Zero trust access control method and device

Abstract

The present application relates to the field of communications, and provides a zero-trust access control method and device. The method includes: performing user zero-trust calculation based on the pre-scoring information of the user to be processed to obtain a user trust score; performing resource zero-trust calculation based on the pre-scoring information of the resource to be processed to obtain a resource trust score; performing joint zero-trust calculation based on the joint pre-scoring information of the user to be processed and the resource to be processed to obtain a joint trust score; and performing access control on the user to be processed and the resource to be processed based on the user trust score, the resource trust score, and the joint trust score. The zero-trust access control method and device provided in the embodiment of the present application fully take into account the risks on the resource side, as well as the linkage risks between the resource side and the user side, so as to effectively improve the security of the computing power network, and thus improve the service capabilities of the computing power network.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a zero-trust access control method and device. Background Art

[0002] The computing network builds a central system with sensing, aggregation, scheduling, and service capabilities—the computing network operating system—to centrally manage and provide external services for various cloud and edge nodes, intelligent computing, supercomputing, and other social computing resources. The computing network establishes a unified computing power abstraction and identification system to shield the complexity of heterogeneous computing power and resources. Upward, based on the central system, it provides users with consistent, seamless, end-to-end task-based services.

[0003] Users of the computing network usually access the resources of the computing network through the computing network operating system. Zero trust technology believes that users accessing resources are untrustworthy. Therefore, through real-time trust calculation, multivariate data analysis, the principle of least privilege, etc., a trust chain from users to resources is established to achieve secure and reliable access to resources by users.

[0004] The above-mentioned zero-trust technology assumes that resources are always trustworthy. This assumption is based on centralized data centers, cloud resource pools, and application services. Through security gateways and dynamic policies, it can achieve zero trust in the protection of intranet services and resources and external access, thereby ensuring the security of the computing network.

[0005] However, since the cross-regional and cross-level computing network operating system manages various types of resources such as computing power, services, and data, these resources are highly complex in terms of geographical distribution, resource type, and resource behavior. Therefore, in addition to risky behaviors on the external user side, the potential attacks faced by the computing network also include the resource side, such as malicious changes to resources and reduced resource service quality. Traditional zero-trust technology does not consider risky behaviors on the resource side, which will lead to a decline in the security of the computing network and thus reduce the service capabilities of the computing network. Summary of the Invention

[0006] The embodiments of the present application provide a zero-trust access control method and device to solve the technical problem that traditional zero-trust technology does not consider risky behaviors on the resource side, which will lead to a decrease in the security of the computing power network and further reduce the service capabilities of the computing power network.

[0007] In a first aspect, an embodiment of the present application provides a zero-trust access control method, including:

[0008] Perform user zero trust calculation based on the pre-scoring information of the user to be processed to obtain the user trust score;

[0009] Perform resource zero-trust calculation based on the pre-scoring information of the resource to be processed to obtain the resource trust score;

[0010] Performing a joint zero-trust calculation based on the joint pre-scoring information of the user to be processed and the resource to be processed to obtain a joint trust score;

[0011] Access control is performed on the user to be processed and the resource to be processed according to the user trust score, the resource trust score and the joint trust score.

[0012] In one embodiment, the performing access control on the user to be processed and the resource to be processed according to the user trust score, the resource trust score, and the joint trust score includes:

[0013] If the user trust score is less than the user score threshold, prohibiting the user to be processed from accessing the resource to be processed;

[0014] If the user trust score is greater than or equal to the user score threshold, and the resource trust score is less than the resource score threshold, then after selecting another resource to replace the resource to be processed, return to the step of performing resource zero trust calculation based on the pre-scoring information of the resource to be processed to obtain the resource trust score;

[0015] If the user trust score is greater than or equal to the user score threshold, the resource trust score is greater than or equal to the resource score threshold, and the joint trust score is less than the joint score threshold, prohibiting the user to be processed from accessing the resource to be processed;

[0016] If the user trust score is greater than or equal to the user score threshold, the resource trust score is greater than or equal to the resource score threshold, and the joint trust score is greater than or equal to the joint score threshold, the user to be processed is allowed to access the resource to be processed.

[0017] In one embodiment, the performing access control on the user to be processed and the resource to be processed according to the user trust score, the resource trust score, and the joint trust score includes:

[0018] If the user trust score is greater than or equal to the user score threshold, the user to be processed is allowed to access the computing power network operating system;

[0019] If the user trust score is less than the user score threshold, the user to be processed is prohibited from accessing the computing power network operating system.

[0020] In one embodiment, the performing access control on the user to be processed and the resource to be processed according to the user trust score, the resource trust score, and the joint trust score includes:

[0021] If the resource trust score is greater than or equal to the resource score threshold, the resource to be processed is allowed to access the computing power network operating system;

[0022] If the resource trust score is less than the resource score threshold, the resource to be processed is prohibited from accessing the computing power network operating system.

[0023] In one embodiment, before performing user zero-trust calculation based on the pre-scoring information of the user to be processed, the process includes:

[0024] Authenticating the identity information of the user to be processed to obtain user identity authentication information;

[0025] Perceiving the behavior of the user to be processed to obtain user perception information;

[0026] Pre-score information of the user to be processed is obtained according to the user identity authentication information and the user perception information.

[0027] In one embodiment, before performing resource zero-trust computing based on pre-scoring information of the resource to be processed, the process includes:

[0028] Authenticating the identity information of the resource to be processed to obtain resource identity authentication information;

[0029] Perceiving the behavior of the resource to be processed to obtain resource perception information;

[0030] Pre-scoring information of the resource to be processed is obtained according to the resource identity authentication information and the resource perception information.

[0031] In one embodiment, after performing access control on the user to be processed and the resource to be processed according to the user trust score, the resource trust score, and the joint trust score, the method includes:

[0032] Monitor users and resources in real time, and iteratively optimize user zero-trust computing rules, resource zero-trust computing rules, and joint zero-trust computing rules based on the service status of the computing power network operating system.

[0033] In a second aspect, an embodiment of the present application provides a zero-trust access control device, comprising:

[0034] The user zero-trust calculation module is used to perform user zero-trust calculation based on the pre-scoring information of the user to be processed to obtain the user trust score;

[0035] The resource zero-trust calculation module is used to perform resource zero-trust calculation based on the pre-scoring information of the resource to be processed to obtain the resource trust score;

[0036] A joint zero-trust calculation module is used to: perform a joint zero-trust calculation based on the joint pre-scoring information of the user to be processed and the resource to be processed to obtain a joint trust score;

[0037] The access control module is used to perform access control on the user to be processed and the resource to be processed according to the user trust score, the resource trust score and the joint trust score.

[0038] In a third aspect, an embodiment of the present application provides an electronic device comprising a processor and a memory storing a computer program, wherein when the processor executes the program, the steps of the zero-trust access control method described in the first aspect are implemented.

[0039] In a fourth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the zero-trust access control method described in the first aspect.

[0040] The zero-trust access control method and device provided by the present application perform user zero-trust calculation based on the pre-scoring information of the user to be processed to obtain a user trust score, perform resource zero-trust calculation based on the pre-scoring information of the resource to be processed to obtain a resource trust score, perform joint zero-trust calculation based on the joint pre-scoring information of the user to be processed and the resource to be processed to obtain a joint trust score, and perform access control on the user to be processed and the resource to be processed based on the user trust score, resource trust score, and joint trust score. Since the present application performs zero-trust calculation on the resource side and performs joint zero-trust calculation on the user side and the resource side, the access control for users and resources fully takes into account the risks on the resource side and the linkage risks between the resource side and the user side, thereby effectively improving the security of the computing power network and thereby improving the service capabilities of the computing power network. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the present application or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0042] Figure 1 This is one of the flow diagrams of the zero-trust access control method provided in the embodiment of the present application;

[0043] Figure 2 This is the second flow chart of the zero-trust access control method provided in the embodiment of the present application;

[0044] Figure 3This is the third flow chart of the zero-trust access control method provided in the embodiment of the present application;

[0045] Figure 4 A schematic diagram of the structure of a zero-trust access control device provided in an embodiment of the present application;

[0046] Figure 5 It is a structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] To make the objectives, technical solutions, and advantages of this application more clear, the technical solutions in this application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this application.

[0048] Figure 1 This is one of the flow charts of the zero-trust access control method provided in the embodiment of this application. Figure 1 , an embodiment of the present application provides a zero-trust access control method, which may include:

[0049] 101. Perform user zero trust calculation based on the pre-scoring information of the user to be processed to obtain the user trust score;

[0050] 102. Perform resource zero trust calculation based on the pre-scoring information of the resource to be processed to obtain a resource trust score;

[0051] 103. Perform a joint zero trust calculation based on the joint pre-scoring information of the to-be-processed user and the to-be-processed resource to obtain a joint trust score;

[0052] 104. Access control is performed on the users to be processed and the resources to be processed based on the user trust score, the resource trust score, and the joint trust score.

[0053] In step 101, the pre-scoring information of the user to be processed includes user identity authentication information and user perception information. The user identity authentication information can be sent to the access proxy module in the computing power network operating system through the identity authentication module, and then obtained from the access proxy module, including user identification authentication information, user account authentication information, user certificate authentication information and device authentication information accessed by the user. The user perception information can be obtained through the trust perception module in the computing power network operating system, including the user's historical access information to the computing power network operating system and the user's historical call count information for applications in the computing power network operating system.

[0054] In step 102, the pre-scoring information of the resource to be processed includes resource identity authentication information and resource perception information. The resource identity authentication information can also be sent to the access proxy module in the computing power network operating system through the identity authentication module, and then obtained from the access proxy module, including resource identification authentication information, resource geographic location authentication information, resource configuration authentication information and other authentication information such as resource software environment. The resource perception information can also be obtained through the trust perception module in the computing power network operating system, including resource historical service quality information, resource life information, resource historical service duration information and historical mutual calling behavior information with other resources.

[0055] In step 103, the joint pre-scoring information of the user to be processed and the resource to be processed includes user identity authentication information, resource identity authentication information, and joint perception information between the user and the resource. The joint perception information between the user and the resource can also be obtained through the trust perception module in the computing power network operating system, including the term information of the transaction between the user and the resource and the cost information of the user ordering the resource.

[0056] It should be noted that other information can also be obtained through the trust perception module and included in the reference scope of zero trust computing, such as environmental security information, external event information, etc.

[0057] In addition, in actual applications, there is no strict timing relationship between step 101, step 102 and step 103; that is, they can be executed simultaneously, or any step can be executed first, depending on actual needs and is not limited here.

[0058] The zero-trust access control method provided in this embodiment performs user zero-trust calculation based on the pre-scoring information of the user to be processed to obtain a user trust score, performs resource zero-trust calculation based on the pre-scoring information of the resource to be processed to obtain a resource trust score, performs joint zero-trust calculation based on the joint pre-scoring information of the user to be processed and the resource to be processed to obtain a joint trust score, and performs access control on the user to be processed and the resource to be processed based on the user trust score, resource trust score, and joint trust score. Since this embodiment performs zero-trust calculation on the resource side and performs joint zero-trust calculation on the user side and the resource side, the access control for users and resources fully takes into account the risks on the resource side and the linkage risks between the resource side and the user side, thereby effectively improving the security of the computing power network and further improving the service capabilities of the computing power network.

[0059] In one embodiment, access control of the user to be processed and the resource to be processed based on the user trust score, the resource trust score, and the joint trust score may include:

[0060] If the user's trust score is lower than the user score threshold, the user to be processed is prohibited from accessing the resources to be processed;

[0061] The access proxy module can be used to prohibit the user to be processed from accessing the resources to be processed.

[0062] If the user trust score is greater than or equal to the user score threshold, and the resource trust score is less than the resource score threshold, then another resource is selected to replace the resource to be processed, and the process returns to the step of performing resource zero trust calculation based on the pre-scoring information of the resource to be processed to obtain the resource trust score.

[0063] The relevant information of users and resources can be sent to the trust perception module through the access proxy module, and the relevant resource or task requirements can be sent to the computing power network operating system, and other resources can be selected through the computing power network operating system to replace the resources to be processed.

[0064] If the user trust score is greater than or equal to the user score threshold, the resource trust score is greater than or equal to the resource score threshold, and the joint trust score is less than the joint score threshold, the user to be processed is prohibited from accessing the resource to be processed;

[0065] The access proxy module can be used to prohibit pending users from accessing pending resources.

[0066] If the user trust score is greater than or equal to the user score threshold, the resource trust score is greater than or equal to the resource score threshold, and the joint trust score is greater than or equal to the joint score threshold, the pending user is allowed to access the pending resource.

[0067] The access proxy module can be used to send the access traffic of the user to be processed to the resource to be processed, thereby allowing the user to be processed to access the resource to be processed.

[0068] This embodiment generates different policies for user access to resources based on different situations of user trust scores, resource trust scores, and joint trust scores. It can fully utilize the joint information of the user side, resource side, and users and resources to perform zero-trust control on user access to resources, ensure the security of the computing power network, and improve the service capabilities of the computing power network.

[0069] In one embodiment, access control of the user to be processed and the resource to be processed based on the user trust score, the resource trust score, and the joint trust score may include:

[0070] If the user's trust score is greater than or equal to the user score threshold, the pending user is allowed to access the computing power network operating system;

[0071] The access proxy module can be used to send the access traffic of the users to be processed to the computing power network operating system, thereby allowing the users to be processed to access the computing power network operating system. Through the computing power network operating system, the users to be processed are allowed to access various platforms in the computing power network system, such as the computing network trading platform and the computing network development platform, to purchase computing power, develop computing power, etc.

[0072] It should be noted that the access traffic of the users to be processed can be encrypted in advance through the access proxy module. In addition, for the advertising pages, product descriptions, activity pages and other interfaces in the computing network operating system, the users to be processed can directly access them without going through user zero-trust calculation and threshold comparison.

[0073] If the user trust score is less than the user score threshold, the pending user is prohibited from accessing the computing power network operating system.

[0074] The access proxy module can be used to prohibit pending users from accessing the computing power network operating system, and the prohibition information can be sent to the trust perception module and synchronized to the computing power network operating system. The computing power network operating system can prohibit pending users from accessing various platforms in the computing power network operating system, such as the computing network trading platform and the computing network development platform.

[0075] This embodiment generates different policies for users to access the computing power network operating system based on the user trust score, which can perform zero-trust control on user access to the computing power network operating system, ensure the security of the computing power network, and improve the service capabilities of the computing power network.

[0076] In one embodiment, access control of the user to be processed and the resource to be processed based on the user trust score, the resource trust score, and the joint trust score may include:

[0077] If the resource trust score is greater than or equal to the resource score threshold, the pending resource is allowed to access the computing network operating system;

[0078] The access proxy module can be used to send access traffic of pending resources to the computing network operating system, allowing pending resources to access the computing network operating system to bring resources online, change resource information, relocate resources, change software resources, etc.

[0079] It should be noted that the access traffic to the resource to be processed may be encrypted in advance by using an access proxy module.

[0080] If the resource trust score is less than the resource score threshold, the pending resource is prohibited from accessing the computing power network operating system.

[0081] The access proxy module can be used to prohibit the pending resources from accessing the computing power network operating system, and the prohibition information can be sent to the trust perception module and synchronized to the computing power network operating system. The computing network scheduling platform in the computing power network operating system can stop the call to the pending resources and select other resources to replace the pending resources.

[0082] This embodiment generates different strategies for resource access to the computing power network operating system based on the resource trust score, which can perform zero-trust control on the resource access to the computing power network operating system, ensure the security of the computing power network, and improve the service capabilities of the computing power network.

[0083] Figure 2 This is the second flow chart of the zero-trust access control method provided by the embodiment of this application. Figure 2 In one embodiment, before performing user zero-trust calculation based on the pre-scoring information of the user to be processed, the following steps may be included:

[0084] 201. Authenticate the identity information of the user to be processed and obtain user identity authentication information;

[0085] 202. Sense the behavior of the user to be processed and obtain user perception information;

[0086] 203. Obtain pre-score information of the user to be processed based on the user identity authentication information and the user perception information.

[0087] In step 201, the identity information of the user to be processed, such as user identification information, user account information, user certificate information, and device information accessed by the user, can be collected through the identity collection module, and then the identity information of the user to be processed can be authenticated through the identity authentication module. If the authentication is successful, user identity authentication information, such as user identification authentication information, user account authentication information, user certificate authentication information, and device authentication information accessed by the user, is generated, and the user identity authentication information is sent to the access proxy module. If the authentication is unsuccessful, the identity information of the user to be processed is sent to the trust perception module.

[0088] In step 202, the trust perception module can perceive the behavior of the user to be processed and obtain user perception information, such as the user's historical access information to the computing power network operating system and the user's historical call times for applications in the computing power network operating system.

[0089] In actual applications, there is no strict timing relationship between step 201 and step 202; that is, they can be executed simultaneously, or any one step can be executed first, depending on actual needs and is not limited here.

[0090] This embodiment uses user identity authentication information and user perception information as pre-scoring information for the user to be processed. When performing subsequent user zero-trust calculations, the real identity information and real behavior information of the user to be processed can be used as the calculation basis, so that the obtained user trust score is true and reliable.

[0091] Figure 3 This is the third flow chart of the zero-trust access control method provided by the embodiment of this application. Figure 3 In one embodiment, before performing resource zero-trust calculation based on pre-scoring information of the resource to be processed, the following steps may be included:

[0092] 301. Authenticate the identity information of the resource to be processed and obtain resource identity authentication information;

[0093] 302. Sense the behavior of the resource to be processed and obtain resource perception information;

[0094] 303. Obtain pre-scoring information of the resource to be processed based on the resource identity authentication information and the resource perception information.

[0095] In step 301, the identity information of the resource to be processed, such as resource identification information, resource geographic location information, resource configuration information, and other information such as resource software environment, can be collected through the identity collection module, and then the identity information of the resource to be processed can be authenticated through the identity authentication module. If the authentication is successful, resource identity authentication information, such as resource identification authentication information, resource geographic location authentication information, resource configuration authentication information, and other authentication information such as resource software environment, is generated, and the resource identity authentication information is sent to the access agent module. If the authentication is unsuccessful, the identity information of the resource to be processed is sent to the trust perception module.

[0096] In step 302, the trust perception module can be used to perceive the behavior of the resource to be processed and obtain resource perception information, such as resource historical service quality information, resource life information, resource historical service duration information, historical mutual calling behavior information with other resources, etc.

[0097] In actual applications, there is no strict timing relationship between step 301 and step 302; that is, they can be executed simultaneously, or any one step can be executed first, depending on actual needs and is not limited here.

[0098] This embodiment uses resource identity authentication information and resource perception information as pre-scoring information for the resources to be processed. When performing subsequent resource zero-trust calculations, the real identity information and real behavior information of the resources to be processed can be used as the basis for calculation, so that the obtained resource trust score is true and reliable.

[0099] In one embodiment, after performing access control on the user to be processed and the resource to be processed based on the user trust score, the resource trust score, and the joint trust score, the process includes:

[0100] Monitor users and resources in real time, and iteratively optimize user zero-trust computing rules, resource zero-trust computing rules, and joint zero-trust computing rules based on the service status of the computing power network operating system.

[0101] User zero-trust computing rules, resource zero-trust computing rules, and joint zero-trust computing rules include AI analysis, computing scope decision-making, external expert judgment, etc. Therefore, user zero-trust computing rules, resource zero-trust computing rules, and joint zero-trust computing rules can be iteratively optimized by adjusting AI analysis parameters, computing scope decision thresholds, external expert judgment rules, etc.

[0102] This embodiment monitors users and resources in real time and iteratively optimizes zero-trust computing rules to ensure the accuracy and reliability of zero-trust computing on the user side, resource side, and both sides, making access control to users and resources more accurate and effective, thereby improving the security and service capabilities of the computing network.

[0103] The zero-trust access control device provided in an embodiment of the present application is described below. The zero-trust access control device described below and the zero-trust access control method described above can be referenced to each other.

[0104] Figure 4 This is a schematic diagram of the structure of the zero-trust access control device provided in the embodiment of the present application. Figure 4 , an embodiment of the present application provides a zero-trust access control device, which may include:

[0105] The user zero trust calculation module 401 is used to perform user zero trust calculation based on the pre-scoring information of the user to be processed to obtain a user trust score;

[0106] The resource zero-trust calculation module 402 is used to perform resource zero-trust calculation based on the pre-scoring information of the resource to be processed to obtain a resource trust score;

[0107] The joint zero-trust calculation module 403 is configured to perform a joint zero-trust calculation based on the joint pre-scoring information of the user to be processed and the resource to be processed to obtain a joint trust score;

[0108] The access control module 404 is configured to perform access control on the user to be processed and the resource to be processed according to the user trust score, the resource trust score, and the joint trust score.

[0109] Specifically, the policy control module in the access control module 404 receives the trust score information sent by the user zero trust computing module, the resource zero trust computing module and the joint zero trust computing module, generates a corresponding access policy, and sends the access policy to the access proxy module in the access control module 404, which performs access control.

[0110] The zero-trust access control device provided in this embodiment performs user zero-trust calculation based on the pre-scoring information of the user to be processed to obtain a user trust score, performs resource zero-trust calculation based on the pre-scoring information of the resource to be processed to obtain a resource trust score, performs joint zero-trust calculation based on the joint pre-scoring information of the user to be processed and the resource to be processed to obtain a joint trust score, and performs access control on the user to be processed and the resource to be processed based on the user trust score, resource trust score, and joint trust score. Since this embodiment performs zero-trust calculation on the resource side and performs joint zero-trust calculation on the user side and the resource side, the access control for users and resources fully takes into account the risks on the resource side and the linkage risks between the resource side and the user side, thereby effectively improving the security of the computing power network and further improving the service capabilities of the computing power network.

[0111] In one embodiment, the access control module 404 is specifically configured to:

[0112] If the user trust score is less than the user score threshold, prohibiting the user to be processed from accessing the resource to be processed;

[0113] If the user trust score is greater than or equal to the user score threshold, and the resource trust score is less than the resource score threshold, then after selecting another resource to replace the resource to be processed, return to the step of performing resource zero trust calculation based on the pre-scoring information of the resource to be processed to obtain the resource trust score;

[0114] If the user trust score is greater than or equal to the user score threshold, the resource trust score is greater than or equal to the resource score threshold, and the joint trust score is less than the joint score threshold, prohibiting the user to be processed from accessing the resource to be processed;

[0115] If the user trust score is greater than or equal to the user score threshold, the resource trust score is greater than or equal to the resource score threshold, and the joint trust score is greater than or equal to the joint score threshold, the user to be processed is allowed to access the resource to be processed.

[0116] In one embodiment, the access control module 404 is specifically configured to:

[0117] If the user trust score is greater than or equal to the user score threshold, the user to be processed is allowed to access the computing power network operating system;

[0118] If the user trust score is less than the user score threshold, the user to be processed is prohibited from accessing the computing power network operating system.

[0119] In one embodiment, the access control module 404 is specifically configured to:

[0120] If the resource trust score is greater than or equal to the resource score threshold, the resource to be processed is allowed to access the computing power network operating system;

[0121] If the resource trust score is less than the resource score threshold, the resource to be processed is prohibited from accessing the computing power network operating system.

[0122] In one embodiment, a pre-scoring information acquisition module (not shown) is further included, which is used to:

[0123] Authenticating the identity information of the user to be processed to obtain user identity authentication information;

[0124] Perceiving the behavior of the user to be processed to obtain user perception information;

[0125] Pre-score information of the user to be processed is obtained according to the user identity authentication information and the user perception information.

[0126] In one embodiment, the pre-scoring information acquisition module is further configured to:

[0127] Authenticating the identity information of the resource to be processed to obtain resource identity authentication information;

[0128] Perceiving the behavior of the resource to be processed to obtain resource perception information;

[0129] Pre-scoring information of the resource to be processed is obtained according to the resource identity authentication information and the resource perception information.

[0130] In one embodiment, a monitoring and optimization module (not shown) is further included to:

[0131] Monitor users and resources in real time, and iteratively optimize user zero-trust computing rules, resource zero-trust computing rules, and joint zero-trust computing rules based on the service status of the computing power network operating system.

[0132] Figure 5 An example of a physical structure diagram of an electronic device is shown below. Figure 5As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530 and a communication bus 540, wherein the processor 510, the communication interface 520, and the memory 530 communicate with each other via the communication bus 540. The processor 510 may call a computer program in the memory 530 to execute the steps of the zero-trust access control method, for example, including:

[0133] Perform user zero trust calculation based on the pre-scoring information of the user to be processed to obtain the user trust score;

[0134] Perform resource zero-trust calculation based on the pre-scoring information of the resource to be processed to obtain the resource trust score;

[0135] Performing a joint zero-trust calculation based on the joint pre-scoring information of the user to be processed and the resource to be processed to obtain a joint trust score;

[0136] Access control is performed on the user to be processed and the resource to be processed according to the user trust score, the resource trust score and the joint trust score.

[0137] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0138] On the other hand, an embodiment of the present application further provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can perform the steps of the zero-trust access control method provided in the above embodiments, for example, including:

[0139] Perform user zero trust calculation based on the pre-scoring information of the user to be processed to obtain the user trust score;

[0140] Perform resource zero-trust calculation based on the pre-scoring information of the resource to be processed to obtain the resource trust score;

[0141] Performing a joint zero-trust calculation based on the joint pre-scoring information of the user to be processed and the resource to be processed to obtain a joint trust score;

[0142] Access control is performed on the user to be processed and the resource to be processed according to the user trust score, the resource trust score and the joint trust score.

[0143] On the other hand, an embodiment of the present application further provides a processor-readable storage medium, wherein the processor-readable storage medium stores a computer program, wherein the computer program is configured to cause a processor to execute the steps of the methods provided in the above embodiments, for example, including:

[0144] Perform user zero trust calculation based on the pre-scoring information of the user to be processed to obtain the user trust score;

[0145] Perform resource zero-trust calculation based on the pre-scoring information of the resource to be processed to obtain the resource trust score;

[0146] Performing a joint zero-trust calculation based on the joint pre-scoring information of the user to be processed and the resource to be processed to obtain a joint trust score;

[0147] Access control is performed on the user to be processed and the resource to be processed according to the user trust score, the resource trust score and the joint trust score.

[0148] The processor-readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO)), optical storage (such as CDs, DVDs, BDs, HVDs, etc.), and semiconductor storage (such as ROMs, EPROMs, EEPROMs, non-volatile memories (NANDFLASH), solid-state drives (SSDs)), etc.

[0149] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0150] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0151] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A zero-trust access control method, characterized in that: include: Perform user zero trust calculation based on the pre-scoring information of the user to be processed to obtain the user trust score; Perform resource zero-trust calculation based on the pre-scoring information of the resource to be processed to obtain the resource trust score; Performing a joint zero-trust calculation based on the joint pre-scoring information of the user to be processed and the resource to be processed to obtain a joint trust score; Performing access control on the user to be processed and the resource to be processed according to the user trust score, the resource trust score, and the joint trust score, including: If the user trust score is less than the user score threshold, prohibiting the user to be processed from accessing the resource to be processed; If the user trust score is greater than or equal to the user score threshold, and the resource trust score is less than the resource score threshold, then after selecting another resource to replace the resource to be processed, return to the step of performing resource zero trust calculation based on the pre-scoring information of the resource to be processed to obtain the resource trust score; If the user trust score is greater than or equal to the user score threshold, the resource trust score is greater than or equal to the resource score threshold, and the joint trust score is less than the joint score threshold, prohibiting the user to be processed from accessing the resource to be processed; If the user trust score is greater than or equal to the user score threshold, the resource trust score is greater than or equal to the resource score threshold, and the joint trust score is greater than or equal to the joint score threshold, the user to be processed is allowed to access the resource to be processed.

2. The zero-trust access control method according to claim 1, wherein: The performing access control on the user to be processed and the resource to be processed according to the user trust score, the resource trust score and the joint trust score includes: If the user trust score is greater than or equal to the user score threshold, the user to be processed is allowed to access the computing power network operating system; If the user trust score is less than the user score threshold, the user to be processed is prohibited from accessing the computing power network operating system.

3. The zero-trust access control method according to claim 1, wherein: The performing access control on the user to be processed and the resource to be processed according to the user trust score, the resource trust score and the joint trust score includes: If the resource trust score is greater than or equal to the resource score threshold, the resource to be processed is allowed to access the computing power network operating system; If the resource trust score is less than the resource score threshold, the resource to be processed is prohibited from accessing the computing power network operating system.

4. The zero-trust access control method according to claim 1, wherein: Before performing the user zero trust calculation based on the pre-scoring information of the user to be processed, the following steps are included: Authenticating the identity information of the user to be processed to obtain user identity authentication information; Perceiving the behavior of the user to be processed to obtain user perception information; Pre-score information of the user to be processed is obtained according to the user identity authentication information and the user perception information.

5. The zero-trust access control method according to claim 1, wherein: Before performing resource zero-trust calculation based on the pre-scoring information of the resource to be processed, the following steps are included: Authenticating the identity information of the resource to be processed to obtain resource identity authentication information; Perceiving the behavior of the resource to be processed to obtain resource perception information; Pre-scoring information of the resource to be processed is obtained according to the resource identity authentication information and the resource perception information.

6. The zero-trust access control method according to claim 1, wherein: After performing access control on the user to be processed and the resource to be processed according to the user trust score, the resource trust score, and the joint trust score, the method includes: Monitor users and resources in real time, and iteratively optimize user zero-trust computing rules, resource zero-trust computing rules, and joint zero-trust computing rules based on the service status of the computing power network operating system.

7. A zero-trust access control device, characterized in that: include: The user zero-trust calculation module is used to perform user zero-trust calculation based on the pre-scoring information of the user to be processed to obtain the user trust score; The resource zero-trust calculation module is used to perform resource zero-trust calculation based on the pre-scoring information of the resource to be processed to obtain the resource trust score; A joint zero-trust calculation module is used to: perform a joint zero-trust calculation based on the joint pre-scoring information of the user to be processed and the resource to be processed to obtain a joint trust score; An access control module is configured to perform access control on the user to be processed and the resource to be processed according to the user trust score, the resource trust score, and the joint trust score, including: If the user trust score is less than the user score threshold, prohibiting the user to be processed from accessing the resource to be processed; If the user trust score is greater than or equal to the user score threshold, and the resource trust score is less than the resource score threshold, then after selecting another resource to replace the resource to be processed, return to the step of performing resource zero trust calculation based on the pre-scoring information of the resource to be processed to obtain the resource trust score; If the user trust score is greater than or equal to the user score threshold, the resource trust score is greater than or equal to the resource score threshold, and the joint trust score is less than the joint score threshold, prohibiting the user to be processed from accessing the resource to be processed; If the user trust score is greater than or equal to the user score threshold, the resource trust score is greater than or equal to the resource score threshold, and the joint trust score is greater than or equal to the joint score threshold, the user to be processed is allowed to access the resource to be processed.

8. An electronic device comprising a processor and a memory storing a computer program, characterized in that: When the processor executes the computer program, the steps of the zero-trust access control method according to any one of claims 1 to 6 are implemented.

9. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the zero-trust access control method according to any one of claims 1 to 6 are implemented.

Images