Zero-trust access control system and method for video cloud security

Abstract

The invention relates to a zero-trust access control system and method for video cloud security, and belongs to the technical field of network security. The system is based on a zero-trust architecture, performs identity management and authentication on video terminal devices connected to the system and users accessing video cloud through the video terminal devices, and performs real-time monitoring on the video terminal devices and the users. And a dynamic access strategy is formulated and updated based on the user, the authentication identity of the video terminal equipment, the real-time monitoring result, the security state information of the network support equipment and the video traffic security information in the access process, and access is controlled based on the dynamic access strategy. According to the invention, through dual authentication of the access user and the video terminal equipment, unauthorized access and operation are rejected, the access risk value is calculated in real time, and the dynamic access strategy is updated, so that the risk can be effectively identified, and the security of the system is ensured.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and in particular relates to a zero-trust access control system and method for video cloud security. Background Art

[0002] Video cloud is a cloud-based video system deployed and built on the basis of cloud computing infrastructure. The video cloud service platform built through flexible cluster deployment and elastic resource expansion can support a variety of video applications such as video conferencing, video command, video monitoring, video live broadcast, video collaboration, etc. It has the advantages of strong network adaptability, high reliability and stability, low asset investment and operation and maintenance management costs. However, while cloud computing improves resource utilization, it also has many security issues, such as unauthorized access vulnerabilities, service denial attacks (i.e. large-scale traffic attacks), data leakage, etc. Therefore, in some application scenarios that have extremely high requirements for the security of the accessed resources, how to ensure the security of the video cloud is an urgent problem to be solved. Summary of the invention

[0003] In view of the above analysis, the present invention aims to provide a zero-trust access control system and method for video cloud security, which continuously performs risk identification and dynamic trust assessment on users and devices accessing the video cloud, and formulates dynamic access policies based on the dynamic assessment trust value to implement access control and improve the security protection capabilities of the video cloud.

[0004] In one aspect, the present invention provides a zero-trust access control system for video cloud security, comprising:

[0005] An identity authentication unit, used to manage and authenticate video terminal devices connected to the system and users accessing the video cloud through each video terminal device;

[0006] Security management center, used to monitor the security status information of network support devices of zero-trust access control system in real time;

[0007] Video security perception collection unit, used to monitor user access behavior, video terminal device host resources, video terminal device operation status and video media quality and obtain corresponding real-time monitoring results;

[0008] A zero-trust control unit, configured to formulate and update a dynamic access policy based on the authentication identity of the user and the video terminal device, the real-time monitoring result, the security status information, and the video traffic security information;

[0009] The zero-trust data unit is used to execute the dynamic access policy sent by the zero-trust control unit and monitor the video traffic security information in real time.

[0010] Furthermore, it is characterized in that the zero trust control unit includes:

[0011] A risk identification and analysis module, used to calculate and update the access risk value based on the real-time monitoring results, the security status information, and the video traffic security information;

[0012] A rights management module, used to configure and manage access rights corresponding to the identities of the user and the video terminal device;

[0013] Security policy configuration module, used to configure and manage static access policies for accessed resources;

[0014] A dynamic trust evaluation module, used to calculate an authentication attribute trust value based on the authentication identity, and to calculate a dynamic evaluation trust value based on the access risk value and the authentication attribute trust value;

[0015] The dynamic access control module is used to formulate or update the dynamic access policy based on the dynamically evaluated trust value, the authority of the user and the video terminal device, and the static access policy.

[0016] Further, the risk identification and analysis module calculates and updates the access risk value based on the real-time monitoring result, the security status information, and the video traffic security information, including:

[0017] The risk identification and analysis module determines the risk factor level values ​​corresponding to the real-time monitoring results, the security status information, and the video traffic security information respectively according to the preset risk factor level threshold;

[0018] The access risk value is calculated based on the level value of each risk factor and the corresponding weight. The calculation formula is expressed as:

[0019] r total (t) = α 1 r 1 (t)+α 2 r 2 (t)+…+α N r N (t);

[0020] Among them, r total (t) represents the access risk value at time t; parameter α 1 , α 2 ...α N Respectively represent the weights corresponding to the real-time monitoring results, the security status information, and the video traffic security information; r 1 (t), r 2 (t)...r N (t) respectively represent the risk factor level values ​​corresponding to the real-time monitoring results, the security status information, and the video traffic security information.

[0021] Furthermore, the dynamic trust evaluation module calculates the authentication attribute trust value based on the authentication identity, including:

[0022] T ia =β 1 T user +β 2 T term ;

[0023] Among them, T ia is the authentication attribute trust value; T user and T term Respectively represent the user identity trust value and the video terminal device security attribute information value; β 1 and β 2 Represent the corresponding weight coefficients respectively.

[0024] Furthermore, the user identity trust value is calculated as follows:

[0025]

[0026] Among them, I total Indicates the total number of identity authentications for the user; S tatal Indicates the number of times the user's identity authentication was successful; f I Indicates the strength factor coefficient of the user's identity authentication.

[0027] Furthermore, the method for calculating the security attribute information value of the video terminal device is:

[0028]

[0029] Among them, D total Indicates the total number of times the video terminal device is used for authentication, C tatal Indicates the total number of successful authentications of the video terminal device, f T Indicates the security factor of the video terminal device.

[0030] Further, the dynamic trust evaluation module calculates the dynamic evaluation trust value based on the access risk value and the authentication attribute trust value, including:

[0031]

[0032] Among them, T total (t) represents the dynamically evaluated trust value; λ is the attenuation factor and 0<λ<1.

[0033] Furthermore, the dynamic access control module formulates or updates the dynamic access policy based on the dynamically evaluated trust value, the authority of the user and the video terminal device, and the static access policy, including:

[0034] The dynamic access control module determines the real-time dynamic evaluation trust level based on the dynamic evaluation trust value and the preset dynamic evaluation trust level threshold; the dynamic evaluation trust level includes a high trust level, a medium trust level, a low trust level and a no trust level;

[0035] Formulate a dynamic access policy based on the real-time dynamic evaluation trust level, the authority of the user and the video terminal device, and the static access policy, including:

[0036] For a high trust level, a static access policy of resources accessible by the user and the video terminal device with corresponding permissions is used as a corresponding dynamic access policy;

[0037] For the medium trust level, the static access policy of the resources accessible by the user and the video terminal device with corresponding permissions is used as the corresponding dynamic access policy, and the preset time period is shortened;

[0038] For a low trust level, a static access policy of the next level of authority accessible to the user and the video terminal device is used as a corresponding dynamic access policy;

[0039] For untrusted levels, the session is terminated.

[0040] Furthermore, the user access behavior monitoring includes login behavior monitoring and operation behavior monitoring; the device host resource monitoring includes device memory monitoring, device CPU monitoring, and device storage space monitoring; the operation status monitoring includes device network connection monitoring, device key service monitoring, and device malware activity monitoring; the video media quality monitoring includes video tampering monitoring and video clarity monitoring.

[0041] On the other hand, the present invention also provides a zero-trust access control method for video cloud security, which specifically includes the following steps:

[0042] Authenticating the video terminal devices connected to the system and the users who access the video cloud through the video terminal devices;

[0043] Formulate a dynamic access strategy for the user based on the authentication identity of the user and the video terminal device, the security status information of the network support device, the real-time monitoring results of the user's access behavior, the real-time monitoring results of the host resources of the video terminal device, the real-time monitoring results of the operation status of the video terminal device, the real-time monitoring results of the video media quality, and the video traffic security information;

[0044] During the user's access process, the dynamic access policy is updated based on the authentication identity, the security status information, the real-time monitoring results and the video traffic security information.

[0045] The present invention can achieve at least one of the following beneficial effects:

[0046] Based on the zero-trust architecture, user identity identification and access control are carried out to reject unauthorized operations, ensure the security and privacy of data, and greatly reduce the risks brought by diverse transport layer protocols and flexible signaling control protocols and media coding protocols.

[0047] Through dual authentication of access users and video terminal devices, the user identity trust value and the video terminal device security attribute information value are calculated based on the user identity and the video terminal device respectively, and the authentication attribute trust value is further calculated. Combined with the real-time monitoring results of video terminal devices and users, the security status information obtained from monitoring network devices, and the video traffic security information, the access risk is calculated and updated. The dynamic access strategy can be comprehensively determined according to the authentication attributes and risk assessment status, and the user access risk can be identified in real time, the accuracy of risk assessment can be improved, the user's trustworthiness can be effectively reflected, and the system security can be enhanced.

[0048] By making the risk identification and analysis module and the dynamic trust assessment module independent of each other and avoiding coupling, the weight information of the calculation method can be optimized based on the historical data used during use, thereby improving the accuracy of risk identification.

[0049] Other features and advantages of the present invention will be described in the following description, and some advantages may become apparent from the description, or may be understood by practicing the present invention. The purpose and other advantages of the present invention may be realized and obtained through the contents particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The accompanying drawings are only used for the purpose of illustrating specific embodiments and are not to be considered as limiting the present invention. In the entire drawings, the same reference symbols represent the same components;

[0051] Figure 1 This is an architecture diagram of the zero-trust access control system of the present invention. DETAILED DESCRIPTION

[0052] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not used to limit the scope of the present invention.

[0053] System Example

[0054] A specific embodiment of the present invention discloses a zero-trust access control system for video cloud security, including: an identity authentication unit, a video security perception collection unit, a security management center, a zero-trust control unit and a zero-trust data unit.

[0055] It should be noted that, in this embodiment, the accessed resources in the zero-trust access control system for video cloud security include various video resources and various video service resources. The video service resources exemplarily include video conferencing services, video command services, video surveillance services, etc. Each video service resource corresponds to different application scenarios and permissions of users / video terminal devices, among which the video conferencing service refers to the service of initiating or participating in a video conference; the video command service refers to the service of initiating video calls with multi-level permissions, focusing on top-down application scenarios; the video surveillance service refers to the service of mobilizing and querying video surveillance resources.

[0056] Furthermore, in this embodiment, a micro-isolation component is used to implement security management and control of accessed resources.

[0057] Identity Authentication Unit

[0058] The identity authentication unit is used to manage and authenticate the video terminal devices connected to the system and the users who access the video cloud through the video terminal devices.

[0059] Specifically, the identity authentication unit includes an identity management module and an identity authentication module.

[0060] The identity management module is used to manage the video terminal devices connected to the system, the users registered in the system, and the system applications running in the system. The identity management module is used to establish a standardized identity library for the users, the video terminal devices, and the system applications, manage the creation, modification, and cancellation of each identity information, and ensure the uniqueness, consistency, and accuracy of each identity information in the system.

[0061] The identity authentication module is used to authenticate the video terminal device through a digital certificate or device fingerprint feature. When the video terminal device is turned on, it sends a digital certificate or device fingerprint feature to the system. The identity authentication module verifies whether its identity is legitimate based on the received digital certificate or device fingerprint feature. Among them, the device fingerprint feature includes hardware identification (such as MAC address, device serial number, etc.) and software configuration information (such as operating system version, driver version, etc.).

[0062] Further, the user accesses the system based on the video terminal device that has passed the authentication. In response to the access initiated by the user, the identity authentication module authenticates the user based on the Ukey or smart card inserted by the user in the video terminal device, combined with the user's fingerprint read by the fingerprint reader and the facial features captured by the camera of the video terminal device to confirm the user's identity.

[0063] Furthermore, the system allows users who have passed identity authentication to access the system. To enhance security, when users access various applications in the system, they need to access based on the pre-registered account name and password.

[0064] When a user initiates access, the identity authentication module sends the identity information of the authenticated video terminal device, the authenticated user identity information, and the account name and password entered by the user to the zero trust control unit.

[0065] Video security perception acquisition unit

[0066] The video security perception acquisition unit is used to realize user access behavior monitoring, video terminal device host resource monitoring, video terminal device operation status monitoring and video media quality monitoring and obtain corresponding real-time monitoring results.

[0067] Specifically, user access behavior monitoring is used to discover abnormal user behavior, including login behavior monitoring and operation behavior monitoring; examples include abnormal login in login behavior, sharing of meeting numbers, sharing of meeting passwords, recording of meetings, or transferring files in operation behaviors.

[0068] Specifically, the host resource monitoring of the video terminal device includes device memory monitoring, device CPU monitoring, and device storage space monitoring.

[0069] Specifically, the video terminal device operation status monitoring is used to monitor abnormal conditions in the operation status of the video terminal device, including device network connection monitoring, video terminal device key service monitoring, and device malware activity monitoring.

[0070] The video media quality monitoring includes video tampering monitoring (exemplarily such as illegal images, video blocking, etc.) and video clarity monitoring.

[0071] Furthermore, the video security perception collection unit sends the collected real-time monitoring results to the zero trust control unit and the security management center respectively.

[0072] Security Management Center

[0073] The security management center is used to monitor the security status information of the zero-trust access control system, i.e., the network support equipment of the system, in real time, and provide it to the zero-trust control unit.

[0074] Specifically, network support equipment includes routers, switches, firewalls, gateways, etc.

[0075] Specifically, the security status information exemplarily includes: intrusion attempts, malware infection, data leakage, system vulnerability exploitation, DDoS attack, device configuration information change, device configuration information anomaly, etc.

[0076] It should be noted that the security management center is also used to receive and record the real-time monitoring results collected by the video security perception collection unit and the video traffic security information monitored by the zero-trust data unit.

[0077] Zero Trust Control Unit

[0078] The zero trust control unit is used to formulate and update dynamic access policies based on the authentication identity of the user and the video terminal device, the real-time monitoring results, the security status information and the video traffic security information.

[0079] The zero-trust control unit includes a risk identification and analysis module, a permission management module, a security policy configuration module, a dynamic trust assessment module and a dynamic access control module.

[0080] Risk Identification and Analysis Module

[0081] Specifically, the risk identification and analysis module calculates and updates the access risk value based on the real-time monitoring results of the video security perception collection unit, the security status information of the security management center, and the video traffic security information of the zero trust unit.

[0082] Specifically include:

[0083] The risk identification and analysis module determines the risk factor level values ​​corresponding to the real-time monitoring results, the security status information, and the video traffic security information respectively according to the preset risk factor level threshold;

[0084] The access risk value is calculated based on the level value of each risk factor and the corresponding weight. The calculation formula is expressed as:

[0085] r total (t) = α 1 r 1 (t)+α 2 r 2 (t)+…+α N r N (t);

[0086] Among them, r total (t) represents the access risk value at time t; parameter α 1 , α 2 ...α N Respectively represent the weights corresponding to the real-time monitoring results, the security status information, and the video traffic security information; r 1 (t), r 2 (t)...r N (t) respectively represent the risk factor level values ​​corresponding to each real-time monitoring result, the security status information, and the video traffic security information, and N represents the number of risk factors.

[0087] Specifically, the risk factor level value combination is set as R level= {no risk, lower risk, general risk, more serious risk, serious risk, particularly serious risk}, the corresponding risk factor level value combination is r value ={0,1,2,3,4,5}.

[0088] Furthermore, each of the weight values ​​can be obtained by fitting based on historical data.

[0089] It should be noted that the risk identification and analysis module calculates the access risk value of each user according to a preset time period, and sends the access risk value to the dynamic trust assessment module.

[0090] Rights Management Module

[0091] The rights management module is used to manage the access rights information of each user and video terminal device.

[0092] It should be noted that the system of the present invention allows users to access the system through video terminal devices by dual identity authentication of users and video terminal devices. Accordingly, the permissions corresponding to the video terminal devices are set according to the device type, the scenario in which the device is used, etc.

[0093] Specifically, the permissions of each user and video terminal device are set based on the RBAC and ABAC authorization models.

[0094] Security policy configuration module

[0095] The security policy configuration module is used to configure and manage static access policies for accessed resources, including setting different access time ranges and different access conditions for users and video terminal devices with different permissions for each accessed resource.

[0096] Dynamic Trust Assessment Module

[0097] Specifically, the dynamic trust evaluation module calculates the authentication attribute trust value of the user access system based on the authentication identity of the user and the video terminal device by the identity authentication unit, and calculates the dynamic evaluation trust value based on the access risk value calculated by the risk identification and analysis module and the authentication attribute trust value.

[0098] Specifically, the method for calculating the authentication attribute trust value of the authentication identity is:

[0099] T ia =β 1 T user +β 2 T term ;

[0100] Among them, T ia is the authentication attribute trust value; T user and T termRespectively represent the user identity trust value and the video terminal device security attribute information value; β 1 and β 2 They represent the corresponding weight coefficients respectively, which can be determined based on historical data.

[0101] Furthermore, the calculation method of the user identity trust value is:

[0102]

[0103] Among them, I total Indicates the total number of identity authentications for the user. The value is 1 for the first login. tatal Indicates the number of times the user's identity authentication is successful. The value is 0 for the first login. I Indicates the strength factor coefficient of the user identity authentication, which is related to the authentication method. For example, the strength factor coefficient corresponding to two-factor authentication is greater than the strength factor coefficient corresponding to single-factor authentication.

[0104] Furthermore, the calculation method of the security attribute information value of the video terminal device is:

[0105]

[0106] Among them, D total Indicates the total number of authentications using this video terminal device. The value is 1 for the first authentication. tatal Indicates the total number of successful authentications of the video terminal device; f T The security factor representing the video terminal device is determined based on the security attribute status of the video terminal device. Exemplary security attribute statuses include patch update status, anti-virus software installation status, etc.

[0107] Furthermore, a calculation method for calculating a dynamic evaluation trust value based on the access risk value and the authentication attribute trust value is:

[0108]

[0109] Among them, T total (t) represents the dynamically evaluated trust value; λ is the decay factor and 0<λ<1.

[0110] Furthermore, the dynamic trust assessment module updates the corresponding dynamic assessment trust value according to the access risk value of each user calculated by the risk identification and analysis module according to a preset period, and sends it to the dynamic access control module.

[0111] Dynamic Access Control Module

[0112] The dynamic access control module formulates or updates a dynamic access policy based on the dynamically evaluated trust value, the permissions of the user and the video terminal device, and the static access policy.

[0113] include:

[0114] Determine the real-time dynamic evaluation trust level based on the dynamic evaluation trust value and the preset dynamic evaluation trust level threshold; the dynamic evaluation trust level includes a high trust level, a medium trust level, a low trust level and a no trust level;

[0115] Formulate a dynamic access policy based on the real-time dynamic evaluation trust level, the authority of the user and the video terminal device, and the static access policy, including:

[0116] For a high trust level, a static access policy of resources accessible by the user and the video terminal device with corresponding permissions is used as a corresponding dynamic access policy;

[0117] For the medium trust level, the static access policy of the resources accessible by the user and the video terminal device with corresponding permissions is used as the corresponding dynamic access policy, and the preset time period corresponding to the user in the risk identification and analysis module is shortened, that is, the risk identification and analysis module updates the access risk value of the user based on the modified time period, and the corresponding dynamic trust assessment module updates the corresponding dynamic assessment trust value based on the modified time period;

[0118] For a low trust level, a static access policy of the next level of authority accessible to the user and the video terminal device is used as a corresponding dynamic access policy;

[0119] For untrusted levels, the session is terminated.

[0120] Furthermore, the dynamic access control module sends the dynamic access policy to the zero trust data unit.

[0121] Zero Trust Data Unit

[0122] The zero-trust data unit is used to execute the dynamic access policy sent by the zero-trust control unit and monitor video traffic security information in real time.

[0123] Specifically, the zero-trust data unit monitors the video traffic security information of users during the access process in real time, including: sudden growth of video traffic, abnormal port traffic, malicious code hidden in video traffic, abnormal fields in the video protocol, etc.

[0124] Furthermore, the zero-trust data unit feeds back the real-time monitored video traffic security information to the dynamic access control module.

[0125] The present embodiment discloses a zero-trust access control system for video cloud security, which performs identity identification and access control on users based on a zero-trust architecture, rejects unauthorized operations, ensures data security and privacy, and greatly reduces the risks caused by diverse transport layer protocols and flexible signaling control protocols and media coding protocols.

[0126] Through dual authentication of access users and video terminal devices, the user identity trust value and the video terminal device security attribute information value are calculated based on the user identity and the video terminal device respectively, and the authentication attribute trust value is further calculated. Combined with the real-time monitoring results of video terminal devices and users, the security status information obtained from monitoring network devices, and the video traffic security information, the access risk is calculated and updated. The dynamic access strategy can be comprehensively determined according to the authentication attributes and risk assessment status, and the user access risk can be identified in real time, the accuracy of risk assessment can be improved, the user's trustworthiness can be effectively reflected, and the system security can be enhanced.

[0127] By making the risk identification and analysis module and the dynamic trust assessment module independent of each other and avoiding coupling, the weight information of the calculation method can be optimized based on the historical data used during use, thereby improving the accuracy of risk identification.

[0128] Method Embodiment

[0129] Another specific embodiment of the present invention discloses a zero-trust access control method for video cloud security, comprising the following steps:

[0130] Authenticating the video terminal devices connected to the system and the users who access the video cloud through the video terminal devices;

[0131] Formulate a dynamic access strategy for the user based on the authentication identity of the user and the video terminal device, the security status information of the network support device, the real-time monitoring results of the user's access behavior, the real-time monitoring results of the host resources of the video terminal device, the real-time monitoring results of the operation status of the video terminal device, the real-time monitoring results of the video media quality, and the video traffic security information;

[0132] During the user's access process, the dynamic access policy is updated based on the authentication identity, the security status information, the real-time monitoring results and the video traffic security information.

[0133] Compared with the prior art, the beneficial effects of a zero-trust access control method for video cloud security provided by this embodiment are basically the same as the beneficial effects provided by the system embodiment, and are not elaborated here one by one.

[0134] It should be noted that the above embodiments are based on the same inventive concept and parts not described repeatedly can be used as reference for each other.

[0135] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

Claims

1. A zero-trust access control system for video cloud security, characterized in that: include: An identity authentication unit, used to manage and authenticate video terminal devices connected to the system and users accessing the video cloud through each video terminal device; Security management center, used to monitor the security status information of network support devices of zero-trust access control system in real time; Video security perception collection unit, used to monitor user access behavior, video terminal device host resources, video terminal device operation status and video media quality and obtain corresponding real-time monitoring results; A zero-trust control unit, configured to formulate and update a dynamic access policy based on the authentication identity of the user and the video terminal device, the real-time monitoring result, the security status information, and the video traffic security information; The zero-trust data unit is used to execute the dynamic access policy sent by the zero-trust control unit and monitor the video traffic security information in real time.

2. The zero-trust access control system for video cloud security according to claim 1, characterized in that: The zero trust control unit includes: A risk identification and analysis module, used to calculate and update the access risk value based on the real-time monitoring results, the security status information, and the video traffic security information; A rights management module, used to configure and manage access rights corresponding to the identities of the user and the video terminal device; Security policy configuration module, used to configure and manage static access policies for accessed resources; A dynamic trust evaluation module, used to calculate an authentication attribute trust value based on the authentication identity, and to calculate a dynamic evaluation trust value based on the access risk value and the authentication attribute trust value; The dynamic access control module is used to formulate or update the dynamic access policy based on the dynamically evaluated trust value, the authority of the user and the video terminal device, and the static access policy.

3. The zero-trust access control system for video cloud security according to claim 2, characterized in that: The risk identification and analysis module calculates and updates the access risk value based on the real-time monitoring results, the security status information, and the video traffic security information, including: The risk identification and analysis module determines the risk factor level values ​​corresponding to the real-time monitoring results, the security status information, and the video traffic security information respectively according to the preset risk factor level threshold; The access risk value is calculated based on the level value of each risk factor and the corresponding weight. The calculation formula is expressed as: r total (t)=α1r1(t)+α2r2(t)+…+α N r N (t); Among them, r total (t) represents the access risk value at time t; parameters α1, α2, ... N Respectively represent the weights corresponding to the real-time monitoring results, the security status information, and the video traffic security information; r1(t), r2(t)...r N (t) respectively represent the risk factor level values ​​corresponding to the real-time monitoring results, the security status information, and the video traffic security information.

4. The zero-trust access control system for video cloud security according to claim 2, characterized in that: The dynamic trust evaluation module calculates the authentication attribute trust value based on the authentication identity, including: T ia =β1T user +β2T term ; Among them, T ia is the authentication attribute trust value; T user and T term They represent the user identity trust value and the video terminal device security attribute information value respectively; β1 and β2 represent the corresponding weight coefficients respectively.

5. The zero-trust access control system for video cloud security according to claim 4, characterized in that: The calculation method of the user identity trust value is: Among them, I total Indicates the total number of identity authentications for the user; S tatal Indicates the number of times the user's identity authentication succeeded; f I Indicates the strength factor coefficient of the user's identity authentication.

6. The zero-trust access control system for video cloud security according to claim 4, characterized in that: The calculation method of the security attribute information value of the video terminal device is: Among them, D total Indicates the total number of times the video terminal device is used for authentication, C tatal Indicates the total number of successful authentications of the video terminal device, f T Indicates the security factor of the video terminal device.

7. The zero-trust access control system for video cloud security according to claim 3, characterized in that: The dynamic trust evaluation module calculates the dynamic evaluation trust value based on the access risk value and the authentication attribute trust value, including: Among them, T total (t) represents the dynamically evaluated trust value; λ is the attenuation factor and 0<λ<1.

8. The zero-trust access control system for video cloud security according to claim 2, characterized in that: The dynamic access control module formulates or updates the dynamic access policy based on the dynamically evaluated trust value, the authority of the user and the video terminal device, and the static access policy, including: The dynamic access control module determines the real-time dynamic evaluation trust level based on the dynamic evaluation trust value and the preset dynamic evaluation trust level threshold; the dynamic evaluation trust level includes a high trust level, a medium trust level, a low trust level and a no trust level; Formulate a dynamic access policy based on the real-time dynamic evaluation trust level, the authority of the user and the video terminal device, and the static access policy, including: For a high trust level, a static access policy of resources accessible by the user and the video terminal device with corresponding permissions is used as a corresponding dynamic access policy; For the medium trust level, the static access policy of the resources accessible by the user and the video terminal device with corresponding permissions is used as the corresponding dynamic access policy, and the preset time period is shortened; For a low trust level, a static access policy of the next level of authority accessible to the user and the video terminal device is used as a corresponding dynamic access policy; For untrusted levels, the session is terminated.

9. The zero-trust access control system for video cloud security according to claim 1, characterized in that: The user access behavior monitoring includes login behavior monitoring and operation behavior monitoring; the device host resource monitoring includes device memory monitoring, device CPU monitoring, and device storage space monitoring; the operation status monitoring includes device network connection monitoring, device key service monitoring, and device malware activity monitoring; the video media quality monitoring includes video tampering monitoring and video clarity monitoring.

10. A zero-trust access control method for video cloud security, characterized in that: The steps include: Authenticating the video terminal devices connected to the system and the users who access the video cloud through the video terminal devices; Formulate a dynamic access strategy for the user based on the authentication identity of the user and the video terminal device, the security status information of the network support device, the real-time monitoring results of the user's access behavior, the real-time monitoring results of the host resources of the video terminal device, the real-time monitoring results of the operation status of the video terminal device, the real-time monitoring results of the video media quality, and the video traffic security information; During the user's access process, the dynamic access policy is updated based on the authentication identity, the security status information, the real-time monitoring results and the video traffic security information.

Images