Dynamic access control method and device based on security gateway and trust evaluation and related products

Abstract

The embodiment of the invention provides a dynamic access control method and device based on a security gateway and trust evaluation and a related product. The dynamic access control method based on the security gateway and trust evaluation comprises the following steps: closing an external access permission of an application and analyzing a domain name of the application to a security gateway address based on the security gateway, so that all access requests are accessed through the security gateway; whether an access control strategy is triggered or not is judged according to the risk assessment result and a pre-configured access control triggering rule, and if the access control strategy is triggered, the access control strategy is issued to the security gateway; and the security gateway receives the access control strategy in real time, intercepts an access request of a client to a target application, performs matching judgment on the content of an access request message according to a dynamic strategy, and executes a corresponding control action on the access request according to a strategy rule if a preset triggering condition is met so as to realize dynamic access control. And the access is safer and more flexible, and the self-adaption and the expandability are higher.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of network security, and in particular to a dynamic access control method, device and related products based on a security gateway and trust evaluation. Background Art

[0002] In today's digital age, network technology is developing rapidly, and network access has become an indispensable part of people's daily work, study and life. At the same time, network security is facing unprecedented challenges. Access control, as a key line of defense for network security, aims to limit the access of specific subjects to specific resources under specific conditions to ensure the confidentiality, integrity and availability of data.

[0003] Traditional access control methods mostly rely on static policy configuration. Such static policies are usually built around relatively fixed and easily accessible elements such as authentication status, roles, menus, and IP addresses. For example, corporate internal networks often assign specific network resource access rights based on employee positions and roles, such as financial personnel can access the financial system, while ordinary employees can only access the office automation system; or based on IP address range restrictions, only devices in the company's internal network IP segment are allowed to access specific applications. In this mode, when the access subject initiates a resource access request, the application will intercept and judge it based on the pre-set static policy. If it meets the access rights, it will be released. Otherwise, it will be intercepted and blocked or given a corresponding prompt.

[0004] However, with the increasing complexity of the network environment and the continuous evolution of network attack methods, the static policy access control method has exposed many limitations. From a security perspective, it is difficult to cope with complex and changing security threats by only performing access control based on simple and static factors. For example, it is impossible to effectively identify the security status of the access subject device, such as whether the device is infected with malware, whether there are system vulnerabilities, etc.; it is also impossible to consider the security of the network link, such as whether the link has been hijacked, whether there is a risk of man-in-the-middle attack, etc. Once an attacker breaks through these simple static defenses, such as forging a legitimate IP address or stealing the authentication credentials of a legitimate user, it may be easy to obtain sensitive resources, leading to serious security incidents.

[0005] From the perspective of flexibility, static access control methods lack real-time monitoring and dynamic adjustment capabilities. It cannot timely perceive the security risks brought about by changes in the behavior of the access subject during the access process and the real-time status changes of the network link. For example, when a user account is abnormally logged in at a different location, or when an abnormal traffic fluctuation suddenly occurs on the network link, the static policy cannot automatically respond and adjust the access rights. This puts the system in a passive defense state when facing new network attacks or abnormal access behaviors, and is unable to effectively and timely prevent potential security threats, thus posing a huge hidden danger to network security.

[0006] In summary, the traditional static policy access control method can no longer meet the growing network security needs. There is an urgent need for a more secure, flexible and intelligent dynamic access control solution to effectively respond to complex and changing network environments and security challenges. Summary of the invention

[0007] In view of this, an embodiment of the present invention provides a dynamic access control method, device and related products based on a security gateway and trust evaluation to at least partially solve the above problems.

[0008] According to a first aspect of an embodiment of the present invention, a dynamic access control method based on a security gateway and trust evaluation is provided, comprising:

[0009] Based on the deployed security gateway, by closing the application's external access rights and resolving the application domain name to the security gateway address, all access requests directed to the application domain name are reverse-proxy accessed through the security gateway;

[0010] Perform risk assessment on the real-time collected log information based on the trust assessment model to obtain a risk assessment result, and determine whether to trigger the access control policy based on the risk assessment result and the pre-configured access control trigger rule. If triggered, send the access control policy to the security gateway;

[0011] The security gateway automatically starts dynamic policy reception monitoring, receives and updates the access control policy in real time, and then stores the access control policy in the storage of the security gateway to form a dynamic policy;

[0012] Based on the security gateway, the client's access request to the target application is intercepted, and the access request message content is parsed, and the access request message content is matched and judged according to the dynamic policy. If the preset trigger condition is met, the access request is subjected to corresponding control action according to the policy rules to realize dynamic access control.

[0013] Optionally, the control actions include: blocking, releasing, prompting, warning, and supplementary authentication.

[0014] Optionally, when the access control action is release, the security gateway forwards the access request to the target application server based on the domain name information carried in the access request and the mapping relationship between the configured domain name and the target application server, and receives the response from the target application server and returns it to the client to achieve access to the target application.

[0015] Optionally, the log information includes authentication logs, risk warning logs, terminal device operation logs, and threat intelligence logs.

[0016] Optionally, the risk assessment process is performed on the log and intelligence information collected in real time based on the trust assessment model, and the risk assessment result obtained includes:

[0017] The trust assessment model is based on multiple risk detection components, and performs risk assessment processing on the log information according to the risk behavior detection logic preset by each of the risk detection components to obtain a risk assessment result;

[0018] The risk detection component is designed based on the preset risk rule type classification, and the risk rule types include: attack threat detection risk rule type, user behavior matching risk rule type, and management policy matching risk rule type;

[0019] The attack threat detection type risk detection components include: risk detection component, brute force detection component, user frequent access application detection component, threat IP login detection component, multiple account login detection component, user frequent login detection component, user request information frequent change detection component, unfamiliar UserAgent request detection component, database collision attack detection component, slow attack detection component;

[0020] The user behavior matching type risk detection components include: sudden activity detection components, intranet location feature matching components, remote login components, device feature matching components, IP feature matching components, operating system feature matching components, and active time feature matching components;

[0021] The management policy matching risk detection component includes: using a browser restriction component, using an IP range restriction component, using a location restriction component, using a time restriction component, using a mobile device restriction component, and using an operating system restriction component.

[0022] Optionally, the trust assessment model is based on multiple risk detection components, and performs risk assessment processing on the log information according to risk behavior detection logic preset by each of the risk detection components to obtain a risk assessment result, which specifically includes:

[0023] Set up a multi-level trust evaluation system for users and set an initial trust level for users, where the level of trust reflects the credibility of the user;

[0024] The risk detection component performs feature matching on the log information according to respective preset risk behavior detection logic;

[0025] If the risk behavior detection logic feature is triggered, the trust assessment level of the user is dynamically adjusted to obtain a risk assessment result, and the risk assessment result includes the adjusted user trust level information.

[0026] Optionally, the triggering of the risk behavior detection logic dynamically adjusts the trust assessment level of the user to obtain a risk assessment result, including:

[0027] If the risk behavior detection logic is triggered, the user's trust assessment level is adjusted according to the configured risk behavior and trust level mapping relationship;

[0028] The risk behavior and trust level mapping relationship includes a single risk behavior triggering and a preset trust level mapping and a multiple risk behaviors simultaneously triggering and a preset trust level mapping.

[0029] Optionally, judging whether to trigger an access control policy according to the risk assessment result and a pre-configured access control trigger rule, and if triggered, sending the access control policy to the security gateway, includes:

[0030] Notifying the strategy judgment engine of the result;

[0031] The policy judgment engine determines whether to trigger the access control policy based on the configured trust level and control action mapping relationship;

[0032] If the access control policy is triggered, the policy judgment engine sends the access control policy to the security gateway based on a preset communication method;

[0033] The communication method includes a message queue or an API call.

[0034] Optionally, the security gateway also has one or a combination of HTTP request packet filtering, blacklist and whitelist management and other security capabilities. The security capabilities are combined with dynamic access control policies to jointly ensure application security.

[0035] Optionally, the method also includes expanding and improving the functions of the gateway and trust assessment module at any time to adapt to various applications, and integrating with one or a combination of situational awareness, threat intelligence, honeypot, and AI technologies to define dynamic access control policies.

[0036] In a second aspect of the embodiments of the present application, a dynamic access control device based on a security gateway and a trust evaluation is provided, which is applied to a dynamic access control method based on a security gateway and a trust evaluation as described in any one of the above, and comprises:

[0037] A trust assessment module is used to perform risk assessment on the log information collected in real time to obtain a risk assessment result, and determine whether to trigger the access control policy based on the risk assessment result and the pre-configured access control trigger rule. If triggered, the access control policy is sent to the security gateway;

[0038] A security gateway, which is used to close the external access rights of the application and resolve the application domain name to the address of the security gateway, so that all access requests directed to the application domain name are reverse-proxy accessed through the security gateway;

[0039] The security gateway is also used to automatically start dynamic policy reception monitoring, receive and update the access control policy in real time, and then save the access control policy in the storage of the security gateway to form a dynamic policy;

[0040] The security gateway is also used to intercept the client's access request to the target application, and parse the access request message content, and match and judge the access request message content according to the dynamic policy. If the preset trigger condition is met, the access request is executed according to the policy rules. The corresponding control action is performed to achieve dynamic access control.

[0041] In a third aspect of the implementation manner of the present application, an electronic device is provided, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the dynamic access control method based on a security gateway and trust assessment as described in any one of the embodiments of the present application.

[0042] In a fourth aspect of the implementation manner of the present application, a computer storage medium is provided, on which a computer program is stored. When the program is executed by a processor, a dynamic access control method based on a security gateway and trust assessment as described in any one of the embodiments of the present application is implemented.

[0043] The present application provides a dynamic access control method, device and related products based on a security gateway and trust evaluation, which have the following beneficial effects:

[0044] 1. Significantly improved security

[0045] The present invention breaks through the limitation of traditional static access control that only relies on limited and fixed elements. Through the trust assessment module, multi-source data can be collected in real time, including user authentication logs, risk warning logs, terminal device operation logs, and threat intelligence logs, etc., and multiple risk detection components designed based on different risk rule types are used to conduct in-depth analysis of these data. Based on this, it is possible to conduct a comprehensive assessment of almost all possible security risks, timely detect and control potential malicious access requests, and greatly enhance the system's ability to prevent various network attacks and security threats, thereby effectively ensuring the security of applications and resources.

[0046] 2. Enhanced flexibility and adaptability

[0047] Compared with traditional static policies, the dynamic access control of the present invention can dynamically monitor and analyze security risks in multiple aspects such as access subjects, access links, and user identities in real time and continuously. When any abnormal behavior or risk changes occur, the system can respond quickly and automatically adjust the access policy. It is no longer limited to pre-set fixed rules, but flexibly determines the processing method of access requests based on real-time risk conditions, such as blocking, releasing, prompting, warning or supplementary authentication, etc., to ensure that the system is always in the best security protection state and effectively respond to the ever-changing network environment and security threats.

[0048] 3. Advantages of gateway-based implementation

[0049] (1) Non-invasive: By resolving the application domain name to the secure gateway address and closing the application's external access rights, all access requests are accessed through the secure gateway through reverse proxy. This approach does not require deep modification of the application system itself or invasive code implantation, which minimizes interference with the existing application architecture and business processes, reduces the risk of introducing new problems or failures due to access control implementation, and ensures the stability and normal operation of the application system.

[0050] (2) Easy scalability. The security gateway and trust assessment module have good scalability. On the one hand, the security gateway itself can easily integrate a variety of security capabilities. In addition, with the development of network security technology, new security functions or protection mechanisms can be easily added to the security gateway. On the other hand, the trust assessment module can be integrated with a variety of third-party systems to continuously expand the data sources and analysis dimensions of risk assessment. At the same time, whether it is the functional expansion of the security gateway or the trust assessment module, there is no need for additional development and modification of the application. The expanded capabilities can be directly applied to various applications, which significantly improves the overall adaptability and scalability of the system, can quickly respond to changing security needs, and effectively reduces the cost and complexity of system upgrades and maintenance.

[0051] (3) High cost-effectiveness. Since there is no need to carry out customized security development and transformation for each application, large-scale software development, testing and deployment costs are avoided. In addition, the centralized access control management mode based on the gateway reduces the need for a large number of decentralized security devices or software, and reduces the cost of hardware procurement, installation and operation and maintenance. At the same time, the easy scalability of the system means that when responding to new security challenges, there is no need for large-scale system reconstruction or replacement, which further saves costs. In summary, the present invention significantly reduces the total cost of ownership while providing efficient security protection, and improves the return on investment of enterprises or organizations in network security construction. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0053] Figure 1 The figure is a flow chart of a dynamic access control method based on a security gateway and trust evaluation according to the present invention. DETAILED DESCRIPTION

[0054] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions in the embodiments of the present invention will be described clearly and in detail below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in the field based on the embodiments in the embodiments of the present invention should fall within the scope of protection of the embodiments of the present invention.

[0055] It should be understood that the terms "first", "second", "third", etc. in the claims, specifications and drawings of the present disclosure are used to distinguish different objects rather than to describe a specific order. The terms "include" and "comprise" used in the specifications and claims of the present disclosure indicate the presence of the described features, wholes, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or their collections.

[0056] It should also be understood that the terms used in this disclosure are only for the purpose of describing specific embodiments and are not intended to limit the disclosure. As used in this disclosure and claims, the singular forms of "a", "an", and "the" are intended to include the plural forms unless the context clearly indicates otherwise. It should also be further understood that the term "and / or" used in this disclosure and claims refers to any combination of one or more of the associated listed items and all possible combinations, including these combinations.

[0057] Figure 1 FIG. 1 is a flow chart of a dynamic access control method based on a security gateway and trust evaluation according to an embodiment of the present invention. Figure 1 As shown, including:

[0058] A dynamic access control method based on a security gateway and trust evaluation, comprising:

[0059] Based on the deployed security gateway, by closing the application's external access rights and resolving the application domain name to the security gateway address, all access requests directed to the application domain name are reverse-proxy accessed through the security gateway;

[0060] Perform risk assessment on the real-time collected log information based on the trust assessment model to obtain a risk assessment result, and determine whether to trigger the access control policy based on the risk assessment result and the pre-configured access control trigger rule. If triggered, send the access control policy to the security gateway;

[0061] The security gateway automatically starts dynamic policy reception monitoring, receives and updates the access control policy in real time, and then stores the access control policy in the storage of the security gateway to form a dynamic policy;

[0062] Based on the security gateway, the client's access request to the target application is intercepted, and the access request message content is parsed, and the access request message content is matched and judged according to the dynamic policy. If the preset trigger condition is met, the access request is subjected to corresponding control action according to the policy rules to realize dynamic access control.

[0063] In this embodiment, by resolving the application domain name to the security gateway address and closing the application's external access rights, all access requests are accessed through the reverse proxy of the security gateway, which makes the security gateway the core hub of access control and can centrally check and manage all access traffic. Compared with the decentralized access control method, this centralized mode can more effectively prevent external malicious attacks from bypassing security protection because all requests must pass through a unified checkpoint. In addition, the trust assessment model performs risk assessment based on real-time collected log information. This real-time performance is a key advantage, and it can capture potential security threats in a timely manner. For example, when abnormal login behavior (such as multiple login attempts in a short period of time, logins from unfamiliar IPs, etc.) occurs, the model can quickly analyze the relevant log information and identify risks. Unlike traditional static access control methods, it does not only rely on fixed, preset rules, but can dynamically assess risks based on the current actual operating status of the system and user behavior, thereby more accurately discovering new security risks. Furthermore, defining access control policies based on risk assessment results can achieve more sophisticated access control. Different risk levels or types can trigger different policies. For example, high-risk access attempts can be directly blocked, and additional authentication can be required for some situations where there may be risks but they are not so certain. This risk-based dynamic policy adjustment is more adaptable to complex and changing security scenarios than traditional static policies (such as those based on simple IP addresses or user roles), and effectively prevents unauthorized access and malicious attacks.

[0064] In this embodiment, the security gateway automatically turns on the dynamic policy receiving and monitoring function, and can receive and store new access control policies in real time. This means that when the trust assessment model discovers new risks and adjusts the policy, the security gateway can immediately take effect on the new policy. For example, if a large number of attack attempts against the system are detected in a certain area, the system can quickly update the policy to restrict access from that area without manual intervention or restarting the entire system. This real-time update capability enables the system to quickly adapt to the ever-changing network security environment, such as responding to new network attack methods or maintaining effective access control when the network topology changes. In addition, since the policy is adjusted based on real-time collected log information and risk assessment, the system can make adaptive adjustments based on the actual behavior patterns of users and systems. For example, if a user's usual login time and location are relatively fixed, but suddenly logs in at an abnormal time or place, the system can dynamically adjust the user's access rights based on this behavior change, enhancing the sensitivity and response capabilities to abnormal behavior, making access control more in line with actual usage scenarios and security needs. In addition, as a key node for reverse proxy access, the security gateway provides administrators with a single control point for centralized management of access control. All access requests are processed and monitored here, which makes it easier for administrators to configure and adjust access policies, view access logs and statistical information, etc. Compared with configuring and managing access control separately on multiple applications or servers, this centralized management method greatly reduces the complexity and workload of management and improves management efficiency. Furthermore, the access control policy is uniformly generated and sent to the security gateway through the trust assessment model, ensuring the consistency of the access control policy in the entire system. It avoids policy conflicts or inconsistencies that may occur in different applications or servers, reduces security vulnerabilities caused by policy differences, and makes the security management of the system more standardized and reliable.

[0065] Optionally, the control actions include: blocking, releasing, prompting, warning, and supplementary authentication.

[0066] In this embodiment, the control actions include blocking, releasing, prompting, warning, supplementary authentication, and other control actions. These control actions can make corresponding access control according to different needs. When clear malicious access behavior or high-risk situations are detected, such as connection attempts from threatening IPs and brute force attacks are in progress, the blocking action can immediately block the access request to prevent the attacker from further invading the system and protect the security of applications and data. It is a key line of defense against external malicious attacks and can effectively prevent unauthorized visitors from obtaining sensitive information or causing damage to the system. In addition, for access requests that have been identified as having serious security risks, blocking can prevent these risks from spreading within the system. For example, if a user's device is detected to be infected with malware and is trying to access critical applications, blocking its access can prevent the malware from spreading in the network, avoid possible damage to other users or system resources, and maintain the security of the entire system environment. For access requests that are determined to be legitimate after trust evaluation and policy matching, the release action ensures that the user can successfully access the target application. This ensures the normal operation of business processes, allowing legitimate users to use system resources without hindrance, improving work efficiency and user experience. For example, during normal working hours, when employees use authorized devices to access internal company applications on the company's internal network, the release mechanism allows them to work smoothly. By accurately releasing legitimate requests, unnecessary resources are avoided from being wasted on excessive review of normal access. The system can focus more resources on monitoring and processing potential risk requests, improving the performance and resource utilization efficiency of the entire access control system, while maintaining the availability and response speed of the system. Furthermore, when there are some potential problems with the access request but it has not yet reached the level where it needs to be blocked, the prompt action can provide relevant information to the user. For example, when the browser version used by the user is too low and there may be security risks, the system can pop up a prompt to inform the user to upgrade the browser, guide the user to take the right action to improve the security of their own access, and also help reduce security vulnerabilities caused by user negligence. The prompt function helps to improve users' awareness and attention to network security. After receiving the prompt information, the user can understand the possible risks of the current access behavior, so as to pay more attention to security issues in the future use process, promote users to develop good security habits, and strengthen the overall network security protection from the user level. In addition, when abnormal access behavior or potential security threats are detected, the alarm action can notify the administrator in time. Administrators can quickly take appropriate measures based on the alert information, such as further investigating suspicious activities, adjusting access policies, or initiating emergency response processes. For example, if the system detects that a user account has multiple remote login attempts in a short period of time, the alert information can allow administrators to pay attention to the security of the account in a timely manner to prevent possible account theft.

[0067] Moreover, in this embodiment, a large amount of alarm information can provide administrators with an overall perception of the system security situation. By analyzing the alarm content and frequency, administrators can understand the main security issues and trends in the current network environment, so as to make security protection preparations in advance and formulate corresponding security policy improvement plans, thereby enhancing the ability to control the security status of the entire system. In some cases, when the user's trust level is reduced due to some abnormal behavior or when accessing sensitive resources, the user can be required to provide additional authentication information through supplementary authentication actions, which increases the security of access and ensures that only truly legitimate users can continue to access key resources even when there are certain signs of risk. For example, when a user logs in from a new device and triggers a risk detection rule, supplementary authentication methods such as requiring the input of a text message verification code can further verify the user's identity. The supplementary authentication mechanism provides a flexible way to deal with potential risks without completely blocking user access. It dynamically adjusts the authentication requirements according to the specific risk situation, which can not only ensure the user's availability to a certain extent, but also effectively control security risks, balance the relationship between security and user experience, and adapt to complex and changing security scenario requirements.

[0068] Optionally, when the access control action is release, the security gateway forwards the access request to the target application server based on the domain name information carried in the access request and the mapping relationship between the configured domain name and the target application server, and receives the response from the target application server and returns it to the client to achieve access to the target application.

[0069] In this embodiment, when the access control action is release, this reverse proxy forwarding mechanism based on the mapping relationship between the domain name and the target application server has the following technical advantages:

[0070] 1. Accurate request routing

[0071] (1) Ensure correct forwarding: forwarding based on the domain name information in the access request can accurately guide the request to the corresponding target application server. In a complex network environment, there may be multiple application servers, each server hosting different applications or services. This domain name-based mapping method prevents requests from being mistakenly sent to other unrelated servers, ensuring that each access request can reach its intended destination, improving the accuracy and reliability of the system.

[0072] (2) Support for multi-application architecture: For enterprise-level or large-scale network application architectures, there are often multiple different applications running at the same time. Through this precise domain name mapping and forwarding mechanism, different applications can have their own independent domain names. The security gateway can easily handle access requests from various applications and correctly forward them to the corresponding servers, allowing the entire system to support a diverse application ecosystem and facilitate application deployment, management, and expansion.

[0073] 2. Enhance system security

[0074] (1) Hiding application server information: The client only interacts with the security gateway, which forwards the request to the target application server based on the domain name information. This makes the actual address and architecture of the application server transparent to the client, and external users or attackers cannot directly obtain relevant information about the application server, reducing the risk of direct attacks on the application server. For example, attackers cannot easily find the IP address of the application server through scanning and other means to carry out targeted attacks, which increases the security of the system.

[0075] (2) Unified security checkpoint: As an intermediate link in request forwarding, the security gateway can perform unified security checks on all access requests before releasing them (such as checks based on trust assessment models and dynamic policies). This centralized security check mechanism ensures that only authorized and security-verified requests can reach the application server, providing pre-emptive security protection for the application server, effectively preventing malicious requests from directly contacting the application server, and protecting the security of the application server and the data therein.

[0076] 3. Improve the manageability and maintainability of the system

[0077] (1) Centralized configuration management: The mapping relationship between domain names and target application servers can be centrally configured and managed in the security gateway. Administrators can easily add, modify, or delete mapping relationships. When a new application is launched or the address of an application server changes, they only need to update the corresponding configuration at the security gateway. There is no need to perform complex settings on each client or application server, which greatly simplifies system management and maintenance.

[0078] (2) Troubleshooting and monitoring: Through the security gateway's forwarding of requests and receipt of responses, administrators can conduct comprehensive traffic monitoring and troubleshooting at the security gateway level. If an application has an access problem, the administrator can first check at the security gateway whether the request arrives normally, whether it is forwarded according to the correct mapping relationship, and whether the response is returned normally, etc., to quickly locate the problem, thereby improving the system's maintainability and troubleshooting efficiency.

[0079] 4. Optimize user experience

[0080] (1) Seamless access process: For users, the entire access process is seamless. When a user initiates an access request to an application, as long as the request passes the security check of the security gateway and is released, the user does not need to worry about how the request is forwarded to the target application server in the background. The user can successfully obtain the response of the application server and use the application normally, which improves the user experience and enables users to focus on business operations without being disturbed by the underlying network architecture and forwarding mechanism.

[0081] Optionally, the log information includes authentication logs, risk warning logs, terminal device operation logs, and threat intelligence logs.

[0082] Optionally, the risk assessment process is performed on the log and intelligence information collected in real time based on the trust assessment model, and the risk assessment result obtained includes:

[0083] The trust assessment model is based on multiple risk detection components, and performs risk assessment processing on the log information according to the risk behavior detection logic preset by each of the risk detection components to obtain a risk assessment result;

[0084] The risk detection component is designed based on the preset risk rule type classification, and the risk rule types include: attack threat detection risk rule type, user behavior matching risk rule type, and management policy matching risk rule type;

[0085] The attack threat detection type risk detection components include: risk detection component, brute force detection component, user frequent access application detection component, threat IP login detection component, multiple account login detection component, user frequent login detection component, user request information frequent change detection component, unfamiliar UserAgent request detection component, database collision attack detection component, slow attack detection component;

[0086] The user behavior matching type risk detection components include: sudden activity detection components, intranet location feature matching components, remote login components, device feature matching components, IP feature matching components, operating system feature matching components, and active time feature matching components;

[0087] The management policy matching risk detection component includes: using a browser restriction component, using an IP range restriction component, using a location restriction component, using a time restriction component, using a mobile device restriction component, and using an operating system restriction component.

[0088] In this embodiment, the following are the technical benefits of performing risk assessment based on multiple log information and specific risk detection components:

[0089] 1. Comprehensive risk assessment from multiple dimensions

[0090] 1. Use various log information

[0091] (1) Authentication log: It provides key data related to user identity authentication. By analyzing the authentication log, the system can determine the legitimacy and regularity of user logins. For example, if the authentication log shows that an account frequently logs in from different locations within a short period of time, this may be a sign that the account has been stolen. Based on this information, the trust assessment model can more accurately determine the credibility of user access requests, help to detect abnormal login behavior in a timely manner, and protect user account security and the system from illegal access.

[0092] (2) Risk Alert Log: Provides real-time feedback on risk events that are occurring or have been detected in the system. It enables the trust assessment model to respond quickly to emerging security threats. For example, when the risk alert log indicates that a brute force attack against the system is ongoing, the model can immediately adjust the assessment strategy for the relevant access request and enhance protection measures to prevent the attack from succeeding.

[0093] (3) Terminal device operation log: It provides rich materials for risk assessment from the device level. By understanding the operation status of the terminal device, such as CPU usage, memory usage, device temperature and other parameters, as well as the process and software information running on the device, it is possible to determine whether the device is infected by malware or whether there is abnormal behavior. For example, if the device operation log shows that a device frequently sends a large amount of data to an unknown server, it may indicate that the device has been controlled and is stealing data, thereby affecting the processing of access requests initiated to the device.

[0094] (4) Threat intelligence log: It integrates external security intelligence, enabling the system to be aware of global network threat trends. When the threat intelligence log indicates that a specific IP or network segment is the source of malicious activity, the system can conduct strict review or direct blocking of access requests from these areas in advance, effectively preventing known external threats, enhancing the system's ability to resist new attacks, and preventing the system from being damaged by unknown threats.

[0095] 2. Synergy of multiple risk detection components

[0096] (1) Attack threat detection risk rule type component: covers a variety of detection capabilities for common network attack methods. For example, the brute force detection component can effectively prevent attackers from trying different password combinations to gain access to user accounts; the database attack detection component can identify the use of a large number of leaked usernames and password combinations to attempt to log in to the system; the threat IP login detection component, combined with the threat intelligence log, can quickly block access from malicious IPs. These components work together to greatly reduce the risk of external attacks on the system and protect the system's security boundaries.

[0097] (2) User behavior matching risk rule type component: Assess risk through detailed analysis of user behavior. For example, the remote login component can detect login attempts of user accounts in abnormal geographical locations, which may be a signal that the account has been stolen; the sudden activity detection component can detect sudden changes in user behavior patterns, such as a user who is usually inactive suddenly accessing a large number of system resources in a short period of time. This abnormal behavior may indicate a security problem. By matching and monitoring these user behavior features, the system can better understand the user's normal behavior pattern and promptly detect abnormal behavior that deviates from the normal pattern, thereby more accurately assessing the risk of access requests.

[0098] (3) Management policy matching risk detection component: Control access risks according to the management policies formulated within the enterprise or organization. For example, the time restriction component can limit users' access to specific sensitive systems during non-working hours to prevent security vulnerabilities caused by access during unauthorized hours; the operating system restriction component can ensure that only operating system versions that meet the enterprise's security standards can access specific applications to avoid security issues caused by operating system vulnerabilities. These components help ensure that users' access behavior complies with the enterprise's security policies and compliance requirements.

[0099] 2. Refined risk control and personalized processing

[0100] 1. Targeted treatment based on different risk types

[0101] (1) Different types of risk detection components can identify risks of different natures, allowing the system to take different control measures based on the specific risk type. For example, for high-risk situations determined to be brute force attacks, the relevant access requests can be directly blocked, and the source IP address of the attack attempt can be temporarily banned; for situations where user behavior is slightly abnormal but the risk is low, such as occasional remote logins, users can be required to perform additional authentication, such as SMS verification code verification, while ensuring a certain level of security, while reducing the impact on users' normal access, thus achieving refined access control based on the degree of risk.

[0102] 2. Adapt to diverse application scenarios and user needs

[0103] (1) This design based on multiple risk rule types and detection components can be easily customized according to different application scenarios and user groups. For example, for financial applications, more emphasis may be placed on strict verification of user identities and detection of abnormal transaction behaviors. This requirement can be met by adjusting the parameters and rules of user behavior matching and attack threat detection related components; for office applications within the enterprise, more emphasis may be placed on access restrictions based on management policies, such as controlling access rights based on employees' departments, positions, and working hours. In this way, the system can better adapt to security needs in different environments and provide personalized security protection.

[0104] 3. Dynamically adapt to changes in the security environment

[0105] 1. Update risk assessment in real time

[0106] Since the risk detection component works based on real-time collected log information, the system can continuously monitor changes in the network environment and user behavior. When new security threats emerge or user behavior patterns change, the trust assessment model can quickly update the risk assessment results. For example, as new network attack methods continue to emerge, the system can respond to new attack patterns by updating the rules of the attack threat detection component; when the business scope of the enterprise expands or the work mode of employees changes, the user behavior matching and management policy matching components can also be adjusted accordingly to adapt to the new security situation, ensuring that the system always maintains effective security protection.

[0107] 2. Flexibly adjust access control policies

[0108] Based on the continuously updated risk assessment results, the system can dynamically adjust the access control policy. This flexibility enables the system to respond quickly to complex and changing network security environments. For example, if a large number of attacks against the system occur in a certain area, the system can adjust the policy to strengthen the review of access requests in that area, such as adding additional authentication requirements or limiting the frequency of access, so as to effectively respond to the ever-changing security threats and ensure the security and stable operation of the system.

[0109] As shown in Table 1, the risk rule model includes specific risk monitoring components, risk rule types corresponding to the risk components, and risk behavior detection logics preset by the risk detection components.

[0110] Table 1: Risk rule model

[0111]

[0112]

[0113]

[0114] The risk rule model includes not only the specific risk monitoring components described in the above table, but also other risk detection components.

[0115] In the attack threat detection type component,

[0116] The brute force cracking detection component can effectively prevent brute force cracking attacks. By monitoring a large number of failed authentication requests for a specific account in a short period of time, it can promptly detect the attacker's attempt to guess the password by traversing the password list. This can prevent attacks in the early stages, prevent user accounts from being cracked, protect the security of users' personal information and related data, and prevent unauthorized visitors from obtaining sensitive data. Protect system resources. Brute force cracking attacks may consume a large amount of system resources, such as the server's computing power used to process a large number of invalid authentication requests. Timely detection and prevention of such attacks can reduce unnecessary consumption of system resources, ensure the normal operation of the system, and avoid service interruptions or performance degradation due to resource exhaustion.

[0117] The user frequent access application detection component can prevent the abuse of abnormal access patterns and detect abnormal behavior of users who continuously single-sign on to applications in a short period of time. This abnormality may be a sign of automated attack tools or malicious users trying to break through system restrictions. By limiting this abnormal access, malicious users can be prevented from obtaining system permissions or conducting malicious activities such as data theft through a large number of repeated logins. It can also enhance application security. For the application itself, this detection can avoid application crashes or data anomalies caused by abnormally frequent access. For example, a large number of repeated login requests may put pressure on the application's database connection pool or session management mechanism. Timely detection and prevention can maintain the stability and security of the application.

[0118] The threat IP login detection component can resist external malicious IP attacks, obtain the threat IP list from a third party and cache it, and can detect in real time whether the login IP is a threat IP. This can effectively prevent attacks from known malicious sources (such as botnet IPs controlled by hackers, IPs used by cybercrime organizations, etc.), greatly reduce the possibility of successful external attacks, and protect the system from malicious intrusions. It can also respond quickly to new threats. Third-party security agencies can usually update the black market IP library in a timely manner. By querying and caching this information, the system can quickly adapt to emerging malicious IP threats, quickly defend after new attack sources are identified, and enhance the system's dynamic defense capabilities against external threats.

[0119] The multi-account login detection component can prevent account sharing abuse and malicious attacks, detect the same IP login to multiple accounts within a specified time, and prevent legitimate accounts from being illegally shared or maliciously used. For example, in an enterprise environment, it can prevent employee accounts from being stolen by others and logged in at the same time under the same IP, or prevent attackers from using multiple accounts to conduct batch attacks, such as batch downloading of sensitive data. In addition, in compliance with security policies and compliance requirements, for some environments with high requirements for data security and privacy, this detection helps ensure that account usage complies with security policies and relevant regulations and maintains system compliance.

[0120] The user frequent login detection component is used to identify abnormal login behaviors and detect frequent login behaviors of users with the same IP in a short period of time, which helps to discover possible account theft. For example, if a user account is constantly attempted to log in by an automated script, this abnormal behavior can be captured in time to protect the user account security and prevent malicious users from obtaining account permissions and performing illegal operations. The authentication mechanism can also be optimized. By monitoring frequent login behaviors, the system can adjust the authentication mechanism according to the situation, such as adding verification codes, secondary authentication and other requirements, to optimize the security of the login process, while avoiding excessive interference with normal users' occasional multiple login attempts.

[0121] The user request information frequent change detection component is used to prevent dynamic attacks and identity fraud. By monitoring the frequent changes of features such as UA, IP, and the number of intranet and extranet switching, it can detect abnormal changes in user request information. This can prevent attackers from bypassing security detection by dynamically changing this information. For example, it prevents attackers from using constantly changing IP and UA to simulate legitimate user behavior to attack or steal data, and enhances the verification of user identity authenticity. Enhance the system's defense capabilities against complex attacks. In complex network attack scenarios, attackers may use a variety of means to hide their identities and attack intentions. This detection of frequent changes in multiple features can effectively respond to such complex attacks and improve the overall security of the system.

[0122] The unfamiliar UserAgent request detection component is used to prevent malicious requests from unknown sources, detect uncommon and unresolvable UAs, and block requests from unknown or potentially malicious sources. Some malware or automated attack tools may use special UAs to disguise themselves. This detection can identify and block these malicious requests and protect the system from new or targeted attacks. It can also maintain the normal access environment of the system and only allow common and identifiable UAs to access the system. This ensures that the requests received by the system come from legitimate and expected clients, maintains the stability and security of the system access environment, and reduces compatibility issues and security risks that may be caused by unknown UAs.

[0123] The credential stuffing attack detection component is used to prevent the risk of large-scale data leakage. By analyzing the authentication logs of a specific IP over a period of time, detecting a large number of unknown users and abnormal authentication situations, it can effectively identify credential stuffing attacks. This attack may lead to the leakage of a large amount of user account information. Timely detection and prevention can protect the user's account security and prevent attackers from using leaked account passwords to obtain illegal permissions in the system. It can also protect the system's reputation and user trust. A successful credential stuffing attack may cause serious reputation damage to the system and cause users to doubt the security of the system. Through this detection mechanism, the possibility of successful credential stuffing attacks can be reduced, user trust in the system can be maintained, and the long-term stable operation of the system can be guaranteed.

[0124] The slow attack detection component is used to defend against low-frequency and long-term attacks. It detects the behavior of a specific IP using weak passwords to make a large number of authentication failure requests for multiple accounts within a period of time (even if the speed may be slow). It can deal with the low-frequency and long-term attack strategies adopted by some attackers. This attack method may avoid some mechanisms based on high-frequency attack detection in a short period of time. This special detection can enhance the defense capability against such covert attacks. The attack detection system can be improved and combined with other attack detection components to form a more comprehensive attack detection system, covering different types and time scales of attack behaviors, improving the system's overall defense capability against various password guessing attacks, and protecting user accounts and system security.

[0125] In the user behavior matching component,

[0126] The sudden activity detection component is used to discover abnormal user behavior patterns. By comparing the user's last activity time and the current request time, it can detect abnormal situations where the user suddenly becomes active after a long period of inactivity. This may be a signal that the account has been stolen, because normal user activities usually have a certain regularity. This sudden change can trigger risk assessment in time to protect user account security. It can also enhance the ability to monitor account security. For accounts that have not been used for a long time, the system can strengthen its access review based on this detection mechanism to prevent attackers from exploiting the account because it has not been paid attention to for a long time, and improve the system's sensitivity to potential security threats.

[0127] The intranet location feature matching component is used to protect the security of the intranet. Based on the intranet segment features, it detects whether the segment to which the requesting IP belongs matches the intranet segment of daily activities, which can prevent external attackers from breaking through the intranet defense line. This is crucial for environments with high security requirements such as corporate internal networks. It can effectively prevent unauthorized devices or users from accessing intranet resources from external segments and protect internal sensitive information. It can also prevent internal network penetration attacks. Even for users in the internal network, if their requests come from abnormal intranet segments, it may be a sign of being controlled after being attacked. Through this detection, potential security threats in the internal network can be discovered and prevented in a timely manner, such as malicious behavior by internal personnel or attacks launched by internal devices used by external attackers.

[0128] The remote login component is used to prevent the risk of remote account theft. It detects remote logins based on the characteristics of the country and city where the user is often active, and can effectively detect the use of accounts in abnormal geographical locations. This is a common sign of account theft. By timely identifying and taking corresponding measures (such as requiring additional authentication, alerting, etc.), user accounts can be protected from remote attackers and the user's personal information security can be guaranteed. It can also improve the security of mobile users: For users who often move between different regions, this detection can accurately judge abnormal remote logins while ensuring their normal use, avoiding misjudgments due to normal user movement, and effectively preventing illegal use of accounts in remote locations due to account theft.

[0129] The device feature matching component is used to ensure the legitimacy of the device. By comparing the device fingerprint of this request with the device fingerprint of daily activities, it can be confirmed whether the device is legitimate. This can prevent attackers from using unauthorized devices to access user accounts. For example, it can prevent users from logging in to their accounts on stolen phones or computers, and protect the security of user device binding and account information. It can also enhance the management of device replacement. When users replace devices, the system can require appropriate authentication or authorization steps based on this detection mechanism to ensure that the device replacement is performed by the user himself, while also preventing account security issues caused by device loss or theft.

[0130] The IP feature matching component is used to protect user IP-related security. It can prevent IP impersonation by comparing the IP features of users' daily activities. Whether in the intranet or extranet environment, this detection can ensure that the request comes from a legitimate IP address, protect the user's IP binding security, and prevent attackers from using IP spoofing and other means to obtain user account permissions or access restricted resources. It can also adapt to a variety of network environments and support IP matching of all networks, intranets, extranets and other different network types, so that the system can effectively detect IP features in various complex network deployment scenarios, and improve the system's ability to respond to security threats in different network environments.

[0131] The operating system feature matching component is used to ensure security at the operating system level: by comparing the operating system type and version of this request with the operating system type and version of daily activities, security issues caused by operating system mismatches can be prevented. For example, attackers may exploit vulnerabilities in older versions of the operating system to gain system permissions. This detection can prevent such attacks and also avoid application operation problems caused by users using incompatible operating system versions. It can also promote system upgrades and security maintenance. Through this detection mechanism, the system can encourage users to upgrade the operating system in a timely manner to improve the security of the entire system environment. For organizations such as enterprises, it can also better manage the use of user operating systems to ensure compliance with security policy requirements.

[0132] The active time feature matching component is used to discover abnormal time access behavior. By breaking down the request time into weeks and hours and comparing it with the time features of the user portrait, the user's access behavior at abnormal times can be detected. This may be a sign that the account has been stolen or that the attacker has used non-working hours and other low-regulatory periods to attack. Timely detection of such anomalies can strengthen security precautions during these periods. It can also optimize the allocation of security resources: Based on the user's normal active time characteristics, the system can strengthen security detection and access control during high-risk abnormal times, and appropriately simplify the process during the user's normal active time period to improve the user experience, while reasonably allocating security resources and improving the efficiency of security protection.

[0133] In the management policy matching component, the browser restriction component is used to ensure browser compatibility and security. It detects whether the user's browser meets the minimum version number requirements, version number matching requirements, and brand matching requirements, which can ensure the compatibility of the browser and the application system. Old versions of browsers may have security vulnerabilities that are easily exploited by attackers. Through this restriction, users can be required to use a more secure browser version to reduce security risks caused by browser vulnerabilities. It can also unify the user access environment. The matching requirements for browser brands and versions can enable the system to run in a relatively stable and controllable access environment, which is convenient for security management and maintenance. For example, some specific functions or applications may only run normally and ensure security on specific browsers. This restriction can ensure that users use the appropriate browser for access.

[0134] The IP range restriction component is used to control the access source. By detecting whether the user logs in within the set IP or IP segment range, the access source can be effectively controlled. Whether using a whitelist or a blacklist, it can ensure that only authorized IP addresses can access the system, prevent attacks from external unauthorized IPs, and protect the system from illegal access, especially for some systems that only allow access from internal networks or specific partner IPs. It can also enhance network boundary security. This restriction is an important part of network boundary security and can serve as a supplement to network security devices such as firewalls to further strengthen control over network access, especially in preventing external network attacks and illegal access to internal networks.

[0135] The location restriction component is used for security protection based on geographic location. It detects whether the user logs in outside the set country and city, and prevents the user account from being used in abnormal geographical locations. For some systems with high requirements for data security and privacy, such as applications in finance, government and other fields, this can avoid the risk of data leakage caused by account access in high-risk areas and enhance the system's geographical security protection. It can also protect compliance and data sovereignty. In some cases, enterprises or organizations need to comply with specific regulatory requirements and limit the geographical location of data access. This location restriction component can help achieve such compliance requirements, protect data sovereignty, and ensure that data is not illegally transmitted to unauthorized areas.

[0136] The time limit component is used for time-based access control. It detects whether the user logs in outside the set week and time range, and can control access in the time dimension. This can prevent users from making unnecessary access during non-working hours or high-risk periods, and reduce the security risks of the system during unsupervised periods. For example, for some sensitive systems within an enterprise, access can be restricted during normal working hours to avoid data leakage or system damage caused by illegal access during low-supervision periods such as nighttime. It can also optimize system resources and security management. According to the time limit, system maintenance, updates and other operations can be reasonably arranged. At the same time, security protection measures can be strengthened during high-risk times, such as increasing authentication requirements or conducting more frequent security monitoring, to improve the overall security of the system and resource utilization efficiency.

[0137] Use the mobile device restriction component to ensure mobile device access security: Detecting whether the user logs in outside the set mobile device and system version range can ensure the security of the mobile device. Old versions of mobile device operating systems may have security vulnerabilities. Through restrictions, users can be required to use more secure devices and system versions to prevent attackers from exploiting mobile device vulnerabilities to obtain user account permissions or access sensitive data. It can also be used to manage mobile device access policies. For organizations such as enterprises, it can better manage employees' use of mobile devices to access company systems. For example, only specific models and versions of company-issued mobile devices are allowed to access sensitive applications to ensure that mobile device access meets security policy requirements.

[0138] The operating system restriction component is used to provide security protection at the operating system level, detecting whether the user's operating system meets the minimum version number requirements, version number matching requirements, and brand matching requirements. Similar to using browser restrictions, it can ensure the security of the operating system. New operating system versions usually fix security vulnerabilities in old versions. Through this restriction, users can be required to use a more secure operating system, reduce security risks caused by operating system vulnerabilities, and protect the security of system and user data. It can also ensure system compatibility and stable operation. Ensuring the matching requirements of the operating system can improve the compatibility between the system and the operating system, avoid application operation problems caused by operating system incompatibility, and ensure that the system runs in a stable and secure operating system environment, facilitating system maintenance and management.

[0139] Optionally, the trust assessment model is based on multiple risk detection components, and performs risk assessment processing on the log information according to risk behavior detection logic preset by each of the risk detection components to obtain a risk assessment result, which specifically includes:

[0140] Set up a multi-level trust evaluation system for users and set an initial trust level for users, where the level of trust reflects the credibility of the user;

[0141] The risk detection component performs feature matching on the log information according to respective preset risk behavior detection logic;

[0142] If the risk behavior detection logic feature is triggered, the trust assessment level of the user is dynamically adjusted to obtain a risk assessment result, and the risk assessment result includes the adjusted user trust level information.

[0143] In this embodiment, the technical benefits of risk assessment processing based on the user multi-level trust assessment system and risk detection components are as follows:

[0144] 1. Accurate user trust quantification and risk measurement

[0145] 1. Advantages of the multi-level trust evaluation system

[0146] (1) More sophisticated user differentiation: Setting up a multi-level user trust evaluation system can enable more detailed classification of users. Different trust levels represent different degrees of user credibility, enabling the system to more accurately distinguish between legitimate users and potentially malicious users. For example, a user with a high trust level may be an internal employee who has been using the system normally for a long time, has a stable behavior pattern, and has no abnormal records, while a user with a low trust level may be a newly registered user or a user whose behavior exhibits certain abnormalities. This refined differentiation helps to formulate appropriate access control policies based on the specific circumstances of the user, improve security, avoid excessive restrictions on high-credibility users, and improve user experience.

[0147] (2) Reflecting the long-term behavior trends of users: By setting an initial trust level for users and dynamically adjusting it based on their behavior over time, the trust assessment system can reflect the long-term behavior trends of users. Long-term good behavior can gradually increase the trust level, while occasional abnormal behavior may cause the trust level to temporarily decrease. This helps the system to fully and dynamically understand the security of users, rather than just judging based on a single access behavior, thereby more accurately assessing the risks posed by users.

[0148] 2. Dynamic adjustment based on risk behavior detection logic

[0149] (1) Real-time response to risky behaviors: Risk detection components perform feature matching on log information according to their own preset risk behavior detection logic, and can detect abnormal user behavior in real time. For example, when the brute force detection component finds that a user account has a large number of failed authentication attempts in a short period of time, this indicates that there may be malicious attack behavior. This detection mechanism based on real-time log analysis can quickly capture signs of security threats, allowing the system to respond in a timely manner.

[0150] (2) Accurate risk feedback: Once the risk behavior detection logic feature is triggered, the user's trust assessment level is dynamically adjusted to provide the system with accurate risk feedback. Different risk behaviors correspond to different degrees of trust level adjustment. For example, minor abnormal behaviors may cause a small drop in the trust level, while serious attack behaviors (such as credential stuffing attacks) may cause a significant drop in the trust level. This precise feedback mechanism enables the system to take appropriate measures based on the severity of the risk and achieve more reasonable access control.

[0151] 2. Flexible and Adaptive Access Control Policy Adjustment

[0152] 1. Dynamically adapt to changes in user behavior

[0153] As users move around in the system, their behavior may change. Through the continuous monitoring of log information and dynamic adjustment of trust levels by the risk detection component, the system can automatically adapt to these changes. For example, if a user's usual access behavior is normal, but suddenly changes login devices frequently or accesses abnormal resources during a certain period, the system will lower its trust level accordingly and may conduct a stricter review of its access requests, such as requiring additional authentication or restricting access rights for certain high-risk operations. This adaptive capability enables the system to ensure security while minimizing the impact on users' normal use and remain sensitive to potential security threats.

[0154] 2. Personalized access control

[0155] Different users will be subject to different access control policies due to their different trust levels. Users with high trust levels can enjoy more relaxed access rights, such as reducing authentication steps and more convenient access to certain resources; while for users with low trust levels, the system will implement stricter control measures, such as increasing authentication requirements and restricting access to sensitive resources. This personalized access control is generated based on user behavior and risk assessment results, which can better balance the relationship between security and user experience, meet the needs of different user groups, and effectively prevent malicious users from exploiting system vulnerabilities for illegal access.

[0156] 3. Optimizing resource allocation and system performance

[0157] 1. Reasonable allocation of resources

[0158] Allocating system resources according to the user's trust level can achieve optimal resource utilization. For users with high trust levels, since their behavior is considered relatively safe, the system can reduce the resource consumption of checking and verifying their access requests, allowing these users to access applications quickly and smoothly. On the contrary, for users with low trust levels, the system will invest more resources in detailed risk assessment and strict access control to ensure safety. In this way, the system can reasonably allocate limited resources to different user access request processing, improve overall resource utilization efficiency, avoid wasting too many resources on low-risk user access, and ensure effective control of high-risk access.

[0159] 2. Improve system performance

[0160] Through accurate risk assessment and trust level adjustment, the system can avoid unnecessary complex processing of a large number of normal access requests, thereby improving system performance. For example, when most users have a high trust level and behave normally, the system can quickly release their access requests and reduce processing delays. This dynamic access control mechanism based on user trust helps maintain the efficient operation of the system, especially when dealing with a large number of concurrent access requests, improving the system's response speed and processing capabilities.

[0161] Optionally, the triggering of the risk behavior detection logic dynamically adjusts the trust assessment level of the user to obtain a risk assessment result, including:

[0162] If the risk behavior detection logic is triggered, the user's trust assessment level is adjusted according to the configured risk behavior and trust level mapping relationship;

[0163] The risk behavior and trust level mapping relationship includes a single risk behavior triggering and a preset trust level mapping and a multiple risk behaviors simultaneously triggering and a preset trust level mapping.

[0164] In this embodiment, the technical benefits of dynamically adjusting the user trust assessment level based on the mapping relationship between risk behavior and trust level are as follows:

[0165] 1. Accurate risk quantification and response

[0166] 1. Precise adjustment based on mapping relationship

[0167] (1) Scientific and reasonable assessment: The user trust assessment level is adjusted according to the configured mapping relationship between risk behavior and trust level, making the risk assessment process more scientific and reasonable. The system does not simply make a binary judgment on risky behavior (such as safe or unsafe), but quantifies the degree of risk and links it to the user's trust level. For example, for minor risky behaviors (such as occasional password input errors), it may only lead to a small drop in the trust level; while for serious risky behaviors (such as frequent brute force cracking attempts), the trust level will be greatly reduced. This precise adjustment method can more accurately reflect the actual risks posed by users.

[0168] (2) Targeted risk response: Different risk behaviors correspond to different trust level adjustments, allowing the system to take more targeted measures for risks of different types and severity. When a user's trust level is adjusted due to a specific risk behavior, the system can implement the corresponding access control policy based on the new trust level. For example, a lower trust level may result in restricted access rights, require additional authentication steps, or trigger an alarm mechanism, thereby more effectively responding to risks and protecting system security.

[0169] 2. Mapping advantages triggered by single risk behavior

[0170] (1) Rapid identification and response: Single risk behavior triggers and preset trust level mappings can quickly identify and respond to specific high-risk behaviors. For example, when the brute force detection component detects a large number of authentication failure attempts (single risk behavior) for a single user account in a short period of time, the system can quickly lower the trust level of the user based on the mapping relationship and take immediate measures, such as temporarily limiting the number of login attempts for the account or adding additional authentication requirements. This rapid response mechanism helps to curb potential security threats at an early stage and prevent attacks from further developing.

[0171] (2) Clear responsibility tracing: For situations triggered by a single risky behavior, it is easier to trace the source and responsibility of the risk. When a specific risky behavior causes a change in the trust level, the administrator can clearly understand which behavior caused the security issue, facilitating subsequent investigation and processing, such as determining whether it was the user's own negligence (such as forgetting the password resulting in multiple authentication failures) or a sign of a malicious attack.

[0172] 3. Mapping advantages of multiple risk behaviors triggered simultaneously

[0173] (1) Comprehensive risk assessment: Considering multiple risk behaviors and simultaneously triggering them with the preset trust level mapping can achieve a more comprehensive and integrated risk assessment. In an actual network environment, attackers may use multiple means to break through system security at the same time. For example, a user may simultaneously perform multiple abnormal behaviors such as logging in from a different location, using unfamiliar devices, and frequently accessing sensitive resources. By comprehensively considering these risk behaviors, the system can more accurately assess the overall risk posed by the user and avoid focusing on a single risk while ignoring other potential threats.

[0174] (2) Response to complex scenarios: This mapping relationship helps the system respond to complex security scenarios. When multiple risk behaviors occur at the same time, there may be correlations and synergies between them, and the threat to system security may be greater than the simple superposition of a single risk behavior. Adjusting the trust level according to the mapping relationship can more reasonably reflect the degree of risk in such complex situations, and adopt stricter access control strategies, such as completely blocking access, requiring higher levels of authentication, or notifying administrators for manual review, to effectively respond to complex attack scenarios.

[0175] 2. Enhance the adaptability and flexibility of the system

[0176] 1. Adapt to various attack methods

[0177] As cyberattacks become increasingly diverse and complex, a single risk assessment standard often fails to meet security needs. By covering mapping relationships for both single risk behaviors and multiple risk behaviors triggered simultaneously, the system can adapt to a variety of different types of attacks, whether simple single-mode attacks or complex combined attacks. This comprehensive mapping relationship makes the system more adaptable in the face of an ever-changing cyber threat environment, and can promptly update and adjust risk assessment strategies to respond to emerging attack patterns.

[0178] 2. Flexible strategy adjustment

[0179] The mapping relationship between risky behaviors and trust levels provides the system with a basis for flexibly adjusting access control policies. Administrators can flexibly configure the mapping relationship based on the security requirements and actual conditions of the system. For example, when the network security situation is more severe, the mapping relationship can be adjusted so that certain behaviors that were originally considered low-risk will lead to a more significant decrease in trust levels under specific combinations, thereby strengthening the security protection of the system; when the security environment is relatively loose, the mapping relationship can be appropriately relaxed to reduce interference with normal user access. This flexibility enables the system to maintain a good balance between performance and user experience in different security scenarios.

[0180] 3. Improve user safety awareness and guide behavior

[0181] 1. Safety awareness education

[0182] When users are experiencing the system, if their trust level is reduced and they are subject to corresponding access restrictions due to certain risky behaviors, this can be used as an implicit security awareness education method. For example, when users are prompted by the system that their trust level is reduced due to frequent changes in login devices or using weak passwords, they will realize that these behaviors may affect their account security and system security, and thus pay more attention to security issues in the subsequent use process, develop good security habits, and improve the overall network security level from the user level.

[0183] 2. Behavioral guidance and regulation

[0184] By clearly mapping risky behaviors to trust levels, the system can guide users' behaviors toward a safer direction. Users will learn which behaviors are considered high-risk by the system and avoid them. For example, if the system stipulates that frequent logins in different network environments will lead to a decrease in trust levels, users may try to log in in a stable network environment, thereby reducing potential security risks, promoting users to regulate their own network behaviors, and improving system security.

[0185] Optionally, judging whether to trigger an access control policy according to the risk assessment result and a pre-configured access control trigger rule, and if triggered, sending the access control policy to the security gateway, includes:

[0186] Notifying the strategy judgment engine of the result;

[0187] The policy judgment engine determines whether to trigger the access control policy based on the configured trust level and control action mapping relationship;

[0188] If the access control policy is triggered, the policy judgment engine sends the access control policy to the security gateway based on a preset communication method;

[0189] The communication method includes message queue or API call, and also includes other communication methods.

[0190] In this embodiment, the technical benefits of defining, determining and issuing access control policies based on evaluation results are as follows:

[0191] 1. Advantages of the strategy judgment engine

[0192] 1. Accurate basis for strategic decision-making

[0193] (1) Scientific mapping relationship utilization: The policy judgment engine determines the access control policy based on the configured trust level and control action mapping relationship, which makes the policy formulation more scientific, reasonable and targeted. Different trust levels reflect the user's current risk status. Through accurate mapping relationships, the system can match the most appropriate control action for each trust level. For example, for users with high trust levels, relatively loose access rights can be granted, such as reducing authentication steps; while for users with low trust levels, stricter controls are implemented, such as increasing authentication requirements or restricting access to sensitive resources, thereby optimizing the user experience while ensuring security.

[0194] (2) Flexible response to risk changes: As user behavior and system environment change, the trust level may be adjusted dynamically. This mapping-based policy judgment engine can respond to such changes in real time and flexibly determine the corresponding access control policy. When it is detected that the user's risky behavior causes the trust level to decrease, the system can quickly adjust to a stricter access control policy to effectively prevent potential security threats; conversely, when the user maintains good behavior and the trust level increases, the restrictions can be appropriately relaxed to improve user convenience.

[0195] 2. Centralized strategy determination

[0196] (1) Unified management and coordination: The policy judgment engine serves as a centralized decision point and is responsible for determining access control policies based on evaluation results. This avoids the problem of decentralized and inconsistent policy formulation in the system and ensures the uniformity and coordination of access control policies throughout the system. Regardless of how many different applications, user groups, or access scenarios there are in the system, the policy judgment engine can determine the appropriate policy according to the same standards and rules, reducing the risk of security vulnerabilities caused by inconsistent policies.

[0197] (2) Easy to maintain and update: When the access control policy needs to be modified or updated (for example, when the enterprise adjusts its security policy or responds to new network threats, etc.), it is only necessary to make corresponding configuration adjustments in the policy judgment engine. This centralized maintenance method greatly simplifies the management of the system, reduces the complexity and workload of modifying policies in multiple applications or modules, and improves the maintainability and adaptability of the system.

[0198] 2. Benefits of delivering policies through specific communication methods

[0199] 1. Advantages of message queues or API calls

[0200] (1) Reliable message delivery: Using message queues as a communication method can ensure reliable delivery of access control policies. Message queues have asynchronous processing and buffering functions, which can ensure that policy information is not lost even when the system load is high or the network is unstable. For example, when a large number of evaluation results are generated at the same time and policies need to be issued, the message queue can process them in sequence to avoid confusion and loss of information, ensuring that the security gateway can accurately receive the latest policies.

[0201] (2) Loosely coupled system architecture: Communication through message queues or API calls achieves loose coupling between the policy judgment engine and the security gateway. This architecture allows the two modules to develop and update independently, and as long as they follow the same communication interface and data format, they will not affect each other. For example, when the security gateway needs to be upgraded or replaced with a new implementation technology, as long as it maintains compatibility with the message queue or API, it will not affect the work of the policy judgment engine, and vice versa, which improves the flexibility and scalability of the system.

[0202] (3) Efficient communication efficiency: API calls provide a direct and efficient means of communication. When policies need to be issued in real time, API calls can quickly pass policy information from the policy judgment engine to the security gateway. This immediacy is critical when responding to emergency security situations or when access control policies need to be adjusted quickly. It enables the security gateway to quickly execute new policies and effectively respond to sudden security threats.

[0203] 3. Ensure timely update and implementation of strategies

[0204] (1) Real-time policy implementation: The access control policy is sent to the security gateway in a timely manner through a pre-set communication method, ensuring that the security gateway can obtain the latest policy information in real time and take effect immediately. This enables the system to quickly respond to changing security risks. For example, when a new malicious attack pattern or a user's high-risk behavior is discovered, the evaluation results can be quickly converted into a new access control policy and implemented on the security gateway, preventing potential security threats and improving the system's security and response capabilities.

[0205] (2) Dynamically adapt to environmental changes: Whether it is changes in the network environment, changes in user behavior, or the emergence of new security threats, this fast and reliable policy delivery mechanism can ensure that the access control policy of the security gateway is updated synchronously. This enables the system to always maintain effective security protection in a complex and changing network environment, dynamically adapt to various security challenges, and ensure the stable operation of the system and data security.

[0206] Optionally, the security gateway also has one or a combination of HTTP request packet filtering and black and white list management security capabilities, and the security capabilities are combined with dynamic access control policies to jointly ensure application security.

[0207] In this embodiment, the security gateway's security capabilities such as HTTP request packet filtering and blacklist and whitelist management are combined with dynamic access control policies, which has the following technical benefits:

[0208] 1. Technical benefits of HTTP request packet filtering

[0209] 1. Prevent malicious request content

[0210] (1) Rule-based precision protection: HTTP request packet filtering can check request packets based on custom rules (such as regular expressions, string rules, etc.). For example, you can set rules to prohibit requests containing specific malicious characters (such as special characters commonly used in SQL injection) or attack URLs from passing. This can effectively prevent hackers from exploiting common vulnerability attack methods (such as SQL injection, cross-site scripting attacks XSS, etc.), protect applications from malicious attacks based on the HTTP protocol, and ensure the security of applications and data.

[0211] (2) Deep inspection at the content level: Different from traditional access control based only on IP or port, request packet filtering goes deep into the HTTP request content level. It can check various information in the request header and request body, including user-submitted data, requested resource path, etc. For example, for an e-commerce application, filtering rules can prevent users from maliciously modifying key data such as product prices during order submission, ensuring the integrity of business logic and data accuracy.

[0212] 2. Optimize network traffic and resource utilization

[0213] (1) Filter invalid requests: By filtering HTTP request packets that do not comply with the rules, unnecessary network traffic entering the application server can be reduced. A large number of invalid or malicious requests may occupy network bandwidth and server resources, such as CPU and memory. By filtering request packets at the security gateway, only legitimate and valid requests can continue to be transmitted to the application server, improving the utilization of network resources, reducing the burden on the application server, and thus optimizing the performance of the entire system.

[0214] (2) Improve processing efficiency: The application server does not need to process malicious or invalid requests that are filtered out, and can use more resources to process legitimate requests. This helps to improve the application server's response speed to legitimate user requests and improve user experience, especially in high-traffic application scenarios, where this optimization effect is more significant.

[0215] 2. Technical Benefits of Blacklist and Whitelist Management

[0216] 1. Precise access control

[0217] (1) Whitelisting ensures legitimate access: Whitelist management allows system administrators to clearly specify which users (based on IP and other identifiers) can access specific applications or resources. This is critical for applications that require high security protection, such as core business systems within an enterprise, which can only be accessed by authorized specific departments or personnel with IP addresses on the whitelist. This precise access control ensures that only legitimate users and devices can interact with the application, greatly reducing the risk of external attacks and illegal access.

[0218] (2) Blacklists prevent malicious access: Blacklists are used to block known malicious sources. When an IP address or user is found to frequently launch attacks (such as brute force cracking, malicious scanning, etc.), it is added to the blacklist and the security gateway directly rejects all requests from these sources. This is a fast and effective defense mechanism that can quickly block attacks from specific malicious entities and protect applications from targeted threats.

[0219] 2. Flexibly respond to changes in security threats

[0220] (1) Dynamic update of blacklists and whitelists: Blacklists and whitelists can be adjusted dynamically based on security conditions. For example, when new threat intelligence indicates that a certain IP segment is used for large-scale attacks, the IP segment can be added to the blacklist in a timely manner; or when a new partner needs to access the application, its related IP can be added to the whitelist. This dynamism enables the system to quickly adapt to the ever-changing network security environment and respond to new security threats or changes in business needs in a timely manner.

[0221] (2) Collaboration with dynamic access control policies: Blacklist and whitelist management is combined with dynamic access control policies to form a multi-level security protection system. Dynamic access control policies can be adjusted based on more complex factors such as user behavior and risk assessment, while blacklists and whitelists serve as a basic and clear access control method. For example, even if a user originally has certain access rights in the dynamic policy evaluation, if his IP appears in the blacklist, he will still be denied access. The two complement each other and enhance the overall security of the system.

[0222] III. Benefits of combining security capabilities with dynamic access control policies

[0223] 1. Comprehensive security protection

[0224] (1) Multi-dimensional risk response: Combining HTTP request packet filtering, blacklist and whitelist management, and dynamic access control policies, it covers multiple dimensions, from request content inspection, access source restriction to dynamic control based on user behavior and system risk assessment. This multi-dimensional security protection can effectively respond to various types of security threats, whether they are known attack patterns or newly emerging complex attack methods, and can prevent them at different levels, greatly improving the security of applications.

[0225] (2) Make up for the shortcomings of a single strategy: A single security capability or access control strategy may have certain limitations. For example, a dynamic access control strategy may not be able to respond to new zero-day attacks in a timely manner. If combined with HTTP request packet filtering, it can be initially intercepted based on the abnormal characteristics of the request content; while blacklist and whitelist management may not be able to adapt to the abnormal behavior changes of legitimate users, and dynamic access control strategies can be adjusted according to the real-time behavior of users. The combination of the three forms a more complete security protection network.

[0226] 2. Adaptive security environment adaptability

[0227] (1) Real-time adjustment of protection strategies: As the network security situation changes and the application environment evolves, this combination can achieve real-time adjustment of security protection strategies. For example, during the peak period of network attacks, dynamic access control policies can be used to tighten access rights, while HTTP request packet filtering can be used to strengthen the review of request content, and blacklists and whitelists can be updated accordingly based on newly emerged malicious IP addresses, so that the system can adaptively respond to environmental changes at different security levels and always maintain the best security status.

[0228] (2) Continuous optimization of security protection: By continuously analyzing the data collected by the security gateway (such as the type of filtered requests, hits on the blacklist and whitelist, dynamic policy adjustment records, etc.), the security protection mechanism can be continuously optimized. For example, if a filtering rule is found to be triggered frequently, it may be necessary to further refine or adjust the rule; if some IPs are on the edge of the blacklist and whitelist (such as frequently changing between the whitelist and dynamic policy restrictions), their behavior can be further analyzed and the policy can be optimized, thereby achieving continuous improvement in security protection.

[0229] Optionally, the method also includes expanding and improving the functions of the gateway and trust assessment module at any time to adapt to various applications, and integrating with one or a combination of situational awareness, threat intelligence, honeypot, and AI technologies to define dynamic access control policies.

[0230] In this embodiment, a function expansion and improvement mechanism for the gateway and trust assessment module is established. In the initial design of the gateway and trust assessment module, a modular and pluggable architecture is adopted. This architecture allows new functional modules to be easily added without affecting the operation of the overall system. For example, the gateway can reserve specific interfaces or plug-in slots for accessing new security functions or protocol processing modules; the trust assessment module can have flexible data access points and analysis algorithm expansion interfaces. And based on the development of standards and interfaces, unified standards and interfaces are defined, and these standards are followed whether it is internal development of new functions or external integration of third-party functions. This ensures that newly added functions can be seamlessly connected to the existing system. For example, for new authentication methods or risk detection algorithms, as long as they are implemented in accordance with the prescribed interface specifications, they can be easily integrated into the trust assessment module.

[0231] In this embodiment, this solution can also be integrated with situational awareness, threat intelligence, honeypot, and AI technology to establish a data sharing interface with the situational awareness system, receive network topology, traffic trend and other information; connect with the threat intelligence platform to obtain the latest malicious IP, attack mode and other data; interact with the honeypot system to collect the attacker's behavior patterns and attack methods; use the interface of AI technology to integrate machine learning models into risk assessment and policy formulation. These interfaces ensure that data can be exchanged in real time and accurately between various systems. In addition, the logic of collaborative work is designed so that the gateway and trust assessment module can use data obtained from other technologies to optimize dynamic access control policies. For example, when the situational awareness system detects that abnormal traffic in the network is concentrated in a certain area, the gateway can strengthen the review of requests from the source of the area based on this information; new malicious IP information in threat intelligence can be directly updated to the gateway's blacklist or affect the trust assessment module's risk assessment of related access; the attack behavior patterns collected by the honeypot can be used to train the AI ​​model, thereby improving the risk detection algorithm.

[0232] In this embodiment, this design has the following technical advantages:

[0233] 1. Enhanced system adaptability and flexibility

[0234] (1) Adapt to various application scenarios: By expanding the functions of the gateway and trust assessment modules, the security requirements of different types of applications can be met. For example, for an e-commerce application, it may be necessary to pay more attention to the protection of user transaction data and the prevention of payment fraud. By adding specific risk detection modules and data encryption functions to the gateway and trust assessment modules, transaction security can be better guaranteed. For an enterprise resource planning (ERP) system, stricter user authority management and data access control may be required. Through functional expansion, more sophisticated access control strategies can be implemented.

[0235] (2) Responding to changing business needs: The business of an enterprise is constantly developing and changing, and new business processes and application functions may require new security requirements. This scalable design can respond to these changes in a timely manner and quickly add new security features. For example, when an enterprise launches a new mobile office business, it can add mobile device security detection and mobile application access control functions to the gateway and trust assessment module to ensure the safe development of mobile business.

[0236] 2. Improve security protection capabilities

[0237] (1) Integrate multi-source data for comprehensive risk assessment: Integrate with situational awareness, threat intelligence, honeypots and other technologies to obtain more comprehensive security information. The global network perspective provided by situational awareness, the latest attack clues from threat intelligence, the real attack behaviors collected by honeypots, and the deep analysis capabilities of AI technology on these massive data together provide a richer basis for the formulation of access control policies. This enables the system to more accurately assess potential security risks and detect and prevent complex network attacks in advance.

[0238] (2) Using AI technology to optimize risk prediction and policy adjustment: The introduction of AI technology can learn and analyze a large amount of historical data and real-time data, and discover patterns and trends hidden in the data. For example, through the analysis of user behavior data by machine learning algorithms, it is possible to more accurately predict whether users have abnormal behavior, so as to adjust access control policies more timely. This data-driven risk prediction and policy adjustment capability far exceeds the traditional rule-based access control method, and effectively improves the security protection level of the system.

[0239] 3. Improve resource utilization efficiency and cost-effectiveness

[0240] (1) Avoid duplication of construction: Through functional expansion and technology integration, existing security infrastructure and technology investments can be fully utilized. For example, there is no need to rebuild an independent intelligence collection system to obtain threat intelligence, but it can be integrated with the existing threat intelligence platform. This avoids duplication of construction and reduces the cost of security construction.

[0241] (2) Optimize resource allocation: By using the fused multi-source data, security resources can be allocated more reasonably. For example, when threat intelligence shows that a certain type of attack has a low risk in the current network environment, resources invested in this area can be appropriately reduced (such as reducing the relevant detection frequency); and when situational awareness finds that the access volume of a certain application has suddenly increased and there is a potential risk, more resources can be allocated to the review of access requests to the application, thereby improving resource utilization efficiency and ensuring system security.

[0242] In another embodiment, a dynamic access control device based on a security gateway and trust evaluation is provided, comprising:

[0243] A trust assessment module is used to perform risk assessment on the log information collected in real time to obtain a risk assessment result, and determine whether to trigger the access control policy based on the risk assessment result and the pre-configured access control trigger rule. If triggered, the access control policy is sent to the security gateway;

[0244] A security gateway, which is used to close the external access rights of the application and resolve the application domain name to the address of the security gateway, so that all access requests directed to the application domain name are reverse-proxy accessed through the security gateway;

[0245] The security gateway is also used to automatically start dynamic policy reception monitoring, receive and update the access control policy in real time, and then save the access control policy in the storage of the security gateway to form a dynamic policy;

[0246] The security gateway is also used to intercept the client's access request to the target application, and parse the access request message content, and match the access request message content according to the dynamic policy. If the preset trigger condition is met, the access request is executed according to the policy rules. The corresponding control action is performed to achieve dynamic access control

[0247] The dynamic access control based on security gateway and trust assessment in the embodiments of the present application can be used to implement any dynamic access control method based on security gateway and trust assessment in the embodiments of the present application.

[0248] In another embodiment of the present application, an electronic device is also provided, which includes: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute any operation corresponding to the dynamic access control method based on a security gateway and trust assessment.

[0249] In another embodiment of the present application, a computer storage medium is provided, on which a computer program is stored. When the program is executed by a processor, any dynamic access control method based on a security gateway and trust assessment in the embodiments of the present application is implemented.

[0250] The above-mentioned method according to the embodiment of the present application can be implemented in hardware, firmware, or implemented as software or computer code that can be stored in a recording medium (such as a CD, ROM, RAM, floppy disk, hard disk or magneto-optical disk), or implemented as a computer code originally stored in a remote recording medium or a non-temporary machine-readable medium downloaded through a network and to be stored in a local recording medium, so that the method described herein can be stored in such software processing on a recording medium using a general-purpose computer, a dedicated processor or programmable or dedicated hardware (such as an ASIC or FPGA). It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component (e.g., RAM, ROM, flash memory, etc.) that can store or receive software or computer code, and when the software or computer code is accessed and executed by a computer, a processor or hardware, an access control policy construction method is implemented.

[0251] It should be noted that the same and similar parts between the various embodiments in this specification can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments. The device and system embodiments described above are merely schematic, wherein the modules described as separate components may or may not be physically separated, and the components indicated as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. A person of ordinary skill in the art can understand and implement it without paying creative labor.

[0252] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Claims

1. A dynamic access control method based on security gateway and trust evaluation, characterized in that include: Based on the deployed security gateway, by closing the application's external access rights and resolving the application domain name to the security gateway address, all access requests directed to the application domain name are reverse-proxy accessed through the security gateway; Perform risk assessment on the real-time collected log information based on the trust assessment model to obtain a risk assessment result, and determine whether to trigger the access control policy based on the risk assessment result and the pre-configured access control trigger rule. If triggered, send the access control policy to the security gateway; The security gateway automatically starts dynamic policy reception monitoring, receives and updates the access control policy in real time, and then stores the access control policy in the storage of the security gateway to form a dynamic policy; Based on the security gateway, the client's access request to the target application is intercepted, and the access request message content is parsed, and the access request message content is matched and judged according to the dynamic policy. If the preset trigger condition is met, the access request is subjected to corresponding control action according to the policy rules to realize dynamic access control.

2. The dynamic access control method based on security gateway and trust evaluation according to claim 1 is characterized in that: When the access control action is release, the security gateway forwards the access request to the target application server based on the domain name information carried in the access request and the mapping relationship between the configured domain name and the target application server, and receives the response from the target application server and returns it to the client to achieve access to the target application.

3. The dynamic access control method based on security gateway and trust evaluation according to claim 1 is characterized in that: The risk assessment results obtained by performing risk assessment on the real-time collected logs and intelligence information based on the trust assessment model include: The trust assessment model is based on multiple risk detection components, and performs risk assessment processing on the log information according to the risk behavior detection logic preset by each of the risk detection components to obtain a risk assessment result; The risk detection component is designed based on the preset risk rule type classification, and the risk rule types include: attack threat detection risk rule type, user behavior matching risk rule type, and management policy matching risk rule type; The attack threat detection type risk detection components include: risk detection component, brute force detection component, user frequent access application detection component, threat IP login detection component, multiple account login detection component, user frequent login detection component, user request information frequent change detection component, unfamiliar UserAgent request detection component, database collision attack detection component, slow attack detection component; The user behavior matching type risk detection components include: sudden activity detection components, intranet location feature matching components, remote login components, device feature matching components, IP feature matching components, operating system feature matching components, and active time feature matching components; The management policy matching risk detection component includes: using a browser restriction component, using an IP range restriction component, using a location restriction component, using a time restriction component, using a mobile device restriction component, and using an operating system restriction component.

4. The dynamic access control method based on security gateway and trust evaluation according to claim 3 is characterized in that: The trust assessment model is based on multiple risk detection components, and performs risk assessment processing on the log information according to the risk behavior detection logic preset by each of the risk detection components to obtain a risk assessment result, which specifically includes: Set up a multi-level trust evaluation system for users and set an initial trust level for users, where the level of trust reflects the credibility of the user; The risk detection component performs feature matching on the log information according to respective preset risk behavior detection logic; If the risk behavior detection logic feature is triggered, the trust assessment level of the user is dynamically adjusted to obtain a risk assessment result, and the risk assessment result includes the adjusted user trust level information.

5. The dynamic access control method based on security gateway and trust evaluation according to claim 4 is characterized in that: The triggering of the risk behavior detection logic dynamically adjusts the trust assessment level of the user to obtain a risk assessment result, including: If the risk behavior detection logic is triggered, the user's trust assessment level is adjusted according to the configured risk behavior and trust level mapping relationship; The risk behavior and trust level mapping relationship includes a single risk behavior triggering and a preset trust level mapping and a multiple risk behavior triggering and a preset trust level mapping.

6. The dynamic access control method based on security gateway and trust evaluation according to claim 5 is characterized in that: The determining whether to trigger the access control policy according to the risk assessment result and the pre-configured access control triggering rule, and if triggered, sending the access control policy to the security gateway, includes: Notifying the strategy judgment engine of the result; The policy judgment engine determines whether to trigger the access control policy based on the configured trust level and control action mapping relationship; If the access control policy is triggered, the policy judgment engine sends the access control policy to the security gateway based on a preset communication method; The communication method includes a message queue or an API call.

7. The dynamic access control method based on security gateway and trust evaluation according to claim 1 is characterized in that: The security gateway also has one or a combination of HTTP request packet filtering and black and white list management security capabilities. The security capabilities are combined with dynamic access control strategies to jointly ensure application security.

8. A dynamic access control device based on a security gateway and trust evaluation, characterized in that: include: A trust assessment module is used to perform risk assessment processing on the log information collected in real time to obtain a risk assessment result, and determine whether to trigger the access control policy based on the risk assessment result and the pre-configured access control trigger rule. If triggered, the access control policy is sent to the security gateway; A security gateway, which is used to close the external access rights of the application and resolve the application domain name to the address of the security gateway, so that all access requests directed to the application domain name are reverse-proxy accessed through the security gateway; The security gateway is also used to automatically start dynamic policy reception monitoring, receive and update the access control policy in real time, and then save the access control policy in the storage of the security gateway to form a dynamic policy; The security gateway is also used to intercept the client's access request to the target application, and parse the access request message content, and match and judge the access request message content according to the dynamic policy. If the preset trigger condition is met, the access request is executed according to the policy rules. The corresponding control action is performed to achieve dynamic access control.

9. An electronic device, characterized in that: include: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform an operation corresponding to the method according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images