Artificial intelligence-based data zero-trust authentication method and system

Abstract

This invention discloses an AI-based zero-trust authentication method and system. It utilizes LDA topic modeling to obtain request tags corresponding to access requests, dynamically calculates security values ​​for users, terminals, and the external environment, and uses a collaborative filtering recommendation algorithm to recommend corresponding zero-trust security services. Simultaneously, it authenticates data resource access requests and establishes a corresponding secure communication channel, enabling data resource transmission through this secure communication channel. Compared to traditional data sharing methods, this invention not only provides support technology for zero-trust access through dynamic calculation of security values, effectively improving the security of data sharing, but also uses a collaborative filtering recommendation algorithm to quickly and accurately provide zero-trust security services for access requests. This effectively enhances the security of data resources during the sharing process, reduces the possibility of data leakage, and better meets the needs of enterprises.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a data zero-trust authentication method and system based on artificial intelligence. BACKGROUND

[0002] Network security has experienced more than 40 years of development, from the earliest firewall and antivirus technology to the dozens of network security protection technologies that have been developed so far, which have jointly built a network security protection system for enterprises. However, the development of network security technology in the past 40 years has not brought new ideas or improvements to the current network security technology architecture and concept. The current network security protection system takes the boundary as the core and uses in-depth protection as the means for continuous security construction. The risk of implicit trust and the defects of the TCP / IP protocol make the traditional network security protection technology insufficient in the new network environment, such as cloud computing, big data, artificial intelligence, 5G and IOT, and unable to provide more reliable security protection technology and architecture for enterprises.

[0003] With the continuous rise of emerging technologies such as cloud computing, big data, and the Internet of Things, enterprise IT architecture is changing from "bordered" to "borderless", and the traditional security boundary is gradually collapsing. With the continuous advancement of new infrastructure represented by 5G and industrial internet, the evolution process of "borderless" will be further accelerated. At the same time, zero-trust security is gradually entering people's field of vision and becoming a new concept and architecture to solve network security problems in the new era. However, with the continuous development of information communication technology, fast and efficient sharing of information resources is increasingly demanded by the market.

[0004] Currently, resource data sharing is usually used to share information resource data, which can effectively increase the interaction of resources and fully play the role of resource value. In the existing related technology, for part of the data that needs to be disclosed, although it is in a secret state before the decision to disclose; but in the process of resource interaction, the data in the secret state will be leaked due to the low security of sharing the secret, so that the confidentiality of the data cannot be fully guaranteed. SUMMARY

[0005] The purpose of the present application is to solve the problems existing in the prior art and provide a data zero-trust authentication method and system based on artificial intelligence.

[0006] Technical solution: The data zero-trust authentication method based on artificial intelligence comprises the following steps:

[0007] S1, receiving a data resource access request sent by a terminal, and extracting a request label corresponding to the data resource access request by using an LDA topic model;

[0008] S2, calculating a communication security value based on a terminal network security trustworthiness value, a user network security trustworthiness value, and an external environment security value;

[0009] S3, recommending a corresponding zero-trust security service for the data resource access request using a collaborative filtering recommendation algorithm;

[0010] S3.1, obtaining historical data in the zero-trust security service corresponding to the data resource access request;

[0011] S3.2, calculating the similarity between the data resource access request and the historical data resource access requests;

[0012] S3.3, calculating a recommendation value based on the similarity, and then sorting to generate a recommendation data set;

[0013] S3.4, selecting the zero-trust security service with the largest recommendation value in the recommendation data set as the corresponding zero-trust security service recommended for the data resource access request; the zero-trust security service includes at least one of authentication service, approval service, or authorization service, and corresponding preset configuration rules;

[0014] S4, performing authentication processing on the data resource access request based on the zero-trust security service obtained in step S3, and establishing a corresponding secure communication channel;

[0015] S5, sending the data resource corresponding to the data resource access request to the terminal using the secure communication channel obtained in step S4.

[0016] Further, the specific process of step S1 is as follows:

[0017] S1.1, obtaining data resource access requests in historical data and performing text labeling; the historical data is obtained from a log server, and the text information includes various feature information such as users, devices, and access situations;

[0018] S1.2, cleaning and preprocessing a plurality of text labeled data (including data word segmentation, removing empty data / invalid data, removing words without emotional meaning, and removing duplicate data), and dividing the processed text labeled data into a data training set and a data test set;

[0019] S1.3, inputting the data training set into an LDA topic model for training, and testing and verifying the trained LDA topic model using the data test set, to obtain a trained LDA topic model;

[0020] S1.4, using the trained LDA topic model to analyze and obtain request labels corresponding to the data resource access request.

[0021] Further, the specific process in step S2 is:

[0022] S2.1, automatically collecting, analyzing and calculating the security status data of the terminal through the terminal agent, and analyzing the security trust measurement value of the terminal network according to the data calculation and evaluation method;

[0023] S2.2, analyzing the security trust measurement value of the user network security by calculating and evaluating the user information;

[0024] S2.3, calculating the security value of the external environment by combining the network security data with the environmental status analysis;

[0025] S2.4, calculating the sum of the security trust measurement value of the terminal network, the security trust measurement value of the user network security and the security value of the external environment to obtain the communication security value:

[0026] S2.5, judging whether the obtained communication security value is greater than the pre-set security threshold value, if yes, executing step S3, if not, prompting that the network security is low, and terminating the service.

[0027] Further, the detailed content of step S3.2 is as follows:

[0028] First, the LDA topic model trained in step S1 is used to obtain the historical request label of the data resource access request in the historical data;

[0029] Then, the cosine similarity algorithm is used to calculate the similarity cos (θ) between the request label obtained in step S1 and the historical request label:

[0030]

[0031] In the above formula, x i represents the request label vector, y i represents the historical request label vector, n represents the number of request labels, i takes the value of 0 to n, x i and y i are measured by 0 and 1 corresponding to the attribute value.

[0032] Further, the detailed content of step S3.3 is as follows:

[0033] First, the recommendation value p of a certain zero trust security service for the current data resource access request is calculated, and the calculation formula is as follows:

[0034]

[0035] In the formula, sim (u, u i ) is the similarity between the current data resource access request u and the historical access request u iSimilarity of the request input i to the zero-trust security service group (the calculation method and formula are the same as cos(θ)), r i is the average evaluation of the access request input i to the zero-trust security service group, is the average evaluation of the access request input i to the zero-trust security service; n represents the number of labels;

[0036] Finally, the recommended values p are sorted from large to small, and the top preset number of zero-trust security services are selected according to the sorting to generate a recommended data set.

[0037] Further, the detailed process of step S4 is as follows:

[0038] If the authentication service is included in the zero-trust security service obtained in S3, the data resource access request is processed according to the configuration rule to obtain the pass or fail result;

[0039] If the approval service is included in the zero-trust security service obtained in S3, the approval service processing is performed according to the configuration rule to obtain the pass or fail result;

[0040] If the authorization service is included in the zero-trust security service obtained in S3, the authorization service processing is performed according to the configuration rule to obtain the pass or fail result;

[0041] In the authentication processing of the above three cases, if there is a fail result, an error return message is sent to the terminal; if there is no fail result, all authentication processing is passed.

[0042] The application also discloses a system for implementing the data zero-trust authentication method based on artificial intelligence, comprising a request label extraction module, a communication security value calculation module, a zero-trust security service recommendation module, a secure communication channel establishment module and a data resource transmission module connected in sequence.

[0043] Firstly, the request label extraction module receives the data resource access request sent by the terminal, and uses the LDA topic model to extract the request label corresponding to the resource data access request;

[0044] Secondly, the communication security value calculation module obtains the security and trust measurement value based on the terminal network, the security and trust measurement value of the user network security and the security value of the external environment, and further calculates the communication security value;

[0045] Then, the zero-trust security service recommendation module uses the collaborative filtering recommendation algorithm to recommend the corresponding zero-trust security service for the data resource access request;

[0046] Then, the secure communication channel establishment module performs authentication processing on the data resource access request based on the obtained zero-trust security service, and establishes the corresponding secure communication channel;

[0047] Finally, the data resource transmission module transmits the data resource corresponding to the data resource access request to the terminal through the obtained secure communication channel.

[0048] Beneficial effects: the application obtains the request label corresponding to the access request by using the LDA topic model, calculates the security values of the user, terminal and external environment for dynamic calculation, and recommends the corresponding zero-trust security service by using the collaborative filtering recommendation algorithm, authenticates the data resource access request and establishes the corresponding secure communication channel, so that the transmission of the data resource can be realized based on the secure communication channel; compared with the traditional data sharing mode, the application not only can provide support technology for zero-trust access by using the dynamic calculation of the security value, effectively improve the security of data sharing, but also can quickly and accurately provide zero-trust security service for the access request by using the collaborative filtering recommendation algorithm, so as to effectively improve the security of the data resource in the sharing process, reduce the possibility of data resource leakage, and better meet the use demand of enterprises. BRIEF DESCRIPTION OF DRAWINGS

[0049] Figure 1 The figure is a schematic diagram of the arrangement process of the application. DETAILED DESCRIPTION

[0050] The technical scheme of the application will be described in detail below, but the protection scope of the application is not limited to the embodiments.

[0051] Compared with other prior art schemes, the advantages of the application are that the storage and calculation of data are carried out in the secure computing environment, and the computing environment is completely managed and controlled by the enterprise. The enterprise data can be flexibly stored and calculated in the environment, but the data in the environment cannot be stolen in the terminal running state or the terminal closed state, that is, the data can be used in the environment through various application programs, but cannot be separated from the secure computing environment. All computing processes in the secure computing environment are monitored by the enterprise, including but not limited to file operation, network behavior, program start and stop, hardware peripheral use, etc. After the enterprise completes the construction of the secure computing environment, the data can be safely placed in the secure environment. The secure computing environment supports various application programs to use and process the data in various scenarios without sacrificing performance. At the same time, the secure computing environment and the local environment of the terminal are in a deep isolation state, which guarantees the security of data storage and calculation, and realizes lightness and flexibility, and ensures the efficiency of program execution.

[0052] As shown in the figure, the data zero-trust authentication method based on artificial intelligence of the embodiment comprises the following steps. Figure 1

[0053] ​Step S1, receiving a data resource access request sent by a terminal, and extracting a request label corresponding to the access request by using an LDA topic model

[0054] Firstly, data resource access requests in historical data are obtained and text labeling is performed; the obtained text labeling data are cleaned and preprocessed, and the processed text labeling data are divided into a data training set and a data test set;

[0055] Then, the data training set is input into an LDA topic model for training, and the data test set is used to test and verify the LDA topic model, so as to obtain a trained LDA topic model;

[0056] Finally, the trained LDA topic model is used to analyze a request label corresponding to a current data resource access request.

[0057] Step S2, calculating a communication security value based on a security and trust measurement value of a terminal network, a security and trust measurement value of user network security, and a security value of an external environment

[0058] In this embodiment, binary classification machine learning algorithms are used for the three groups of features of the terminal, the user and the external environment, and the results are accessible and inaccessible, represented by 1 and 0. If the sum of the three groups of features is greater than 1, the condition is met; otherwise, it is not met, and then the corresponding security and trust measurement value, security and trust measurement value and security value are obtained. The specific content is as follows:

[0059] Firstly, the security status data of the terminal are automatically collected, analyzed and calculated by the terminal agent, and the security and trust measurement value of the terminal network is obtained by analyzing the data calculation and evaluation method;

[0060] Secondly, the security and trust measurement value of user network security is obtained by calculating and evaluating user information;

[0061] Thirdly, the security value of the external environment is obtained by analyzing and calculating the network security data combined with the environmental status;

[0062] Then, the sum of the security and trust measurement value of the terminal network, the security and trust measurement value of user network security and the security value of the external environment is calculated to obtain a communication security value;

[0063] Finally, it is judged whether the obtained communication security value meets a pre-set security threshold. If yes, step S3 is executed; if not, it is prompted that the network security is low, and the service is terminated.

[0064] Step S3, using a collaborative filtering recommendation algorithm to recommend a corresponding zero-trust security service for the data resource access request

[0065] (1) obtaining historical data in the zero-trust security service corresponding to the current data resource access request;

[0066] (2) calculating the similarity of the data resource access request and the data resource access request in the historical data;

[0067] First, the pre-constructed LDA topic model is used to obtain the historical request label of the data resource access request in the historical data;

[0068] Then, the cosine similarity algorithm is used to calculate the similarity cos(θ) between the request label and the historical request label;

[0069]

[0070] (3) sorting according to the similarity calculation result to generate a recommended data set;

[0071] First, calculate the recommendation value p of the current data resource access request for a certain zero-trust security service:

[0072]

[0073] Then, sort the obtained recommendation values from large to small, and select the top pre-set number of zero-trust security services to generate a recommended data set;

[0074] (4) obtaining the recommendation value of the pre-set data in the recommended data set; selecting the zero-trust security service with the largest recommendation value to match the data resource access request.

[0075] Step S4, based on the zero-trust security service, the data resource access request is authenticated and processed, and the corresponding secure communication channel is established

[0076] If the zero-trust security service obtained in S3 contains an authentication service, the data resource access request is processed according to the configuration rules, and the pass or fail result is obtained;

[0077] If the zero-trust security service obtained in S3 contains an approval service, the approval service processing is performed according to the configuration rules, and the pass or fail result is obtained;

[0078] If the zero-trust security service obtained in S3 contains an authorization service, the authorization service processing is performed according to the configuration rules, and the pass or fail result is obtained;

[0079] In the authentication processing of the above three cases, if there is a fail result, an error return message is sent to the terminal; if there is no fail result, all authentication processes are passed;

[0080] Then, the security communication channel establishment module authenticates the data resource access request based on the obtained zero-trust security service and establishes a corresponding security communication channel; this channel is established one by one, and a channel is established through authentication.

[0081] Step S5, sending the data resource corresponding to the data resource access request to the terminal through the established security communication channel

[0082] First, the terminal and the data resource are monitored in real time according to a preset monitoring rule;

[0083] Then, in the case that the parameters of the terminal or the data resource change, the security communication channel between the terminal is disconnected.

[0084] The artificial intelligence-based data zero-trust authentication system of the embodiment comprises a request label extraction module, a communication security value calculation module, a zero-trust security service recommendation module, a security communication channel establishment module and a data resource transmission module connected in sequence. First, the request label extraction module receives the data resource access request sent by the terminal, and extracts the request label corresponding to the resource data access request by using the LDA topic model. Second, the communication security value calculation module obtains the security trust measurement value based on the terminal network, the security trust measurement value of the user network security and the security value of the external environment, and then calculates the communication security value. Third, the zero-trust security service recommendation module recommends the corresponding zero-trust security service for the data resource access request by using the collaborative filtering recommendation algorithm. Fourth, the security communication channel establishment module authenticates the data resource access request based on the obtained zero-trust security service and establishes a corresponding security communication channel. Finally, the data resource transmission module sends the data resource corresponding to the data resource access request to the terminal through the obtained security communication channel.

[0085] In embodiment 2, the request label {network port, protocol, device model, system version, etc.} of the data resource access request is obtained, the security trust of the terminal is calculated according to the LDA model, the trust of the user is calculated according to the user information {access time, IP, access record, new device, etc.}, the security value is calculated according to the external environment information {gateway, access traffic, abnormal situation, etc.}, the communication security value is obtained by summing up the three measurements, if it is lower than the set threshold, the access is rejected, if it is higher than the threshold, the collaborative filtering recommendation value with the historical data is further calculated, then the recommendation value of the historical label and the current label of the access request is calculated, sorted, a preset number of zero-trust security services are selected, and corresponding security communication channels are established.

[0086] To sum up, by means of the above technical scheme of the present application, the request label corresponding to the access request is obtained by using the LDA topic model, the security values of the user, the terminal and the external environment are calculated for dynamic calculation, and the corresponding zero-trust security service is recommended by using the collaborative filtering recommendation algorithm, and the data resource access request is authenticated and the corresponding security communication channel is established, so that the transmission of the data resource can be realized based on the security communication channel; compared with the traditional data sharing mode, the present application not only can provide support technology for zero-trust access by using the dynamic calculation of the security value, effectively improving the security during data sharing, but also can quickly and accurately provide zero-trust security service for the access request by using the collaborative filtering recommendation algorithm, so as to effectively improve the security of the data resource in the sharing process, reduce the possibility of data resource leakage, and better meet the use demand of enterprises.

Claims

1. An artificial intelligence-based data zero-trust authentication method, characterized in that: The method comprises the following steps: S1, receiving the data resource access request sent by the terminal, and extracting the request label corresponding to the data resource access request by using the LDA topic model; S1.1, obtaining data resource access requests in historical data and performing text labeling; S1.2, cleaning and preprocessing a plurality of text labeled data, and dividing the processed text labeled data into a data training set and a data test set; S1.3, inputting the data training set into the LDA topic model for training, and testing and verifying the trained LDA topic model using the data test set, to obtain the trained LDA topic model; S1.4, using the trained LDA topic model to analyze and obtain the request label corresponding to the data resource access request; S2, calculating a communication security value based on a security and trust measurement value of a terminal network, a security and trust measurement value of user network security, and a security value of an external environment; S3, recommending a corresponding zero-trust security service for the data resource access request by using a collaborative filtering recommendation algorithm; S3.1, obtaining historical data in the zero-trust security service corresponding to the data resource access request; S3.2, calculating the similarity between the data resource access request and the data resource access request in the historical data, the details being as follows: First, use the trained LDA topic model in step S1 to obtain the historical request label of the data resource access request in the historical data; Then, use the cosine similarity algorithm to calculate the similarity cos(θ) between the request label obtained in step S1 and the historical request label: In the above formula, x i represents a request label vector, y i represents a historical request label vector, n represents the number of request labels, i takes values from 0 to n, x i and y i are both measured by 0 and 1 for corresponding attribute values; S3.3, calculating a recommendation value according to the similarity, and then sorting to generate a recommended data set; The details are as follows: First, calculate the recommendation value p of a certain zero-trust security service for the current data resource access request, the calculation formula being as follows: where sim(u, u i ) is the similarity of the current data resource access request u and the historical access request u i , r i is the average evaluation of the access request input i to the zero-trust security service group, and is the average evaluation of the access request input i to the zero-trust security service. Finally, sort the recommendation values p from large to small, and select the top pre-set number of zero-trust security services according to the sorting to generate a recommended data set; S3.4, selecting the zero-trust security service with the largest recommendation value in the recommended data set as the zero-trust security service corresponding to the data resource access request; The zero-trust security service at least includes one of authentication service, approval service or authorization service, and corresponding pre-set configuration rules; S4, performing authentication processing on the data resource access request based on the zero-trust security service obtained in step S3, and establishing a corresponding secure communication channel; S5, sending the data resource corresponding to the data resource access request to the terminal by using the secure communication channel obtained in step S4.

2. The artificial intelligence-based data zero-trust authentication method of claim 1, wherein: The specific process in step S2 is as follows: S2.1, automatically collecting, analyzing and calculating the security status data of the terminal through the terminal agent, and obtaining the security and trust measurement value of the terminal network according to the data calculation and evaluation method; S2.2, obtaining the security and trust measurement value of user network security by calculating and evaluating user information; S2.3, obtaining the security value of the external environment by analyzing and calculating the network security data combined with the environmental status; S2.4, calculating the sum of the security and trust measurement value of the terminal network, the security and trust measurement value of user network security, and the security value of the external environment to obtain the communication security value: S2.5, judging whether the obtained communication security value is greater than a preset security threshold value, if yes, executing step S3, if no, prompting that the network security is low, and terminating the service. 3.The artificial intelligence-based data zero-trust authentication method of claim 1, wherein: The detailed process of the step S4 is: If the obtained zero-trust security service in S3 contains an authentication service, the data resource access request is processed according to the configuration rule to obtain a pass or fail result; If the obtained zero-trust security service in S3 contains an approval service, the approval service processing is performed according to the configuration rule to obtain a pass or fail result; If the obtained zero-trust security service in S3 contains an authorization service, the authorization service processing is performed according to the configuration rule to obtain a pass or fail result; In the authentication processing of the above three cases, if there is a fail result, an error return message is sent to the terminal; If there is no fail result, all authentication processing is passed.

4. A system for implementing the artificial intelligence-based data zero-trust authentication method of any one of claims 1 to 3, characterized in that: The method comprises the steps of: receiving the data resource access request sent by the terminal through the request label extraction module, and extracting the request label corresponding to the data resource access request by using the LDA topic model; Secondly, the communication security value calculation module is used to obtain the security and trust measurement value based on the terminal network, the security and trust measurement value of the user network security and the security value of the external environment, and then the communication security value is calculated; Next, the zero-trust security service recommendation module uses the collaborative filtering recommendation algorithm to recommend the corresponding zero-trust security service for the data resource access request; Then, the security communication channel establishment module performs authentication processing on the data resource access request based on the obtained zero-trust security service, and establishes the corresponding security communication channel; Finally, the data resource transmission module sends the data resource corresponding to the data resource access request to the terminal by using the obtained security communication channel. ​

Images