Zero-trust railway 5G private network-based secure transmission balancing method and system

Abstract

The invention provides a safe transmission balancing method and system based on a zero-trust railway 5G private network, and relates to the technical field of network security, and the method comprises the following steps: S1, selecting services in the railway 5G private network, and carrying out zero-trust mechanism configuration; s2, evaluating the risk level of the selected service based on the security threat faced by the selected service; s3, determining an AoT curve slope and a change condition for each service in combination with a risk assessment result; s4, making a security verification strategy according to different risk levels and AoT curve change conditions; and S5, performing corresponding identity verification according to the security verification strategy and the zero-trust mechanism. According to the method and the system provided by the invention, the resource demand of a zero-trust mechanism during actual operation can be effectively overcome, the wireless transmission efficiency of the railway 5G private network is ensured, and the operation in an actual application scene is more flexible.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for balancing secure transmission of a zero-trust railway 5G private network. Background Art

[0002] In the era of rapid development of modern communication technology, the security of railway 5G private networks has become an important research field. With the development of railway 5G private networks, the complexity and heterogeneity of the network have increased significantly, and traditional security mechanisms have been unable to cope with complex security threats.

[0003] In response to network complexity and heterogeneity, zero-trust architecture has gradually become a new security concept, emphasizing the security principle of "never trust, always verify", requiring continuous identity authentication for each user and device to ensure network security. However, the continuous identity authentication process faces the problem of high resource requirements, while ensuring the wireless transmission efficiency of the railway 5G private network. Therefore, the zero-trust mechanism needs to balance the trust level and network performance.

[0004] AoT (Age of Trust) is the trust freshness of the target user, which is used to quantify the decay of the target user's trust level over time. It provides a dynamic trust management mechanism for the zero-trust architecture, allowing the network to adjust the verification frequency according to actual conditions, thereby improving transmission efficiency while ensuring security. Therefore, how to use AoT to achieve a balance between security and efficiency is an urgent problem to be solved.

[0005] In the existing technology, for networks that introduce zero-trust mechanisms, continuous identity authentication is usually required for each interaction, which consumes a lot of resources and makes it difficult to ensure the efficient transmission efficiency of other businesses. The zero-trust mechanism is only responsible for identity verification and dynamic trust evaluation, and usually does not have the ability to evaluate long-term trust levels. In addition, the zero-trust mechanism solution usually cannot take into account both efficient transmission performance and strict security guarantees. Summary of the invention

[0006] The technical problem to be solved by the present invention is how to optimize the existing zero-trust mechanism to achieve continuous identity authentication while ensuring the wireless transmission efficiency of the railway 5G private network. In order to overcome the defects of the above-mentioned prior art, the present invention provides a zero-trust railway 5G private network security transmission balance method and system.

[0007] The present invention provides a zero-trust railway 5G private network secure transmission balancing method, comprising the following steps:

[0008] S1. Select services in the railway 5G private network and configure the zero-trust mechanism;

[0009] S2. Assess the risk level of the selected business based on the security threats it faces;

[0010] S3. Determine the slope and change of the AoT curve for each business based on the results of the risk assessment;

[0011] S4. Make security verification strategies based on different risk levels and AoT curve changes;

[0012] S5. Based on the security verification strategy, the zero trust mechanism performs corresponding identity authentication.

[0013] Compared with the existing technology, the present application's method for balancing secure transmission of 5G private railway networks based on zero trust has the following advantages: it can achieve continuous identity authentication while ensuring the wireless transmission efficiency of the 5G private railway network, and provide security strategies that dynamically adapt to changes in the network environment, thereby blocking access to illegal users or data. It can not only avoid the risk of being attacked to a great extent, but also effectively solve the problem that continuous identity authentication in the current zero-trust mechanism of most networks affects the efficiency of wireless transmission, and is more in line with actual network security application scenarios.

[0014] In a possible implementation, in step S1, in order to ensure the effectiveness of the zero-trust mechanism, the selected railway 5G private network services need to be configured to ensure that each service can operate effectively in a zero-trust environment, including the following steps: S11. For high-risk services, configure strict access control and enable MFA, and deploy services in isolated network areas, using virtual LAN or virtual private network technology to reduce the scope of attack; S12. For low-risk services, simplify access control, ensure basic authentication and authorization mechanisms, configure access rights in accordance with the principle of least privilege, and maintain basic network security measures.

[0015] Compared with existing technologies, the effectiveness of the zero-trust mechanism is ensured by configuring high-risk businesses and low-risk businesses separately to ensure that each business can operate effectively in a zero-trust environment.

[0016] In a possible implementation, in step S1, the railway 5G private network services include railway emergency calls, driving-related dispatching voice, driving safety data, driving information data, driving dispatching videos, operation and maintenance data; the zero-trust mechanism configuration includes: configuration of the data layer and the control layer based on supporting components, combined with policy engines, policy management, and policy execution points.

[0017] Compared with existing technologies, it can handle multiple different railway 5G private network services.

[0018] In a possible implementation, in step S2, it is necessary to ensure the comprehensiveness and accuracy of the risk assessment, analyze the importance of the business and the security threats it faces, and evaluate its risk level, which specifically includes the following steps: S21, identify and analyze threats and vulnerabilities, and conduct a comprehensive risk assessment based on historical attack records, potential threat intelligence and current network situation; S22, use the risk matrix to derive the threat risk level and determine the risk level of different businesses.

[0019] Compared with existing technologies, comprehensive risk assessment based on historical attack records, potential threat intelligence and current network situation, and then using risk matrix, can ensure the comprehensiveness and accuracy of risk assessment and analyze the importance of the business and the security threats it faces.

[0020] In a possible implementation, step S3 specifically includes the following steps: S31, calculating the initial trust level of each business in combination with the risk assessment results; S32, determining the slope of the AoT curve, and setting the verification frequency based on the importance and risk level of the business; S33, determining the change of the AoT curve for different types of businesses.

[0021] In a possible implementation, in step S32, determining the slope of the AoT curve specifically includes the following steps:

[0022] S321. Risk levels are divided into extremely high risk, high risk, medium risk, low risk and extremely low risk;

[0023] S322, determine the corresponding numerical representation of each risk level: extremely high risk is 4, high risk is 3, medium risk is 2, low risk is 1, and extremely low risk is 0;

[0024] S323. Establish a relationship model between risk level and slope of AoT curve:

[0025] h=h 0 +w(1-e -k / w )

[0026] Among them, h 0 is a constant, w is a weighting factor, and k is the value corresponding to the risk level;

[0027] S324, determine the slope α(t) of the AoT curve:

[0028]

[0029] Compared with the existing technology, by constructing a relationship model between the risk level and the slope of the AoT curve, it is convenient to obtain the slope of the AoT curve corresponding to each risk level.

[0030] In a possible implementation, in step S4, making a security verification strategy includes the following specific steps:

[0031] S41. Calculate the average AoT curve:

[0032]

[0033] S42. Calculate the service throughput of a time slot:

[0034]

[0035] The average service throughput is:

[0036]

[0037] Where, v(t) is the instantaneous service transmission rate;

[0038] S43, by adjusting the weight β, using linear programming to achieve and Dual-objective optimization:

[0039]

[0040] S44. Use enhanced Q learning to solve the dual-objective optimization problem in step 43 to obtain the verification cycle of the optimal trust verification solution.

[0041] In a possible implementation, in step S44, the dual-objective optimization problem in step S43 is mapped to the four core elements of state, action, reward function and strategy of enhanced Q learning to obtain the verification cycle of the optimal trust verification scheme;

[0042] Status: including instantaneous service rate, AoT and verification period of the current time slot:

[0043] s=(v(t), a(t), T(t))

[0044] Where, T(t) is the verification period of the current time slot;

[0045] Action: Defined as the validation cycle for the current time slot:

[0046] a=(T(t))

[0047] Reward function: The reward function is defined based on the objective function:

[0048]

[0049] Q-learning update: At each step of the Q-learning process, the Q-value is updated using the reward function defined above:

[0050] Q(s,a)=Q(s,a)+α[R(s,a)+γmax(Q(s′,a′))-Q(s,a)]

[0051] Where Q(s, a) is the value of taking action a in the current state s; α is the learning rate; γ is the discount factor, which indicates the importance of future rewards; max(Q(s′, a′)) is the maximum Q value of all possible actions in the next state s′;

[0052] According to the above four preset mappings, the Q learning algorithm is run and the Q value is continuously updated to finally obtain an optimized strategy; according to the training results, the optimal verification period T(t) is selected to maximize the value of the objective function.

[0053] In a possible implementation, step S5 specifically includes the following steps:

[0054] S51. Initial identity verification through multi-factor authentication and / or biometric verification;

[0055] S52. Perform dynamic risk assessment on attempted access behaviors, including behavior analysis, environmental analysis, and threat intelligence;

[0056] S53. Based on the results of dynamic risk assessment, decide whether to allow the access request, and perform fine-grained control over access rights through role-based access control and attribute-based access control;

[0057] S54, monitor the user's operation behavior in real time, establish the user's normal behavior baseline, and detect abnormal behavior that deviates from the baseline in real time;

[0058] S55. For any abnormal behavior or potential security threats detected, take immediate response measures, automatically block suspicious access requests and issue an alarm.

[0059] Another technical solution of the present invention is to provide a zero-trust-based railway 5G private network security and transmission efficiency balance system, including:

[0060] A business risk assessment module, which conducts a comprehensive risk level assessment on the selected railway 5G private network business, collects historical data, real-time data and environmental data related to the business, uses risk analysis methods to identify security threats and vulnerabilities, and classifies risk levels;

[0061] An AoT curve generation module, wherein the AoT curve generation module determines the descending slope of the AoT curve for different services based on the service risk assessment result, and generates an adapted AoT curve;

[0062] A security verification strategy generation module, which generates a suitable security verification strategy according to the risk level of different services and the change of AoT curve;

[0063] A verification policy implementation module, wherein the verification policy implementation module authenticates different users and devices in a zero-trust mechanism according to a security verification policy.

[0064] Compared with the existing technology, the zero-trust railway 5G private network security transmission balance system proposed in this application has the following advantages: it can effectively overcome the resource requirements faced by the zero-trust mechanism in actual operation, ensure the wireless transmission efficiency of the railway 5G private network, and operate more flexibly in actual application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 A processing flow chart of a zero-trust railway 5G private network secure transmission balancing method provided by the present invention;

[0066] Figure 2 A flowchart of a preferred embodiment of a zero-trust railway 5G private network secure transmission balancing method provided by the present invention;

[0067] Figure 3 A zero-trust mechanism diagram based on a zero-trust railway 5G private network secure transmission balancing method provided by the present invention;

[0068] Figure 4 An AoT curve diagram based on a zero-trust railway 5G private network secure transmission balancing method provided by the present invention;

[0069] Figure 5 A schematic diagram of a model of a zero-trust railway 5G private network secure transmission balancing method in a 5G-R application scenario provided by the present invention;

[0070] Figure 6 A logical block diagram of a zero-trust railway 5G private network secure transmission balance system provided by the present invention. DETAILED DESCRIPTION

[0071] First, those skilled in the art should understand that these implementations are only used to explain the technical principles of the embodiments of the present application, and are not intended to limit the protection scope of the embodiments of the present application. Those skilled in the art can make adjustments to them as needed to adapt to specific application scenarios.

[0072] The present application is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0073] Embodiment 1

[0074] See also Figure 1As shown, the present invention provides a method for balancing secure transmission of a 5G private railway network based on zero trust, comprising the following steps:

[0075] S1. Select services in the railway 5G private network and configure the zero-trust mechanism;

[0076] S2. Assess the risk level of the selected business based on the security threats it faces;

[0077] S3. Determine the slope and change of the AoT curve for each business based on the results of the risk assessment;

[0078] S4. Make security verification strategies based on different risk levels and AoT curve changes;

[0079] S5. Based on the security verification strategy, the zero trust mechanism performs corresponding identity authentication.

[0080] See also Figure 2 The above is a flow chart of a preferred embodiment of this embodiment.

[0081] In the embodiment provided by the present invention, in the process of step S1, in order to ensure the effectiveness of the zero-trust mechanism, it is necessary to carefully configure the selected railway 5G private network service to ensure that each service can run effectively in the zero-trust environment. The specific steps are as follows:

[0082] S11. For high-risk businesses, configure strict access control and enable MFA, and deploy businesses in isolated network areas, using virtual local area network (VLAN) or virtual private network (VPN) technology to reduce the scope of attack;

[0083] S12. For low-risk businesses, simplify access control, ensure basic authentication and authorization mechanisms, and configure access rights in accordance with the principle of least privilege. Maintain basic network security measures such as firewalls and intrusion detection systems (IDS).

[0084] Among them, railway 5G private network services include railway emergency calls, driving-related dispatching voice, driving safety data, driving information data, driving dispatching videos, operation and maintenance data; the zero-trust mechanism configuration includes: based on supporting components (situational awareness, resource management, equipment management, identity management, cryptographic services and authentication), combined with the policy engine (PE), policy management (PA), and policy enforcement point (PEP) to configure the data layer and control layer.

[0085] Those skilled in the art should understand that the above-mentioned business types are only examples, and other existing or future business types (systems, services, etc.) that are applicable to the embodiments of the present invention should also be included in the scope of protection of the present invention and are included here by reference.

[0086] In the embodiment provided by the present invention, it is necessary to ensure the comprehensiveness and accuracy of risk assessment during step S2, analyze the importance of the business and the security threats it faces, and assess its risk level. Specifically, the following settings can be made:

[0087] S21. Identify and analyze threats and vulnerabilities, and conduct a comprehensive risk assessment based on historical attack records, potential threat intelligence, and current network situation;

[0088] S22. Use the risk matrix to derive the threat risk level and determine the risk level of different businesses.

[0089] Among them, the risk matrix is ​​shown in Table 1:

[0090] Table 1 Risk Matrix

[0091]

[0092] Note: Extremely high risk (25), high risk (12-16), medium risk (8-10), low risk (4-6), extremely low risk (1-3).

[0093] This determines the risk level of different businesses:

[0094] It is determined that railway emergency calls are extremely high risk, train-related dispatching voices are high risk, train safety data are high risk, train information data are medium risk, train dispatching videos are low risk, and operation and maintenance data are extremely low risk.

[0095] When businesses of different risk levels are running, the dynamic changes of their trust freshness show significant differences. After identity verification, the trust freshness of high-risk businesses tends to decrease rapidly, thus quickly becoming a high-risk state, while the trust freshness of low-risk businesses decreases relatively slowly.

[0096] Furthermore, step S3 specifically includes the following steps:

[0097] S31. Calculate the initial trust level of each business based on the risk assessment results;

[0098] S32. Determine the slope of the AoT curve and set the verification frequency based on the importance and risk level of the business;

[0099] S33. Determine the change of the AoT curve for different types of services.

[0100] In step S32, determining the slope of the AoT curve specifically includes the following steps:

[0101] S321. Risk levels are divided into extremely high risk, high risk, medium risk, low risk and extremely low risk;

[0102] S322, determine the corresponding numerical representation of each risk level: extremely high risk is 4, high risk is 3, medium risk is 2, low risk is 1, and extremely low risk is 0;

[0103] S323. Establish a relationship model between risk level and slope of AoT curve:

[0104] h=h 0 +w(1-e -k / w )

[0105] Among them, h 0 is a constant, w is a weighting factor, and k is the value corresponding to the risk level;

[0106] S324. Determine the slope α(t) of the AoT curve in units of one time slot:

[0107]

[0108] Specifically, determine the constant h 0 =0.5, and the weighting factor w = 32, the growth trend of the AOT value is more reasonable. Assuming that the slope α(0) of the AoT curve of services with different risk levels is 0 at the initial moment, the next time slot t 1 If identity authentication is not performed at all times, the slope α(1) of the AoT curve for services of different risk levels is shown in Table 2:

[0109] Table 2t 1 The slope of the AoT curve for businesses with different risk levels without identity authentication at all times

[0110]

[0111] Next time slot t 2 If identity authentication is performed at the moment, the slope of the AoT curve drops to 0, otherwise the slopes of the AoT curves are as shown in Table 3:

[0112] Table 3 t 2 The slope of the AoT curve for businesses with different risk levels without identity authentication at all times

[0113]

[0114] Specifically, the slope of the AoT curve of the next time slot is deduced in the same way.

[0115] See also Figure 4 As shown, t 1 ,t 2 ……t i : represents the i-th identity authentication;

[0116] l 0 , l 1 , l 2 , l 3 , l 4 : Business curves at different risk levels;

[0117] a 23 : The initial trust freshness of a business with a risk level of 4 during the second identity verification;

[0118] a 24 : The initial trust freshness of a business with a risk level of 5 during the second identity verification.

[0119] The slope of the AoT curve determined above is combined with the transmission rate of the service to generate a suitable security verification strategy in step S4, which specifically includes:

[0120] S41. Calculate the average AoT curve slope:

[0121]

[0122] S42. Calculate the service throughput of a time slot:

[0123]

[0124] The average service throughput is:

[0125]

[0126] Where, v(t) is the instantaneous service transmission rate;

[0127] S43, by adjusting the weight β, using linear programming to achieve and Dual-objective optimization:

[0128]

[0129] S44. Use enhanced Q learning to solve the dual-objective optimization problem in step 43 to obtain the verification cycle of the optimal trust verification solution.

[0130] Among them, in step S44, the dual-objective optimization problem in step S43 is mapped to the four core elements of state, action, reward function and strategy of enhanced Q learning to obtain the verification cycle of the optimal trust verification scheme;

[0131] Status: includes the instantaneous service rate of the current time slot, the slope of the AoT curve, and the verification period, represented by s:

[0132] s=(v(t), a(t), T(t))

[0133] Where, T(t) is the verification period of the current time slot;

[0134] Action: Defined as the verification period of the current time slot, represented by a:

[0135] a=(T(t))

[0136] Reward function: The reward function is defined based on the objective function and is represented by R(s, a):

[0137]

[0138] Q-learning update: At each step of the Q-learning process, the reward function defined above is used to update the Q value, denoted by Q(s, a):

[0139] Q(s,a)=Q(s,a)+α[R(s,a)+γmax(Q(s′,a′))-Q(s,a)]

[0140] Where Q(s, a) is the value of taking action a in the current state s; α is the learning rate; γ is the discount factor, which indicates the importance of future rewards; max(Q(s′, a′)) is the maximum Q value of all possible actions in the next state s′;

[0141] According to the above four preset mappings, the Q learning algorithm is run and the Q value is continuously updated to finally obtain an optimized strategy; according to the training results, the optimal verification period T(t) is selected to maximize the value of the objective function.

[0142] Finally, the zero-trust mechanism verifies services of different risk levels according to the security verification strategy to ensure a balance between security and transmission efficiency. The policy engine uses security policies and inputs from external sources (such as IP blacklists, threat intelligence services) as inputs to the "trust algorithm" to decide whether to grant access rights to resources (access objects) to designated access subjects; policy management establishes the connection between the client and the resource, generates authentication tokens or credentials for the client to access resources, and is the determination component of zero-trust dynamic permissions; the policy execution point establishes, continuously monitors, and ultimately terminates the connection between the access subject and the access object to ensure secure access and authentication of the service.

[0143] In this embodiment, step S5 specifically includes the following steps:

[0144] S51. Perform initial identity verification through multi-factor authentication (MFA) and / or biometric verification;

[0145] S52. Perform dynamic risk assessment on attempted access behaviors, including behavior analysis, environmental analysis, and threat intelligence;

[0146] S53. Based on the results of dynamic risk assessment, decide whether to allow the access request, and perform fine-grained control of access rights through role-based access control (RBAC) and attribute-based access control (ABAC);

[0147] S54, monitor the user's operation behavior in real time, establish the user's normal behavior baseline, and detect abnormal behavior that deviates from the baseline in real time;

[0148] S55. For any abnormal behavior or potential security threats detected, take immediate response measures, automatically block suspicious access requests and issue an alarm.

[0149] See also Figure 3 As shown, this is a specific system block diagram of the zero-trust mechanism of this embodiment.

[0150] The method for balancing the security and transmission efficiency of the railway 5G private network based on zero trust proposed in the present invention can achieve continuous identity authentication while ensuring the wireless transmission efficiency of the railway 5G private network, and provide a security strategy that dynamically adapts to changes in the network environment, thereby blocking access to illegal users or data. It can not only avoid the risk of being attacked to a great extent, but also effectively solve the problem that continuous identity authentication in the current zero-trust mechanism of most networks affects the wireless transmission efficiency, and is more in line with the actual application scenarios of network security.

[0151] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present invention can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of various embodiments of the present invention or certain parts of the embodiments.

[0152] For example, see Figure 5 As shown, this method can be applied to 5G-R application scenarios.

[0153] Embodiment 2

[0154] See also Figure 6 As shown, the present invention provides a zero-trust-based railway 5G private network security and transmission efficiency balancing system, including:

[0155] A business risk assessment module, which conducts a comprehensive risk level assessment on the selected railway 5G private network business, collects historical data, real-time data and environmental data related to the business, uses risk analysis methods to identify security threats and vulnerabilities, and classifies risk levels;

[0156] An AoT curve generation module, wherein the AoT curve generation module determines the descending slope of the AoT curve for different services based on the service risk assessment result, and generates an adapted AoT curve;

[0157] A security verification strategy generation module, which generates a suitable security verification strategy according to the risk level of different services and the change of AoT curve;

[0158] A verification policy implementation module, wherein the verification policy implementation module authenticates different users and devices in a zero-trust mechanism according to a security verification policy.

[0159] In the preferred embodiment provided by the present invention, the specific functions of each part are as follows:

[0160] When the business risk assessment module performs zero-trust configuration for businesses of different risk levels, it first needs to assess the risk level and sensitivity of each business. Secondly, to ensure the security of businesses of different risk levels, it is necessary to implement dynamic access control strategies to ensure the effectiveness and adaptability of the zero-trust model, and to continuously monitor and update security strategies.

[0161] After receiving the risk level information of different businesses, the AoT curve generation module will first analyze the impact of risk changes on the AoT curve. Secondly, the AoT curve generation module will map the risk level information to the slope of the AoT curve to ensure that the curve can accurately reflect the trust of the business under different risk conditions. At the same time, the AoT curve generation module will update the trust freshness curve in real time to achieve accurate modeling and monitoring of business trust.

[0162] After receiving the AoT curve information of different services, the security verification strategy generation module first analyzes the AoT curve of each service and the transmission performance of the service, and judges the trust strength of the service at different time points and the trust decay rate over time through the downward slope and trend of the AoT curve. Secondly, the security verification strategy generation module generates a suitable security verification strategy, dynamically adjusts the verification strength to optimize the balance between security and user experience, formulates a flexible policy framework to adapt to the real-time changes of the AoT curve, and comprehensively considers the complexity of security verification and business needs to generate an optimized verification strategy, thereby ensuring high security while maintaining the efficiency of business transmission.

[0163] After receiving the corresponding security verification policy information, the verification policy implementation module first parses the policy to extract rules and operation requirements, maps this information to system components and operation processes, configures access control systems, updates verification settings, and deploys security monitoring and protection measures. The verification policy implementation module continuously monitors and evaluates the execution effect of the policy, and updates policy parameters based on feedback from actual operation to maintain the security and stability of the system.

[0164] This embodiment can effectively overcome the resource requirements faced by the zero-trust mechanism during actual operation, ensure the wireless transmission efficiency of the railway 5G private network, and make the operation more flexible in actual application scenarios.

[0165] Those skilled in the art can understand that the accompanying drawings are only schematic diagrams of an embodiment, and the modules or processes in the accompanying drawings are not necessarily required to implement the present invention.

[0166] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The device and system embodiments described above are merely schematic, in which the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.

[0167] In the description of the present application, the description with reference to the terms "one embodiment", "some embodiments", "in the present embodiment", "specific example", or "some examples" etc. means that the specific features, mechanisms, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, mechanisms, materials or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0168] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A zero-trust railway 5G private network secure transmission balancing method, characterized in that: The steps include: S1. Select services in the railway 5G private network and configure the zero-trust mechanism; S2. Assess the risk level of the selected business based on the security threats it faces; S3. Determine the slope and change of the AoT curve for each business based on the results of the risk assessment; S4. Make security verification strategies based on different risk levels and AoT curve changes; S5. Based on the security verification strategy, the zero trust mechanism performs corresponding identity authentication.

2. The method for balancing secure transmission of a zero-trust railway 5G private network according to claim 1 is characterized in that: In step S1, to ensure the effectiveness of the zero-trust mechanism, the selected railway 5G private network services need to be configured to ensure that each service can run effectively in a zero-trust environment, including the following steps: S11. For high-risk businesses, configure strict access control and enable MFA, deploy businesses in isolated network areas, and use virtual LAN or virtual private network technology to reduce the scope of attack; S12. For low-risk businesses, simplify access control, ensure basic authentication and authorization mechanisms, configure access rights in accordance with the principle of least privilege, and maintain basic network security measures.

3. The method for balancing secure transmission of a zero-trust railway 5G private network according to claim 1 is characterized in that: In step S1, the railway 5G private network services include railway emergency calls, driving-related dispatching voice, driving safety data, driving information data, driving dispatching video, and operation and maintenance data; Zero trust mechanism configuration includes: configuring the data layer and control layer based on supporting components, combined with policy engine, policy management, and policy execution points.

4. The method for balancing secure transmission of a zero-trust railway 5G private network according to claim 1 is characterized in that: In step S2, it is necessary to ensure the comprehensiveness and accuracy of the risk assessment, analyze the importance of the business and the security threats it faces, and assess its risk level. The specific steps include: S21. Identify and analyze threats and vulnerabilities, and conduct a comprehensive risk assessment based on historical attack records, potential threat intelligence, and current network situation; S22. Use the risk matrix to derive the threat risk level and determine the risk level of different businesses.

5. The method for balancing secure transmission of a zero-trust railway 5G private network according to claim 1 is characterized in that: Step S3 specifically includes the following steps: S31. Calculate the initial trust level of each business based on the risk assessment results; S32. Determine the slope of the AoT curve and set the verification frequency based on the importance and risk level of the business; S33. Determine the change of the AoT curve for different types of services.

6. The method for balancing secure transmission of a zero-trust railway 5G private network according to claim 5 is characterized in that: In step S32, determining the slope of the AoT curve specifically includes the following steps: S321. Risk levels are divided into extremely high risk, high risk, medium risk, low risk and extremely low risk; S322, determine the corresponding numerical representation of each risk level: extremely high risk is 4, high risk is 3, medium risk is 2, low risk is 1, and extremely low risk is 0; S323. Establish a relationship model between risk level and slope of AoT curve: <h2 style=";text-align:left;direction:ltr">h = h0 + w(1 - e<h2 style=";text-align:left;direction:ltr"> -k / w <h2 style=";text-align:left;direction:ltr"> ) Among them, h0 is a constant, w is a weighting factor, and k is the value corresponding to the risk level; S324, determine the slope α(t) of the AoT curve:

7. The method for balancing secure transmission of a zero-trust railway 5G private network according to claim 6 is characterized in that: In step S4, making a security verification strategy includes the following specific steps: S41. Calculate the average AoT curve slope: S42. Calculate the service throughput of a time slot: The average service throughput is: Where, v(t) is the instantaneous service transmission rate; S43, by adjusting the weight β, using linear programming to achieve and Dual-objective optimization: S44. Use enhanced Q learning to solve the dual-objective optimization problem in step 43 to obtain the verification cycle of the optimal trust verification solution.

8. The method for balancing secure transmission of a zero-trust railway 5G private network according to claim 7 is characterized in that: In step S44, the dual-objective optimization problem in step S43 is mapped to the four core elements of state, action, reward function and strategy of enhanced Q learning to obtain the verification cycle of the optimal trust verification scheme; Status: including the instantaneous service rate of the current time slot, the slope of the AoT curve, and the verification period: s=(v(t),a(t),T(t)) Where, T(t) is the verification period of the current time slot; Action: Defined as the validation cycle for the current time slot: a=(T(t)) Reward function: The reward function is defined based on the objective function: Q-learning update: At each step of the Q-learning process, the Q-value is updated using the reward function defined above: Q(s,a)=Q(s,a)+α[R(s,a)+γmax(Q(s′,a′))-Q(s,a)] Where Q(s,a) is the value of taking action a in the current state s; α is the learning rate; γ is the discount factor, which indicates the importance of future rewards; max(Q(s',a')) is the maximum Q value of all possible actions in the next state s'; According to the above four preset mappings, the Q learning algorithm is run and the Q value is continuously updated to finally obtain an optimized strategy; according to the training results, the optimal verification period T(t) is selected to maximize the value of the objective function.

9. The method for balancing secure transmission of a zero-trust railway 5G private network according to claim 1 is characterized in that: Step S5 specifically includes the following steps: S51. Initial identity verification through multi-factor authentication and / or biometric verification; S52. Perform dynamic risk assessment on attempted access behaviors, including behavior analysis, environmental analysis, and threat intelligence; S53. Based on the results of dynamic risk assessment, decide whether to allow the access request, and perform fine-grained control over access rights through role-based access control and attribute-based access control; S54, monitor the user's operation behavior in real time, establish the user's normal behavior baseline, and detect abnormal behavior that deviates from the baseline in real time; S55. For any abnormal behavior or potential security threats detected, take immediate response measures, automatically block suspicious access requests and issue an alarm.

10. A system based on the zero-trust railway 5G private network secure transmission balancing method according to any one of claims 1 to 9, characterized in that: include: A business risk assessment module, which conducts a comprehensive risk level assessment on the selected railway 5G private network business, collects historical data, real-time data and environmental data related to the business, uses risk analysis methods to identify security threats and vulnerabilities, and classifies risk levels; An AoT curve generation module, wherein the AoT curve generation module determines the descending slope of the AoT curve for different services based on the service risk assessment result, and generates an adapted AoT curve; A security verification strategy generation module, which generates a suitable security verification strategy according to the risk level of different services and the change of AoT curve; A verification policy implementation module, wherein the verification policy implementation module authenticates different users and devices in a zero-trust mechanism according to a security verification policy.

Images