Terminal access authority analysis method and system based on zero-trust ABAC model

Abstract

The invention discloses a terminal access permission analysis method and system based on a zero-trust ABAC model. The method comprises the steps that a user terminal sends a resource access request; the PEP receives a resource access request sent by the user terminal; the method comprises the following steps: extracting a multi-dimensional attribute from a user request according to a preset acquisition requirement based on the user request, converting the user request into an attribute request, and sending the attribute request to a policy decision point PDP; the attributes comprise a user attribute, an environment attribute, an operation attribute and an object attribute; the PDP performs access permission analysis by using a policy management point (PAP) based on the attribute request, obtains an access permission analysis result and feeds back the access permission analysis result to the PEP, and information fed back by the PDP to the PEP comprises permission, rejection, inapplicability and unknown; and the PEP permits or prohibits the resource access request according to the feedback information received from the PDP. According to the invention, on the basis of a zero-trust technical framework, fine management of authority is realized through the ABAC, and continuously changing business requirements and security challenges are effectively coped with.

Description

Technical Field

[0001] The present invention relates to the technical field of access permission analysis, and in particular to a terminal access permission analysis method and system based on a zero-trust ABAC model. Background Art

[0002] The various businesses of power companies have always been the core of security protection, and the security and stability of the business also require the support of various security protection technologies. However, since external businesses such as website systems are directly exposed to the Internet, it is convenient for ordinary business users to use, but also brings a lot of security risks. The existing business security access control of power companies is still imperfect, and dynamic access control and authorization cannot be performed, resulting in high security risks for the company's power business. Summary of the invention

[0003] In view of the problems existing in the above-mentioned prior art, the present invention provides a terminal access rights analysis method and system based on the zero-trust ABAC model. The technical solution is as follows:

[0004] In a first aspect, a method for analyzing terminal access rights based on a zero-trust ABAC model is provided, the method comprising the following steps:

[0005] The user terminal sends a resource access request;

[0006] The policy execution point PEP receives a resource access request sent by a user terminal; based on the user request and in accordance with preset collection requirements, it extracts multi-dimensional attributes from the user request, converts the user request into an attribute request and sends it to the policy decision point PDP; the attributes include user attributes, environment attributes, operation attributes, and object attributes;

[0007] Based on the attribute request, the PDP uses the policy management point PAP to perform access permission analysis, obtain the access permission analysis result, and feedback the access permission analysis result to the PEP. The information fed back by the PDP to the PEP includes permission, rejection, not applicable, and unknown;

[0008] The PEP allows or prohibits the resource access request according to the feedback information received from the PDP.

[0009] In some implementations, extracting multi-dimensional attributes from the user request based on the user request according to the preset collection requirements includes:

[0010] Extract keywords based on the current resource access request;

[0011] Perform part-of-speech analysis and attribute type classification on keywords;

[0012] Extracting multi-dimensional attributes according to a preset attribute path for a user access request; extracting multi-dimensional attributes according to a preset attribute path for a user access request includes:

[0013] Based on user access requests, after word embedding, a multi-head self-attention mechanism is used to capture the dependency relationship of words at different positions in the access request. The multi-head attention result is transmitted to the decoding network through a feedforward neural network for decoding to obtain the descriptive features of the user access request.

[0014] Based on the description features of the user access request, the corresponding preset attribute path is matched, and the multi-dimensional attributes in the user access request are extracted according to the matched preset attribute path.

[0015] In some implementations, the using a policy administration point PAP to perform access rights analysis includes:

[0016] Obtain multi-dimensional attribute data of user access requests, input the preset access permission policy reasoning model for analysis, and obtain the user's access permission analysis results;

[0017] The preset access permission policy inference model includes: an input module, a data logicization module, an access permission policy module, and an inference module. The inference module uses the multi-dimensional attribute data based on the user access request and the data logically processed by the data logicization module in combination with the access permission policy module to perform access permission inference.

[0018] In some implementations, the policy management point PAP is pre-designed with an attribute access control policy, and the generation process of the attribute access control policy includes: determining the order of different attributes in the attribute access control policy based on the importance of different attributes and the data distribution complexity of different attributes.

[0019] In some implementations, a method for obtaining data distribution complexity of different attributes includes:

[0020] Based on historical access data, extract the multi-dimensional attributes of the access request and the execution status of the access request in each access record as training samples;

[0021] Based on historical data, the attribute value range corresponding to the same attribute is obtained, and the data distribution complexity of the attribute is determined according to the attribute value range. The complexity is determined based on the number of attribute value ranges and whether the boundaries between different values ​​are clear.

[0022] In some implementations, a method for obtaining the importance of different attributes includes:

[0023] Recording the multi-dimensional attributes included in different access requests as an access request attribute set; the set includes attributes and corresponding attribute values;

[0024] Calculating similarities of different access request attribute sets and differences in access request execution conditions of corresponding different access requests;

[0025] The importance of the attribute is determined based on the similarity of different access request attribute sets and the difference of access request execution conditions of the corresponding different access requests.

[0026] In some implementations, determining the importance of an attribute based on similarities between different access request attribute sets and differences between access request execution conditions of corresponding different access requests includes:

[0027] Based on historical access data, an attribute access control analysis model is trained to output a binary classification result of whether access is allowed based on the multi-dimensional attributes in the access request as input, wherein the output result includes a probability value of allowing access and a probability value of not allowing access. When the probability value of allowing access is greater than the probability value of not allowing access, an access-allowed result is output; otherwise, an access-not allowed result is output;

[0028] Based on different access request attribute sets, using the attribute access control analysis model, obtaining the access request target execution result;

[0029] Select at least one attribute from all attributes as an attribute combination, and sort different attribute combinations from largest to smallest according to the number of attributes in the combination;

[0030] According to the sorting of the attribute combinations, starting from the first attribute combination, according to the attributes in the attribute combination, for different access request attribute sets, multiple access request attribute sets whose attribute values ​​in the attribute combinations are the same are obtained and divided into a set of categories; the second attribute combination is analyzed, and multiple access request attribute sets whose attribute values ​​in the attribute combinations are the same are obtained and divided into a set of categories, wherein the access request attribute set obtained based on the second attribute combination belongs to the set of categories obtained based on the first attribute combination or the access request attribute set obtained based on the second attribute combination does not belong to the set of categories obtained based on the first attribute combination;

[0031] For multiple access request attribute sets in a class of sets, one access request attribute set and the corresponding access request target execution result are used as reference data, and the remaining access request attribute sets and the corresponding access request target execution results are used as auxiliary data; based on the difference between the access request attribute set of the reference data and the access request attribute set in the auxiliary data, and the difference between the access request target execution result corresponding to the access request attribute set of the reference data and the access request target execution result corresponding to the access request attribute set of the reference data, the importance of attributes of different dimensions to the access request target execution result is linearly fitted.

[0032] In some implementations, after the PDP uses the policy management point PAP to perform access permission analysis based on the attribute request, it also includes: further determining whether to allow the resource access request based on the stability of the user access environment and the security of the user access behavior; if allowed, determining to allow the resource access request.

[0033] In some implementations, the method for acquiring the stability of the user access environment includes:

[0034] Obtain multi-dimensional attribute information of the access environment in the user's historical access requests;

[0035] Determine the stability of the attribute value of the environmental attribute based on the time series distribution of different attribute values ​​of the same environmental attribute, and determine the stability of the attribute value of the environmental attribute based on the diversity of the attribute value, the frequency of occurrence of different attribute values, and the number of times that the same attribute value continuously appears greater than a preset value within a sliding time window of a preset length, wherein the greater the diversity of the attribute value, the smaller the stability, the greater the frequency of occurrence of different attribute values, the greater the stability, and the greater the number of times that the same attribute value continuously appears greater than a preset value within a sliding time window of a preset length, the greater the stability;

[0036] The result of the stability of the attribute values ​​of different environmental attributes is integrated to comprehensively decide the stability of the user access environment. The integration includes integrating the result of the stability of the attribute values ​​of different environmental attributes based on the contribution of different environmental attributes to the stability of the user access environment.

[0037] In some implementations, the method for obtaining the security level of user access behavior includes:

[0038] Based on the user's historical access behavior, obtain the user's illegal connection time series characteristics, attempted unauthorized behavior time series characteristics, and user connection failure time series characteristics, the time series characteristics include the frequency of behavior occurrence, the frequency of behavior occurrence, and the time distribution characteristics of behavior occurrence;

[0039] Based on the fusion analysis of the user's illegal connection timing characteristics, the timing characteristics of the attempted unauthorized behavior, and the user's connection failure timing characteristics, the user's access behavior security is obtained through nonlinear fitting or linear fitting of the relationship between the timing characteristics and the user's access behavior security. The nonlinear fitting includes a fitting model obtained through sample training based on a neural network model, and the linear fitting includes configuring corresponding importance coefficients based on the importance of different timing characteristics, and performing linear fitting based on the importance system; the linear fitting also includes attenuating the importance of the behavior timing characteristics occurring at different times based on the time interval between the behavior occurrence time and the current time based on the user's illegal connection timing characteristics, the attempt to unauthorized behavior timing characteristics, and the user's connection failure timing characteristics.

[0040] In a second aspect, a terminal access rights analysis system based on a zero-trust ABAC model is provided, the system comprising:

[0041] An access request obtaining unit, used to obtain a resource access request sent by a user terminal;

[0042] The multi-dimensional attribute extraction unit is used to receive a resource access request sent by a user terminal through a policy execution point PEP; based on the user request and in accordance with preset collection requirements, extract multi-dimensional attributes from the user request, convert the user request into an attribute request and send it to a policy decision point PDP; the attributes include user attributes, environment attributes, operation attributes, and object attributes;

[0043] The access permission analysis unit is used to perform access permission analysis using the policy management point PAP based on the attribute request through the PDP, obtain the access permission analysis result, and feed back the access permission analysis result to the PEP. The information fed back by the PDP to the PEP includes permission, rejection, not applicable, and unknown;

[0044] The access request execution unit is used to execute permission or prohibition of the resource access request according to the feedback information received from the PDP through the PEP.

[0045] The terminal access permission analysis method and system based on the zero-trust ABAC model of the present invention have the following beneficial effects: based on the zero-trust technical framework, focusing on the security protection issues of various external businesses of the power company, based on the key threats of user permission control for business security protection, using the concept of zero trust to solve actual business security problems, and through the terminal access permission analysis method based on the zero-trust ABAC model provided in the application embodiment, preventing illegal behavior of legitimate users and zero-trust full business life cycle security control. Fine management of permissions is achieved through ABAC, effectively responding to changing business needs and security challenges. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1It is a flow chart of a terminal access rights analysis method based on a zero-trust ABAC model in an embodiment of the present application;

[0047] Figure 2 is a flowchart of a method for obtaining the importance of different attributes in an embodiment of the present application;

[0048] Figure 3 It is a flowchart of a method for obtaining the stability of a user access environment in an embodiment of the present application;

[0049] Figure 4 It is a structural diagram of a terminal access permission analysis system based on a zero-trust ABAC model in an embodiment of the present application. DETAILED DESCRIPTION

[0050] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0051] The present invention provides a method for analyzing terminal access rights based on a zero-trust ABAC model, including the following steps:

[0052] Step 1: The user terminal sends a resource access request;

[0053] Step 2: The policy execution point PEP receives a resource access request sent by a user terminal; based on the user request and in accordance with preset collection requirements, extracts multi-dimensional attributes from the user request, converts the user request into an attribute request and sends it to the policy decision point PDP; the attributes include user attributes, environment attributes, operation attributes, and object attributes;

[0054] Step 3: PDP uses the policy management point PAP to perform access permission analysis based on the attribute request, obtains the access permission analysis result, and feeds back the access permission analysis result to PEP. The information fed back by PDP to PEP includes allow, deny, not applicable, and unknown.

[0055] Step 4: The PEP allows or denies the resource access request according to the feedback information received from the PDP.

[0056] In the embodiments of the present application, based on the technical framework of zero trust, we focus on the security protection issues of various external businesses of the power company, based on the key threats of user authority management for business security protection, and use the concept of zero trust to solve actual business security problems. Through the terminal access permission analysis method based on the zero trust ABAC model provided in the application embodiment, we prevent illegal behavior of legitimate users and zero trust security management of the entire business life cycle. ABAC enables fine management of permissions, accurately specifying who can access which resources under specific conditions. Based on adaptability and fine-grained control, it effectively responds to changing business needs and security challenges. Among them, environmental attributes include location information, operating system version, time information, etc., operation attributes include reading, writing, deleting, modifying, etc., and object attributes are attribute information for accessing resources.

[0057] In one implementation, in the above step 2, extracting multi-dimensional attributes from the user request according to preset collection requirements based on the user request includes the following steps:

[0058] Step 21, extracting keywords based on the current resource access request;

[0059] Step 22, performing part-of-speech analysis and attribute type classification on the keywords, wherein the attribute types include user attributes, environment attributes, operation attributes, and object attributes;

[0060] Step 23, extracting multi-dimensional attributes according to a preset attribute path for the user access request; the extracting multi-dimensional attributes according to a preset attribute path for the user access request includes:

[0061] Step 231: Based on the user access request, after word embedding, a multi-head self-attention mechanism is used to capture the dependency relationship of words at different positions in the access request, and the multi-head attention result is transmitted to the decoding network for decoding through a feedforward neural network to obtain the description feature of the user access request;

[0062] Step 232: Based on the description features of the user access request, a corresponding preset attribute path is matched, and the multi-dimensional attributes in the user access request are extracted according to the matched preset attribute path.

[0063] In the embodiment of the present application, when extracting attributes from a user access request, the method of extracting attribute words one by one is not adopted directly, but extraction is performed according to a preset attribute path adapted to the semantics and type of the access request. On the one hand, orderly extraction is achieved, and on the other hand, the preset attribute path can be arranged in order according to the characteristics such as attribute importance and attribute complexity, so that the attribute data extracted for the user access request is more convenient for subsequent access permission policy matching analysis. It can be understood that the greater the attribute complexity, the later the order of extraction is, so that a greater probability of completing the access permission policy matching analysis by simple attribute data analysis is achieved. Of course, the greater the attribute importance, the greater the weight of its influence on the result during the access permission policy matching analysis.

[0064] In an embodiment of the present application, the user access request is subjected to encoding-decoding analysis to determine the type and semantic features of the access request, i.e., the descriptive features of the user access request. Based on the descriptive features, the corresponding preset attribute path is further adapted. User access requests with different descriptive features have different preset attribute paths when extracting attributes. It can be understood that different user access requests may have different attributes that are prioritized during access permission analysis or different attributes have different importance during access permission policy analysis, depending on different user attributes, different environments, and different resource attributes.

[0065] In one implementation, the above step 3, using the policy administration point PAP to perform access permission analysis, includes the following steps:

[0066] Step 31, obtaining multi-dimensional attribute data of the user's access request, inputting the preset access permission policy reasoning model for analysis, and obtaining the user's access permission analysis result;

[0067] The preset access permission policy inference model includes: an input module, a data logicization module, an access permission policy module, and an inference module. The inference module uses the multi-dimensional attribute data based on the user access request and the data logically processed by the data logicization module in combination with the access permission policy module to perform access permission inference.

[0068] In the embodiment of the present application, the multi-dimensional attribute data of the user access request is subjected to data logic processing to obtain the attribute data logical expression data corresponding to the user access request; it can be understood that the data logic module is mainly for digital numerical data, and for text attribute values, logical processing can also be used to convert text attribute values ​​into digital data. For digital numerical data, logical processing can be performed according to the interval to which the data belongs, whether it is greater than a preset value, whether it is less than a preset value, etc.

[0069] Based on the user access request attribute data after data logic processing, a matching analysis is performed with the access permission policy pre-stored in the access permission policy module to obtain the access permission inference result of the user access request.

[0070] In one embodiment, the policy management point PAP in the above step 3 is pre-designed with an attribute access control policy, and the generation process of the attribute access control policy includes: determining the order of different attributes in the attribute access control policy based on the importance of different attributes and the data distribution complexity of different attributes.

[0071] In the embodiment of the present application, the order of different attributes in the attribute access control policy is determined based on the importance of different attributes and the data distribution complexity of different attributes, that is, when the attribute access control policy is used to analyze whether the access right is granted based on the multi-dimensional attribute data of the real-time access request, the multi-dimensional attributes of the real-time access request are matched with the attributes in the attribute access control policy in turn to determine the attribute access control policy that meets the requirements. The order in which the attributes are considered is determined based on the combination of the importance of different attributes and the data distribution complexity of different attributes.

[0072] In one implementation, during the generation of the attribute access control policy, a method for obtaining the data distribution complexity of different attributes includes:

[0073] Step 301, based on historical access data, extract the multi-dimensional attributes and access request execution status in the access request of each access record as training samples;

[0074] Step 302, based on historical data, obtain the attribute value range corresponding to the same attribute, and determine the data distribution complexity of the attribute according to the attribute value range, and the complexity is determined based on the number of attribute value ranges and whether the boundaries between different values ​​are clear. Among them, the more the number of attribute value ranges, the greater the data distribution complexity, but if the number of original attribute value ranges is large, it should be noted that if the number of logically expressed values ​​after logical processing is small in order to correspond to the access permission policy in the access permission policy module, the data distribution complexity is large. Whether the boundaries between different values ​​are clear, for example, after the attribute values ​​of certain attributes are converted into logical expressions, multiple logical expressions may have a containment and inclusion relationship, an intersection relationship, etc., that is, the boundaries between different values ​​are not clear.

[0075] In one implementation, during the generation of the attribute access control policy, a method for obtaining the importance of different attributes includes:

[0076] Step 303: record the multi-dimensional attributes included in different access requests as an access request attribute set; the set includes attributes and corresponding attribute values;

[0077] Step 304, calculating the similarities of different access request attribute sets and the differences of access request execution conditions of the corresponding different access requests;

[0078] Step 305 : Determine the importance of the attribute based on the similarity of different access request attribute sets and the difference of access request execution conditions of the corresponding different access requests.

[0079] In the embodiment of the present application, the importance of the attribute is determined by considering the similarity of different access request attribute sets and the difference of the access request execution situations of the corresponding different access requests. For example, in one case, the number of attributes with the same attribute values ​​in multiple access request attribute sets is greater than a first preset value and the difference of the access request execution situations of the corresponding different access requests is greater than a second preset value, then the attributes with different attribute values ​​in the multiple access request attribute sets can be determined as important attributes. For a further example, the number of attributes with different attribute values ​​in the multiple access request attribute sets is only one, and the difference of the access request execution situations of the corresponding different access requests is determined by the attribute with different attribute values, then the attribute with different attribute values ​​is an important attribute. On the contrary, if the number of attributes with the same attribute values ​​in multiple access request attribute sets is greater than a first preset value and the difference of the access request execution situations of the corresponding different access requests is less than a third preset value, then the attributes with different attribute values ​​in the multiple access request attribute sets can be determined as unimportant attributes.

[0080] In one embodiment, in step 313, determining the importance of the attribute based on the similarity between different access request attribute sets and the difference between the access request execution conditions of the corresponding different access requests includes:

[0081] Step 3051: Based on the historical access data, an attribute access control analysis model is trained to output a binary classification result of whether access is allowed based on the multi-dimensional attributes in the access request as input, wherein the output result includes a probability value of allowing access and a probability value of not allowing access. When the probability value of allowing access is greater than the probability value of not allowing access, an access-allowed result is output; otherwise, an access-not allowed result is output;

[0082] Step 3052, based on different access request attribute sets, using the attribute access control analysis model, obtaining the access request target execution result;

[0083] Step 3053, selecting at least one attribute from all the attributes as an attribute combination, and sorting different attribute combinations from large to small according to the number of attributes in the combination;

[0084] Step 3054: According to the sorting of the attribute combinations, starting from the first attribute combination, according to the attributes in the attribute combination, for different access request attribute sets, multiple access request attribute sets whose attribute values ​​in the attribute combinations are the same are obtained and divided into a set; the second attribute combination is analyzed, and multiple access request attribute sets whose attribute values ​​in the attribute combinations are the same are obtained and divided into a set, wherein the access request attribute set obtained based on the second attribute combination belongs to the set obtained based on the first attribute combination or the access request attribute set obtained based on the second attribute combination does not belong to the set obtained based on the first attribute combination, and so on, to obtain sets corresponding to different attribute combinations;

[0085] Step 3055, for multiple access request attribute sets in a class set, one access request attribute set and the corresponding access request target execution result are used as reference data, and the remaining access request attribute sets and the corresponding access request target execution results are used as auxiliary data; based on the difference between the access request attribute set of the reference data and the access request attribute set in the auxiliary data, and the difference between the access request target execution result corresponding to the access request attribute set of the reference data and the access request target execution result corresponding to the access request attribute set of the reference data, linearly fit the importance of attributes of different dimensions to the access request target execution result.

[0086] When the number of access request attribute sets in the first set corresponding to the first attribute combination is less than a preset value, it is recorded that the first set corresponding to the first attribute combination is invalid;

[0087] It can be immediately understood that the number of attributes in the attribute combination cannot be too small, that is, not less than the second preset value.

[0088] The design of the attribute combination in the embodiment of the present application ensures that the attribute values ​​of several attributes in different access request attribute sets in a class of sets obtained are the same.

[0089] It can be understood that based on the reference data and auxiliary data in a class set, the importance of the remaining attributes outside the attribute combination to the access request target execution result can be obtained by linearly fitting the attribute values ​​of the attributes in the attribute combination corresponding to the class set. Different classes of sets obtained according to different attribute combinations can be linearly fitted according to the reference data and auxiliary data therein to obtain the importance of each attribute to the access request target execution result.

[0090] In one implementation, after the PDP performs access permission analysis using the policy administration point PAP based on the attribute request in step 3, the following steps are further included:

[0091] Step 32, further determining whether to allow the resource access request based on the stability of the user access environment and the security of the user access behavior; if allowed, determining to allow the resource access request.

[0092] In the embodiment of the present application, in view of the business security issues of the power company, after considering the permission analysis based on the attribute access control policy, the potential security risks of dynamic environmental changes and the user's personal access security are also considered to achieve more effective and secure dynamic control of terminal access rights. After using the policy management point PAP to perform permission policy analysis, if it is determined that the access request is allowed, it is further determined whether to allow the resource access request based on the stability of the user access environment and the security of the user access behavior; if allowed, it is determined to allow the resource access request.

[0093] In one implementation, in the above step 32, the method for obtaining the stability of the user access environment includes:

[0094] Step 3211, obtaining multi-dimensional attribute information of the access environment in the user's historical access request;

[0095] Step 3212, determining the stability of the attribute value of the environmental attribute based on the time series distribution of different attribute values ​​of the same environmental attribute, the stability of the attribute value of the environmental attribute is determined based on the diversity of the attribute value, the frequency of occurrence of different attribute values, and the number of times that the same attribute value continuously appears greater than a preset value within a sliding time window of a preset length, wherein the greater the diversity of the attribute value, the smaller the stability, the greater the frequency of occurrence of different attribute values, the greater the stability, and the greater the number of times that the same attribute value continuously appears greater than a preset value within a sliding time window of a preset length, the greater the stability;

[0096] Step 3213, fusing the attribute value stability results of different environmental attributes to comprehensively decide on the stability of the user access environment, wherein the fusing includes fusing the attribute value stability results of different environmental attributes based on the contribution of different environmental attributes to the stability of the user access environment.

[0097] In an embodiment of the present application, the stability of the user access environment is determined based on the diversity of attribute values, the frequency of occurrence of different attribute values, and the number of consecutive occurrences of the same attribute value greater than a preset value within a sliding time window of a preset length. It can be understood that the smaller the user access environment changes or is relatively fixed, the greater the user access security.

[0098] In one implementation, in the above step 32, the method for obtaining the security level of user access behavior includes:

[0099] Step 3221, based on the user's historical access behavior, obtain the user's illegal connection time series characteristics, attempted unauthorized behavior time series characteristics, and user connection failure time series characteristics, wherein the time series characteristics include the behavior occurrence frequency, the behavior occurrence frequency, and the behavior occurrence time distribution characteristics;

[0100] Step 3222, based on the fusion analysis of the user's illegal connection timing characteristics, the unauthorized attempt timing characteristics, and the user's connection failure timing characteristics, the user's access behavior security is obtained by nonlinear fitting or linear fitting of the relationship between the timing characteristics and the user's access behavior security.

[0101] Among them, the nonlinear fitting includes a fitting model obtained through sample training based on a neural network model;

[0102] Among them, linear fitting includes configuring corresponding importance coefficients based on the importance of different timing characteristics, and performing linear fitting based on the importance system; the linear fitting also includes attenuating the importance of behavior timing characteristics occurring at different times based on the time interval between the occurrence time of the behavior and the current time based on the timing characteristics of illegal connection of users, the timing characteristics of attempted unauthorized behavior, and the timing characteristics of user connection failure.

[0103] In the embodiment of the present application, the security of user access behavior is comprehensively considered from the user's illegal connection timing behavior data, the attempt to overauthorize timing behavior data, and the user's connection failure timing behavior data. If the frequency of these unsafe behaviors is greater, the number of times is greater, and they occur more recently, the user's access behavior security is lower. In the embodiment of the present application, the time distribution characteristics of the behavior occurrence may include the periodicity of the behavior, the regular characteristics of the time of occurrence of different lines, etc. It should be noted that if the linear fitting of the user's illegal connection timing characteristics, the attempt to overauthorize timing characteristics, and the user's connection failure timing characteristics are related to the security of the user's access behavior, the time of occurrence of each behavior needs to be considered during the linear fitting, and the recent unsafe behavior is more important for evaluating the security of the user's access behavior.

[0104] Specifically include:

[0105] For the time series characteristics of illegal user connections, time series characteristics of attempted unauthorized behaviors, and time series characteristics of user connection failures within time periods of different lengths from the current time, attenuation calculations are performed according to a preset time attenuation algorithm, wherein the preset time attenuation algorithm satisfies that the longer the time of the behavior is from the current time, the greater the attenuation degree;

[0106] The relationship between the user's illegal connection timing characteristics, the unauthorized attempt timing characteristics, and the user's connection failure timing characteristics after attenuation calculation and the user's access behavior security is linearly fitted to obtain the user's access behavior security.

[0107] The present application embodiment provides a terminal access rights analysis system based on a zero-trust ABAC model, the system comprising:

[0108] An access request obtaining unit, used to obtain a resource access request sent by a user terminal;

[0109] The multi-dimensional attribute extraction unit is used to receive a resource access request sent by a user terminal through a policy execution point PEP; based on the user request and in accordance with preset collection requirements, extract multi-dimensional attributes from the user request, convert the user request into an attribute request and send it to a policy decision point PDP; the attributes include user attributes, environment attributes, operation attributes, and object attributes;

[0110] The access permission analysis unit is used to perform access permission analysis using the policy management point PAP based on the attribute request through the PDP, obtain the access permission analysis result, and feed back the access permission analysis result to the PEP. The information fed back by the PDP to the PEP includes permission, rejection, not applicable, and unknown;

[0111] The access request execution unit is used to execute permission or prohibition of the resource access request according to the feedback information received from the PDP through the PEP.

[0112] For the specific limitations of the terminal access permission analysis system based on the zero-trust ABAC model, please refer to the limitations of the terminal access permission analysis method based on the zero-trust ABAC model above, which will not be repeated here. Each unit in the above-mentioned terminal access permission analysis system based on the zero-trust ABAC model can be implemented in whole or in part through software, hardware and a combination thereof. The above-mentioned units can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above-mentioned units.

[0113] The present invention is not limited to the above-mentioned specific implementation modes. Various changes made by ordinary technicians in this field based on the above-mentioned concepts without creative work are all within the protection scope of the present invention.

Claims

1. A terminal access rights analysis method based on a zero-trust ABAC model, characterized in that: include: The user terminal sends a resource access request; The policy enforcement point PEP receives the resource access request sent by the user terminal; Based on the user request and according to the preset collection requirements, extract multi-dimensional attributes from the user request, convert the user request into an attribute request and send it to the policy decision point PDP; The attributes include user attributes, environment attributes, operation attributes, and object attributes; Based on the attribute request, the PDP uses the policy management point PAP to perform access permission analysis, obtain the access permission analysis result, and feedback the access permission analysis result to the PEP. The information fed back by the PDP to the PEP includes permission, rejection, not applicable, and unknown; The PEP allows or prohibits the resource access request according to the feedback information received from the PDP.

2. The terminal access rights analysis method based on the zero-trust ABAC model according to claim 1 is characterized in that: The extracting of multi-dimensional attributes from the user request based on the user request according to the preset collection requirements includes: Extract keywords based on the current resource access request; Perform part-of-speech analysis and attribute type classification on keywords; Extracting multi-dimensional attributes according to a preset attribute path for a user access request; extracting multi-dimensional attributes according to a preset attribute path for a user access request includes: Based on user access requests, after word embedding, a multi-head self-attention mechanism is used to capture the dependency relationship of words at different positions in the access request. The multi-head attention result is transmitted to the decoding network through a feedforward neural network for decoding to obtain the descriptive features of the user access request. Based on the description features of the user access request, a corresponding preset attribute path is matched, and the multi-dimensional attributes in the user access request are extracted according to the matched preset attribute path.

3. The terminal access rights analysis method based on the zero-trust ABAC model according to claim 2 is characterized in that: The access permission analysis using the policy management point PAP includes: Obtain multi-dimensional attribute data of user access requests, input the preset access permission policy reasoning model for analysis, and obtain the user's access permission analysis results; The preset access permission policy inference model includes: an input module, a data logicization module, an access permission policy module, and an inference module. The inference module uses the multi-dimensional attribute data based on the user access request and the data logically processed by the data logicization module in combination with the access permission policy module to perform access permission inference.

4. The terminal access rights analysis method based on the zero-trust ABAC model according to claim 1 or 3 is characterized in that: The policy management point PAP is pre-designed with an attribute access control policy, and the generation process of the attribute access control policy includes: determining the order of different attributes in the attribute access control policy based on the importance of different attributes and the complexity of data distribution of different attributes.

5. The terminal access rights analysis method based on the zero-trust ABAC model according to claim 4 is characterized in that: Methods for obtaining data distribution complexity of different attributes include: Based on historical access data, extract the multi-dimensional attributes of the access request and the execution status of the access request in each access record as training samples; Based on historical data, the attribute value range corresponding to the same attribute is obtained, and the data distribution complexity of the attribute is determined according to the attribute value range. The complexity is determined based on the number of attribute value ranges and whether the boundaries between different values ​​are clear.

6. The terminal access rights analysis method based on the zero-trust ABAC model according to claim 4 is characterized in that: Methods for obtaining the importance of different attributes include: Recording the multi-dimensional attributes included in different access requests as an access request attribute set; the set includes attributes and corresponding attribute values; Calculating similarities of different access request attribute sets and differences in access request execution conditions of corresponding different access requests; The importance of the attribute is determined based on the similarity of different access request attribute sets and the difference of access request execution conditions of the corresponding different access requests.

7. The terminal access rights analysis method based on the zero-trust ABAC model according to claim 5 is characterized in that: The determining the importance of the attribute based on the similarity of different access request attribute sets and the difference of access request execution conditions of the corresponding different access requests includes: Based on historical access data, an attribute access control analysis model is trained to output a binary classification result of whether access is allowed based on the multi-dimensional attributes in the access request as input, wherein the output result includes a probability value of allowing access and a probability value of not allowing access. When the probability value of allowing access is greater than the probability value of not allowing access, an access-allowed result is output; otherwise, an access-not allowed result is output; Based on different access request attribute sets, using the attribute access control analysis model, obtaining the access request target execution result; Select at least one attribute from all attributes as an attribute combination, and sort different attribute combinations from largest to smallest according to the number of attributes in the combination; According to the sorting of the attribute combinations, starting from the first attribute combination, according to the attributes in the attribute combination, for different access request attribute sets, multiple access request attribute sets whose attribute values ​​in the attribute combinations are the same are obtained and divided into a set of categories; the second attribute combination is analyzed, and multiple access request attribute sets whose attribute values ​​in the attribute combinations are the same are obtained and divided into a set of categories, wherein the access request attribute set obtained based on the second attribute combination belongs to the set of categories obtained based on the first attribute combination or the access request attribute set obtained based on the second attribute combination does not belong to the set of categories obtained based on the first attribute combination; For multiple access request attribute sets in a class of sets, one access request attribute set and the corresponding access request target execution result are used as reference data, and the remaining access request attribute sets and the corresponding access request target execution results are used as auxiliary data; based on the difference between the access request attribute set of the reference data and the access request attribute set in the auxiliary data, and the difference between the access request target execution result corresponding to the access request attribute set of the reference data and the access request target execution result corresponding to the access request attribute set of the reference data, the importance of attributes of different dimensions to the access request target execution result is linearly fitted.

8. The terminal access rights analysis method based on the zero-trust ABAC model according to claim 1 is characterized in that: After the PDP uses the policy management point PAP to perform access permission analysis based on the attribute request, it also includes: further determining whether to allow the resource access request based on the stability of the user access environment and the security of the user access behavior; if allowed, determining to allow the resource access request.

9. The terminal access rights analysis method based on the zero-trust ABAC model according to claim 7 is characterized in that: The method for obtaining the stability of the user access environment includes: Obtain multi-dimensional attribute information of the access environment in the user's historical access requests; Determine the stability of the attribute value of the environmental attribute based on the time series distribution of different attribute values ​​of the same environmental attribute, and determine the stability of the attribute value of the environmental attribute based on the diversity of the attribute value, the frequency of occurrence of different attribute values, and the number of times that the same attribute value continuously appears greater than a preset value within a sliding time window of a preset length, wherein the greater the diversity of the attribute value, the smaller the stability, the greater the frequency of occurrence of different attribute values, the greater the stability, and the greater the number of times that the same attribute value continuously appears greater than a preset value within a sliding time window of a preset length, the greater the stability; The result of the stability of the attribute values ​​of different environmental attributes is integrated to comprehensively decide the stability of the user access environment. The integration includes integrating the result of the stability of the attribute values ​​of different environmental attributes based on the contribution of different environmental attributes to the stability of the user access environment.

10. The terminal access rights analysis method based on the zero-trust ABAC model according to claim 7 is characterized in that: The method for obtaining the security degree of user access behavior includes: Based on the user's historical access behavior, obtain the user's illegal connection time series characteristics, attempted unauthorized behavior time series characteristics, and user connection failure time series characteristics, the time series characteristics include the frequency of behavior occurrence, the frequency of behavior occurrence, and the time distribution characteristics of behavior occurrence; Based on the fusion analysis of the user's illegal connection timing characteristics, the timing characteristics of the attempted unauthorized behavior, and the user's connection failure timing characteristics, the user's access behavior security is obtained through nonlinear fitting or linear fitting of the relationship between the timing characteristics and the user's access behavior security. The nonlinear fitting includes a fitting model obtained through sample training based on a neural network model, and the linear fitting includes configuring corresponding importance coefficients based on the importance of different timing characteristics, and performing linear fitting based on the importance system; the linear fitting also includes attenuating the importance of the behavior timing characteristics occurring at different times based on the time interval between the behavior occurrence time and the current time based on the user's illegal connection timing characteristics, the attempt to unauthorized behavior timing characteristics, and the user's connection failure timing characteristics.

11. A terminal access rights analysis system based on a zero-trust ABAC model, characterized in that: include: An access request obtaining unit, used to obtain a resource access request sent by a user terminal; A multi-dimensional attribute extraction unit, configured to receive a resource access request sent by a user terminal through a policy enforcement point PEP; Based on the user request and according to the preset collection requirements, extract multi-dimensional attributes from the user request, convert the user request into an attribute request and send it to the policy decision point PDP; the attributes include user attributes, environment attributes, operation attributes, and object attributes; The access permission analysis unit is used to perform access permission analysis using the policy management point PAP based on the attribute request through the PDP, obtain the access permission analysis result, and feed back the access permission analysis result to the PEP. The information fed back by the PDP to the PEP includes permission, rejection, not applicable, and unknown; The access request execution unit is used to execute permission or prohibition of the resource access request according to the feedback information received from the PDP through the PEP.

Images