Dynamic access control method and device based on security gateway and trust evaluation and related products

Abstract

The embodiment of the application provides a dynamic access control method and device based on a security gateway and trust evaluation and related products. The dynamic access control method based on the security gateway and the trust evaluation comprises the following steps: based on the security gateway, closing the external access permission of an application and resolving the domain name of the application to the address of the security gateway, so that all access requests pass through the security gateway for access; judging whether an access control strategy is triggered according to the risk evaluation result and a pre-configured access control triggering rule, and if the access control strategy is triggered, issuing the access control strategy to the security gateway; the security gateway receives the access control strategy in real time, intercepts an access request of a client to a target application, and matches and judges the content of the access request message according to the dynamic strategy, if the preset triggering condition is met, performing a corresponding control action on the access request according to the strategy rule, so as to realize dynamic access control. The access is safer, more flexible, more adaptive and more scalable.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of network security, and in particular to a dynamic access control method, apparatus and related products based on security gateway and trust assessment. Background Technology

[0002] In today's digital age, network technology is developing rapidly, and network access has become an indispensable part of people's daily work, study, and life. At the same time, network security is facing unprecedented and severe challenges. Access control, as a key line of defense for network security, aims to restrict specific subjects' access to specific resources under specific conditions in order to ensure the confidentiality, integrity, and availability of data.

[0003] Traditional access control methods often rely on static policy configurations. These static policies are typically built around relatively fixed and easily accessible elements such as authentication status, roles, menus, and IP addresses. For example, corporate intranets often assign specific network resource access permissions based on employees' job roles, such as finance personnel accessing the finance system while ordinary employees can only access the office automation system; or they may restrict access based on IP address ranges, allowing only devices within the company's intranet IP range to access specific applications. In this model, when an access subject initiates a resource access request, the application intercepts and judges it according to the pre-set static policy. If the access permission is met, it is allowed; otherwise, it is blocked or an appropriate prompt is given.

[0004] However, with the increasing complexity of the network environment and the continuous evolution of network attack methods, static access control has revealed many limitations. From a security perspective, relying solely on simple, static elements for access control makes it difficult to cope with complex and ever-changing security threats. For example, it cannot effectively identify the security status of the accessing device, such as whether the device is infected with malware or has system vulnerabilities; nor can it assess the security of network links, such as whether the link has been hijacked or whether there is a risk of man-in-the-middle attacks. Once attackers breach these simple static defenses, such as by forging legitimate IP addresses or stealing legitimate users' authentication credentials, they can easily obtain sensitive resources, leading to serious security incidents.

[0005] From a flexibility perspective, static access control lacks real-time monitoring and dynamic adjustment capabilities. It cannot promptly detect security risks arising from changes in the access subject's behavior or real-time changes in the network link's status. For example, when a user account is abnormally logged in from a different location, or when there are sudden abnormal traffic fluctuations in the network link, static policies cannot automatically respond and adjust access permissions. This leaves the system in a passive defensive state when facing new network attacks or abnormal access behavior, unable to effectively prevent potential security threats in a timely manner, thus posing a significant threat to network security.

[0006] In conclusion, traditional static access control methods are no longer sufficient to meet the growing network security demands. There is an urgent need for a more secure, flexible, and intelligent dynamic access control solution to effectively address the complex and ever-changing network environment and security challenges. Summary of the Invention

[0007] In view of this, embodiments of the present invention provide a dynamic access control method, apparatus, and related products based on security gateways and trust assessment, to at least partially solve the above-mentioned problems.

[0008] According to a first aspect of the present invention, a dynamic access control method based on a security gateway and trust assessment is provided, comprising:

[0009] Based on the deployed security gateway, by disabling external access permissions for applications and resolving application domain names to the security gateway address, all access requests pointing to application domain names are reverse proxied through the security gateway.

[0010] The risk assessment is performed on the real-time collected log information based on the trust assessment model to obtain the risk assessment result. Based on the risk assessment result and the pre-configured access control triggering rules, it is determined whether to trigger the access control policy. If triggered, the access control policy is sent to the security gateway.

[0011] The security gateway automatically enables dynamic policy reception and monitoring, receives and updates the access control policy in real time, and then saves the access control policy in the security gateway's storage to form a dynamic policy.

[0012] The security gateway intercepts client access requests to the target application, parses the content of the access request message, and matches and judges the content of the access request message according to the dynamic policy. If the preset triggering condition is met, the corresponding control action is executed on the access request according to the policy rules to achieve dynamic access control.

[0013] Optionally, the control actions include: blocking, allowing, prompting, alarming, and supplementary authentication.

[0014] Optionally, when the access control action is to allow, the security gateway forwards the access request to the target application server based on the domain name information carried in the access request and the configured mapping relationship between the domain name and the target application server, and receives the response from the target application server and returns it to the client, so as to realize access to the target application.

[0015] Optionally, the log information includes authentication logs, risk alarm logs, terminal device operation logs, and threat intelligence logs.

[0016] Optionally, the risk assessment processing of the real-time collected logs and intelligence information based on the trust assessment model to obtain the risk assessment results includes:

[0017] The trust assessment model is based on multiple risk detection components. The log information is processed for risk assessment according to the risk behavior detection logic preset by each of the risk detection components to obtain the risk assessment result.

[0018] The risk detection component is designed based on a preset risk rule type classification, which includes: attack threat detection risk rule type, user behavior matching risk rule type, and management strategy matching risk rule type.

[0019] The attack threat detection type risk detection components include: risk detection component, brute-force attack detection component, frequent user access to application detection component, threat IP login detection component, multi-account login detection component, frequent user login detection component, frequent change of user request information detection component, unfamiliar UserAgent request detection component, credential stuffing attack detection component, and slow attack detection component.

[0020] The user behavior matching type risk detection component includes: sudden activity detection component, intranet location feature matching component, remote login component, device feature matching component, IP feature matching component, operating system feature matching component, and active time feature matching component;

[0021] The management strategy matching risk detection components include: browser restriction component, IP range restriction component, location restriction component, time restriction component, mobile device restriction component, and operating system restriction component.

[0022] Optionally, the trust assessment model is based on multiple risk detection components. The log information is processed for risk assessment according to the pre-defined risk behavior detection logic of each of the risk detection components to obtain a risk assessment result, specifically including:

[0023] Establish a multi-level user trust assessment system and assign an initial trust level to each user, where the level of trust reflects the user's credibility.

[0024] The risk detection components perform feature matching on the log information according to their respective preset risk behavior detection logic;

[0025] If the risk behavior detection logic is triggered, the user's trust assessment level will be dynamically adjusted to obtain a risk assessment result, which includes the adjusted user trust level information.

[0026] Optionally, triggering the risk behavior detection logic dynamically adjusts the user's trust assessment level to obtain a risk assessment result, including:

[0027] If this risk behavior detection logic is triggered, the user's trust assessment level will be adjusted according to the configured risk behavior and trust level mapping relationship.

[0028] The mapping relationship between risk behaviors and trust levels includes the mapping between a single risk behavior trigger and a preset trust level, and the mapping between multiple risk behaviors triggering simultaneously and a preset trust level.

[0029] Optionally, the step of determining whether to trigger an access control policy based on the risk assessment result and pre-configured access control triggering rules, and if triggered, issuing the access control policy to the security gateway, includes:

[0030] The results are then communicated to the strategy judgment engine.

[0031] The policy judgment engine determines whether to trigger the access control policy based on the configured trust level and control action mapping relationship.

[0032] If an access control policy is triggered, the policy determination engine will send the access control policy to the security gateway based on a pre-defined communication method.

[0033] The communication methods include message queues or API calls.

[0034] Optionally, the security gateway may also have one or a combination of HTTP request packet filtering, blacklist / whitelist management and other security capabilities. These security capabilities, combined with dynamic access control policies, jointly ensure application security.

[0035] Optionally, the method also includes the ability to extend and improve the functionality of the gateway and trust assessment module at any time to adapt to various applications, and to integrate with one or a combination of situational awareness, threat intelligence, honeypots, and AI technologies to define dynamic access control policies.

[0036] In a second aspect of this application, a dynamic access control apparatus based on a security gateway and trust assessment is provided, applied to a dynamic access control method based on a security gateway and trust assessment as described in any one of the claims, comprising:

[0037] The trust assessment module is used to perform risk assessment on the real-time collected log information to obtain the risk assessment result. Based on the risk assessment result and the pre-configured access control triggering rules, it determines whether to trigger the access control policy. If triggered, the access control policy is sent to the security gateway.

[0038] A security gateway is used to disable external access permissions for applications and resolve application domain names to the address of the security gateway, so that all access requests pointing to application domain names are reverse proxied through the security gateway.

[0039] The security gateway is also used to receive and update the access control policy in real time by automatically enabling dynamic policy reception and monitoring, and then save the access control policy in the storage of the security gateway to form a dynamic policy.

[0040] The security gateway is also used to intercept client access requests to the target application, parse the content of the access request message, match and judge the content of the access request message according to the dynamic policy, and if the preset triggering conditions are met, execute the corresponding control action on the access request according to the policy rules to achieve dynamic access control.

[0041] In a third aspect of the embodiments of this application, an electronic device is provided, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other through the communication bus; the memory is used to store at least one executable instruction, wherein the executable instruction causes the processor to execute the dynamic access control method based on security gateway and trust assessment as described in any one of the embodiments of this application.

[0042] In a fourth aspect of the embodiments of this application, a computer storage medium is provided, wherein a computer program is stored on the storage medium, and when the program is executed by a processor, it implements a dynamic access control method based on a security gateway and trust assessment as described in any one of the embodiments of this application.

[0043] This application provides a dynamic access control method, apparatus, and related products based on security gateways and trust assessment, which have the following beneficial effects:

[0044] 1. Significantly improved security

[0045] This invention overcomes the limitations of traditional static access control, which relies on only limited and fixed elements. Through a trust assessment module, it can collect multi-source data in real time, including user authentication logs, risk alarm logs, terminal device operation logs, and threat intelligence logs. It then utilizes multiple risk detection components designed based on different risk rule types to perform in-depth analysis of this data. Based on this, it can comprehensively assess almost all possible security risks, promptly detect and control potential malicious access requests, greatly enhancing the system's ability to defend against various network attacks and security threats, thereby effectively ensuring the security of applications and resources.

[0046] 2. Enhanced flexibility and adaptability

[0047] Compared to traditional static policies, the dynamic access control of this invention can continuously monitor and analyze security risks related to access subjects, access links, and user identities in real time. When any abnormal behavior or risk changes occur, the system can respond quickly and automatically adjust its access policies. It is no longer limited to pre-set fixed rules, but flexibly determines how to handle access requests based on real-time risk conditions, such as blocking, allowing, prompting, alarming, or supplementary authentication, ensuring the system is always in optimal security protection and effectively responding to constantly changing network environments and security threats.

[0048] 3. Advantages of gateway-based implementation

[0049] (1) Non-intrusive: By resolving the application domain name to the security gateway address and disabling the application's external access permissions, all access requests are reverse proxied through the security gateway. This approach does not require deep modification or intrusive code injection into the application system itself, minimizing interference with the existing application architecture and business processes, reducing the risk of introducing new problems or failures due to access control, and ensuring the stability and normal operation of the application system.

[0050] (2) Scalability: The security gateway and trust assessment module possess excellent scalability. On the one hand, the security gateway itself can easily integrate various security capabilities. Furthermore, with the development of network security technology, new security functions or protection mechanisms can be easily added to the security gateway. On the other hand, the trust assessment module can be integrated with various third-party systems, continuously expanding the data sources and analysis dimensions for risk assessment. Simultaneously, neither the expansion of the security gateway nor the trust assessment module requires additional development or modification of the application; the expanded capabilities can be directly applied to various applications, significantly improving the overall adaptability and scalability of the system. This enables rapid response to constantly changing security needs and effectively reduces the cost and complexity of system upgrades and maintenance.

[0051] (3) High cost-effectiveness: Since customized security development and modifications are not required for each application, large-scale software development, testing, and deployment costs are avoided. Furthermore, the gateway-based centralized access control management model reduces the need for numerous distributed security devices or software, lowering hardware procurement, installation, and maintenance costs. Simultaneously, the system's scalability eliminates the need for large-scale system reconstruction or replacement when addressing new security challenges, further saving costs. In summary, this invention provides efficient security protection while significantly reducing the total cost of ownership and improving the return on investment for enterprises or organizations in network security construction. Attached Figure Description

[0052] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0053] Figure 1 This is a flowchart of a dynamic access control method based on a security gateway and trust assessment according to the present invention. Detailed Implementation

[0054] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions in the embodiments of the present invention will be clearly and thoroughly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art should fall within the protection scope of the present invention.

[0055] It should be understood that the terms "first," "second," and "third," etc., in the claims, specification, and drawings of this disclosure are used to distinguish different objects, not to describe a specific order. The terms "comprising" and "including" as used in the specification and claims of this disclosure indicate the presence of the described features, integrals, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or sets thereof.

[0056] It should also be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this disclosure. As used in this disclosure and claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this disclosure and claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes such combinations.

[0057] Figure 1 A flowchart illustrating a dynamic access control method based on a security gateway and trust assessment, according to an embodiment of the present invention, is shown. Figure 1 As shown, it includes:

[0058] A dynamic access control method based on security gateway and trust assessment includes:

[0059] Based on the deployed security gateway, by disabling external access permissions for applications and resolving application domain names to the security gateway address, all access requests pointing to application domain names are reverse proxied through the security gateway.

[0060] The risk assessment is performed on the real-time collected log information based on the trust assessment model to obtain the risk assessment result. Based on the risk assessment result and the pre-configured access control triggering rules, it is determined whether to trigger the access control policy. If triggered, the access control policy is sent to the security gateway.

[0061] The security gateway automatically enables dynamic policy reception and monitoring, receives and updates the access control policy in real time, and then saves the access control policy in the security gateway's storage to form a dynamic policy.

[0062] The security gateway intercepts client access requests to the target application, parses the content of the access request message, and matches and judges the content of the access request message according to the dynamic policy. If the preset triggering condition is met, the corresponding control action is executed on the access request according to the policy rules to achieve dynamic access control.

[0063] In this embodiment, by resolving the application domain name to the security gateway address and disabling the application's external access permissions, all access requests are routed through the security gateway's reverse proxy. This makes the security gateway the core hub of access control, enabling centralized inspection and management of all access traffic. Compared to decentralized access control methods, this centralized model more effectively prevents external malicious attacks from bypassing security protections because all requests must pass through a unified checkpoint. Furthermore, the trust assessment model performs risk assessments based on real-time collected log information. This real-time capability is a key advantage, allowing it to promptly detect potential security threats. For example, when abnormal login behavior occurs (such as multiple login attempts within a short period, logins from unknown IPs, etc.), the model can quickly analyze relevant log information and identify the risk. Unlike traditional static access control methods, it does not rely solely on fixed, preset rules but dynamically assesses risks based on the system's current operational status and user behavior, thus more accurately identifying emerging security vulnerabilities. Moreover, defining access control policies based on risk assessment results enables more granular access control. Different risk levels or types can trigger different policies. For example, high-risk access attempts can be blocked directly, while supplementary authentication can be required for situations that may pose a risk but are uncertain. This risk-based dynamic policy adjustment is more adaptable to complex and ever-changing security scenarios than traditional static policies (such as those based on simple IP addresses or user roles), effectively preventing unauthorized access and malicious attacks.

[0064] In this embodiment, the security gateway automatically enables dynamic policy reception and monitoring, allowing it to receive and store new access control policies in real time. This means that when the trust assessment model detects new risks and adjusts its policies, the security gateway can immediately implement the new policies. For example, if a large number of attack attempts against the system are detected in a certain region, the system can quickly update its policies to restrict access from that region without manual intervention or a system restart. This real-time update capability enables the system to quickly adapt to constantly changing network security environments, such as responding to new network attack methods or maintaining effective access control when the network topology changes. Furthermore, because the policies are adjusted based on real-time collected log information and risk assessments, the system can adaptively adjust according to the actual behavior patterns of users and the system. For example, if a user's usual login time and location are relatively fixed, but suddenly logs in at an abnormal time or location, the system can dynamically adjust the user's access permissions based on this behavioral change, enhancing sensitivity and response capabilities to abnormal behavior and making access control more aligned with actual usage scenarios and security needs. Furthermore, as a key node for reverse proxy access, the security gateway provides administrators with a single control point for centralized access control management. All access requests are processed and monitored here, making it easier for administrators to configure and adjust access policies, view access logs and statistics, etc. Compared to configuring and managing access control separately on multiple applications or servers, this centralized management approach significantly reduces management complexity and workload, and improves management efficiency. Moreover, by uniformly generating and distributing access control policies to the security gateway through a trust assessment model, consistency of access control policies throughout the system is ensured. This avoids policy conflicts or inconsistencies that may occur on different applications or servers, reduces security vulnerabilities caused by policy differences, and makes system security management more standardized and reliable.

[0065] Optionally, the control actions include: blocking, allowing, prompting, alarming, and supplementary authentication.

[0066] In this embodiment, control actions include blocking, allowing, prompting, alarming, supplementary authentication, and other control actions. These control actions can perform corresponding access control according to different needs. When a clear malicious access behavior or high-risk situation is detected, such as a connection attempt from a threatening IP address or an ongoing brute-force attack, the blocking action can immediately block the access request, preventing attackers from further intruding into the system and protecting the security of applications and data. It is a key line of defense against external malicious attacks, effectively preventing unauthorized accessors from obtaining sensitive information or causing damage to the system. Furthermore, for access requests that have been identified as having serious security risks, blocking can prevent these risks from spreading within the system. For example, if a user's device is detected to be infected with malware and is attempting to access a critical application, blocking its access can prevent the malware from spreading in the network, avoiding potential damage to other users or system resources, and maintaining the security of the entire system environment. For access requests determined to be legitimate after trust assessment and policy matching, the allowing action ensures that the user can successfully access the target application. This ensures the normal operation of business processes, allowing legitimate users to use system resources without hindrance, improving work efficiency and user experience. For example, during normal working hours, when employees access internal applications using authorized devices on the company's intranet, the access control mechanism allows them to work smoothly. By accurately allowing legitimate requests, unnecessary resources are avoided from being wasted on excessive scrutiny of normal access. The system can then focus more resources on monitoring and handling potentially risky requests, improving the performance and resource utilization efficiency of the entire access control system while maintaining system availability and response speed. Furthermore, when an access request has some potential problems but has not yet reached the point of needing to be blocked, prompts can provide users with relevant information. For example, if a user's browser version is too low and may pose a security risk, the system can prompt the user to upgrade their browser, guiding them to take the correct actions to improve their access security, and also helping to reduce security vulnerabilities caused by user negligence. The prompt function helps improve users' awareness and attention to network security. After receiving the prompt information, users can understand the potential risks of their current access behavior, thus paying more attention to security issues in future use, promoting good security habits, and strengthening overall network security protection from the user's perspective. In addition, when abnormal access behavior or potential security threats are detected, alerts can promptly notify administrators. Administrators can quickly take appropriate measures based on alert information, such as further investigating suspicious activities, adjusting access policies, or initiating emergency response procedures. For example, if the system detects that a user account has made multiple login attempts from different locations within a short period of time, the alert information allows the administrator to promptly monitor the account's security and prevent potential account theft.

[0067] Furthermore, in this embodiment, a large number of alarm messages can provide administrators with an overall understanding of the system's security posture. By analyzing the content and frequency of alarms, administrators can understand the main security problems and trends in the current network environment, enabling them to prepare for security protection in advance and formulate corresponding security policy improvement plans, thus enhancing their control over the overall system security situation. In some cases, when a user's trust level is lowered due to abnormal behavior or when accessing sensitive resources, supplementary authentication actions can be used to require the user to provide additional identity verification information. This increases access security and ensures that even in the presence of certain risk indicators, only truly legitimate users can continue to access critical resources. For example, when a user logs in from a new device and triggers a risk detection rule, requiring supplementary authentication methods such as SMS verification codes can further verify the user's identity. The supplementary authentication mechanism provides a flexible way to address potential risks without completely blocking user access. It dynamically adjusts authentication requirements according to specific risk situations, ensuring a certain degree of user availability while effectively controlling security risks, balancing the relationship between security and user experience, and adapting to the needs of complex and ever-changing security scenarios.

[0068] Optionally, when the access control action is to allow, the security gateway forwards the access request to the target application server based on the domain name information carried in the access request and the configured mapping relationship between the domain name and the target application server, and receives the response from the target application server and returns it to the client, so as to realize access to the target application.

[0069] In this embodiment, when the access control action is to allow, this reverse proxy forwarding mechanism based on the mapping relationship between domain names and target application servers has the following technical advantages:

[0070] 1. Precise request routing

[0071] (1) Ensure correct forwarding: Forwarding requests based on the domain name information in the access request ensures that the request is accurately directed to the corresponding target application server. In complex network environments, there may be multiple application servers, each hosting different applications or services. This domain name-based mapping method avoids requests being mistakenly sent to other unrelated servers, ensuring that each access request reaches its intended destination and improving the accuracy and reliability of the system.

[0072] (2) Support for multi-application architecture: For enterprise-level or large-scale network application architectures, there are often multiple different applications running simultaneously. Through this precise domain name mapping and forwarding mechanism, different applications can have their own independent domain names. The security gateway can easily handle access requests from various applications and correctly forward them to the corresponding servers, enabling the entire system to support a diverse application ecosystem and facilitating the deployment, management, and expansion of applications.

[0073] 2. Enhance system security

[0074] (1) Hiding application server information: The client only interacts with the security gateway, which forwards requests to the target application server based on the domain name information. This makes the actual address and architecture of the application server transparent to the client, and external users or attackers cannot directly obtain relevant information about the application server, reducing the risk of direct attacks on the application server. For example, attackers cannot easily find the application server's IP address through scanning or other means to launch targeted attacks, increasing system security.

[0075] (2) Unified security checkpoint: As an intermediate link in request forwarding, the security gateway can perform unified security checks on all access requests before allowing them to pass (such as checks based on trust assessment models and dynamic policies). This centralized security check mechanism ensures that only authorized and security-verified requests can reach the application server, providing front-end security protection for the application server, effectively preventing malicious requests from directly contacting the application server, and protecting the application server and the data security therein.

[0076] 3. Improve the manageability and maintainability of the system.

[0077] (1) Centralized configuration management: The mapping relationship between domain names and target application servers can be centrally configured and managed in the security gateway. Administrators can easily add, modify or delete mapping relationships. When a new application is launched or the address of the application server changes, the corresponding configuration only needs to be updated at the security gateway. There is no need to perform complex settings on each client or application server, which greatly simplifies the management and maintenance of the system.

[0078] (2) Troubleshooting and Monitoring: Through the security gateway's forwarding of requests and reception of responses, administrators can perform comprehensive traffic monitoring and troubleshooting at the security gateway level. If an application experiences access problems, the administrator can first check at the security gateway whether the request arrives normally, whether it is forwarded according to the correct mapping relationship, and whether the response is returned normally, quickly locating the problem and improving the system's maintainability and troubleshooting efficiency.

[0079] 4. Optimize user experience

[0080] (1) Seamless access process: For users, the entire access process is seamless. When a user initiates an access request to an application, as long as the request passes the security check of the security gateway and is allowed, the user does not need to care about how the request is forwarded to the target application server in the background. The user can successfully obtain the application server's response and use the application normally, which improves the user experience and allows the user to focus on business operations without being disturbed by the underlying network architecture and forwarding mechanism.

[0081] Optionally, the log information includes authentication logs, risk alarm logs, terminal device operation logs, and threat intelligence logs.

[0082] Optionally, the risk assessment processing of the real-time collected logs and intelligence information based on the trust assessment model to obtain the risk assessment results includes:

[0083] The trust assessment model is based on multiple risk detection components. The log information is processed for risk assessment according to the risk behavior detection logic preset by each of the risk detection components to obtain the risk assessment result.

[0084] The risk detection component is designed based on a preset risk rule type classification, which includes: attack threat detection risk rule type, user behavior matching risk rule type, and management strategy matching risk rule type.

[0085] The attack threat detection type risk detection components include: risk detection component, brute-force attack detection component, frequent user access to application detection component, threat IP login detection component, multi-account login detection component, frequent user login detection component, frequent change of user request information detection component, unfamiliar UserAgent request detection component, credential stuffing attack detection component, and slow attack detection component.

[0086] The user behavior matching type risk detection component includes: sudden activity detection component, intranet location feature matching component, remote login component, device feature matching component, IP feature matching component, operating system feature matching component, and active time feature matching component;

[0087] The management strategy matching risk detection components include: browser restriction component, IP range restriction component, location restriction component, time restriction component, mobile device restriction component, and operating system restriction component.

[0088] In this embodiment, the following are the technical advantages of this risk assessment based on multiple log information and specific risk detection components:

[0089] I. Comprehensive Risk Assessment from Multiple Dimensions

[0090] 1. Utilize multiple log information

[0091] (1) Authentication Logs: These provide key data related to user authentication. By analyzing authentication logs, the system can determine the legitimacy and regularity of user logins. For example, if the authentication logs show that an account logs in frequently from different locations within a short period, this may be a sign that the account has been stolen. Based on this information, the trust assessment model can more accurately determine the credibility of user access requests, helping to promptly detect abnormal login behavior and protect user account security and the system from unauthorized access.

[0092] (2) Risk Alert Log: Provides real-time feedback on risk events that are occurring or have been detected in the system. It enables the trust assessment model to react quickly to emerging security threats. For example, when the risk alert log indicates that a brute-force attack against the system is underway, the model can immediately adjust its assessment strategy for the relevant access requests, strengthen protective measures, and prevent the attack from succeeding.

[0093] (3) Terminal device operation logs: These provide rich material for risk assessment at the device level. By understanding the operating status of the terminal device, such as parameters like CPU usage, memory consumption, and device temperature, as well as the processes and software information running on the device, it is possible to determine whether the device has been infected by malware or whether there is any abnormal behavior. For example, if the device operation logs show that a device is frequently sending large amounts of data to an unknown server, it may indicate that the device has been compromised and is stealing data, thereby affecting the processing of access requests initiated by that device.

[0094] (4) Threat Intelligence Log: Integrates external security intelligence, enabling the system to understand the global network threat landscape. When the threat intelligence log indicates that a specific IP or network segment is the source of malicious activity, the system can conduct strict review or directly block access requests from these areas in advance, effectively preventing known external threats, enhancing the system's ability to resist new attacks, and avoiding damage to the system due to unknown threats.

[0095] 2. Synergistic effect of multiple risk detection components

[0096] (1) Attack Threat Detection Risk Rule Type Component: This component covers a variety of detection capabilities against common network attack methods. For example, the brute-force attack detection component can effectively prevent attackers from gaining access to user accounts by constantly trying different password combinations; the credential stuffing attack detection component can identify attempts to log in to the system using a large number of leaked username and password combinations; and the threat IP login detection component, combined with threat intelligence logs, can quickly block access from malicious IPs. These components work together to greatly reduce the risk of the system being attacked from the outside and protect the system's security perimeter.

[0097] (2) User Behavior Matching Risk Rule Type Components: These components assess risk through detailed analysis of user behavior. For example, the remote login component can detect login attempts by user accounts in abnormal geographical locations, which may be a signal of account theft; the sudden activity detection component can detect sudden changes in user behavior patterns, such as a normally inactive user suddenly accessing a large number of system resources in a short period of time, which may indicate a security problem. By matching and monitoring these user behavior characteristics, the system can better understand users' normal behavior patterns, promptly detect abnormal behaviors that deviate from normal patterns, and thus more accurately assess the risk of access requests.

[0098] (3) Management Strategy Matching Risk Detection Components: These components control access risks based on the management strategies established by the enterprise or organization. For example, time-restriction components can restrict user access to specific sensitive systems outside of working hours, preventing security vulnerabilities that may result from unauthorized access; operating system restriction components can ensure that only operating system versions that meet the enterprise's security standards can access specific applications, avoiding security issues caused by operating system vulnerabilities. These components help ensure that user access behavior complies with the enterprise's security policies and compliance requirements.

[0099] II. Refined Risk Control and Personalized Handling

[0100] 1. Targeted handling based on different risk types

[0101] (1) Different types of risk detection components can identify risks of different natures, enabling the system to take different control measures according to the specific risk type. For example, for high-risk situations identified as brute-force attacks, relevant access requests can be directly blocked, and the source IP of the attacking party can be temporarily banned; for situations where user behavior is slightly abnormal but the risk is low, such as occasional logins from other locations, users can be required to perform supplementary authentication, such as SMS verification code verification, which ensures a certain level of security while reducing the impact on normal user access, thus achieving fine-grained access control based on the degree of risk.

[0102] 2. Adapt to diverse application scenarios and user needs

[0103] (1) This design, based on multiple risk rule types and detection components, can be easily customized for different application scenarios and user groups. For example, financial applications may place greater emphasis on strict verification of user identity and detection of abnormal transaction behavior, which can be met by adjusting the parameters and rules of user behavior matching and attack threat detection components. For internal office applications, there may be a greater focus on access restrictions based on management policies, such as controlling access permissions based on employees' departments, positions, and working hours. In this way, the system can better adapt to security needs in different environments and provide personalized security protection.

[0104] III. Dynamically Adapting to Changes in the Safety Environment

[0105] 1. Real-time updates to risk assessment

[0106] Because the risk detection component operates based on real-time log data, the system can continuously monitor changes in the network environment and user behavior. When new security threats emerge or user behavior patterns change, the trust assessment model can quickly update the risk assessment results. For example, as new network attack methods constantly emerge, the system can update the rules of the attack threat detection component to address new attack patterns; when the enterprise's business scope expands or employees' work patterns change, the user behavior matching and management policy matching components can also be adjusted accordingly to adapt to the new security situation and ensure that the system always maintains effective security protection.

[0107] 2. Flexible adjustment of access control policies

[0108] Based on continuously updated risk assessment results, the system can dynamically adjust access control policies. This flexibility enables the system to react quickly to complex and ever-changing cybersecurity environments. For example, if a large number of attacks against the system occur in a certain region, the system can adjust its policies to strengthen the review of access requests from that region, such as adding additional authentication requirements or limiting access frequency, thereby effectively responding to constantly evolving security threats and ensuring the secure and stable operation of the system.

[0109] As shown in Table 1, the risk rule model includes specific risk monitoring components, risk rule types corresponding to risk components, and preset risk behavior detection logic for each risk detection component.

[0110] Table 1: Risk Rule Model

[0111]

[0112]

[0113]

[0114] The risk rule model includes not only the specific risk monitoring components listed in the table above, but may also include other risk detection components.

[0115] In the attack threat detection type component,

[0116] Brute-force attack detection components can effectively prevent brute-force attacks. By monitoring a large number of failed authentication requests for a specific account within a short period, they can promptly detect attackers attempting to guess passwords by traversing a password list. This allows for early prevention, avoiding the compromise of user accounts, protecting user personal information and related data security, and preventing unauthorized access to sensitive data. Furthermore, brute-force attacks can consume significant system resources, such as server computing power, to handle a large number of invalid authentication requests. Timely detection and prevention of such attacks can reduce unnecessary consumption of system resources, ensuring normal system operation and preventing service interruptions or performance degradation due to resource exhaustion.

[0117] User frequent access detection components can prevent the abuse of abnormal access patterns by detecting unusual behavior such as users continuously logging into applications with a single sign-on within a short period. This anomaly could be a sign of automated attack tools or malicious users attempting to bypass system restrictions. By restricting such abnormal access, malicious users can be prevented from gaining system privileges or engaging in malicious activities such as data theft through a large number of repeated logins. It also enhances application security; for the application itself, this detection can prevent application crashes or data corruption caused by abnormally frequent access. For example, a large number of repeated login requests can put pressure on the application's database connection pool or session management mechanism; timely detection and blocking can maintain the stability and security of the application.

[0118] The threat IP login detection component can defend against external malicious IP attacks. It obtains and caches a list of threat IPs from third parties and can detect whether a login IP is a threat IP in real time. This can effectively block attacks from known malicious sources (such as botnet IPs controlled by hackers, IPs used by cybercrime organizations, etc.), greatly reducing the possibility of successful external attacks and protecting the system from malicious intrusion. It can also respond quickly to new threats. Third-party security agencies can usually update their black market IP databases in a timely manner. By querying and caching this information, the system can quickly adapt to newly emerging malicious IP threats and rapidly defend against new attack sources once they are identified, enhancing the system's dynamic defense capabilities against external threats.

[0119] Multi-account login detection components prevent account sharing abuse and malicious attacks. They detect when multiple accounts are logged in from the same IP address within a specified time period, preventing legitimate accounts from being illegally shared or maliciously used. For example, in an enterprise environment, this can prevent employee accounts from being stolen and logged in simultaneously from the same IP address, or prevent attackers from using multiple accounts for mass attacks, such as bulk downloading of sensitive data. Furthermore, it complies with security policies and compliance requirements. For environments with high data security and privacy requirements, this detection helps ensure that account usage complies with security policies and relevant regulations, maintaining system compliance.

[0120] The frequent login detection component identifies abnormal login behavior by detecting repeated login attempts from the same IP address within a short period, which helps identify potential account theft. For example, if an automated script repeatedly attempts to log in to a user's account, this abnormal behavior can be detected promptly, protecting user account security and preventing malicious users from gaining account privileges and performing unauthorized operations. It can also optimize the authentication mechanism. By monitoring frequent login behavior, the system can adjust the authentication mechanism as needed, such as adding CAPTCHAs or two-factor authentication, thus improving the security of the login process while avoiding excessive interference with occasional multiple login attempts by legitimate users.

[0121] The frequent change detection component for user request information is used to prevent dynamic attacks and identity spoofing. By monitoring frequent changes in features such as User Agent (UA), IP address, and the number of times user switches between internal and external networks, it can detect abnormal changes in user request information. This prevents attackers from bypassing security detection by dynamically altering this information. For example, it prevents attackers from using constantly changing IP addresses and UAs to simulate legitimate user behavior to launch attacks or steal data, thus enhancing the verification of user identity authenticity. It also enhances the system's defense capabilities against complex attacks. In complex network attack scenarios, attackers may employ multiple methods to conceal their identity and attack intent. This detection of frequent changes in multiple features can effectively address such complex attacks, improving the overall security of the system.

[0122] The Unknown User-Agent Request Detection component is used to prevent malicious requests from unknown sources. It detects uncommon and unresolved User-Agents (UAs) and blocks requests from unknown or potentially malicious sources. Some malware or automated attack tools may use special UAs to disguise themselves; this detection can identify and block these malicious requests, protecting the system from new or targeted attacks. It also maintains the system's normal access environment by allowing only common and identifiable UAs to access the system. This ensures that requests received by the system come from legitimate and expected clients, maintaining the stability and security of the system's access environment and reducing compatibility issues and security risks that may arise from unknown UAs.

[0123] Credential stuffing attack detection components are used to prevent large-scale data breaches. By analyzing the authentication logs of specific IPs over a period of time, they detect a large number of unknown users and abnormal authentication scenarios, effectively identifying credential stuffing attacks. Such attacks can lead to the leakage of a large amount of user account information. Timely detection and prevention protect user account security and prevent attackers from using leaked account passwords to gain unauthorized access to the system. It also protects the system's reputation and user trust. A successful credential stuffing attack can cause serious reputational damage to the system, leading users to doubt its security. This detection mechanism reduces the likelihood of successful credential stuffing attacks, maintains user trust in the system, and ensures the long-term stable operation of the system.

[0124] Slow attack detection components are used to defend against low-frequency, long-duration attacks. They detect instances where a specific IP address makes a large number of failed authentication requests (even if slow) to multiple accounts using weak passwords over a period of time. This can counter some attackers' low-frequency, long-duration attack strategies. Such attacks may evade mechanisms based on high-frequency attacks over short periods; this specialized detection enhances defenses against these covert attacks. It can improve the attack detection system and, when combined with other attack detection components, form a more comprehensive attack detection system covering different types and time scales of attacks, improving the system's overall defense against various password guessing attacks and protecting user accounts and system security.

[0125] In user behavior matching components

[0126] The sudden activity detection component is used to detect abnormal user behavior patterns. By comparing the user's last activity time with the time of the current request, it can detect anomalies such as sudden activity after a long period of inactivity. This could be a sign of account theft, as normal user activity usually follows certain patterns. Such sudden changes can trigger risk assessments in a timely manner, protecting user account security. It also enhances the monitoring capabilities for account security. For accounts that have not been used for a long time, the system can use this detection mechanism to strengthen the review of their access, preventing attackers from exploiting accounts that have not been monitored for a long time, and improving the system's sensitivity to potential security threats.

[0127] The intranet location feature matching component is used to protect intranet security. Based on the characteristics of the intranet segment, it detects whether the network segment of the requesting IP matches the intranet segment used in daily operations, preventing external attackers from breaching the intranet defenses. This is crucial for environments with high security requirements, such as enterprise intranets, effectively preventing unauthorized devices or users from accessing intranet resources from external network segments and protecting sensitive internal information. It can also prevent intranet penetration attacks; even if a user within the intranet makes a request originating from an abnormal intranet segment, it may be a sign of being compromised and controlled. This detection method can promptly identify and prevent potential security threats within the intranet, such as malicious actions by internal personnel or attacks launched by internal devices exploited by external attackers.

[0128] The remote login component is designed to prevent account theft from different locations. Based on the characteristics of the user's frequently active countries and cities, it detects remote logins and can effectively identify situations where accounts are used in unusual geographical locations. This is a common sign of account theft. By promptly identifying and taking appropriate measures (such as requiring additional authentication and issuing alerts), user accounts can be protected from attackers in other locations, ensuring the security of users' personal information. It also enhances security for mobile users: for users who frequently travel between different regions, this detection can accurately identify abnormal remote logins while ensuring normal use, avoiding misjudgments due to normal user movement, and effectively preventing unauthorized use of stolen accounts in other locations.

[0129] The device signature matching component ensures device legitimacy by comparing the device fingerprint of the current request with the fingerprint of devices used in daily activities to confirm device authenticity. This prevents attackers from accessing user accounts using unauthorized devices; for example, it prevents user accounts from logging in on stolen phones or computers, protecting the security of user device bindings and account information. It also enhances the management of device replacements. When a user replaces their device, the system can use this detection mechanism to require appropriate authentication or authorization steps, ensuring the replacement was performed by the user themselves, and preventing account security issues caused by lost or stolen devices.

[0130] The IP signature matching component protects user IP-related security by comparing IP signatures based on users' daily activities, preventing IP spoofing. Whether in an intranet or extranet environment, this detection ensures requests originate from legitimate IP addresses, protecting user IP binding security and preventing attackers from using IP spoofing to gain user account privileges or access restricted resources. It is adaptable to various network environments, supporting IP matching for all network types, including intranets and extranets, enabling the system to effectively detect IP signatures in complex network deployment scenarios and improving its ability to respond to security threats in different network environments.

[0131] The operating system signature matching component ensures operating system-level security: by comparing the operating system type and version requested in this request with those used in daily activities, it prevents security issues caused by operating system incompatibility. For example, attackers might exploit vulnerabilities in older operating system versions to gain system privileges; this detection prevents such attacks and avoids application malfunctions caused by users using incompatible operating system versions. It also promotes system upgrades and security maintenance; through this detection mechanism, the system encourages users to upgrade their operating systems promptly, improving the overall security of the system environment. For organizations such as enterprises, it allows for better management of user operating system usage, ensuring compliance with security policy requirements.

[0132] The active time feature matching component is used to detect abnormal access behavior. It breaks down the request time into weekdays and hours and compares it with the user's profile time characteristics to detect user access behavior during abnormal times. This could be a sign of account theft or attackers exploiting off-peak hours or other periods of low oversight. Timely detection of such anomalies strengthens security precautions during these times. It also optimizes security resource allocation: based on the user's normal active time characteristics, the system can strengthen security detection and access control during high-risk abnormal times, while appropriately simplifying processes during normal active periods to improve user experience, and simultaneously allocating security resources rationally to improve the efficiency of security protection.

[0133] In the management policy matching components, browser restriction components are used to ensure browser compatibility and security. They detect whether the user's browser meets the minimum version number requirements, version number matching requirements, and brand matching requirements, ensuring browser compatibility with the application system. Older browser versions may contain security vulnerabilities that can be exploited by attackers. This restriction requires users to use more secure browser versions, reducing security risks caused by browser vulnerabilities. It also unifies the user access environment; browser brand and version matching requirements ensure the system runs in a relatively stable and controllable access environment, facilitating security management and maintenance. For example, certain functions or applications may only function and remain secure on specific browsers; this restriction ensures users use the appropriate browser for access.

[0134] IP range restriction components are used to control access sources. By detecting whether a user logs in from a defined IP address or IP range, access sources can be effectively controlled. Whether using whitelists or blacklists, it ensures that only authorized IP addresses can access the system, preventing attacks from unauthorized external IPs and protecting the system from unauthorized access, especially for systems that only allow access from internal networks or specific partner IPs. It also enhances network perimeter security. This restriction is a crucial component of network perimeter security and can supplement firewalls and other network security devices to further strengthen control over network access, playing a vital role in preventing external network attacks and unauthorized access to the internal network.

[0135] Location restriction components are used for geo-based security, detecting whether users log in outside of designated countries and cities, preventing user accounts from being used in abnormal geographical locations. This is particularly beneficial for systems with high data security and privacy requirements, such as those in finance and government, as it can prevent data breaches caused by accounts being accessed in high-risk areas, thus enhancing the system's geo-security. Furthermore, it can protect compliance and data sovereignty. In some cases, businesses or organizations need to comply with specific regulations that restrict the geographical location of data access. These location restriction components can help achieve this compliance requirement, protect data sovereignty, and ensure that data is not illegally transferred to unauthorized regions.

[0136] Using time-limited components for time-based access control allows for the detection of user logins outside of defined weekdays and time ranges, enabling access control at the time level. This prevents unnecessary access during non-working hours or high-risk periods, reducing security risks during unsupervised periods. For example, for sensitive internal enterprise systems, access can be restricted to normal working hours to prevent data breaches or system damage caused by unauthorized access at night or during periods of low oversight. Furthermore, it optimizes system resource and security management. Based on usage time limits, system maintenance and updates can be scheduled more efficiently, while security measures are strengthened during high-risk periods, such as increasing authentication requirements or conducting more frequent security monitoring, thereby improving overall system security and resource utilization efficiency.

[0137] Using mobile device restriction components ensures secure mobile device access: Detecting whether users log in outside the defined range of mobile devices and system versions ensures mobile device security. Older mobile operating systems may have security vulnerabilities; restrictions require users to use more secure devices and system versions, preventing attackers from exploiting these vulnerabilities to gain user account privileges or access sensitive data. It can also be used to manage mobile device access policies. For organizations such as enterprises, it allows for better management of employee access to company systems via mobile devices. For example, it allows access to sensitive applications only on specific models and versions of company-issued mobile devices, ensuring that mobile device access complies with security policy requirements.

[0138] Operating system restriction components are used to provide operating system-level security assurance, detecting whether the user's operating system meets minimum version number requirements, version number matching requirements, and brand matching requirements. Similar to browser restrictions, this ensures operating system security. New operating system versions typically fix security vulnerabilities in older versions; these restrictions require users to use more secure operating systems, reducing security risks caused by operating system vulnerabilities and protecting system and user data security. They also ensure system compatibility and stable operation. Ensuring operating system matching requirements improves compatibility between the system and the operating system, avoiding application malfunctions caused by operating system incompatibility, ensuring the system runs in a stable and secure operating system environment, and facilitating system maintenance and management.

[0139] Optionally, the trust assessment model is based on multiple risk detection components. The log information is processed for risk assessment according to the pre-defined risk behavior detection logic of each of the risk detection components to obtain a risk assessment result, specifically including:

[0140] Establish a multi-level user trust assessment system and assign an initial trust level to each user, where the level of trust reflects the user's credibility.

[0141] The risk detection components perform feature matching on the log information according to their respective preset risk behavior detection logic;

[0142] If the risk behavior detection logic is triggered, the user's trust assessment level will be dynamically adjusted to obtain a risk assessment result, which includes the adjusted user trust level information.

[0143] In this embodiment, the technical advantages of risk assessment based on a multi-level user trust assessment system and risk detection components are as follows:

[0144] I. Precise Quantification of User Trust and Risk Measurement

[0145] 1. Advantages of a multi-level trust assessment system

[0146] (1) More refined user segmentation: Establishing a multi-level user trust assessment system allows for more detailed user classification. Different trust levels represent different degrees of user credibility, enabling the system to more accurately distinguish between legitimate users and potentially malicious users. For example, users with high trust levels may be internal employees who have been using the system normally for a long time, have stable behavior patterns, and have no abnormal records, while users with low trust levels may be newly registered users or users whose behavior shows certain abnormalities. This refined segmentation helps to formulate appropriate access control policies based on the specific circumstances of users, improving security while avoiding excessive restrictions on highly trustworthy users and enhancing the user experience.

[0147] (2) Reflecting long-term user behavior trends: By setting an initial trust level for users and dynamically adjusting it over time based on their behavior, the trust assessment system can reflect users' long-term behavioral trends. Consistent positive behavior can gradually increase the trust level, while occasional abnormal behavior may lead to a temporary decrease. This helps the system to comprehensively and dynamically understand user security, rather than relying solely on a single access behavior, thus more accurately assessing the risks posed by users.

[0148] 2. Dynamic adjustment based on risk behavior detection logic

[0149] (1) Real-time response to risky behavior: The risk detection components perform feature matching on log information according to their respective preset risk behavior detection logic, enabling them to detect abnormal user behavior in real time. For example, when the brute-force attack detection component detects that a user account has a large number of authentication failure attempts in a short period of time, this indicates that there may be malicious attack behavior. This detection mechanism based on real-time log analysis can quickly capture signs of security threats, enabling the system to react in a timely manner.

[0150] (2) Precise Risk Feedback: Once a risk behavior detection logic feature is triggered, the user's trust assessment level is dynamically adjusted, providing the system with precise risk feedback. Different risk behaviors correspond to different degrees of trust level adjustment. For example, minor abnormal behavior may lead to a slight decrease in the trust level, while serious attacks (such as credential stuffing attacks) may cause a significant drop in the trust level. This precise feedback mechanism enables the system to take appropriate measures based on the severity of the risk, achieving more reasonable access control.

[0151] II. Flexible and Adaptive Access Control Policy Adjustment

[0152] 1. Dynamically adapt to changes in user behavior

[0153] As users interact with the system, their behavior may change. Through continuous monitoring of log information and dynamic adjustment of trust levels by the risk detection component, the system can automatically adapt to these changes. For example, if a user's usual access behavior is normal, but suddenly they frequently change login devices or access abnormal resources, the system will correspondingly lower their trust level and may subject their access requests to stricter scrutiny, such as requiring supplementary authentication or restricting access to certain high-risk operations. This adaptive capability allows the system to ensure security while minimizing disruption to normal user experience and remaining sensitive to potential security threats.

[0154] 2. Personalized access control

[0155] Different users are subject to different access control policies due to their varying trust levels. Users with high trust levels enjoy more lenient access permissions, such as fewer authentication steps and easier access to certain resources; while users with low trust levels face stricter controls, such as increased authentication requirements and restricted access to sensitive resources. This personalized access control is generated based on user behavior and risk assessment results, better balancing security and user experience, meeting the needs of different user groups, and effectively preventing malicious users from exploiting system vulnerabilities for unauthorized access.

[0156] III. Optimize resource allocation and system performance

[0157] 1. Rational allocation of resources

[0158] Allocating system resources based on users' trust levels optimizes resource utilization. For users with high trust levels, whose behavior is considered relatively safe, the system can reduce the resource consumption of checking and verifying their access requests, allowing these users to access applications quickly and smoothly. Conversely, for users with low trust levels, the system invests more resources in detailed risk assessments and strict access controls to ensure security. In this way, the system can rationally allocate limited resources to processing different user access requests, improving overall resource utilization efficiency, avoiding excessive resource waste on low-risk user access, and ensuring effective control over high-risk access.

[0159] 2. Improve system performance

[0160] By accurately assessing risks and adjusting trust levels, the system can avoid unnecessary complex processing of a large number of legitimate access requests, thereby improving system performance. For example, when most users have high trust levels and behave normally, the system can quickly allow their access requests, reducing processing latency. This user trust-based dynamic access control mechanism helps maintain the system's efficient operation, especially when handling a large number of concurrent access requests, improving the system's response speed and processing capacity.

[0161] Optionally, triggering the risk behavior detection logic dynamically adjusts the user's trust assessment level to obtain a risk assessment result, including:

[0162] If this risk behavior detection logic is triggered, the user's trust assessment level will be adjusted according to the configured risk behavior and trust level mapping relationship.

[0163] The mapping relationship between risk behaviors and trust levels includes the mapping between a single risk behavior trigger and a preset trust level, and the mapping between multiple risk behaviors triggering simultaneously and a preset trust level.

[0164] In this embodiment, the technical advantages of dynamically adjusting user trust assessment levels based on the mapping relationship between risky behavior and trust levels are as follows:

[0165] I. Precise Risk Quantification and Response

[0166] 1. Precise adjustment based on mapping relationship

[0167] (1) Scientific and Reasonable Assessment: The system adjusts user trust assessment levels based on the configured mapping relationship between risk behaviors and trust levels, making the risk assessment process more scientific and reasonable. Instead of simply making binary judgments about risk behaviors (e.g., safe or unsafe), the system quantifies the degree of risk and links it to the user's trust level. For example, minor risk behaviors (e.g., occasional incorrect password input) may only lead to a slight decrease in trust level; while serious risk behaviors (e.g., frequent brute-force attempts) will cause a significant drop in trust level. This precise adjustment method can more accurately reflect the actual risks posed by users.

[0168] (2) Targeted Risk Response: Different risk behaviors correspond to different trust level adjustments, enabling the system to take more targeted measures for risks of different types and severity. When a user's trust level is adjusted due to a specific risk behavior, the system can implement corresponding access control policies based on the new trust level. For example, a lower trust level may lead to restricted access, the need for additional authentication steps, or the triggering of alarm mechanisms, thereby more effectively responding to risks and protecting system security.

[0169] 2. The mapping advantage triggered by a single risky behavior

[0170] (1) Rapid Identification and Response: The mapping between a single risky behavior and a preset trust level enables rapid identification and response to specific high-risk behaviors. For example, when the brute-force detection component detects a large number of failed authentication attempts (single risky behavior) from a single user account within a short period, the system can quickly lower the user's trust level based on the mapping relationship and immediately take measures, such as temporarily limiting the number of login attempts for that account or adding additional authentication requirements. This rapid response mechanism helps to curb potential security threats in the early stages and prevent attacks from developing further.

[0171] (2) Clear accountability: For situations triggered by a single risky behavior, it is easier to trace the source of the risk and the responsibility. When a specific risky behavior causes a change in the trust level, the administrator can clearly understand which behavior caused the security problem, which facilitates subsequent investigation and handling, such as determining whether it is due to the user's own negligence (such as forgetting the password and causing multiple authentication failures) or signs of malicious attack.

[0172] 3. The mapping advantage of multiple risky behaviors being triggered simultaneously

[0173] (1) Comprehensive Risk Assessment: By considering the simultaneous triggering of multiple risky behaviors and their mapping to preset trust levels, a more comprehensive and integrated risk assessment can be achieved. In real-world network environments, attackers may employ multiple methods simultaneously to breach system security. For example, a user may exhibit multiple abnormal behaviors such as logging in from a different location, using unfamiliar devices, and frequently accessing sensitive resources. By comprehensively considering these risky behaviors, the system can more accurately assess the overall risk posed by the user, avoiding situations where only a single risk is focused on while ignoring other potential threats.

[0174] (2) Handling Complex Scenarios: This mapping relationship helps the system cope with complex security scenarios. When multiple risky behaviors occur simultaneously, they may be interconnected and have synergistic effects, posing a greater threat to system security than the simple superposition of a single risky behavior. Adjusting the trust level according to the mapping relationship can more reasonably reflect the degree of risk in such complex situations and allow for stricter access control policies, such as completely blocking access, requiring higher-level authentication, or notifying the administrator for manual review, effectively addressing complex attack scenarios.

[0175] II. Enhance the system's adaptability and flexibility

[0176] 1. Adaptable to diverse attack methods

[0177] As cyberattacks become increasingly diverse and complex, single risk assessment criteria often fall short of security requirements. By encompassing mapping relationships between single risky behaviors and those triggered by multiple risky behaviors simultaneously, the system can adapt to various attack types, from simple, single-method attacks to complex, combined attacks. This comprehensive mapping relationship makes the system more adaptable to the ever-changing cyber threat environment, enabling timely updates and adjustments to risk assessment strategies to address emerging attack patterns.

[0178] 2. Flexible strategy adjustment

[0179] The mapping relationship between risky behaviors and trust levels provides the system with a basis for flexibly adjusting access control policies. Administrators can flexibly configure the mapping relationship according to the system's security needs and actual conditions. For example, when the network security situation is more severe, the mapping relationship can be adjusted so that certain behaviors that were originally considered low-risk lead to a more significant drop in trust level under certain combinations, thereby strengthening the system's security protection; while in a relatively relaxed security environment, the mapping relationship can be appropriately relaxed to reduce interference with normal user access. This flexibility allows the system to maintain a good balance between performance and user experience in different security scenarios.

[0180] III. Enhancing User Security Awareness and Guiding Behavior

[0181] 1. Safety awareness education

[0182] If users experience a system and their trust level drops due to risky behaviors, resulting in access restrictions, this can serve as a form of implicit security awareness education. For example, when users are prompted by the system that their trust level has been lowered because they frequently change login devices or use weak passwords, they will realize that these behaviors may affect their own account security and system security. As a result, they will pay more attention to security issues in subsequent use, develop good security habits, and improve the overall network security level from the user's perspective.

[0183] 2. Behavioral guidance and norms

[0184] By clearly defining the mapping between risky behaviors and trust levels, the system can guide user behavior towards safer directions. Users will understand which behaviors the system considers high-risk and thus avoid them. For example, if the system stipulates that frequent logins in different network environments will result in a decrease in trust level, users may try to log in in a stable network environment, thereby reducing potential security risks, encouraging users to regulate their online behavior, and improving system security.

[0185] Optionally, the step of determining whether to trigger an access control policy based on the risk assessment result and pre-configured access control triggering rules, and if triggered, issuing the access control policy to the security gateway, includes:

[0186] The results are then communicated to the strategy judgment engine.

[0187] The policy judgment engine determines whether to trigger the access control policy based on the configured trust level and control action mapping relationship.

[0188] If an access control policy is triggered, the policy determination engine will send the access control policy to the security gateway based on a pre-defined communication method.

[0189] The communication methods include message queues or API calls, as well as other communication methods.

[0190] In this embodiment, the technical advantages of defining, determining, and issuing access control policies based on evaluation results are as follows:

[0191] I. Advantages of a Strategy-Based Judgment Engine

[0192] 1. Accurate basis for strategic decision-making

[0193] (1) Scientific Mapping Relationship Utilization: The policy judgment engine determines access control policies based on the configured trust level and control action mapping relationship, making policy formulation more scientific, reasonable, and targeted. Different trust levels reflect the user's current risk status. Through precise mapping relationships, the system can match the most appropriate control action for each trust level. For example, users with high trust levels can be granted relatively lenient access permissions, such as reducing authentication steps; while users with low trust levels can be subject to stricter controls, such as increasing authentication requirements or restricting access to sensitive resources, thereby optimizing user experience while ensuring security.

[0194] (2) Flexible response to risk changes: Trust levels may be dynamically adjusted as user behavior and system environment change. This policy judgment engine based on mapping relationships can respond to such changes in real time and flexibly determine the corresponding access control policies. When risky user behavior is detected that leads to a decrease in trust level, the system can quickly adjust to a stricter access control policy to effectively prevent potential security threats; conversely, when users maintain good behavior and trust level increases, restrictions can be appropriately relaxed to improve user convenience.

[0195] 2. Determining the Centralization Strategy

[0196] (1) Unified Management and Coordination: The policy judgment engine acts as a centralized decision-making point, responsible for determining access control policies based on the evaluation results. This avoids the problem of policies being formulated in a decentralized and inconsistent manner throughout the system, ensuring the uniformity and coordination of access control policies across the entire system. Regardless of the number of different applications, user groups, or access scenarios in the system, the policy judgment engine can determine appropriate policies according to the same standards and rules, reducing the risk of security vulnerabilities caused by inconsistent policies.

[0197] (2) Easy to maintain and update: When access control policies need to be modified or updated (e.g., when enterprises adjust security policies or respond to new network threats), only the corresponding configuration adjustments need to be made at the policy judgment engine. This centralized maintenance method greatly simplifies the management of the system, reduces the complexity and workload of modifying policies in multiple applications or modules, and improves the maintainability and adaptability of the system.

[0198] II. Advantages of distributing strategies through specific communication methods

[0199] 1. Advantages of message queues or API calls

[0200] (1) Reliable message delivery: Using message queues as a communication method ensures the reliable delivery of access control policies. Message queues have asynchronous processing and buffering capabilities, ensuring that policy information is not lost even under high system load or network instability. For example, when a large number of evaluation results are generated simultaneously and policies need to be issued, message queues can process them sequentially, avoiding information confusion and loss, and ensuring that the security gateway can accurately receive the latest policies.

[0201] (2) Loosely Coupled System Architecture: Communication between the policy decision engine and the security gateway is achieved through message queues or API calls. This architecture allows the two modules to be developed and updated independently, without affecting each other as long as they follow the same communication interface and data format. For example, when the security gateway needs to be upgraded or replaced with a new implementation technology, as long as compatibility with the message queue or API is maintained, it will not affect the operation of the policy decision engine, and vice versa, thus improving the system's flexibility and scalability.

[0202] (3) High communication efficiency: The API call method provides a direct and efficient communication means. When policies need to be issued in real time, API calls can quickly transmit policy information from the policy judgment engine to the security gateway. This immediacy is crucial when dealing with emergency security situations or when access control policies need to be adjusted quickly, enabling the security gateway to execute new policies rapidly and effectively respond to sudden security threats.

[0203] 3. Ensure timely updates and implementation of strategies.

[0204] (1) Real-time policy activation: Access control policies are promptly distributed to the security gateway via pre-defined communication methods, ensuring that the security gateway can obtain the latest policy information in real time and activate it immediately. This enables the system to respond quickly to constantly changing security risks. For example, when a new malicious attack pattern or high-risk user behavior is detected, the assessment results can be quickly transformed into new access control policies and implemented on the security gateway to prevent potential security threats and improve the system's security and response capabilities.

[0205] (2) Dynamically adapting to environmental changes: Whether it's changes in the network environment, changes in user behavior, or the emergence of new security threats, this fast and reliable policy delivery mechanism ensures that the access control policies of the security gateway are updated synchronously. This enables the system to maintain effective security protection in complex and ever-changing network environments, dynamically adapt to various security challenges, and ensure the stable operation of the system and data security.

[0206] Optionally, the security gateway may also have one or a combination of HTTP request packet filtering and blacklist / whitelist management security capabilities, which, together with dynamic access control policies, jointly ensure application security.

[0207] In this embodiment, the security gateway's security capabilities, such as HTTP request packet filtering and blacklist / whitelist management, combined with dynamic access control policies, offer the following technical advantages:

[0208] I. Technical Benefits of HTTP Request Packet Filtering

[0209] 1. Preventing malicious request content

[0210] (1) Rule-based Precision Protection: HTTP request packet filtering can inspect request packets based on custom rules (such as regular expressions, string rules, etc.). For example, rules can be set to block requests containing specific malicious characters (such as special characters commonly used in SQL injection) or attack URLs. This can effectively prevent hackers from using common vulnerability attack methods (such as SQL injection, cross-site scripting (XSS), etc.), protect applications from malicious attacks based on the HTTP protocol, and ensure the security of applications and data.

[0211] (2) In-depth content-level inspection: Unlike traditional access control based solely on IP or port, request packet filtering delves into the HTTP request content level. It can inspect various information in the request headers and request body, including user-submitted data and requested resource paths. For example, in an e-commerce application, filtering rules can prevent users from maliciously modifying critical data such as product prices during order submission, ensuring the integrity of business logic and the accuracy of data.

[0212] 2. Optimize network traffic and resource utilization

[0213] (1) Filtering invalid requests: By filtering HTTP request packets that do not conform to the rules, unnecessary network traffic entering the application server can be reduced. A large number of invalid or malicious requests may consume network bandwidth and server resources, such as CPU and memory. By filtering request packets at the security gateway, only legitimate and valid requests can continue to be transmitted to the application server, improving the utilization of network resources, reducing the burden on the application server, and thus optimizing the performance of the entire system.

[0214] (2) Improved processing efficiency: The application server does not need to process the filtered malicious or invalid requests, and can devote more resources to processing legitimate requests. This helps to improve the response speed of the application server to legitimate user requests and enhance the user experience, especially in high-traffic application scenarios, where this optimization effect is more significant.

[0215] II. Technical Benefits of Blacklist and Whitelist Management

[0216] 1. Precise access control

[0217] (1) Whitelisting ensures legitimate access: Whitelisting management allows system administrators to explicitly specify which users (based on identifiers such as IP addresses) can access specific applications or resources. This is crucial for applications requiring high security protection, such as core business systems within an enterprise, where only authorized IP addresses of specific departments or personnel within the whitelist can access the system. This precise access control ensures that only legitimate users and devices can interact with the application, significantly reducing the risk of external attacks and unauthorized access.

[0218] (2) Blacklist to block malicious access: The blacklist is used to block known malicious sources. When an IP address or user is found to frequently launch attack behaviors (such as brute-force attacks, malicious scanning, etc.), it is added to the blacklist, and the security gateway will directly reject all requests from these sources. This is a fast and effective defense mechanism that can quickly block attacks from specific malicious entities and protect applications from targeted threats.

[0219] 2. Flexibly respond to changes in security threats

[0220] (1) Dynamically updated blacklists and whitelists: Blacklists and whitelists can be dynamically adjusted according to the security situation. For example, when new threat intelligence indicates that a certain IP range is being used for large-scale attacks, the IP range can be added to the blacklist in a timely manner; or when a new partner needs to access the application, its relevant IPs can be added to the whitelist. This dynamism enables the system to quickly adapt to the ever-changing network security environment and respond promptly to new security threats or changes in business needs.

[0221] (2) Synergy with Dynamic Access Control Policies: The combination of blacklist / whitelist management and dynamic access control policies forms a multi-layered security protection system. Dynamic access control policies can be adjusted based on more complex user behavior, risk assessment, and other factors, while blacklists and whitelists serve as a basic and explicit access control method. For example, even if a user originally has certain access permissions in the dynamic policy evaluation, if their IP appears on the blacklist, access will still be denied. The two complement each other, enhancing the overall security of the system.

[0222] III. Benefits of Combining Security Capabilities with Dynamic Access Control Policies

[0223] 1. Comprehensive security protection

[0224] (1) Multi-dimensional risk response: It combines HTTP request packet filtering, blacklist and whitelist management with dynamic access control policies, covering multiple dimensions from request content inspection and access source restriction to dynamic control based on user behavior and system risk assessment. This multi-dimensional security protection can effectively deal with various types of security threats. Whether it is a known attack pattern or a newly emerging complex attack method, it can prevent them at different levels, greatly improving the security of the application.

[0225] (2) Compensating for the shortcomings of a single strategy: Individual security capabilities or access control policies may have certain limitations. For example, dynamic access control policies may not be able to respond promptly to newly emerging zero-day attacks. However, if combined with HTTP request packet filtering, preliminary interception can be carried out based on the abnormal characteristics of the request content. Furthermore, blacklist and whitelist management may not be able to adapt to changes in the abnormal behavior of legitimate users, while dynamic access control policies can be adjusted according to the user's real-time behavior. The combination of the three forms a more comprehensive security protection network.

[0226] 2. Adaptive safety environment adaptability

[0227] (1) Real-time adjustment of protection strategies: As the network security situation changes and the application environment evolves, this combination approach enables real-time adjustment of security protection strategies. For example, during peak network attack periods, access permissions can be tightened through dynamic access control policies, while HTTP request packet filtering is used to strengthen the review of request content. Furthermore, the blacklist and whitelist are updated accordingly based on newly emerging malicious IPs, enabling the system to adaptively respond to environmental changes at different security levels and always maintain the best security status.

[0228] (2) Continuous optimization of security protection: By continuously analyzing the data collected by the security gateway (such as the types of filtered requests, the hit status of blacklists and whitelists, and the adjustment records of dynamic policies), the security protection mechanism can be continuously optimized. For example, if a filtering rule is found to be frequently triggered, it may be necessary to further refine or adjust the rule; if some IPs are on the edge of blacklists and whitelists (such as frequently changing between whitelists and dynamic policy restrictions), their behavior can be further analyzed and policies optimized, thereby achieving continuous improvement of security protection.

[0229] Optionally, the method also includes the ability to extend and improve the functionality of the gateway and trust assessment module at any time to adapt to various applications, and to integrate with one or a combination of situational awareness, threat intelligence, honeypots, and AI technologies to define dynamic access control policies.

[0230] In this embodiment, a mechanism for expanding and improving the functionality of the gateway and trust assessment module is established. The initial design of the gateway and trust assessment module adopts a modular and pluggable architecture. This architecture allows for the convenient addition of new functional modules without affecting the overall system operation. For example, the gateway can reserve specific interfaces or plug-in slots for connecting new security functions or protocol processing modules; the trust assessment module can have flexible data access points and analysis algorithm extension interfaces. Furthermore, based on the development of standards and interfaces, unified standards and interfaces are defined, and these standards are followed whether developing new functions internally or integrating third-party functions externally. This ensures that newly added functions can seamlessly integrate with the existing system. For example, new authentication methods or risk detection algorithms can be easily integrated into the trust assessment module as long as they are implemented according to the prescribed interface specifications.

[0231] In this embodiment, the solution can also be integrated with situational awareness, threat intelligence, honeypots, and AI technologies. It establishes a data-sharing interface with the situational awareness system to receive information such as network topology and traffic trends; it interfaces with the threat intelligence platform to obtain the latest malicious IPs and attack patterns; it interacts with the honeypot system to collect attacker behavior patterns and attack methods; and it utilizes AI technology interfaces to integrate machine learning models into risk assessment and policy formulation. These interfaces ensure real-time and accurate data exchange between the various systems. Furthermore, collaborative working logic is designed so that the gateway and trust assessment module can utilize data obtained from other technologies to optimize dynamic access control policies. For example, when the situational awareness system detects abnormal traffic concentrated in a certain area of ​​the network, the gateway can strengthen the review of requests originating from that area based on this information; new malicious IP information from threat intelligence can be directly updated to the gateway's blacklist or affect the trust assessment module's risk assessment of related access; and attack behavior patterns collected by the honeypot can be used to train AI models, thereby improving risk detection algorithms.

[0232] In this embodiment, this design has the following technical advantages:

[0233] 1. Enhanced system adaptability and flexibility

[0234] (1) Adaptable to various application scenarios: By extending the functionality of the gateway and trust assessment modules, the security needs of different types of applications can be met. For example, for an e-commerce application, more attention may be needed to protect user transaction data and prevent payment fraud. By adding specific risk detection modules and data encryption functions to the gateway and trust assessment modules, transaction security can be better guaranteed. For an enterprise resource planning (ERP) system, stricter user permission management and data access control may be needed. More granular access control policies can be achieved through functional extensions.

[0235] (2) Addressing evolving business needs: As businesses evolve and change, new business processes and application functions may require new security requirements. This scalable design can respond to these changes promptly and quickly add new security features. For example, when a company launches new mobile office services, it can add functions for mobile device security detection and mobile application access control to the gateway and trust assessment modules to ensure the secure operation of mobile services.

[0236] 2. Enhance security protection capabilities

[0237] (1) Integrating multi-source data for comprehensive risk assessment: By integrating with technologies such as situational awareness, threat intelligence, and honeypots, more comprehensive security information can be obtained. The global network perspective provided by situational awareness, the latest attack clues from threat intelligence, the real attack behaviors collected by honeypots, and the deep analysis capabilities of AI technology on these massive amounts of data together provide richer evidence for the formulation of access control policies. This enables the system to more accurately assess potential security risks and detect and prevent complex network attacks in advance.

[0238] (2) Utilizing AI technology to optimize risk prediction and strategy adjustment: The introduction of AI technology can learn from and analyze large amounts of historical and real-time data, discovering patterns and trends hidden within the data. For example, by analyzing user behavior data through machine learning algorithms, it is possible to more accurately predict whether users are exhibiting abnormal behavior, thereby adjusting access control policies more promptly. This data-driven risk prediction and strategy adjustment capability far surpasses traditional rule-based access control methods, effectively improving the system's security level.

[0239] 3. Improve resource utilization efficiency and cost-effectiveness

[0240] (1) Avoiding duplication of effort: Existing security infrastructure and technology investments can be fully utilized through functional expansion and technology integration. For example, instead of rebuilding a separate intelligence gathering system to obtain threat intelligence, it can be integrated with an existing threat intelligence platform. This avoids duplication of effort and reduces the cost of security construction.

[0241] (2) Optimize resource allocation: By utilizing the fused multi-source data, security resources can be allocated more rationally. For example, when threat intelligence indicates that a certain type of attack poses a low risk in the current network environment, resource investment in that area can be appropriately reduced (such as reducing the frequency of related detections); while when situational awareness detects a sudden increase in access to an application and potential risks, more resources can be allocated to reviewing access requests to that application, improving resource utilization efficiency while ensuring system security.

[0242] In another embodiment, a dynamic access control device based on a security gateway and trust assessment is provided, comprising:

[0243] The trust assessment module is used to perform risk assessment on the real-time collected log information to obtain the risk assessment result. Based on the risk assessment result and the pre-configured access control triggering rules, it determines whether to trigger the access control policy. If triggered, the access control policy is sent to the security gateway.

[0244] A security gateway is used to disable external access permissions for applications and resolve application domain names to the address of the security gateway, so that all access requests pointing to application domain names are reverse proxied through the security gateway.

[0245] The security gateway is also used to receive and update the access control policy in real time by automatically enabling dynamic policy reception and monitoring, and then save the access control policy in the storage of the security gateway to form a dynamic policy.

[0246] The security gateway is also used to intercept client access requests to the target application, parse the content of the access request message, match and judge the content of the access request message according to the dynamic policy, and if the preset triggering condition is met, execute the corresponding control action on the access request according to the policy rules to realize dynamic access control.

[0247] The dynamic access control based on security gateway and trust assessment in this application can be used to implement any of the dynamic access control methods based on security gateway and trust assessment in this application.

[0248] In another embodiment of this application, an electronic device is also provided, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other through the communication bus; the memory is used to store at least one executable instruction, wherein the executable instruction causes the processor to perform any operation corresponding to a dynamic access control method based on a security gateway and trust assessment.

[0249] In another embodiment of this application, a computer storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements any of the dynamic access control methods based on security gateways and trust assessments in the embodiments of this application.

[0250] The methods described above according to the embodiments of this application can be implemented in hardware, firmware, or as software or computer code that can be stored in a recording medium (such as a CD, ROM, RAM, floppy disk, hard disk, or magneto-optical disk), or as computer code originally stored on a remote recording medium or a non-transitory machine-readable medium and subsequently stored on a local recording medium, downloaded over a network. Thus, the methods described herein can be processed by software stored on a recording medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware (such as an ASIC or FPGA). It is understood that the computer, processor, microprocessor controller, or programmable hardware includes storage components (e.g., RAM, ROM, flash memory, etc.) capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the access control policy construction method.

[0251] It should be noted that similar or identical parts between the various embodiments in this specification can be referred to mutually, and each embodiment focuses on describing the differences from other embodiments. In particular, for the device and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and relevant parts can be referred to the description of the method embodiments. The device and system embodiments described above are merely illustrative, and the modules described as separate components may or may not be physically separate. The components indicated as modules may or may not be physical modules, that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0252] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

Claims

1. A dynamic access control method based on security gateways and trust assessment, characterized in that... include: Based on the deployed security gateway, by disabling external access permissions for applications and resolving application domain names to the security gateway address, all access requests pointing to application domain names are reverse proxied through the security gateway. The risk assessment of real-time collected log information is performed based on a trust assessment model. The trust assessment model is based on multiple risk detection components. The log information is processed according to the risk behavior detection logic preset by each of the risk detection components to obtain the risk assessment result. The risk detection component is designed based on a preset risk rule type classification, which includes: attack threat detection risk rule type, user behavior matching risk rule type, and management strategy matching risk rule type. A multi-level user trust assessment system is established, and an initial trust level is set for each user, where the level of trust reflects the user's credibility. The risk detection component performs feature matching on the log information according to its preset risk behavior detection logic. If the risk behavior detection logic is triggered, the user's trust level is dynamically adjusted to obtain a risk assessment result, which includes the adjusted user's trust level. Based on the adjusted user trust level and control action mapping relationship, determine whether the access control policy is triggered. If triggered, send the access control policy to the security gateway. The security gateway automatically enables dynamic policy reception and monitoring, receives and updates the access control policy in real time, and then saves the access control policy in the security gateway's storage to form a dynamic policy. The security gateway intercepts client access requests to the target application and parses the message content of the access request. It then matches and judges the message content of the access request according to the dynamic policy. If the preset triggering conditions are met, the corresponding control action is executed on the access request according to the policy rules to achieve dynamic access control.

2. The dynamic access control method based on security gateway and trust assessment according to claim 1, characterized in that, When the access control action is to allow, the security gateway forwards the access request to the target application server based on the domain name information carried in the access request and the configured mapping relationship between the domain name and the target application server, and receives the response from the target application server and returns it to the client, so as to realize access to the target application.

3. The dynamic access control method based on security gateway and trust assessment according to claim 1, characterized in that: The attack threat detection risk detection components include: risk detection component, brute-force attack detection component, frequent user access to application detection component, threat IP login detection component, multi-account login detection component, frequent user login detection component, frequent change of user request information detection component, unfamiliar UserAgent request detection component, credential stuffing attack detection component, and slow attack detection component. The user behavior matching type risk detection components include: sudden activity detection component, intranet location feature matching component, remote login component, device feature matching component, IP feature matching component, operating system feature matching component, and active time feature matching component; The risk detection components for management strategy matching include: browser restriction component, IP range restriction component, location restriction component, time restriction component, mobile device restriction component, and operating system restriction component.

4. The dynamic access control method based on security gateway and trust assessment according to claim 1, characterized in that, If the risk behavior detection logic is triggered, the user's trust level will be dynamically adjusted to obtain a risk assessment result, including: If the risk behavior detection logic is triggered, the user's trust level will be adjusted according to the configured risk behavior and trust level mapping relationship. The mapping relationship between risk behaviors and trust levels includes the mapping between a single risk behavior trigger and a preset trust level, and the mapping between multiple risk behaviors triggering simultaneously and a preset trust level.

5. The dynamic access control method based on security gateway and trust assessment according to claim 4, characterized in that, The step of determining whether to trigger an access control policy based on the risk assessment results and pre-configured access control triggering rules, and if triggered, issuing the access control policy to the security gateway, includes: The risk assessment results are then communicated to the strategy judgment engine. The policy judgment engine determines whether to trigger the access control policy based on the configured trust level and control action mapping relationship. If an access control policy is triggered, the policy determination engine will send the access control policy to the security gateway based on a pre-defined communication method. The communication methods include message queues or API calls.

6. The dynamic access control method based on security gateway and trust assessment according to claim 1, characterized in that, The security gateway also has one or a combination of HTTP request packet filtering and blacklist / whitelist management security capabilities. These security capabilities, combined with dynamic access control policies, jointly ensure application security.

7. A dynamic access control device based on a security gateway and trust assessment, characterized in that, include: The trust assessment module is used to perform risk assessment processing on the real-time collected log information. The trust assessment module is based on multiple risk detection components and performs risk assessment processing on the log information according to the risk behavior detection logic preset by each of the risk detection components to obtain the risk assessment result. The risk detection component is designed based on a preset risk rule type classification, which includes: attack threat detection risk rule type, user behavior matching risk rule type, and management policy matching risk rule type. A multi-level user trust assessment system is established, and an initial trust level is set for each user, where the level reflects the user's credibility. The risk detection component performs feature matching on the log information according to its preset risk behavior detection logic. If the risk behavior detection logic feature is triggered, the user's trust assessment level is dynamically adjusted to obtain a risk assessment result. The risk assessment result includes the adjusted user trust level information. Based on the mapping relationship between the adjusted user trust level and control actions, it is determined whether an access control policy is triggered. If triggered, the access control policy is sent to the security gateway. A security gateway is used to disable external access permissions for applications and resolve application domain names to the security gateway address, so that all access requests pointing to application domain names are reverse proxied through the security gateway. The security gateway is also used to receive and update the access control policy in real time by automatically enabling dynamic policy reception and monitoring, and then save the access control policy in the storage of the security gateway to form a dynamic policy. The security gateway is also used to intercept client access requests to the target application, parse the message content of the access request, match and judge the message content of the access request according to the dynamic policy, and if the preset triggering conditions are met, execute the corresponding control action on the access request according to the policy rules to realize dynamic access control.

8. An electronic device, characterized in that, include: The processor, memory, communication interface, and communication bus are provided, wherein the processor, memory, and communication interface communicate with each other via the communication bus. The memory is used to store at least one executable instruction that causes the processor to perform an operation corresponding to the method as described in any one of claims 1-6.

9. A computer storage medium, characterized in that, The storage medium stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1-6.

Images