User Trust Measurement Methods and Systems in Zero-Trust Network Environments

Abstract

This invention discloses a user trust measurement method and system in a zero-trust network environment. It pre-collects user information, token information, device information, and system information, and generates an access control list. When a device sends a request, a risk assessment is performed on the request, followed by authentication. Based on historical access data, the request status is determined. Based on the authentication result and request status, it is determined whether authorization is allowed. If authorization is not allowed, the request is marked as a device anomaly. Based on the device's abnormal behavior, it is determined whether the device belongs to the category of remote control anomalies. If so, the access permissions of devices connected to and interacting with this device in the access control list are updated. This reduces the risk of network attack risk propagation in a zero-trust network environment.

Description

Technical Field

[0001] This invention belongs to the field of zero-trust networks and relates to user trust measurement technology, specifically to a user trust measurement method and system in a zero-trust network environment. Background Technology

[0002] With the continuous upgrading of network attack methods and the increase in network threats, the zero-trust security model has gradually gained widespread application. The zero-trust security model is a security strategy based on the principle of least privilege. It achieves comprehensive network protection by authenticating and controlling access to users, devices, and applications. In a zero-trust network environment, any device or user connecting to the network must be authenticated and authorized before accessing network resources.

[0003] In a zero-trust network environment, user trust assessment is crucial. User trust assessment involves evaluating multiple factors, including a user's historical behavior, authentication information, and device characteristics. The key to user trust assessment lies in comprehensive access control for both users and devices.

[0004] Currently, in zero-trust networks, user trust is often measured at the level of a single user or device. However, in cyberattacks, attackers typically use multiple devices as stepping stones to launch worm attacks, thus requiring protection against such propagating attacks. Therefore, overcoming propagating attacks has become an urgent problem to solve. Summary of the Invention

[0005] This invention addresses the problem of easy spread of network attacks in existing technologies by providing a user trust measurement method and system in a zero-trust network environment. It pre-collects user information, token information, device information, and system information to generate an access control list. When a device sends a request, a risk assessment is performed, followed by authentication. Based on historical access data, the request status is determined. Based on the authentication result and request status, it is determined whether authorization is allowed. If authorization is not allowed, the request is marked as a device anomaly. Based on the device's abnormal behavior, it is determined whether the device is subject to remote control anomalies. If so, the access permissions of devices connected to that device in the access control list are updated. This reduces the risk of network attack spread in a zero-trust network environment.

[0006] To achieve the above objectives, the technical solution adopted by this invention is: a user trust measurement method in a zero-trust network environment, comprising the following steps:

[0007] S1: Collect user information, token information, device information, and system information in advance, and generate an access control list;

[0008] S2: When a device sends a request, it collects the device's network environment information and performs a risk assessment for the request based on the network environment information;

[0009] S3: The cloud data center authenticates the requests sent by the device;

[0010] S4: The cloud data center determines the request status based on the user's and device's historical access data;

[0011] S5: Based on the authentication result and request status of the request, determine whether the request allows authorization. If authorization is not allowed, mark the device corresponding to the request as an abnormal device, reject the response to the request, and proceed to step S6; otherwise, based on the risk assessment and the security level of the request, and according to the content of the request, generate the corresponding response; if the user's security level is lower than the device's security level, define the user's security level as the security level of the request; if the user's security level is higher than the device's security level, define the device's security level as the security level of the request.

[0012] S6: Based on the abnormal behavior of the abnormal device, determine whether the device belongs to the category of remote control anomalies. If it does not belong to the category of remote control anomalies, the cloud data center refuses to accept the device's request; otherwise, proceed to step S7.

[0013] S7: Based on the network connection relationship of this device, update the access permissions of devices that have connection and interaction with this device in the access control table;

[0014] S8: The cloud data center records the request data for this device's request.

[0015] As an improvement of the present invention, in step S1, the user information is the identity feature information of each user;

[0016] The token information is a temporary, one-time dynamic password provided by the cloud data center when the user initiates a request;

[0017] The device information refers to the device hardware information used when a user initiates a request using the device, including at least the device's physical address and the device's owner.

[0018] As an improvement of the present invention, the system information in step S1 is the permission information of the file in the cloud data center, including the security zone where the file is located, the access permission of the file, and the operation permission; the security zone is a number of independent storage areas after the file system of the cloud data center is micro-segmented; each user and device is only allowed to access one of the security zones.

[0019] As another improvement of the present invention, the access control list in step S1 is a permission list pre-generated based on personnel, device and file permissions, used to control file access; the access control list includes the permission level of each file, the permission level of the user and the permission level of the device; the permission level of the file is the security level required to read or operate the file, and the permission level of the user and the permission level of the device are preset security levels in the corresponding security areas.

[0020] As another improvement of the present invention, the risk assessment in step S2 specifically involves: determining whether the network connected to the device is a public area network based on the location of the device used to initiate the request and the name of the network it is connected to; if the network connected to the device is a public area network, the request is judged as a risk request; otherwise, the request is judged as a safe request; a maximum risk permission threshold is preset, and when the request is judged as a risk request, the security level of the request is set to the maximum risk permission threshold.

[0021] As another improvement of the present invention, the authentication in step S3 includes the authentication of user information, the authentication of token information, and the authentication of device information.

[0022] The user information verification method is as follows: The cloud data center pre-sets a database of identity feature information templates, and stores the correspondence between each user's identity information and the identity feature information template in the database; when a user initiates a request, the identity feature information in the user information is compared with the identity feature information template in the database to determine whether the identity feature information is stored in the database. If so, the verification is successful, and the corresponding user identity information is read; otherwise, the verification fails.

[0023] The token information is verified as follows: if the user enters the correct password into the cloud data center within a specified time, the verification is successful; otherwise, the verification fails.

[0024] The device information verification method is as follows: the device's hardware information is encrypted using a private key of an asymmetric encryption algorithm pre-allocated by the cloud data center, and the cloud data center decrypts it using the corresponding public key; if decryption is successful, the device information verification is successful; if decryption fails, the device information verification fails.

[0025] As another improvement of the present invention, step S4 specifically includes the following steps:

[0026] S41: Collect the historical request data of the current user who initiated the request, and generate the user's access habits based on the historical request data; the request data includes the user's request time period, the requested file, the requested file type, the requested operation type on the file, the request frequency, and the file operation duration;

[0027] S42: Pre-set the observation duration threshold T, and collect the request frequency, requested security area, requested file information, and requested file operations of the current device that initiated the request within the most recent observation duration threshold T;

[0028] S43: If the request does not conform to the user's access habits, and the frequency of the request issued by the device exceeds the preset frequency threshold f, the requested security area is not authorized for access, the requested file is not authorized for access, or the operation on the requested file is a dangerous operation, the request status is determined to be abnormal; otherwise, the request status is determined to be normal.

[0029] As a further improvement of the present invention, the method for determining whether the device belongs to the remote control anomaly in step S6 is as follows: the average network traffic per unit time, the system resource occupancy ratio, the number of open dangerous ports in the system, and the number of unknown IP addresses connected within the observation time threshold T are respectively marked as n, p, d, and i, and subjected to formula analysis, x = a1*n + a2*p + a3*d + a4*i; the anomaly coefficient x is obtained, where a1, a2, a3, and a4 are preset proportional coefficients, and all of them are greater than 0; an anomaly coefficient threshold is set. If the anomaly coefficient x is greater than the anomaly coefficient threshold, the device is determined to belong to the remote control anomaly; if the anomaly coefficient x is less than or equal to the anomaly coefficient threshold, the device is determined not to belong to the remote control anomaly.

[0030] As a further improvement of the present invention, the method for updating the access permissions of devices that have connection and interaction with the device in step S7 in the access control table is as follows:

[0031] When a device is determined to be an anomaly related to remote control, the cloud data center presets an observation duration threshold. Within the observation duration threshold prior to the current time, it monitors the network connection relationship between all devices in the access control table and the device in question, and adds devices with network connections to the device in question to the observation device set. It then recursively searches the access control table for devices with network connections to the device in question and adds them to the observation device set until the remaining devices in the access control table no longer have network connections with the devices in the observation device set, at which point the search stops.

[0032] For devices in the observed device set, set the security level of their sent requests to the highest risk permission threshold.

[0033] To achieve the above objectives, the present invention also adopts the following technical solution: a user trust measurement system in a zero-trust network environment, comprising an information collection module, a network risk assessment module, an identity verification module, a request status judgment module, and a request response module; the modules are connected to each other via electrical and / or wireless network means;

[0034] The information collection module collects user information, token information, device information, and system information in advance, and generates an access control list; it sends the user information, token information, and device information to the authentication module, and sends the system information and access control list to the request and response module.

[0035] When a device sends a request, the network risk assessment module collects the device's network environment information, performs a risk assessment for the request based on the network environment information, and sends the risk assessment result to the request response module.

[0036] The authentication module authenticates the requests sent by the device and sends the authentication result to the request-response module;

[0037] The request status determination module determines the request status based on the user's and device's historical access data, and sends the request status to the request response module.

[0038] The request response module determines whether the request is authorized based on the authentication result and request status of the request. In the event of a device malfunction, it determines whether the device is subject to remote control based on the abnormal behavior of the device. If the device is subject to remote control, it updates the access permissions of devices that have connections with the device in the access control table based on the network connection relationship of the device.

[0039] Compared with the prior art, the present invention has the following advantages:

[0040] (1) The present invention pre-establishes an access control table, sets permission levels for each file, each user and device, and when a user sends a request using a device, obtains the current network environment of the device, authenticates the request, and obtains the request status based on the historical access data of the user and device. Based on the authentication result and request status of the request, it is determined whether the request is authorized. For requests that are not authorized, it is determined whether the device belongs to the remote control anomaly based on the abnormal behavior of the device. For requests that belong to the remote control anomaly, the access permissions of devices that have connections and interactions with the device in the access control table are updated.

[0041] (2) Based on the user's historical access habits and the device's historical request data, the present invention proposes a method for judging whether the request status is abnormal, which solves the problem of trust measurement for individual user requests;

[0042] (3) Furthermore, under the condition of an abnormal user request, the present invention further restricts the permission level of devices connected to the device by means of the network connection relationship of the device, thereby reducing the risk of network attack spread. Attached Figure Description

[0043] Figure 1 This is a flowchart illustrating the steps of the user trust measurement method in a zero-trust network environment according to the present invention.

[0044] Figure 2 This is a diagram showing the module connection relationships of the user trust measurement system in a zero-trust network environment according to the present invention. Detailed Implementation

[0045] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are for illustrative purposes only and are not intended to limit the scope of the present invention.

[0046] Example 1

[0047] Methods for measuring user trust in zero-trust network environments, such as Figure 1 As shown, it includes the following steps:

[0048] Step S1: Collect user information, token information, device information, and system information in advance, and generate an access control list;

[0049] The user information refers to the identity features of each user, including but not limited to facial feature data, fingerprint feature data, or iris feature data. The cloud data center pre-sets a database of identity feature information templates, storing the correspondence between each user's identity information and the template. When a user initiates a request, the system compares the identity feature information in the user information with the template in the database to determine if the identity feature information is stored in the database. If so, the verification is successful, and the corresponding user identity information is retrieved; otherwise, the verification fails.

[0050] The token information is a temporary, one-time, and dynamic password provided by the cloud data center when the user initiates a request; verification can only be passed if the user enters the correct password into the cloud data center within a specified time; specifically, the token information includes, but is not limited to, time synchronization tokens and challenge-response tokens;

[0051] The device information refers to the hardware information of the device used when the user initiates a request using the device. Specifically, the hardware information includes, but is not limited to, the device's physical address, device model, and device owner. The device's hardware information can also be encrypted using a private key of an asymmetric encryption algorithm pre-allocated by the cloud data center, while the cloud data center decrypts it using the corresponding public key. If decryption is successful, the device information verification is successful; otherwise, the device information verification fails.

[0052] The system information refers to the file permission information in the cloud data center. Specifically, the permission information includes the security zone where the file is located, the file's access permissions, and the operation permissions. The security zone is a number of independent storage areas after the cloud data center's file system is micro-segmented. Each user and device is only allowed to access one of the security zones. An example of file access permissions and operation permissions is that some files only have read permissions, or some files only allow access to certain personnel, etc.

[0053] The access control list is a pre-generated permission list based on personnel, device, and file permissions. It is used to control file access. Specifically, the access control list includes the permission level of each file, the user's permission level, and the device's permission level. The file's permission level is the security level required to read or manipulate the file. The user's and device's permission levels are preset security levels within their respective security zones. It can be understood that a user or device only has the right to access a file if its security level is greater than the security level required to access it.

[0054] Step S2: When a device sends a request, it collects the device's network environment information and performs a risk assessment on the request based on this information. Specifically, based on the location of the device used to initiate the request and the name of the network it is connected to, it determines whether the network the device is connected to is a public area network. If the network is a public area network, the request is classified as a risky request; otherwise, it is classified as a secure request. A maximum risk permission threshold is pre-set. When the request is classified as a risky request, the security level of the request is set to the maximum risk permission threshold. The public area refers to areas with public attributes such as cafes, train stations, and airports. Networks in public areas, due to their openness, can pose significant network security risks.

[0055] Step S3: The cloud data center authenticates the requests sent by the devices; the authentication includes verification of user information, verification of token information, and verification of device information.

[0056] The user information verification method is as follows: The cloud data center pre-sets a database of identity feature information templates, which stores the correspondence between each user's identity information and the identity feature information template; when a user initiates a request, the identity feature information in the user information is compared with the identity feature information template in the database to determine whether the identity feature information is stored in the database. If so, the verification is successful, and the corresponding user identity information is read; otherwise, the verification fails.

[0057] The token information is verified as follows: if the user enters the correct password into the cloud data center within the specified time, the verification is successful; otherwise, the verification fails.

[0058] The device information verification method is as follows: the device's hardware information is encrypted using a private key of an asymmetric encryption algorithm pre-allocated by the cloud data center, and the cloud data center decrypts it using the corresponding public key; if decryption is successful, the device information verification is successful; if decryption fails, the device information verification fails.

[0059] The user identity information corresponding to the user information read may not be the same user as the holder contained in the device information. In this case, following the principle of least privilege in zero-trust networks, the security level of the request is set to the lower of the user's security level and the device's security level.

[0060] Step S4: The cloud data center determines the request status based on the user's and device's historical access data; this step specifically includes:

[0061] S41: Collect the historical request data of the current user who initiated the request, and generate the user's access habits based on the historical request data; the request data includes the user's request time period, the requested file, the requested file type, the requested operation type on the file, the request frequency, and the file operation duration, etc.; preferably, the access habits can be obtained by using the user's historical request data as input to a machine learning model to train a machine learning model that judges whether the request conforms to the user's access habits based on the request data.

[0062] S42: Pre-set the observation duration threshold T, and collect the request frequency, requested security area, requested file information, and requested file operations of the current device that initiated the request within the most recent observation duration threshold T;

[0063] S43: If the request does not conform to the user's access habits, and the frequency of the request issued by the device exceeds the preset frequency threshold f, the requested security area is not authorized for access, the requested file is not authorized for access, or the operation on the requested file is a dangerous operation, the request status is determined to be abnormal; otherwise, the request status is determined to be normal.

[0064] One way to determine that a request does not conform to a user's access habits is to input the request data into the aforementioned machine learning model to determine whether the request data conforms to the user's access habits.

[0065] The dangerous operation can be an operation that endangers the security of file information, such as deleting files, taking screenshots, or deleting content.

[0066] Step S5: Based on the authentication result and request status of the request, determine whether the request is authorized. If authorization is not allowed, mark the device corresponding to the request as an abnormal device, reject the response to the request, and proceed to step S6; otherwise, based on the risk assessment and the security level of the request, and according to the content of the request, generate the corresponding response; wherein, the security level of the request is the lower of the user's security level and the device's security level.

[0067] Therefore, when determining whether a request is authorized, authorization is granted if and only if the request is successfully authenticated and the request status is normal.

[0068] Step S6: Based on the abnormal behavior of the device, determine whether the device belongs to the category of remote control anomalies. If it does not belong to the category of remote control anomalies, the cloud data center refuses to accept the device's request; otherwise, proceed to step S7.

[0069] Abnormal behaviors include: average network traffic per unit time, system resource utilization ratio, number of open dangerous system ports, and number of unknown IP addresses connected within the observation duration threshold T. The average network traffic per unit time, system resource utilization ratio, number of open dangerous system ports, and number of unknown IP addresses connected are obtained by a pre-installed monitoring program on the device after a monitoring command is sent from the cloud data center. Dangerous system ports are network ports on the device that pose security threats and are pre-defined by those skilled in the art. Unknown IP addresses refer to IP addresses connected to the device that are not included in the access control list. If any of these abnormal behaviors are present, the device is considered to be in a remote control anomaly category.

[0070] The above indicators are labeled as n, p, d, and i, respectively, and then analyzed using a formula: x = a1*n + a2*p + a3*d + a4*i. The anomaly coefficient x is calculated, where a1, a2, a3, and a4 are preset proportional coefficients, and all of them are greater than 0. An anomaly coefficient threshold is set. If the anomaly coefficient x is greater than the anomaly coefficient threshold, the device is determined to be an anomaly of being remotely controlled. If the anomaly coefficient x is less than or equal to the anomaly coefficient threshold, the device is determined not to be an anomaly of being remotely controlled.

[0071] Step S7: Based on the network connection relationship of the device, update the access permissions of devices that have connection and interaction with the device in the access control table;

[0072] When a device is determined to be an anomaly related to remote control, the cloud data center presets an observation duration threshold. Within the observation duration threshold prior to the current time, it monitors the network connection relationship between all devices in the access control table and the device in question, and adds devices with network connections to the device in question to the observation device set. It then recursively searches the access control table for devices with network connections to the device in question and adds them to the observation device set until the remaining devices in the access control table no longer have network connections with the devices in the observation device set, at which point the search stops.

[0073] For devices in the observed device set, set the security level of their sent requests to the highest risk permission threshold.

[0074] Step S8: The cloud data center records the request data for this device's request.

[0075] Example 2

[0076] User trust measurement systems in zero-trust network environments, such as Figure 2 As shown, it includes an information collection module, a network risk assessment module, an identity verification module, a request status judgment module, and a request response module; wherein, the modules are connected to each other via electrical and / or wireless network means;

[0077] The information collection module pre-collects user information, token information, device information, and system information, and generates an access control list. It then sends the user information, token information, and device information to the authentication module, and the system information and access control list to the request response module. When a device sends a request, the network risk assessment module collects the device's network environment information, performs a risk assessment based on this information, and sends the assessment result to the request response module. The authentication module authenticates the request sent by the device and sends the authentication result to the request response module. The request status judgment module determines the request status based on the user's and device's historical access data and sends the status to the request response module. The request response module determines whether authorization is allowed based on the authentication result and request status. Furthermore, in the event of a device malfunction, it determines whether the device is subject to remote control anomalies based on the device's abnormal behavior. If the device is subject to remote control anomalies, it updates the access permissions of devices connected to the device in the access control list based on the device's network connectivity.

[0078] The system in this embodiment collects user information, token information, device information, and system information in advance and generates an access control list. When a device sends a request, a risk assessment is performed on the request, followed by authentication. Based on historical access data, the request status is determined. Based on the authentication result and request status, it is determined whether authorization is allowed. If authorization is not allowed, the request is marked as a device anomaly. Based on the device's abnormal behavior, it is determined whether the device belongs to the category of remote control anomalies. If so, the access permissions of devices connected to the device in the access control list are updated. Under the condition of a single abnormal user request, this system restricts the permission level of devices connected to the device through the device's network connection relationship, reducing the risk of network attack propagation.

[0079] It should be noted that the above content merely illustrates the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. For those skilled in the art, various improvements and modifications can be made without departing from the principle of the present invention, and all such improvements and modifications fall within the scope of protection of the claims of the present invention.

Claims

1. A method for measuring user trust in a zero trust network environment, characterized in that, Includes the following steps: S1: Collect user information, token information, device information, and system information in advance, and generate an access control list; S2: When a device sends a request, it collects the device's network environment information and performs a risk assessment for the request based on the network environment information; S3: The cloud data center authenticates the requests sent by the device; S4: The cloud data center determines the request status based on the user's and device's historical access data; S5: Based on the authentication result and request status of the request, determine whether the request is authorized. If authorization is not allowed, mark the device corresponding to the request as an abnormal device, reject the response to the request, and proceed to step S6; otherwise, based on the risk assessment and the security level of the request, and according to the content of the request, generate the corresponding response. If the user's security level is lower than the device's security level, then the user's security level will be defined as the requested security level. If the user's security level is higher than the device's security level, then the device's security level will be defined as the requested security level. S6: Based on the abnormal behavior of the abnormal device, determine whether the device belongs to the category of remote control anomalies. If it does not belong to the category of remote control anomalies, the cloud data center refuses to accept the device's request; otherwise, proceed to step S7. The specific method for determining whether a device belongs to the category of remote control anomalies is as follows: the average network traffic per unit time, the system resource utilization ratio, the number of open dangerous ports in the system, and the number of unknown IP addresses connected within the observation time threshold T are respectively labeled as n, p, d, and i, and subjected to formula analysis, x=a1*n+a2*p+a3*d+a4*i; the anomaly coefficient x is obtained, where a1, a2, a3, and a4 are preset proportional coefficients, and all of them are greater than 0; an anomaly coefficient threshold is set. If the anomaly coefficient x is greater than the anomaly coefficient threshold, the device is determined to belong to the category of remote control anomalies; if the anomaly coefficient x is less than or equal to the anomaly coefficient threshold, the device is determined not to belong to the category of remote control anomalies. S7: Based on the network connection relationship of this device, update the access permissions of devices that have connection and interaction with this device in the access control table; S8: The cloud data center records the request data for this device's request.

2. The method of claim 1, wherein: In step S1, the user information is the identity feature information of each user; The token information is a temporary, one-time dynamic password provided by the cloud data center when the user initiates a request; The device information refers to the device hardware information used when a user initiates a request using the device, including at least the device's physical address and the device's owner.

3. The method of claim 2, wherein: The system information in step S1 is the file permission information in the cloud data center, including the security zone where the file is located, the file access permissions, and the operation permissions; the security zone is a number of independent storage areas after the file system of the cloud data center is micro-segmented; each user and device is only allowed to access one of the security zones.

4. The user trust measurement method in a zero-trust network environment as described in claim 2 or 3, characterized in that: The access control list in step S1 is a permission list pre-generated based on personnel, device, and file permissions, used to control file access; the access control list includes the permission level of each file, the permission level of the user, and the permission level of the device; the permission level of the file is the security level required to read or operate the file, and the permission level of the user and the permission level of the device are preset security levels within their respective security zones.

5. The user trust measurement method in a zero-trust network environment as described in claim 4, characterized in that: The risk assessment in step S2 specifically involves: determining whether the network connected to the device is a public area network based on the location of the device used to initiate the request and the name of the network it is connected to; if the network connected to the device is a public area network, the request is judged as a risky request; otherwise, the request is judged as a safe request. A maximum risk permission threshold is preset. When a request is determined to be a risky request, its security level is set to the maximum risk permission threshold.

6. The user trust measurement method in a zero-trust network environment as described in claim 5, characterized in that: The authentication in step S3 includes the authentication of user information, the authentication of token information, and the authentication of device information. The user information verification method is as follows: The cloud data center pre-sets a database of identity feature information templates, and stores the correspondence between each user's identity information and the identity feature information template in the database; when a user initiates a request, the identity feature information in the user information is compared with the identity feature information template in the database to determine whether the identity feature information is stored in the database. If so, the verification is successful, and the corresponding user identity information is read; otherwise, the verification fails. The token information is verified as follows: if the user enters the correct password into the cloud data center within a specified time, the verification is successful; otherwise, the verification fails. The device information verification method is as follows: the device's hardware information is encrypted using a private key of an asymmetric encryption algorithm pre-allocated by the cloud data center, and the cloud data center decrypts it using the corresponding public key; if decryption is successful, the device information verification is successful; if decryption fails, the device information verification fails.

7. The user trust measurement method in a zero-trust network environment as described in claim 6, characterized in that: Step S4 specifically includes the following steps: S41: Collect the historical request data of the current user who initiated the request, and generate the user's access habits based on the historical request data; the request data includes the user's request time period, the requested file, the requested file type, the requested operation type on the file, the request frequency, and the file operation duration; S42: Pre-set the observation duration threshold T, and collect the request frequency, requested security area, requested file information, and requested file operations of the current device that initiated the request within the most recent observation duration threshold T; S43: If the request does not conform to the user's access habits, and the frequency of the request issued by the device exceeds the preset frequency threshold f, the requested security area is not authorized for access, the requested file is not authorized for access, or the operation on the requested file is a dangerous operation, the request status is determined to be abnormal; otherwise, the request status is determined to be normal.

8. The user trust measurement method in a zero-trust network environment as described in claim 7, characterized in that: The method for updating the access permissions of devices that have connections and interactions with the device in the access control table in step S7 is as follows: When a device is determined to be an anomaly related to remote control, the cloud data center presets an observation duration threshold. Within the observation duration threshold prior to the current time, it monitors the network connection relationship between all devices in the access control table and the device in question, and adds devices with network connections to the device in question to the observation device set. It then recursively searches the access control table for devices with network connections to the device in question and adds them to the observation device set until the remaining devices in the access control table no longer have network connections with the devices in the observation device set, at which point the search stops. For devices in the observed device set, set the security level of their sent requests to the highest risk permission threshold.

9. A user trust measurement system in a zero-trust network environment, implementing the method as described in claim 1, characterized in that: It includes an information collection module, a network risk assessment module, an identity verification module, a request status determination module, and a request response module; the modules are connected to each other via electrical and / or wireless network means; The information collection module collects user information, token information, device information, and system information in advance, and generates an access control table; Send user information, token information, and device information to the authentication module, and send system information and access control list to the request and response module; When a device sends a request, the network risk assessment module collects the device's network environment information, performs a risk assessment for the request based on the network environment information, and sends the risk assessment result to the request response module. The authentication module authenticates the requests sent by the device and sends the authentication result to the request-response module; The request status determination module determines the request status based on the user's and device's historical access data, and sends the request status to the request response module. The request response module determines whether the request is authorized based on the authentication result and request status of the request. In the event of a device malfunction, it determines whether the device is subject to remote control based on the abnormal behavior of the device. If the device is subject to remote control, it updates the access control table based on the network connection relationship of the device.

Images