degree and obtain an IP score. The key features include but are not limited to the field to which the IP address belongs, the type of access object, the average access time, and the browsing mode.

[0098] The IP score calculation formula is expressed as:

[0099] IPM+ TWS+ DTC+ BPS

[0100] Among them, IPM is IP matching, TWS is time window score, DTC is data type consistency, BPS is browsing mode similarity, , , , are the weight factors of IP matching, time window score, data type consistency, and browsing mode similarity, and + + + =1; The IP matching degree is more important than , The specific weight tuning steps are evaluated in detail by specific real-time scenarios to maximize the accuracy of IP matching and reflect the importance of the IP address itself.

[0101] Among them, IPM is the IP matching degree, which is calculated based on the geographical location similarity between the current IP address and the historical IP address. Use the IP geographical location database to convert the IP address into geographical location information. For the current access IP address and the historical access IP address, their geographical locations are obtained respectively, and the similarity is calculated based on the geographical location level. For example, if two IP addresses are located in the same country, a certain basic score is given; if they are also located in the same city, additional points are added. The similarity scores at each level are weighted and summed to obtain the final IPM score.

[0102] TWS is a time window score that reflects the degree of match between the current access time and the historical behavior pattern.

[0103] DTC stands for data type consistency, which measures the similarity or consistency between the data type currently being accessed and the data type in the historical access records. The data types in the historical access records are counted, and the access frequency of each data type is recorded. For the current access request, its data type is determined, and the relative frequency of the current data type in the historical access records is calculated. If the historical records contain the current data type and the frequency is high, the TWS score is high; otherwise, the score is low.

[0104] BPS is the browsing mode similarity, which is calculated based on the browsing behavior of users in the current visit and the previous visit (such as page jump order, dwell time, etc.). Extract the browsing mode features in the historical visit records, such as page visit sequence, page dwell time, and click link category, perform the same feature extraction on the browsing mode of the current visit, use the sequence alignment algorithm to compare the similarity of the current and historical browsing modes, and give the BPS score based on the similarity calculation results. The higher the score, the more similar the browsing modes are.

[0105] For example, assume the following parameter values: =0.4, =0.3, =0.2, =0.1, IPM=0.8, TWS=0.6, DTC=0.7, BPS=0.5, then 0.4×0.8+0.3×0.6+0.2×0.7+0.1×0.5=0.69. This score reflects the degree of match between the current IP address and the historical access records.

[0106] Step S204, make a security judgment based on the IP score. If the IP score is within the specified range of the security IP threshold, continue to identify the IP as a safe IP and perform subsequent operations.

[0107] Among them, the setting of the security IP threshold should be adjusted according to the actual application scenario and security requirements.

[0108] In some embodiments, the IP matching evaluation realizes a comprehensive analysis of the IP access records. IP access in different historical periods has certain time period regularity and access habits. According to the variability of IP access rules in different time periods, assuming that the IP matching is not affected by the time window, the matching calculation results may be inaccurate and unable to truly reflect the current IP access security status and behavior.

[0109] In some embodiments, historical data is carefully divided into multiple time windows, and the access data type, duration, browsing pattern and other characteristics in each time window are analyzed and compared with the previously constructed historical behavior model. The rate of change of the historical behavior pattern over time is further analyzed, and the time weights of different time windows are adjusted to enhance the system's ability to identify abnormal or malicious access behavior.

[0110] Furthermore, by deeply analyzing the user's historical behavior patterns and comparing them with current access behaviors, abnormal activities that do not match normal behavior patterns can be more accurately identified.

[0111] In some embodiments, extracting key features from each time window to calculate IP matching degree also includes the following:

[0112] Step S301, extract key behavior features from visited IP addresses as candidate IPs for which historical behavior models need to be constructed.

[0113] The extraction of key behavior features includes counting the access time period in each time window and the total access time in each time window.

[0114] Step S302: for each candidate IP, divide its access record into multiple time windows by month.

[0115] Specifically, the access time periods and access durations of all time windows of each candidate IP are stored as the historical behavior model of the IP. If the data starts from January 2021, the first time window will be January 2021, the second time window will be February 2021, and so on.

[0116] Step S303, calculate the similarity between the behavior characteristics of the currently used IP address access time period and the historical time period and consider the weight of the time period, and calculate the TWS time window score using the following formula:

[0117]

[0118] Among them, Wi is the weight of the i-th exponential decay historical time window based on time gap, Si is the similarity between the current comprehensive score access behavior based on time period and duration and the historical behavior in the time window; n is the total number of time windows, = , where Δti is the time difference between the current time and the center time of the i-th time window, λ is the decay coefficient that controls the decay speed of the time weight, and Δti is the time difference between the current time and the center time of the i-th time window; S iIt is a similarity score calculated based on the current access behavior and the behavior in the i-th time window in history. The specific calculation method is Jaccard similarity or customized according to the cloud environment.

[0119] For example, the simplified IP address is 192.168.1.1, the first access time is 2023-01-01 12:00:00, the access duration is 10 minutes, the second access time is 2023-01-02 13:30:00, the access duration is 15 minutes, and the third access time is 2023-02-01 10:00:00, the access duration is 20 minutes. IP 192.168.1.1 has been accessed at least twice, so a historical behavior model is built for them, with two time windows, January 2023 and February 2023. For example, the simplified historical behavior model includes the following:

[0120] 192.168.1.1-January 2023: The access period is [2023-01-01, 2023-01-02], and the total access time is 25 minutes.

[0121] 192.168.1.1-February 2023: The access period is [2023-02-01], and the total access duration is 20 minutes.

[0122] Assume that IP 192.168.1.1 is expected to be accessed for 10 minutes on March 1, 2023. Only the weight of the time window is considered, and the exact similarity calculation of the specific time period and duration is not considered. The attenuation coefficient λ is set to 0.1 (only as an example, the actual value needs to be adjusted according to demand). Therefore: The weight of the time window in January 2023 = ≈0.82 (because it is 2 months away from the current time), the time window weight for February 2023 = ≈0.91 (because it is 1 month away from the current time), the similarity score is given only by comparing whether the current access month overlaps with the historical months (it will be more complicated in practice). The current access is in March, which has a "close" relationship with February (a threshold or function can be set to quantify this relationship), but is farther away from January. Assume that S1=0.2 (low similarity because the months do not overlap), S2=0.8 (higher similarity because of the previous month). Calculate TWS= ≈0.74.

[0123] It should be noted that the TWS calculation in this example is very simplified and is only for illustration purposes. In actual applications, more complex similarity scoring methods and weight allocation strategies need to be designed according to specific needs.

[0124] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0125] 1. By extracting the key behavioral features of the visiting IP addresses, including the access time period and total access duration, and building a historical behavior model, refined management and analysis of IP access behavior is achieved. This method not only helps to quickly identify frequently visited IPs, but also provides strong support for subsequent access behavior prediction and anomaly detection through historical behavior models. By dividing the time window by month, the granularity of the historical behavior model is further refined, so that the model can more accurately reflect the access habits of IPs in different time periods, providing more refined data support for security monitoring and traffic management.

[0126] 2. By introducing the weight of the time window and the similarity scoring mechanism, the time factor and the similarity of the access behavior can be comprehensively considered, so as to more accurately evaluate the correlation between the current access behavior and the historical behavior. In addition, the attenuation coefficient and similarity calculation method can be adjusted according to actual needs to adapt to different application scenarios and monitoring needs. This flexibility and scalability make it have broad application prospects and practical value in cloud environments, network security, traffic analysis and other fields.

[0127] In some embodiments, the gateway device generates an evaluation result based on the received evaluation score, including:

[0128] Step S401, collect historical access data from sources such as application servers, security assessment servers and gateway devices, and clarify the assessment scores of each dimension.

[0129] Among them, the evaluation scores of each dimension include IP matching, user identity trustworthiness, environment trustworthiness, user behavior trustworthiness, software trustworthiness and hardware trustworthiness.

[0130] Step S402: For each evaluation dimension, a statistical learning algorithm is used to train the collected historical data to obtain the score fluctuation range of each evaluation dimension in the total evaluation score under normal circumstances and the score characteristics indicating abnormalities.

[0131] The evaluation scores of each dimension collected in the early stage are combined with the historical access data to ensure that the data includes IP address, access time, access behavior and security labels. Support vector machine (SVM) is selected as the statistical learning algorithm to extract the available information of the access data to form a feature vector that can be processed by the model. The feature value is scaled to the interval [0,1] and the SVM model is trained.

[0132] Step S403: dynamically adjust the threshold interval of access rights according to the current network environment status, the visitor's IP address, and the access behavior, for example, dynamically adjust the threshold interval of read-only mode, read-write mode, or access denied mode.

[0133] Specifically, the network environment and user behavior are constantly changing, so the threshold interval needs to be adjusted dynamically according to real-time conditions. For example, during peak hours or specific time periods, network traffic and access requests may increase. At this time, the threshold needs to be adjusted accordingly to avoid false positives or false negatives, ensure the stability and accuracy of the system, and set a certain buffer space when adjusting the threshold.

[0134] Step S404, calculate the evaluation score of the current access IP in real time, and compare it with the dynamically set threshold range.

[0135] Step S405, if the evaluation score of the current access IP falls within the corresponding threshold range, the access is deemed safe and the corresponding access rights are granted; if the evaluation score deviates from the threshold range, it is regarded as an abnormal access IP and the access right table is denied access mode.

[0136] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0137] 1. The introduction of a dynamic threshold interval adjustment mechanism enhances the flexibility and adaptability of security assessment and access control systems. In the context of real-time changing network environments and user behaviors, the system can intelligently adjust the threshold interval based on the current network status, IP address, and access behavior, effectively responding to the challenges brought about by the surge in network traffic during peak hours or specific time periods.

[0138] 2. Through real-time monitoring and dynamic adjustment, the system can more accurately identify the boundary between normal access and potential threats, improving the accuracy and reliability of security assessment. Secondly, the dynamic threshold setting takes into account the complexity and variability of the network environment, allowing the system to flexibly respond to various emergencies and enhancing the robustness and fault tolerance of the system. Finally, by setting a buffer space for threshold adjustment, the system can reduce the interference caused by threshold fluctuations on normal access while ensuring security, thereby improving user experience and system friendliness.

[0139] In the above step S104, after comparing the evaluation score calculated based on the multi-source trust metric data with the preset dynamic adjustment threshold interval, the evaluation processing result is divided into:

[0140] Read-only mode allows users to access resources in read-only mode when the assessment score indicates that the access request is low risk, but not trustworthy enough for read-write operations.

[0141] Read-write mode: When the evaluation score indicates that the access request is highly trustworthy and meets the security policy requirements, the user is granted full read-write permissions.

[0142] Alternatively, in the access denial mode, when the evaluation score exceeds the normal fluctuation range or there is an obvious security risk, the access request is immediately denied to ensure the security of the system and data.

[0143] In some embodiments, the gateway device receives evaluation scores from various levels, which may include but are not limited to multi-source trust metrics such as application server performance, network security, and user behavior analysis; the gateway device is built-in or connected to a security assessment engine, which processes and analyzes the received evaluation scores according to preset algorithms and policies to generate evaluation results. The evaluation results are used to reflect the current security status of the application server, including but not limited to information such as security level and potential risk level.

[0144] In the above step S105, a token generation server is introduced as a token management component to receive a secure socket layer SSL connection request from an application server. After receiving a valid token request, the token generation server generates unique token information for the application according to preset rules and algorithms.

[0145] The data preprocessing in step S202 specifically includes:

[0146] The collected historical IP access record data is cleaned to identify and remove invalid data, erroneous data or duplicate data; the cleaned data is divided into monthly time periods to form a series of continuous and non-overlapping time windows, and the data in each time window is sorted and divided to ensure that the data in each time window is complete and accurate.

[0147] In some embodiments, the specific steps of constructing the historical behavior model of IP include:

[0148] For each candidate IP, a time window in months is set up, starting from the current month and moving forward in sequence to cover the required historical period; within each time window, the access time period of the IP is recorded, including the access time period and the duration of each visit; these access time periods and access duration data are stored and managed in chronological order to form a historical behavior model of the IP.

[0149] In some embodiments, the specific steps of deploying the zero-trust proxy module on the application servers of the cloud, the edge, and the terminal device include:

[0150] Cloud deployment: Select an appropriate location on the cloud service platform, configure and install the zero-trust agent module for each cloud application server instance; configure the communication parameters between the zero-trust agent module and the cloud security assessment server and token generation server to ensure that data can be transmitted securely and efficiently; customize the data collection strategy of the zero-trust agent module according to the business characteristics and security requirements of the cloud application server, including the type of trust metrics and collection frequency.

[0151] Edge deployment: Install the zero-trust agent module on the edge computing node or edge server to ensure collaboration with the cloud and terminal devices; optimize the performance of the zero-trust agent module for the special network environment at the edge, such as reducing latency and improving data processing efficiency; configure the data synchronization mechanism between the edge zero-trust agent module and the cloud security assessment server to ensure the real-time and consistency of trust data.

[0152] Terminal device deployment: Develop an adaptive zero-trust agent module for each type of terminal device, taking into account factors such as the device's hardware performance, operating system type and version; install and configure the zero-trust agent module on the terminal device to ensure that it can seamlessly connect with the zero-trust agent modules on the cloud and edge; set the data collection scope of the zero-trust agent module of the terminal device to avoid unnecessary performance burden or privacy leakage risks for end users; realize secure communication between the zero-trust agent module of the terminal device and the cloud security assessment server to ensure the reliable transmission of trusted data.

[0153] Through the above steps, this embodiment can successfully deploy the zero-trust agent module on the application servers of the cloud, edge and terminal devices, providing a solid foundation for subsequent trust measurement, security assessment and access control.

[0154] In this embodiment, the zero-trust proxy module is a key component in the zero-trust security architecture, and it plays an important role in protecting the zero-trust network. Specifically, the zero-trust proxy module is an application-level proxy server that handles infrastructure tasks such as authentication, authorization, and encryption. It can be deployed on application servers in the cloud, edge, and terminal devices to implement a zero-trust access control method.

[0155] The zero-trust agent module has the following features:

[0156] Working mode: The zero-trust proxy module has two working modes: reverse proxy and forward proxy. In reverse proxy mode, it receives connection requests from zero-trust clients, performs authentication and authorization, and then passes the request to the backend application system for processing. In forward proxy mode, it processes network requests from non-zero-trust aware components to the zero-trust system.

[0157] The zero-trust proxy module should be deployed in an embedded manner on the device running the workload. In this way, all workload network communication traffic will be forced to flow to the proxy before entering the network, thus ensuring the security and controllability of the traffic.

[0158] The zero-trust agent module encrypts the collected multi-source trust measurement indicator data through an encryption algorithm, and transmits the encrypted data to the security assessment server through a secure communication protocol. This process ensures the confidentiality and integrity of the data during transmission, and effectively prevents the risk of data leakage and tampering.

[0159] Zero-trust agent modules can be customized according to different business characteristics and security requirements. For example, zero-trust agent modules deployed in the cloud, edge, and terminal devices may require different data collection strategies, performance optimization measures, and communication parameter configurations.

[0160] In the zero-trust access control method based on cloud-edge-end collaboration, the zero-trust agent module plays a vital role. It can not only collect multi-source trust measurement indicator data at all levels in real time, but also encrypt and securely transmit these data, providing strong support for subsequent multi-dimensional security assessments and fine-grained access control.

[0161] Therefore, the zero-trust agent module is one of the core components in the zero-trust security architecture to implement access control, identity authentication and data protection. By deploying zero-trust agent modules at different levels, enterprises can build a more secure, trustworthy and controllable network environment.

[0162] In some embodiments, the specific steps of deploying zero-trust agent modules on the application servers of the cloud, edge, and terminal devices to collect multi-source trust metric data at all levels in real time include:

[0163] Data collection of the cloud-based zero-trust agent module: The cloud-based zero-trust agent module is configured with a trust metric collection strategy for the cloud environment, including but not limited to cloud resource usage, network traffic patterns, cloud service access logs, authentication and authorization records, etc.; through integration with cloud infrastructure and services, the cloud-based zero-trust agent module captures and processes the above trust metric data in real time; after preliminary processing, the collected data is encrypted according to the preset data format and encryption standards, and is ready to be transmitted to the security assessment server through a secure communication protocol.

[0164] Data collection of the edge zero-trust agent module: The edge zero-trust agent module is designed with a special trust metric collection mechanism based on the characteristics of the edge computing environment, covering edge device status, edge network traffic, edge application behavior, user access authentication, etc.; using the computing power and storage resources of the edge, the edge zero-trust agent module monitors and collects the above data in real time; the data is initially screened and encrypted at the edge to ensure security and privacy protection during transmission, and then sent to the security assessment server in the cloud through a secure communication protocol.

[0165] Data collection by the zero-trust agent module of terminal devices: The zero-trust agent module of terminal devices customizes the trust metric collection plan according to the type of terminal device, operating system and installed applications, including device usage behavior, application access records, user authentication information, device security status, etc.; through deep integration with terminal devices, the zero-trust agent module can collect this data in real time and efficiently; the collected data is encrypted on the terminal device and, through a secure communication protocol, may be forwarded at the edge or sent directly to a security assessment server in the cloud for further processing.

[0166] Data synchronization and integration: The zero-trust agent modules on the cloud, edge, and terminal devices synchronize the collected trust metric data to the security assessment server regularly or according to preset conditions; the security assessment server receives and integrates data from different levels to form a comprehensive trust assessment view, providing a basis for subsequent security assessments and access control decisions.

[0167] Through the above steps, this embodiment can effectively deploy the zero-trust agent module on the application servers of the cloud, edge and terminal devices, and realize real-time and comprehensive multi-source trust measurement indicator data collection, providing a solid data foundation for building a zero-trust security system.

[0168] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0169] The above-mentioned embodiments are only preferred embodiments of the present invention and cannot be used to limit the scope of protection of the present invention. Any non-substantial changes and substitutions made by technicians in this field on the basis of the present invention shall fall within the scope of protection required by the present invention.

Claims

1. A zero-trust access control method based on cloud-edge-end collaboration, characterized in that: The following steps are involved: Step S101, deploying zero-trust agent modules on the application servers of the cloud, edge, and terminal devices, respectively, to collect multi-source trust metric indicator data at all levels in real time; Step S102: The zero-trust agent module uses an encryption algorithm to encrypt the collected multi-source trust metric indicator data, and encapsulates the encrypted data into a standardized data packet and transmits it to the security assessment server through a secure communication protocol; Step S103: The security assessment server receives the encrypted multi-source trust metric data and the device information corresponding to the terminal device, performs IP matching evaluation and credibility evaluation, generates an evaluation score reflecting the device trustworthiness, and sends the evaluation score to the gateway device; Step S104: The gateway device generates an evaluation result based on the received evaluation score, establishes a security status node for each application server requesting access, stores relevant evaluation result information and access control policies, and creates an IP table for controlling access rights of different IP addresses; wherein the IP table is configured according to the stored access control policies to allow or deny access requests from specific IP addresses; Step S105: The application server uses the pre-installed certificate to establish a secure communication channel with the token generation server and the security assessment server, and obtains a valid access token from the token generation server; at the same time, when initiating an access request, the application server appends signature information signed by the private key to the requested URL; Step S106, the application server carries the access token and the encrypted URL signature information, constructs a request message for accessing the internal network, and sends the request message to the gateway device; Step S107, after receiving the request message, the gateway device first verifies the validity of the access token in the request message, then queries the IP table, and comprehensively determines whether to allow the application server to access the internal network based on the evaluation result corresponding to the IP address in the request message and the token verification result, and performs corresponding access control operations accordingly; Wherein, in step S103, IP matching evaluation includes: Step S201, query the IP access record of the currently accessed IP address; Step S202, retrieving all historical time window IP access records of the currently used IP address from the database, and performing historical IP access record data preprocessing; Step S203, extracting key features from each time window to calculate the IP score and obtain the IP score; Step S204, make a security judgment based on the IP score. If the IP score is within the specified range of the security IP threshold, continue to identify the IP as a safe IP and perform subsequent operations; The IP score calculation formula is expressed as: IPM+ TWS+ DTC+ BPS Among them, IPM is IP matching, TWS is time window score, DTC is data type consistency, BPS is browsing mode similarity, , , , are the weight factors of IP matching, time window score, data type consistency, and browsing mode similarity, respectively. + + + =1; In step S203, key features are extracted from each time window to calculate the IP score, including: Step S301, extracting key behavior features from visited IP addresses as candidate IPs for building historical behavior models; Step S302: for each candidate IP, divide its access record into multiple time windows by month: Step S303, calculate the similarity between the behavior characteristics of the currently used IP address access time period and the historical time period and consider the weight of the time period, and calculate the TWS time window score using the following formula: Among them, W i is the weight of the i-th exponentially decaying historical time window based on time gap; n is the total number of time windows, = , where λ is the decay coefficient controlling the decay speed of the time weight, Δt i is the time difference between the current time and the center time of the i-th time window; S i It is the similarity score calculated based on the current access behavior and the behavior in the i-th time window in history.

2. The method according to claim 1, characterized in that: In step S104, the gateway device generates an evaluation result based on the received evaluation score, including: Step S401, collecting historical access data from application servers, security assessment servers and gateway devices, and clarifying the evaluation scores of each dimension; wherein the evaluation scores of each dimension include IP score, user identity trustworthiness, environment trustworthiness, user behavior trustworthiness, software trustworthiness and hardware trustworthiness; Step S402: for each evaluation dimension, use a statistical learning algorithm to train the collected historical data to obtain the score fluctuation range of each evaluation dimension in the total evaluation score under normal circumstances and the score characteristics indicating abnormality; Step S403, dynamically adjusting the threshold interval of access rights according to the current network environment status, the visitor's IP address, and access behavior; Step S404, calculating the evaluation score of the current access IP in real time and comparing it with the dynamically set threshold range; Step S405: If the evaluation score of the current access IP falls within the corresponding threshold range, the access is deemed safe and the corresponding access rights are granted; if the evaluation score deviates from the threshold range, it is regarded as an abnormal access.

3. The method according to claim 1, characterized in that: In the step S102, the multi-source trust metric indicator data includes multi-source information of user identity data, account data, system log data, network log data, traffic data, application behavior data and data access behavior; The security assessment server is configured to perform the following functions: evaluate the status of the application server and the terminal device connected to it, receive information from the application server in real time, conduct comprehensive analysis and risk assessment on the information, and generate a quantitative scoring result for each access or operation and send it to the gateway device. The scoring result reflects the trustworthiness of the access request.

4. The method according to claim 2, characterized in that: In step S404, after comparing the evaluation score calculated based on the multi-source trust metric data with the preset dynamic adjustment threshold interval, the evaluation result is divided into the following categories according to the comparison result: Read-only mode allows users to access resources in read-only mode when the evaluation score indicates that the access request is low risk but not trustworthy enough for read-write operations; Read-write mode: when the evaluation score indicates that the access request is highly credible and meets the security policy requirements, the user is granted full read-write permissions; Alternatively, in the access denial mode, when the evaluation score exceeds the normal fluctuation range or there is an obvious security risk, the access request is immediately denied to ensure the security of the system and data.

5. The method according to claim 1, characterized in that: In step S105, a token generation server is introduced as a token management component to receive a secure socket layer SSL connection request from an application server. After receiving a valid token request, the token generation server generates unique token information for the application according to preset rules and algorithms.

6. The method according to claim 1, characterized in that: The data preprocessing in step S202 includes: Clean the collected historical IP access record data to identify and remove invalid, erroneous or duplicate data; The cleaned data is divided into monthly time periods to form a series of continuous and non-overlapping time windows. The data in each time window is sorted and divided to ensure that the data in each time window is complete and accurate.

7. The method according to claim 6, characterized in that It also includes building a historical behavior model of IP, and the specific steps include: For each candidate IP, set up a time window in months, starting from the current month and going forward in sequence to cover the required historical period; In each time window, record the access time period of the IP, including the access time period and the duration of each access; These access time periods and access duration data are stored and managed in chronological order to form a historical behavior model of the IP.

8. The method according to claim 1, characterized in that: In step S103, the calculation formula of the evaluation score is: , where n is the total number of evaluation indicators and the weight i The specific value of the weight of the i-th indicator is set according to the actual situation. i The specific value of the score of the ith indicator calculated according to the evaluation logic is set according to the actual situation.

Images