Terminal zero-trust security capability system based on trusted environment perception

Abstract

This application relates to the technical field of system security, and in particular to a terminal zero-trust security capability system based on trusted environment perception. This application provides enterprises with all-round security protection through real-time environmental perception, dynamic risk assessment and fine-grained access control; first, deploy identity agent programs on user terminals to collect and report environmental risk information in real time; then set up a security access control area, including core components such as a trusted environment perception system, an intelligent identity analysis platform and a trusted access console to assess risks, combine user behavior analysis to derive trust levels, and dynamically authorize based on risks and trust levels; finally, fine-grained access control of applications and interfaces in data subnets is achieved through trusted application agents and trusted interface agents; tightly integrate environmental perception, identity analysis and access control to form a coherent zero-trust architecture that can better respond to environmental changes and threats and improve system security.

Description

Technical Field

[0001] The present application relates to the technical field of system security, and in particular to a terminal zero-trust security capability system based on trusted environment perception. Background Art

[0002] With the rapid development of network technology, terminal security issues are becoming increasingly prominent. Traditional terminal security protection methods mainly rely on border defense, but in the face of a complex and changing threat environment, its effectiveness is gradually weakening. As an emerging security architecture, the zero-trust security model emphasizes the principle of "never trust, always verify" and has become an important means to solve terminal security issues.

[0003] In existing technologies, some zero-trust security systems use static policies and fixed access control rules. These systems usually grant access rights after user authentication and keep them unchanged during the session. At the same time, some systems use network segmentation and micro-isolation technologies to limit the impact of potential attacks and implement role-based access control to manage user permissions.

[0004] However, the existing zero-trust security system lacks the ability to perceive the real-time security status of terminal devices, is unable to promptly detect and respond to changes in the terminal environment, and is difficult to achieve accurate risk assessment and response. This situation needs to be further improved. Summary of the invention

[0005] In order to solve the problem that the existing zero-trust security system cannot timely discover and respond to changes in the terminal environment, and it is difficult to achieve accurate risk assessment and response, this application provides a terminal zero-trust security capability system based on trusted environment perception, which adopts the following technical solutions:

[0006] In a first aspect, the present application provides a terminal zero-trust security capability system based on trusted environment perception, the system comprising:

[0007] User subnet: includes identity agent programs installed on user terminals, used to report environmental risk perception information in real time;

[0008] Secure access controlled areas including:

[0009] A trusted environment perception system, used to receive and evaluate the environmental risk perception information, obtain risk assessment results, and provide the risk assessment results to the intelligent identity analysis platform;

[0010] An intelligent identity analysis platform for analyzing user behavior, combining the risk assessment results, obtaining comprehensive trust level information, and providing the trust level information to the trusted access console;

[0011] A trusted access console, used to receive the trust level information and dynamically authorize the trusted application agent and the trusted interface agent based on real-time calculation;

[0012] Trusted application proxy, which is used to implement fine-grained access control to applications based on the authorization of the trusted access console;

[0013] Trusted interface agent, used to implement fine-grained access control to interfaces based on the authorization of the trusted access console;

[0014] Data subnet: includes applications and interface services that need to be protected, and access to the data subnet is controlled by a trusted application agent and a trusted interface agent.

[0015] By adopting the above technical solutions, in the case of increasingly common remote work, employees may access enterprise resources from different locations and use various devices, which makes the traditional fixed boundary protection method no longer effective; in addition, internal threats and advanced persistent threats are also increasing. This application proposes a terminal zero-trust security capability system based on trusted environment perception, which provides all-round security protection for enterprises through real-time environment perception, dynamic risk assessment and fine-grained access control without relying on traditional network boundaries; first, deploy identity agent programs on user terminals to collect and report environmental risk information in real time; then set up a security access control area, including core components such as a trusted environment perception system, an intelligent identity analysis platform and a trusted access console, among which the trusted environment perception system assesses risks, the intelligent identity analysis platform combines user behavior analysis to derive trust levels, and the trusted access console performs dynamic authorization based on this information; finally, fine-grained access control of applications and interfaces in the data subnet is achieved through trusted application agents and trusted interface agents; tightly integrate environmental perception, identity analysis and access control to form a coherent zero-trust architecture, which can better respond to environmental changes and threats and improve system security.

[0016] Optionally, the environmental risk perception information includes hardware information, software information, network information and geographic location information of the user terminal.

[0017] By adopting the above technical solutions, traditional security systems often only focus on a single or limited number of aspects, such as only checking whether the device has installed the latest security patch; however, this one-sided evaluation method cannot capture the full picture of the terminal environment and is prone to security vulnerabilities. For example, a laptop with the latest security patch installed may be using an insecure public Wi-Fi network or located in a high-risk geographical location. These factors may significantly increase security risks; this application comprehensively collects and analyzes multi-dimensional information of user terminals, including hardware information, software information, network information and geographical location information, to build a complete terminal security portrait, which can provide a more comprehensive and accurate risk assessment.

[0018] Optionally, the trusted environment perception system includes:

[0019] A dynamic feature importance evaluator, used to analyze in real time the contribution of each environmental factor in the environmental risk perception information to the risk assessment and automatically adjust the feature weight;

[0020] A multi-scenario risk model coordinator includes risk assessment models for different environmental scenarios, and is used to dynamically select and fuse model outputs based on the current scenario and the feature weights.

[0021] By adopting the above technical solutions, since traditional systems often use static weights and fixed models, they are prone to misjudgment or lag when facing a rapidly changing network environment; for example, in a real network attack case, the traditional system failed to promptly identify the attacker's behavior of evading detection through dynamic IP switching and behavior imitation, resulting in a security incident; the present application uses a dynamic feature importance evaluator to analyze the contribution of environmental factors to risks in real time; and uses a multi-scenario risk model collaborator to select and fuse appropriate evaluation models according to the current scenario and adjusted feature weights, which can quickly adapt to environmental changes, improve the accuracy and real-time performance of risk assessment, and optimize system resource usage.

[0022] Optionally, the dynamic feature importance evaluator includes:

[0023] A fast weight calculation module is used to perform initial weight calculation on environmental factors to obtain initial weights;

[0024] A feature interaction analysis module is used to analyze the interaction relationship between the features of various environmental factors according to the initial weights to obtain feature interaction analysis results;

[0025] A feature set optimization module, used for dynamically adjusting the feature set based on the feature interaction analysis result;

[0026] The weight update module is used to recalculate the weights of environmental factors based on the adjusted feature set;

[0027] The contribution assessment module is used to determine the contribution of each environmental factor to the risk assessment based on the updated weights.

[0028] By adopting the above technical scheme, traditional methods usually adopt static or simple linear feature weight calculation methods, which cannot effectively capture the complex interactive relationships and dynamic changes between features, resulting in inaccurate risk assessment results; for example, in an actual network security incident, the traditional system failed to identify the advanced persistent threat attack carried out by the attacker by cleverly using a combination of multiple seemingly unrelated low-risk factors, resulting in serious data leakage; the present application performs initial weight calculation through a fast weight calculation module; uses a feature interaction analysis module to deeply analyze the nonlinear relationship between features; then, uses a feature set optimization module to dynamically adjust the feature set according to the analysis results; then, recalculates the weight based on the optimized feature set through a weight update module; finally, determines the actual contribution of each factor to the risk assessment through a contribution evaluation module, thereby realizing a highly flexible and adaptive feature importance evaluation system.

[0029] Optionally, the trusted environment perception system is further used for:

[0030] Monitor changes in terminal hardware information, record and display changes, original configurations, and new configurations;

[0031] Supports exporting terminal hardware change records.

[0032] By adopting the above technical solution, in traditional systems, when employees privately replace or upgrade terminal hardware, it may not be discovered for a long time, resulting in potential security vulnerabilities and compliance risks; this application not only records the changes, but also records the original configuration and new configuration in detail, and can export the terminal hardware change records, so that the hardware change data can be easily integrated into other security analysis and management tools, greatly improving the availability and value of the data.

[0033] Optionally, the trusted environment perception system further includes:

[0034] Threat intelligence module, which is used to receive information from external threat intelligence sources and conduct comprehensive analysis in combination with internal security perception data;

[0035] Security policy update module, used to automatically update the terminal's security policy based on the latest threat intelligence;

[0036] Anomaly pattern detectors, which continuously learn normal behavior patterns and identify environmental changes that deviate from the norm;

[0037] Adaptive sampling rate regulator, used to dynamically adjust the sampling frequency of environmental data according to the current system load and risk level.

[0038] By adopting the above technical solution, in order to quickly respond to the latest external security threats and reduce potential security vulnerabilities, this application continuously receives external threat intelligence through the threat intelligence module and conducts a comprehensive analysis with the internal security perception data; finally, the security policy update module automatically updates the terminal's security policy based on the latest threat intelligence; accurate tracking and management of terminal hardware changes are achieved, and by integrating external threat intelligence, the system's response speed and accuracy to emerging threats are improved, the system's transparency and auditability are enhanced, and the comprehensive defense capabilities of the zero-trust system against internal hardware changes and external threats are significantly improved; then, an anomaly pattern detector is used to continuously learn normal behavior patterns and identify anomalies; finally, an adaptive sampling rate regulator is used to dynamically adjust the data sampling frequency according to the system load and risk level, which can improve the accuracy and real-time nature of risk assessment, while improving the accuracy of anomaly judgment and achieving a balance between ensuring data adequacy and system performance.

[0039] Optionally, the intelligent identity analysis platform further includes:

[0040] The user access behavior analysis module is used to analyze the user's historical access records, operation behaviors and time patterns to identify potential abnormal behaviors.

[0041] By adopting the above technical solutions, due to the increasingly complex and hidden network security threats, traditional static identity authentication and simple access control strategies can no longer meet the security needs of modern enterprises; for example, a hacked account may pass regular identity authentication, but its subsequent operation behavior may be very different from the normal mode of the user. This application introduces a user behavior analysis module in the intelligent identity analysis platform, which continuously monitors and analyzes the user's behavior patterns, establishes a dynamic user portrait, and can identify potential abnormal behaviors in real time.

[0042] Optionally, the intelligent identity analysis platform further includes:

[0043] Multi-factor authentication module to support a combination of multiple authentication methods, including passwords, biometrics, hardware tokens, and software tokens;

[0044] Adaptive authentication policy engine, which dynamically adjusts the strength of authentication requirements based on the user's historical behavior, current environmental risk, and the sensitivity of the resources being accessed;

[0045] A continuous authentication module to continuously monitor and verify the user's identity during the user session;

[0046] The identity federation management module is used to support cross-organizational identity authentication and authorization.

[0047] By adopting the above technical solutions, the authentication method that only relies on passwords is vulnerable to brute force cracking or phishing attacks; fixed authentication strategies cannot adapt to security needs in different situations; single authentication cannot prevent session hijacking; and with the increasing prevalence of cross-organizational collaboration, the lack of a unified identity management mechanism will also bring security risks. This application integrates multiple authentication methods and can be flexibly combined according to specific circumstances; the system can sense and adapt to different environments and risk levels, and dynamically adjust security strategies; through continuous authentication, identity authentication is transformed from a single event to a continuous process for the entire session, which significantly improves security; at the same time, the identity federation management module solves the identity authentication problem in cross-organizational collaboration, and can minimize interference to normal users while ensuring high security.

[0048] Optionally, the intelligent identity analysis platform further includes:

[0049] User login behavior analysis module, used to collect user login behavior data and establish user behavior model through preset analysis algorithm;

[0050] The anomaly detection module is used to issue an alarm when the user login behavior is abnormal and automatically trigger further identity authentication processes.

[0051] By adopting the above technical solutions, the existing technology usually relies on static rules or simple threshold detection, which makes it difficult to effectively identify complex abnormal patterns; for example, when an attacker uses legitimate credentials to make carefully disguised login attempts, traditional systems are often unable to detect them in time, resulting in potential security vulnerabilities; this application continuously learns and updates user behavior models to adapt to natural changes in user habits, while accurately identifying potential threatening behaviors; it improves the accuracy of abnormal login detection and significantly reduces the false alarm rate.

[0052] Optionally, the trusted access control center includes:

[0053] An evaluation result processing module, used for receiving and processing the environment trust evaluation result provided by the trusted environment perception control center;

[0054] A security condition verification module, used to verify whether the user terminal meets the requirements for accessing enterprise network resources according to preset security conditions;

[0055] A dynamic authorization module, used to make dynamic authorization decisions on user access requests based on the environmental trust evaluation results and security condition verification results;

[0056] The access behavior monitoring module is used to monitor the user's access behavior in real time and feed back abnormal access behavior to the dynamic authorization module;

[0057] The risk response module is used to automatically trigger the risk response mechanism when abnormal access behavior or environmental changes are detected, including but not limited to secondary authentication requests, access permission adjustments, account freezing and device isolation.

[0058] By adopting the above technical solution, the existing technology usually adopts static access strategies, which cannot effectively cope with complex and changeable network environments and user behaviors; for example, in traditional systems, even if the user's terminal environment has undergone major changes or exhibits abnormal behavior, the original access rights may continue to be maintained, resulting in serious security risks. In this application, the evaluation result processing module first integrates and analyzes the multi-dimensional evaluation results from the trusted environment perception control center in real time, and the security condition verification module uses an intelligent rule engine to dynamically evaluate the security status of the user terminal according to the preset security policy to ensure that it meets the access requirements of the current network environment; the dynamic authorization module comprehensively considers the environmental evaluation results and the security verification results, adjusts the user's access rights in real time, and realizes dynamic authorization decisions accurate to each access request; at the same time, the access behavior monitoring module continues to run, monitors and analyzes the user's access mode in real time, and promptly identifies potential abnormal access behaviors; finally, the risk response module automatically triggers a multi-level response strategy based on the detected abnormal situation or environmental changes, from minor secondary authentication requests to strict device isolation, flexibly responding to security threats of varying degrees, forming a closed-loop adaptive security management system, and reducing the risk of over-authorization or abuse of authority.

[0059] In summary, the present application includes at least one of the following beneficial technical effects:

[0060] This application provides all-round security protection for enterprises through real-time environmental perception, dynamic risk assessment and fine-grained access control without relying on traditional network boundaries. First, deploy identity agent programs on user terminals to collect and report environmental risk information in real time. Then set up a secure access control area, which includes core components such as a trusted environmental perception system, an intelligent identity analysis platform and a trusted access console. Among them, the trusted environmental perception system assesses risks, the intelligent identity analysis platform combines user behavior analysis to derive trust levels, and the trusted access console performs dynamic authorization based on this information. Finally, fine-grained access control of applications and interfaces in the data subnet is achieved through trusted application agents and trusted interface agents. Tightly integrate environmental perception, identity analysis and access control to form a coherent zero-trust architecture that can better respond to environmental changes and threats and improve system security.

[0061] Since traditional systems often use static weights and fixed models, they are prone to misjudgment or lag when facing a rapidly changing network environment. For example, in a real network attack case, the traditional system failed to promptly identify the attacker's behavior of evading detection through dynamic IP switching and behavior imitation, resulting in a security incident. This application uses a dynamic feature importance evaluator to analyze the contribution of environmental factors to risks in real time. It uses a multi-scenario risk model coordinator to select and fuse appropriate evaluation models based on the current scenario and adjusted feature weights, which can quickly adapt to environmental changes, improve the accuracy and real-time performance of risk assessment, and optimize system resource usage.

[0062] Traditional methods usually use static or simple linear feature weight calculation methods, which cannot effectively capture the complex interactions and dynamic changes between features, resulting in inaccurate risk assessment results; for example, in an actual network security incident, the traditional system failed to identify the advanced persistent threat attack carried out by the attacker by cleverly using a combination of multiple seemingly unrelated low-risk factors, resulting in serious data leakage; the present application performs initial weight calculations through a fast weight calculation module; uses a feature interaction analysis module to deeply analyze the nonlinear relationship between features; then, uses a feature set optimization module to dynamically adjust the feature set according to the analysis results; then, recalculates the weights based on the optimized feature set through a weight update module; finally, determines the actual contribution of each factor to the risk assessment through a contribution evaluation module, thereby realizing a highly flexible and adaptive feature importance evaluation system. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 It is a structural diagram of a terminal zero-trust security capability system based on trusted environment perception in an embodiment of the present application;

[0064] Figure 2 It is a module schematic diagram of a trusted environment perception system in a terminal zero-trust security capability system based on trusted environment perception in an embodiment of the present application;

[0065] Figure 3 It is a module schematic diagram of a dynamic feature importance evaluator in a terminal zero-trust security capability system based on trusted environment perception in an embodiment of the present application;

[0066] Figure 4 It is a module schematic diagram of an intelligent identity analysis platform in a terminal zero-trust security capability system based on trusted environment perception in an embodiment of the present application;

[0067] Figure 5 It is a module diagram of a trusted access console in a terminal zero-trust security capability system based on trusted environment perception in an embodiment of the present application. DETAILED DESCRIPTION

[0068] The terms used in the following embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to be used as limitations to the present application. As used in the specification and appended claims of the present application, the singular expressions "one", "a kind of", "said", "above", "the" and "this" are intended to also include plural expressions, unless there is a clear indication to the contrary in the context. It should also be understood that the term "and / or" used in the present application refers to any or all possible combinations comprising one or more listed items.

[0069] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

[0070] The embodiments of the present application are further described in detail below in conjunction with the drawings in the specification.

[0071] In the first aspect, the present application provides a terminal zero-trust security capability system based on trusted environment perception, such as Figure 1 As shown in the figure, the system consists of three parts: user subnet, security access control area and data subnet, forming a complete zero-trust ecosystem.

[0072] User subnet: includes terminals / personnel, which are accessed through the application of a special software program Agent installed on the user terminal device. The Agent sends environmental risk perception information to the trusted environment perception system;

[0073] Security access control area: As the core area, it includes the following modules and links:

[0074] Load balancing HA: Receives application access requests from users.

[0075] Trusted application proxy HA: receives service load from the load balancing HA and initiates application access to the application in the data subnet;

[0076] Trusted environment perception system: receives environmental risk perception information from the agent and reports risk events to the intelligent identity analysis platform;

[0077] Intelligent identity analysis platform: receives risk event information and sends trust levels to the trusted access console;

[0078] Trusted Access Console: Dynamically authorizes trusted application proxy HA and trusted API proxy based on trust level;

[0079] Trusted API proxy: receives dynamic authorization and initiates API calls to the API service of the data subnet;

[0080] Data subnet:

[0081] Contains various applications and API services; receives application access from the trusted application agent HA and API calls from the trusted API agent;

[0082] PKI / CA system: bidirectionally communicates with the trusted access console and provides certificate management services.

[0083] Since the one-sided evaluation method cannot capture the full picture of the terminal environment, it is easy to cause security vulnerabilities. Therefore, in this embodiment, environmental risk perception information is a key data source for evaluating the terminal security status, including but not limited to the hardware information, software information, network information and geographic location information of the user terminal. Specifically, hardware information includes CPU model, number of cores and main frequency, memory size and usage, hard disk model, capacity and usage, network card information (wired / wireless) and external devices (such as USB devices); software information includes IP address (intranet and public network), MAC address, DNS server, proxy settings, VPN connection status, network traffic statistics; geographic location information includes GPS coordinates (if available), IP geographic location, time zone and known location (such as home, office) matching degree; by comprehensively collecting and analyzing the multi-dimensional information of the user terminal, including hardware information, software information, network information and geographic location information, a complete terminal security portrait is constructed, which can provide a more comprehensive and accurate risk assessment.

[0084] In one embodiment, referring to Figure 2 , the trusted environment perception system includes:

[0085] Dynamic feature importance evaluator is used to analyze the contribution of various environmental factors to risk assessment in real time and automatically adjust feature weights.

[0086] Specifically, the dynamic feature importance evaluator first collects environmental risk perception information such as the user terminal's hardware status, software configuration, network connection status, and geographic location from the user terminal, including but not limited to hardware configuration, operating system version, installed software list, network connection type, IP address, geographic location, etc. Then, a feature extraction algorithm is used to extract key features from these raw data, and a machine learning algorithm is used to calculate the initial feature weights. The evaluator also integrates an online learning algorithm, and then continuously updates the feature weights based on the newly collected data, and finally calculates the contribution of each feature to the risk assessment based on the updated weights.

[0087] A multi-scenario risk model collaborator, which contains dedicated risk assessment models for different environmental scenarios, is used to dynamically select and fuse model outputs based on the current scenario dynamics and feature weights.

[0088] In this embodiment, the multi-scenario risk model collaborator selects and applies corresponding risk assessment models according to different environmental scenarios, such as office environment, public Wi-Fi environment, remote office environment, etc.

[0089] Specifically, the multi-scenario risk model collaborator first uses a scenario recognition algorithm, such as classifying the current environment based on preset rules. According to the identified scenario, the collaborator selects the corresponding risk assessment model from the pre-trained model library, including models for network security, models for physical security, models for data sensitivity, etc., and then combines the feature weights adjusted by the dynamic feature importance evaluator to evaluate the environmental risk perception information and obtain the risk assessment results.

[0090] Furthermore, the trusted environment perception system also includes:

[0091] The threat intelligence module is used to receive information from external threat intelligence sources and conduct comprehensive analysis in combination with internal security perception data.

[0092] In this embodiment, the threat intelligence module, as an important component of the trusted environment perception system, can receive and process information from multiple trusted threat intelligence sources in real time, and combine this external intelligence with the security data collected within the system for in-depth analysis and correlation.

[0093] Specifically, the threat intelligence module first obtains the latest threat information from multiple external threat intelligence sources through APIs or other secure channels. The intelligence sources may include national cybersecurity centers, industry-specific threat intelligence sharing platforms, and commercial threat intelligence service providers. The received raw intelligence data is formatted and deduplicated, and then correlated with the system's internal security logs, network traffic data, etc. for analysis.

[0094] The security policy update module is used to automatically update the terminal's security policy based on the latest threat intelligence.

[0095] Specifically, the security policy update module first receives the analysis report from the threat intelligence module, and based on the analysis report, uses the predefined policy template and rule engine to automatically generate new security policies or update existing policies. For example, if a new malware threat is detected, the module may generate new file access control rules or network filtering policies. The generated policies are subject to conflict detection to ensure that there is no conflict with existing policies.

[0096] Anomaly pattern detectors are used to continuously learn normal behavior patterns and identify environmental changes that deviate from the norm.

[0097] In this embodiment, the abnormal pattern detector establishes a baseline behavior model by continuously learning and analyzing normal behavior patterns of users and systems.

[0098] Specifically, the abnormal pattern detector first preprocesses the collected environmental data, including data cleaning, standardization and other steps. Then it uses an unsupervised learning algorithm to learn normal behavior patterns. During real-time monitoring, the detector calculates the deviation between the newly collected data and the learned normal pattern. If the deviation exceeds the preset threshold, the system will determine it as abnormal.

[0099] Adaptive sampling rate regulator, used to dynamically adjust the sampling frequency of environmental data according to the current system load and risk level.

[0100] In this embodiment, the adaptive sampling rate regulator achieves a balance between ensuring data adequacy and system performance by intelligently adjusting the sampling frequency of environmental data. When the system load is high or the risk level is low, the sampling frequency is reduced to reduce system pressure; when the risk level increases, the sampling frequency is increased to obtain more timely and detailed environmental information.

[0101] Specifically, the adaptive sampling rate regulator first monitors the system resource usage in real time, including CPU utilization and memory utilization. At the same time, it receives the current risk level information. Based on the CPU utilization, memory utilization and current risk level information, the regulator calculates the optimal sampling rate using predefined rules.

[0102] Furthermore, the trusted environment perception system is also used to:

[0103] Monitor changes in terminal hardware information, record and display changes, original configurations, and new configurations.

[0104] Specifically, the system collects hardware information by regularly scanning terminal devices, including but not limited to detailed configurations of components such as processors, memory, storage devices, and network adapters. Each scan result is compared with the previous record to identify changes. When a change is detected, the system records the details of the change, including the changed item, the original configuration, and the new configuration. The system also integrates an alarm mechanism, which can promptly notify relevant personnel through preset channels when important hardware changes occur.

[0105] Supports exporting terminal hardware change records.

[0106] In this embodiment, the trusted environment perception system can not only monitor and record changes in terminal hardware information, but also provide the function of exporting these change records, so that administrators can more conveniently perform offline analysis, report generation and long-term archiving. The export function supports a variety of common formats, ensuring the portability and ease of use of data, and meeting the needs of different scenarios, such as auditing, compliance inspection, asset management, etc.

[0107] In one embodiment, referring to Figure 3 , the dynamic feature importance estimator includes:

[0108] The fast weight calculation module is used to perform initial weight calculation on environmental factors to obtain initial weights.

[0109] Specifically, the fast weight calculation module collects various environmental factor data from the system, including but not limited to hardware status, software configuration, network connection status, and geographic location. Then, a lightweight machine learning algorithm is used to quickly analyze this data, evaluate the impact of each factor on the target variable, and calculate the initial weight of each factor. At the same time, historical data is used for pre-training, and weights are adjusted when new data arrives.

[0110] The feature interaction analysis module is used to analyze the interaction relationship between the features of various environmental factors according to the initial weights to obtain the feature interaction analysis results.

[0111] In this embodiment, after obtaining the initial weights, the feature interaction analysis module further analyzes the complex interaction relationship between environmental factors, that is, between features.

[0112] Specifically, the feature interaction analysis module uses statistical algorithms to determine the nonlinear relationship between features and preliminarily screens out potential related feature pairs. For example, after using mutual information analysis, it is found that the network connection type and geographic location have high mutual information values, time and geographic location have medium mutual information values, and device type and network connection type have low mutual information values. The decision tree integration method is then used to further quantify the interaction intensity between features.

[0113] The feature set optimization module is used to dynamically adjust the feature set based on the results of feature interaction analysis.

[0114] In this embodiment, after obtaining the feature interaction analysis results, the feature set optimization module intelligently adjusts the current feature set to reduce the complexity of the feature set.

[0115] The weight updating module is used to recalculate the weights of environmental factors based on the adjusted feature set.

[0116] Specifically, the weight update module receives the optimized feature set information, retrains the risk assessment model, calculates the importance score of each feature, and assigns a new weight to each retained environmental factor based on the importance score.

[0117] The contribution assessment module is used to determine the contribution of each environmental factor to the risk assessment based on the updated weights.

[0118] Specifically, the contribution assessment module receives the updated weight vector and current environmental data, calculates the marginal contribution of each environmental factor to the risk assessment, and generates a contribution report for each risk assessment result, including the absolute contribution value and relative contribution ratio of each factor.

[0119] In one embodiment, referring to Figure 4 , the Intelligent Identity Analytics Platform also includes:

[0120] The user access behavior analysis module is used to analyze the user's historical access records, operation behaviors and time patterns to identify potential abnormal behaviors.

[0121] Multi-factor authentication module to support a combination of multiple authentication methods, including passwords, biometrics, hardware tokens, and software tokens.

[0122] An adaptive authentication policy engine that dynamically adjusts the strength of authentication requirements based on the user's historical behavior, current environmental risk, and the sensitivity of the resources being accessed.

[0123] Specifically, the adaptive authentication policy engine collects and analyzes the user's historical behavior patterns, the current login environment, and the sensitivity of the accessed resources, and evaluates the risk score of the current access request. Based on this score, the engine dynamically selects the appropriate authentication policy. For example, if a user accesses a low-sensitivity resource from a common device during normal working hours, a simple password authentication may be required. On the contrary, if abnormal behavior is detected (such as accessing highly sensitive data from an unknown location), the engine will require stricter multi-factor authentication.

[0124] Furthermore, considering the cumulative risk, if a user attempts to access sensitive resources multiple times within a short period of time, the authentication requirements will be gradually increased.

[0125] A continuous authentication module that continuously monitors and verifies user identity during a user session.

[0126] The identity federation management module is used to support cross-organizational identity authentication and authorization.

[0127] The user login behavior analysis module is used to collect user login behavior data and establish a user behavior model through a preset analysis algorithm.

[0128] Specifically, the user login behavior analysis module collects data points related to user login, including login time, frequency, geographic location, type of device used, network environment, number of login attempts, etc., builds the user's basic login profile, including average login frequency and distribution of commonly used devices, and generates heat maps and timeline graphs of user login behavior.

[0129] The anomaly detection module is used to issue an alarm when the user login behavior is abnormal and automatically trigger further identity authentication processes.

[0130] Specifically, when an anomaly is detected, the module calculates an anomaly score that reflects the degree of deviation from normal behavior. Based on the score and the preset threshold, it is decided whether to trigger an alarm. In this embodiment, the alarm levels include low, medium, and high, and each level corresponds to a different response strategy. For low-level alarms, the system records and notifies the security team. Intermediate alarms trigger additional identity authentication steps, requiring users to answer security questions or perform two-factor authentication. High-level alarms will cause the account to be temporarily locked and the security administrator will be notified immediately.

[0131] In one embodiment, referring to Figure 5 , the Trusted Access Console includes:

[0132] The assessment result processing module is used to receive and process the risk assessment results provided by the trusted environment perception system.

[0133] The security condition verification module is used to verify whether the user terminal meets the requirements for accessing enterprise network resources based on preset security conditions.

[0134] Specifically, the security condition verification module first defines a set of comprehensive security check items. These check items include operating system version and patch level, antivirus software status, firewall configuration, hard disk encryption status, installed application list, device jailbreak / root status, recent system logs, etc. The module uses preset verification rules to evaluate each check item. When all check items are evaluated and passed, it is determined that the requirements for accessing corporate network resources are met.

[0135] The dynamic authorization module is used to make dynamic authorization decisions on user access requests based on trust level information and security condition verification results.

[0136] The access behavior monitoring module is used to monitor the user's access behavior in real time and feed back abnormal access behavior to the dynamic authorization module.

[0137] The risk response module is used to automatically trigger the risk response mechanism when abnormal access behavior or environmental changes are detected, including but not limited to secondary authentication requests, access permission adjustments, account freezing and device isolation.

[0138] The above are all preferred embodiments of the present application, and the protection scope of the present application is not limited thereto. Therefore, any equivalent changes made according to the structure, shape, and principle of the present application should be included in the protection scope of the present application.

Claims

1. A terminal zero-trust security capability system based on trusted environment perception, characterized in that: The system comprises: User subnet: includes identity agent programs installed on user terminals, used to report environmental risk perception information in real time; Secure access controlled areas including: A trusted environment perception system, used to receive and evaluate the environmental risk perception information, obtain risk assessment results, and provide the risk assessment results to the intelligent identity analysis platform; An intelligent identity analysis platform for analyzing user behavior, combining the risk assessment results, obtaining comprehensive trust level information, and providing the trust level information to the trusted access console; A trusted access console, used to receive the trust level information and dynamically authorize the trusted application agent and the trusted interface agent based on real-time calculation; Trusted application proxy, which is used to implement fine-grained access control to applications based on the authorization of the trusted access console; Trusted interface agent, used to implement fine-grained access control to interfaces based on the authorization of the trusted access console; Data subnet: includes applications and interface services that need to be protected, and access to the data subnet is controlled by a trusted application agent and a trusted interface agent; The trusted environment perception system includes: A dynamic feature importance evaluator, used to analyze in real time the contribution of each environmental factor in the environmental risk perception information to the risk assessment and automatically adjust the feature weight; A multi-scenario risk model coordinator, including risk assessment models for different environmental scenarios, for dynamically selecting and fusing model outputs based on the current scenario and the feature weights; The dynamic feature importance evaluator comprises: A fast weight calculation module, used to perform initial weight calculation on each environmental factor in the environmental risk perception information to obtain an initial weight, wherein the environmental factors include the hardware status, software configuration, network connection status and geographical location of the user terminal; A feature interaction analysis module is used to analyze the interaction relationship between the features of various environmental factors according to the initial weights to obtain feature interaction analysis results, wherein the network connection type and geographical location have high mutual information values, the time and geographical location have medium mutual information values, and the device type and network connection type have low mutual information values; A feature set optimization module, used for dynamically adjusting the feature set based on the feature interaction analysis result; The weight update module is used to recalculate the weights of environmental factors based on the adjusted feature set; A contribution assessment module is used to determine the contribution of each environmental factor to the risk assessment based on the updated weights; The multi-scenario risk model coordinator performs the following steps: Classify the current environment; Based on the identified scenarios, select the corresponding risk assessment model from the pre-trained model library, including models for network security, models for physical security, and models for data sensitivity; Combined with the feature weights adjusted by the dynamic feature importance evaluator, the environmental risk perception information is evaluated to obtain the risk assessment results.

2. According to claim 1, the terminal zero-trust security capability system based on trusted environment perception is characterized in that: The trusted environment perception system is also used for: Monitor changes in terminal hardware information, record and display changes, original configurations, and new configurations; Supports exporting terminal hardware change records.

3. The terminal zero-trust security capability system based on trusted environment perception according to claim 1 is characterized in that: The trusted environment perception system also includes: Threat intelligence module, which is used to receive information from external threat intelligence sources and conduct comprehensive analysis in combination with internal security perception data; Security policy update module, used to automatically update the terminal's security policy based on the latest threat intelligence; Anomaly pattern detectors, which continuously learn normal behavior patterns and identify environmental changes that deviate from the norm; Adaptive sampling rate regulator, used to dynamically adjust the sampling frequency of environmental data according to the current system load and risk level.

4. The terminal zero-trust security capability system based on trusted environment perception according to claim 1 is characterized in that: The intelligent identity analysis platform also includes: The user access behavior analysis module is used to analyze the user's historical access records, operation behaviors and time patterns to identify potential abnormal behaviors.

5. The terminal zero-trust security capability system based on trusted environment perception according to claim 4 is characterized in that: The intelligent identity analysis platform also includes: Multi-factor authentication module to support a combination of multiple authentication methods, including passwords, biometrics, hardware tokens, and software tokens; Adaptive authentication policy engine, which dynamically adjusts the strength of authentication requirements based on the user's historical behavior, current environmental risk, and the sensitivity of the resources being accessed; A continuous authentication module to continuously monitor and verify the user's identity during the user session; The identity federation management module is used to support cross-organizational identity authentication and authorization.

6. The terminal zero-trust security capability system based on trusted environment perception according to claim 5 is characterized in that: The intelligent identity analysis platform also includes: User login behavior analysis module, used to collect user login behavior data and establish user behavior model through preset analysis algorithm; The anomaly detection module is used to issue an alarm when the user login behavior is abnormal and automatically trigger further identity authentication processes.

7. The terminal zero-trust security capability system based on trusted environment perception according to claim 1 is characterized in that: The trusted access console includes: An assessment result processing module, used for receiving and processing the risk assessment result provided by the trusted environment perception system; A security condition verification module, used to verify whether the user terminal meets the requirements for accessing enterprise network resources according to preset security conditions; A dynamic authorization module, used to make a dynamic authorization decision on the user's access request based on the trust level information and security condition verification results; The access behavior monitoring module is used to monitor the user's access behavior in real time and feed back abnormal access behavior to the dynamic authorization module; The risk response module is used to automatically trigger the risk response mechanism when abnormal access behavior or environmental changes are detected, including but not limited to secondary authentication requests, access permission adjustments, account freezing and device isolation.

Images