A subject trust degree dynamic evaluation system based on a fuzzy inference zero trust system

Abstract

A kind of fuzzy inference-based zero trust system subject trust degree dynamic evaluation system, the fuzzy class and membership degree initialization module is calculated according to the preset classification and membership degree function, and the fuzzy class and corresponding membership degree of subject information are obtained;Session security fuzzy reasoning module calculates the subject session security fuzzy class by fuzzy reasoning;The session security value of session security fuzzy class is calculated by de-fuzzification through zero trust session security calculation module;Through zero trust subject credit dynamic adjustment module, the comprehensive security value is compared with the requirement of user application resource, and access credentials are issued for user according to the comparison result, and trust degree reward and punishment are carried out on it in the security risk and high-risk operation in the process of user access.The present application introduces fuzzy inference mechanism into zero trust architecture, processes quantitative security elements;Effectively introduce the historical data of access subject trust degree into trust evaluation as trust benchmark, and realize dynamic adjustment of its trust degree according to the security of user access process, realize the dynamic adjustment and quantitative evaluation of zero trust system access security.

Description

Technical Field

[0001] This invention relates to a technology in the field of information security, specifically a dynamic assessment system for subject trust in a zero-trust system based on fuzzy reasoning. Background Technology

[0002] Currently, the architecture of zero-trust systems is receiving increasing attention in domestic and international research. Existing trust assessment methods for zero-trust systems mainly focus on the trust judgment process of a single access subject. On the one hand, they cannot effectively solve the problem of measuring quantitative security factors, and on the other hand, the assessment process is not combined with the historical trust situation of the access subject, resulting in a lack of sustainability in the assessment results. Summary of the Invention

[0003] This invention addresses the shortcomings of existing zero-trust assessment technologies, which fail to provide quantitative assessment results due to the lack of integration with the historical trust data of the accessing subject. It proposes a dynamic assessment system for the subject's trust level in a zero-trust system based on fuzzy reasoning. This system introduces fuzzy reasoning mechanisms into the zero-trust architecture to handle quantitative security elements. It effectively incorporates historical trust data of the accessing subject into the trust assessment as a trust benchmark, and dynamically adjusts the trust level based on the security dynamics of the user's access process, thereby achieving dynamic adjustment and quantitative assessment of access security in the zero-trust system.

[0004] This invention is achieved through the following technical solution:

[0005] This invention relates to a dynamic assessment system for subject trust in a zero-trust system based on fuzzy reasoning, comprising: a fuzzy class and membership initialization module, a session security fuzzy reasoning module, a zero-trust session security calculation module, and a zero-trust subject trust dynamic adjustment module. Specifically: the fuzzy class and membership initialization module calculates the fuzzy class and corresponding membership degree of the subject information based on a preset classification and membership function; the session security fuzzy reasoning module calculates the subject's session security fuzzy class through fuzzy reasoning; the zero-trust session security calculation module defuzzifies the session security fuzzy class and calculates its session security value; and the zero-trust subject trust dynamic adjustment module compares the comprehensive security value with the user's resource request requirements, issues access credentials to the user based on the comparison results, and rewards or punishes the user's trust level for security risks and high-risk operations during the user's access process.

[0006] This invention relates to a dynamic trust assessment method based on fuzzy reasoning for the aforementioned system, comprising the following steps:

[0007] Step 1) Based on the user, device, and program information, initialize the fuzzy class of the access subject to obtain the security fuzzy class and membership degree of the user, device, and program;

[0008] Step 2) Based on the security fuzzy classes of users, devices, and programs, perform reasoning based on session fuzzy class rules to obtain the session fuzzy classes and their membership degrees;

[0009] Step 3) Calculate the session security level based on the fuzzy classification result and membership degree of the user's request to initiate the session, and obtain the defuzzified comprehensive session security value;

[0010] Step 4) Based on the user's current trust level and the alarm information from the zero-trust security module, dynamically adjust the trust level to obtain the trust level after dynamically rewarding or punishing the user's trust level.

[0011] Technical effect

[0012] This invention introduces historical trust data of users into the trust assessment process of access subjects in zero-trust systems, and dynamically adjusts the user subject trust level based on the security status of the access process. By fuzzing quantitative user subject trust level, device security information, and application security information, and using fuzzy inference rules, the invention achieves a quantitative assessment of access security in zero-trust systems, thereby improving the accuracy of the security assessment results of zero-trust systems in a quantitative form. Attached Figure Description

[0013] Figure 1 This is a flowchart of the present invention;

[0014] Figure 2 This is a schematic diagram of the instance relationship in the zero-trust system of the present invention;

[0015] Figure 3 The graph shows the change in experimental data for the dynamic evaluation of trust levels among users with zero trust. Detailed Implementation

[0016] like Figure 1 As shown in the illustration, this embodiment relates to a zero-trust subject security dynamic assessment system based on fuzzy reasoning, comprising: a fuzzy class and membership initialization module, a session security fuzzy reasoning module, a zero-trust session security calculation module, and a zero-trust subject trust dynamic adjustment module. Specifically: the fuzzy class and membership initialization module calculates the fuzzy class and corresponding membership degree of the subject information based on a preset classification and membership function; the session security fuzzy reasoning module calculates the subject's session security fuzzy class through fuzzy reasoning; the zero-trust session security calculation module defuzzifies the session security fuzzy class and calculates its session security value; the zero-trust subject trust dynamic adjustment module compares the comprehensive security value with the user's resource application requirements, issues access credentials to the user based on the comparison results, and rewards or punishes the user's trust level for security risks and high-risk operations during the user's access process.

[0017] The fuzzy class and membership initialization module includes: a user trust fuzzification unit, a device security fuzzification unit, and an application security fuzzification unit. Specifically: the user trust fuzzification unit performs fuzzification processing on user trust data using its membership function to obtain the fuzzy class and membership degree of user trust; the device security fuzzification unit performs fuzzification processing on device security data using its membership function to obtain the fuzzy class and membership degree of device security; and the application security fuzzification unit performs fuzzification processing on application security data using its membership function to obtain the fuzzy class and membership degree of application security.

[0018] The session security fuzzy inference module includes a session security fuzzy inference unit and a session security fuzzy class membership degree calculation unit. The session security fuzzy inference unit performs fuzzy inference according to the fuzzy inference rule set based on the information output by the fuzzy class and membership degree initialization module to obtain the session security fuzzy category. The session security fuzzy class membership degree calculation unit processes the membership degrees of user trust, device security, and application security according to the minimum value method to obtain the membership degree of the session security fuzzy class.

[0019] The zero-trust session security calculation module includes a session security fuzzy membership degree merging unit and a session security degree calculation unit. The session security fuzzy membership degree merging unit, based on the output of the fuzzy inference module, compares the membership degree values ​​of different session security fuzzy classes and sums them to obtain the overall membership degree of different session security fuzzy classes. The session security degree calculation unit processes the session security fuzzy classes and their overall membership degrees using the centroid calculation method to obtain a quantitative result of the session security degree.

[0020] The zero-trust subject credit dynamic adjustment module includes: a user normalized trust calculation unit, a user trust reward unit, and a user trust penalty unit. Specifically: the user normalized trust calculation unit retrieves the current user trust value, the maximum and minimum historical trust values, and performs minimax normalization to obtain the user normalized trust value. The user trust reward unit calculates the trust reward value obtained by the user upon successful access based on the obtained user normalized trust value and adds this reward value to the current trust value to obtain the dynamically adjusted user trust value. The user trust penalty unit calculates the trust penalty value for a user failing to obtain access or encountering risks during the access process based on the obtained user normalized trust value and subtracts this penalty value from the current trust value to obtain the dynamically adjusted user trust value.

[0021] like Figure 2As shown, this embodiment uses three user entities, user1, user2, and user3, as examples. user1 uses app1 and device1 to access resource1. app1 is verified by the system, and due to its older version, its security level is set to 50. Based on historical interactions, user1's trust level is set to 60. device1, as an intranet device, has its security level set to 100. The requested security level for resource1 is 50. user2 uses app2 and device2 to access resource1. The requested security level for resource1 is 50. app2 is verified by the system, and due to its older version, its security level is set to 50. Based on historical interactions, user2's trust level is set to 80, with its highest historical trust level being 85 and its lowest being 20. device2, as an intranet device, has its security level set to 100. user3 uses app3 and device3 to access resource2. The requested security level for resource2 is 30. app3 is verified by the system and its security level is set to 100. Based on historical interaction data, user3's trust level is set to 75, with its highest historical trust level being 90 and its lowest being 20. device3, as an internal network device, has its security level set to 100.

[0022] This embodiment relates to a dynamic trust assessment method based on fuzzy reasoning for the above-mentioned system, including the following steps:

[0023] Step 1) Based on user, device, and program information, initialize the fuzzy class of the access subject to obtain the security fuzzy class and membership degree of the user, device, and program. This invention divides user security into three categories: low, medium, and high, representing low, medium, and high security of the user subject, respectively; divides device security into two categories: unsafe and safe, representing insecure and secure, respectively; and divides program security into two categories: unsafe and safe, representing insecure and secure, respectively.

[0024] Step 1 specifically includes:

[0025] Step 1.1) Calculate the user's fuzzy trust category and membership degree based on the user's trust level, specifically:

[0026] Where: x represents the user's trust level, which is within a closed interval from 0 to 100.

[0027] Specifically, based on this embodiment, the security fuzzy classes for user1 are "medium" and "high," with a membership degree of 0.8 for "medium" and 0.2 for "high." The security fuzzy classes for user2 are also "medium" and "high," with a membership degree of 0.4 for "medium" and 0.6 for "high." The security fuzzy classes for user3 are also "medium" and "high," with a membership degree of 0.5 for both "medium" and "high."

[0028] Step 1.2) Calculate and obtain the fuzzy safety class and membership degree of the equipment based on its safety level, specifically:

[0029] Where: x is the safety level of the equipment, and the safety level ranges from 0 to 100 within a closed interval.

[0030] Specifically, based on this embodiment, the security fuzzy class of device1 is the safe class with a membership degree of 1. The security fuzzy class of device2 is the safe class with a membership degree of 1. The security fuzzy class of device3 is the safe class with a membership degree of 1.

[0031] Step 1.3) Based on the program's security level, calculate and obtain the program's fuzzy security class and membership degree, specifically:

[0032] Where: x is the security level of the application, and the security level is within a closed interval from 0 to 100.

[0033] Specifically, based on this embodiment, the security fuzzy class of app1 is divided into two categories: unsafe and safe. The membership degree of unsafe is 0.5, and the membership degree of safe is 0.5. The security fuzzy class of app2 is divided into two categories: unsafe and safe. The membership degree of unsafe is 0.5, and the membership degree of safe is 0.5. The security fuzzy class of app3 is safe, with a membership degree of 1.

[0034] Step 2) Based on the security fuzzy classes of users, devices, and programs, perform reasoning based on session fuzzy class rules to obtain session fuzzy classes and their membership degrees.

[0035] The aforementioned session fuzzy class rules include UserClass, DevClass, and AppClass, which are fuzzy classes for users, devices, and programs, respectively, and SessionClass, which is the security class for users to request and initiate sessions, as shown in Table 1.

[0036] Table 1. Set of rules for fuzzy reasoning in conversations

[0037]

[0038] Step 2 specifically includes:

[0039] Step 2.1) Combine the fuzzy classes of the current access subject triplet, namely UserClass, DeviceClass, and AppClass, select fuzzy rules from the session fuzzy class inference rule set, perform fuzzy inference, and obtain the corresponding session fuzzy classification result (SessionClass).

[0040] For example, for the session requested by user1, based on Table 1, four rule-based reasoning relationships can be obtained:

[0041] The user's security class is medium, the device's security class is safe, and the program's security class is unsafe. In this case, the session belongs to the unsafe class.

[0042] The user's security class is medium, the device's security class is safe, the program's security class is safe, and the session belongs to the unsafe class.

[0043] The user's security class is high, the device's security class is safe, and the program's security class is unsafe. In this case, the session belongs to the safe class.

[0044] The user's security class is high, the device's security class is safe, the program's security class is safe, and the session belongs to the safe class.

[0045] Based on the above categories, four inference rules can be derived regarding user2's access:

[0046] The user's security class is medium, the device's security class is safe, and the program's security class is unsafe. In this case, the session belongs to the unsafe class.

[0047] The user's security class is medium, the device's security class is safe, the program's security class is safe, and the session belongs to the unsafe class.

[0048] The user's security class is high, the device's security class is safe, and the program's security class is unsafe. In this case, the session belongs to the safe class.

[0049] The user's security class is high, the device's security class is safe, the program's security class is safe, and the session belongs to the safe class.

[0050] For user3's access, based on the above categories, two rule-based inference relationships can be obtained:

[0051] The user's security class is medium, the device's security class is safe, the program's security class is safe, and the session belongs to the unsafe class.

[0052] The user's security class is high, the device's security class is safe, the program's security class is safe, and the session belongs to the safe class.

[0053] Step 2.2) Based on the fuzzy rules selected in 2.1, calculate the membership degree of the obtained session fuzzy class, which is the minimum value among the membership degrees of the user fuzzy class, the device fuzzy class, and the program fuzzy class. Specifically:

[0054] μ(Session∈SessionClass)=min[μ(user∈UserClass),μ(device∈DeviceClass),μ(app∈AppClass)],

[0055] Where: μ(user∈UserClass) refers to the membership degree of the user to the current user fuzzy class, μ(device∈DeviceClass) refers to the membership degree of the device to the current device fuzzy class, μ(app∈AppClass) refers to the membership degree of the program to the current program fuzzy class, and μ(Session∈SessionClass) refers to the membership degree of the session to the current session fuzzy class.

[0056] Taking the above parameters as an example, in this embodiment, the membership degrees of the two mappings belonging to the unsafe class are 0.5 and 0.5, respectively, and the membership degrees of the two mappings belonging to the safe class are 0.2 and 0.2, respectively.

[0057] The membership degrees of the two mappings belonging to the unsafe class in session2 are 0.4 and 0.4, respectively, while the membership degrees of the two mappings belonging to the safe class are 0.5 and 0.5, respectively.

[0058] The two mappings of session3 belonging to unsafe have membership degrees of 0.5 and 0.5.

[0059] Step 3) Based on the fuzzy classification results and membership degrees of the user's initiated session, calculate the session security level to obtain the defuzzified overall session security value, which specifically includes:

[0060] Step 3.1) Combining the inference results of multiple fuzzy rules, the membership degrees of the same fuzzy class of conversation are merged, specifically as follows: The sessions are divided into Unsafe and Safe classes, and the membership degrees of the two classes are merged to obtain the total membership degree of each class.

[0061] For example, session1 has a total membership degree of 1 in the unsafe class and a total membership degree of 0.4 in the safe class.

[0062] The total membership degree of session2 belonging to the unsafe class is 0.8, and the total membership degree of session2 belonging to the safe class is 1.

[0063] session3 belongs only to the safe class, with a membership degree of 1.

[0064] Step 3.2) Combining various membership degrees, the centroid method is used to calculate the security value. Session security values ​​of 0-50 are classified as unsafe, with a centroid security value of Unsafe_Center_Safety of 25. Session security values ​​of 51-100 are classified as safe, with a centroid security value of Safe_Center_Unsafety of 75. After obtaining the sum of membership degrees for each category, the centroid method is introduced to calculate session security from a holistic perspective. Based on the total membership degree and centroid security value for each category, the value is standardized by dividing by the total membership degree to obtain the overall session security value, specifically:

[0065]

[0066] For example:

[0067] The overall security value of session1 is (1*25+0.4*75) / (1+0.4)=39.3

[0068] The overall security value of session2 is (0.8*25+1*75) / (1+0.8)=52.8

[0069] The overall security value for session 3 is 1 * 75 = 75.

[0070] Step 4) Based on the user's current trust level and the alarm information from the zero-trust security module, dynamically adjust the trust level to obtain a new trust level after dynamically rewarding or penalizing the user. Specifically, this includes:

[0071] Step 4.1) Compare the Session security value (Sesson_Center_Safety) output in Step 3.2 with the security value required by the service requested by the user. If the session security value is higher than or equal to the security value required by the service, the zero-trust system will provide access to the corresponding service; otherwise, access will be denied.

[0072] For example: if session1's security value is lower than resource1, its access is denied.

[0073] session2 has a higher security value than resource1, so it is allowed to access it.

[0074] session3 has a higher security value than resource2, so it is allowed to access it.

[0075] Step 4.2) If access is allowed as described in 4.1, then retrieve the maximum and minimum trust scores of the user from the user's historical trust score database, and calculate its normalized trust score, specifically as follows:

[0076] Where: user_normalize_trust is the trust level of the user after minimax normalization, where max(user_trust) is the maximum value of the user's past trust level, min(user_trust) is the minimum value of the user's past trust level, and user_trust is the current user trust level.

[0077] For users user2 and user3 who are allowed access, calculate their normalized trust scores based on their trust history.

[0078] User2 in session2 has a current trust level of 80, a historical high of 85 and a low of 20, so its normalized trust level is 0.078.

[0079] User 3 in session 3 has a current trust level of 75, a historical highest trust level of 90, and a lowest trust level of 20. Therefore, its normalized trust level is 0.214.

[0080] Step 4.3) During the user access phase, dynamically adjust the user's trust level based on security dynamics during the access process: If no security risk alarm occurs during the user's access, first calculate the reward value for the increase in user trust level using the following formula, i.e. Where: λ is the reward / penalty coefficient, ranging from 0 to 1 within a closed interval. The speed of dynamic trust reward / penalty is determined by customizing λ; and it is dynamically updated using the user's current trust value: user_trust = user_trust + reward_trust; correspondingly, when a security risk alarm occurs during the user's access, the penalty value for the decrease in the user's trust level is calculated, and the current trust value is dynamically updated accordingly, specifically:

[0081] user_trust=user_trust-punishment_trust.

[0082] No security risk alerts were detected during user2's access. Based on the user's current trust level, a reward trust level is awarded to increase their trust. The reward coefficient is set to 0.03 according to the system settings; therefore, the reward trust level is:

[0083] reward_trust=0.03*100*(80*e^0.078 / 100-1)=2.59

[0084] user_trust=user_trust+reward_trust=80+2.59=82.59

[0085] During user3's access process, a security risk alert was detected. Based on the user's current trust level, a penalty trust level will be imposed, lowering their trust score. According to the system settings, the penalty coefficient is set to 0.03, therefore, their penalty trust level is:

[0086] punishment_trust=0.03*100((100-75)*e^0.214 / 100-1)=0.93

[0087] user_trust=user_trust–punishment_trust=50–0.93=49.07

[0088] Step 4.4) Write the dynamically updated user trust level from step 4.3 into the user trust level history database.

[0089] In this embodiment, the updated trust scores of user2 (82.59) and user3 (49.07) are written into the user history database.

[0090] Through specific practical experiments, in a Windows 10 system with an Intel i5-1135 G7 CPU, and with an initial trust value of 0.2 and a reward / penalty coefficient of 0.01, 2000 simulations were conducted on three different types of users. The resulting trust level data change curves are shown below. Figure 3 As shown.

[0091] Compared with existing technologies, this method introduces historical data records of user trust levels and dynamically adjusts rewards and penalties based on the security status of the user's access process, making the trust security judgment process of zero-trust subjects more sustainable and stable, and the judgment results more practical.

[0092] The above-described specific implementations can be partially adjusted by those skilled in the art in different ways without departing from the principles and purpose of the present invention. The scope of protection of the present invention is defined by the claims and is not limited to the above-described specific implementations. All implementation schemes within the scope of the claims are bound by the present invention.

Claims

1. A fuzzy inference-based dynamic evaluation system for subject trust in a zero-trust system, characterized in that, include: The system comprises four modules: a fuzzy class and membership initialization module, a session security fuzzy inference module, a zero-trust session security calculation module, and a zero-trust subject trust dynamic adjustment module. Specifically: the fuzzy class and membership initialization module calculates the fuzzy class and corresponding membership degree of the subject information based on a preset classification and membership function; the session security fuzzy inference module calculates the subject's session security fuzzy class through fuzzy inference; the zero-trust session security calculation module defuzzifies the session security fuzzy class and calculates its session security value; and the zero-trust subject trust dynamic adjustment module compares the comprehensive security value with the user's resource request requirements, issues access credentials to the user based on the comparison results, and rewards or punishes the user's trust level for security risks and high-risk operations during the user's access process. The aforementioned dynamic assessment of the subject's trust level in the zero-trust system includes: Step 1) Initialize the fuzzy class of the access subject based on the user, device, and program information to obtain the security fuzzy class and membership degree of the user, device, and program, specifically including: Step 1.1) Calculate the user's belonging to the fuzzy trust class and membership according to the user's trust degree, specifically: Wherein: x is the trust degree of the user, the trust degree ranges from 0 to 100 in a closed interval. Step 1.2) Calculate and obtain the fuzzy safety class and membership degree of the equipment based on its safety level, specifically: wherein: x is the security of the device, the security ranging in the closed interval from 0 to 100; Step 1.3) Based on the program's security level, calculate and obtain the program's fuzzy security class and membership degree, specifically: wherein: x is the security degree applied, the security degree ranging in the closed interval from 0 to 100; Step 2) Based on the security fuzzy classes of users, devices, and programs, perform reasoning based on session fuzzy class rules to obtain the session fuzzy classes and their membership degrees, specifically including: Step 2.1) Combine the fuzzy classes of the current access subject triplet, namely UserClass, DeviceClass, and AppClass, select fuzzy rules from the session fuzzy class inference rule set, perform fuzzy inference, and obtain the corresponding session fuzzy classification result (SessionClass). Step 2.2) According to the fuzzy rules selected in 2.1, the membership degree of the resulting session fuzzy class is calculated, i.e. the minimum value among the user fuzzy class membership degree, the device fuzzy class membership degree, and the program fuzzy class membership degree, which is specifically: Wherein: µ(user ∈ UserClass) refers to the membership degree of the user belonging to the current user fuzzy class, µ(device ∈ DeviceClass) refers to the membership degree of the device belonging to the current device fuzzy class, µ(app ∈ AppClass) refers to the membership degree of the program belonging to the current program fuzzy class, and µ(Session ∈ SessionClass) refers to the membership degree of the session belonging to the current session fuzzy class. Step 3) Based on the fuzzy classification results and membership degrees of the user's initiated session, calculate the session security level to obtain the defuzzified overall session security value, which specifically includes: Step 3.1) Combining the membership of the same session fuzzy class according to the inference results of multiple fuzzy rules, specifically: Wherein: the session is Unsafe and Safe, i.e. unsafe class and safe class, and the membership of the two classes is combined respectively to obtain the total membership of each class; Step 3.2) Combining various membership degrees, the centroid method is used to calculate the security value. Session security values ​​of 0-50 are classified as unsafe, with a centroid security value of Unsafe_Center_Safety of 25. Session security values ​​of 51-100 are classified as safe, with a centroid security value of Safe_Center_Unsafety of 75. After obtaining the sum of membership degrees for each category, the centroid method is introduced to calculate session security from a holistic perspective. Based on the total membership degree and centroid security value for each category, the value is standardized by dividing by the total membership degree to obtain the overall session security value, specifically: ； Step 4) Based on the user's current trust level and the alarm information from the zero-trust security module, dynamically adjust the trust level to obtain a new trust level after dynamically rewarding or penalizing the user. Specifically, this includes: Step 4.1) According to the session security value Session_Center_Safety output by step 3.2, compare it with the security value required by the service the user applies to access, when the session security value is higher than or equal to the security value required by the service, the zero trust system provides access to the corresponding service, otherwise, it denies access; Step 4.2) When the user is allowed to access in 4.1, retrieve and obtain the maximum and minimum values of the user's past trust degree from the user's historical trust degree database, and calculate the normalized trust degree, specifically: wherein: user_normalize_trust is the trust degree of the user after minimax normalization, wherein max(user_trust) is the maximum value of the past trust degree of the user, min(user_trust) is the minimum value of the past trust degree of the user, and user_trust is the current user trust value; Step 4.3) In the user access system stage, the trust degree of the user is dynamically adjusted according to the security dynamics in the user access process: when no security risk alarm occurs in the user access process, first, the reward value of the increase of the trust degree of the user is calculated by using the following formula, that is, wherein λ is a reward and punishment coefficient, the range is closed interval of 0 to 1, and the speed of the dynamic reward and punishment of the trust is determined by self-defining λ; and the current trust value of the user is dynamically updated by using ; accordingly, when a security risk alarm occurs in the user access process, the punishment value of the decrease of the trust degree of the user is calculated, and the current trust value is dynamically updated according to the punishment value, specifically, , ； Step 4.4) Write the user trust degree dynamically updated in step 4.3 into the user trust degree history database.

2. The fuzzy-reasoning-based dynamic evaluation system of a subject's trust degree in a zero-trust system according to claim 1, characterized in that, The fuzzy class and membership degree initialization module comprises a user trust degree fuzzy unit, a device security degree fuzzy unit and an application program security degree fuzzy unit, wherein: the user trust degree fuzzy unit uses the membership function thereof to perform fuzzy processing according to user trust degree data, to obtain the fuzzy class and membership degree of the user trust degree; the device security degree fuzzy unit uses the membership function thereof to perform fuzzy processing according to device security degree data, to obtain the fuzzy class and membership degree of the device security degree; and the application program security degree fuzzy unit uses the membership function thereof to perform fuzzy processing according to application program security degree data, to obtain the fuzzy class and membership degree of the application program security degree.

3. The fuzzy-reasoning-based dynamic evaluation system of a trust degree of a principal of a zero-trust system according to claim 1, characterized in that, The session security fuzzy reasoning module comprises a session security fuzzy reasoning unit and a session security fuzzy class membership degree calculation unit, wherein: the session fuzzy reasoning unit performs fuzzy reasoning according to the information output by the fuzzy class and membership degree initialization module, according to a fuzzy reasoning rule set, to obtain a session security fuzzy class; and the session security fuzzy class membership degree calculation unit processes the membership degrees of the user trust degree, the device security degree and the application security degree according to a minimum value taking method, to obtain the membership degree of the session security fuzzy class.

4. The fuzzy-reasoning-based dynamic evaluation system of a trust degree of a principal of a zero-trust system according to claim 1, characterized in that, The zero trust session security degree calculation module comprises a session security fuzzy membership degree merging unit and a session security degree calculation unit, wherein: the session security fuzzy membership degree merging unit collates different session security fuzzy classes according to the output result of the fuzzy reasoning module, respectively sums up the membership degree values thereof, to obtain the overall membership degree of different session security fuzzy classes; and the session security degree calculation unit processes the session security fuzzy class and the overall membership degree thereof using a centroid calculation method, to obtain a quantitative result of the session security degree.

5. The fuzzy-reasoning-based dynamic evaluation system for zero-trust system principal trustworthiness according to claim 1, characterized in that, The zero-trust subject credit dynamic adjustment module comprises a user normalized trust degree calculation unit, a user trust degree reward unit and a user trust degree punishment unit, wherein: the user normalized trust degree calculation unit retrieves a user trust degree current value, a maximum value and a minimum value of a historical trust degree, performs minimax normalization processing, and obtains a user normalized trust degree; the user trust degree reward unit calculates a trust degree reward value obtained after successful access of the user according to the obtained user normalized trust degree, and increases the current trust degree by the reward value to obtain a dynamically adjusted user trust degree; and the user trust degree punishment unit calculates a trust degree punishment value after the user fails to obtain access or a risk occurs in the access process according to the obtained user normalized trust degree, and subtracts the punishment value from the current trust degree to obtain a dynamically adjusted user trust degree.

Images