Trusted management and control method and device based on zero-trust architecture, storage medium and electronic equipment

Abstract

The embodiment of the invention provides a trusted management and control method and device based on a zero-trust architecture, a storage medium and electronic equipment, and relates to the technical field of Internet of Things security, and the method comprises the steps: carrying out the identity authentication of Internet of Things equipment based on a distributed identity management system; carrying out real-time analysis on the request of the Internet of Things equipment for accessing the resources by adopting dynamic security situation assessment, and dynamically adjusting the access authority according to the behavior, environment and context conditions of the Internet of Things equipment; a trusted computing module and a security key are generated, and a sensitive computing task is executed in a trusted computing environment. According to the technical scheme, the security of the Internet of Things system can be improved, the risk of internal and external attacks can be effectively reduced, and the stable and reliable operation of the Internet of Things application is ensured.

Description

Technical Field

[0001] The present application relates to the field of Internet of Things security technology, and specifically, to a trusted management and control method, device, storage medium and electronic device based on a zero-trust architecture. Background Art

[0002] With the rapid development of the Internet of Things (IoT), the number of smart devices around the world has exploded, and these devices are widely used in smart homes, smart cities, industrial automation, medical health and other fields. However, the large-scale deployment of IoT devices and their heterogeneous and distributed characteristics have made them face severe security challenges. Traditional boundary security models (such as firewalls and intrusion detection systems) rely on the trust division between internal and external networks and cannot effectively deal with internal threats and malicious attacks between devices. In addition, IoT devices often have limited computing power and lack of strong security protection mechanisms, which makes them easy targets for network attacks.

[0003] To address this problem, Zero Trust Architecture (ZTA) was introduced as a new security model. The core principle of Zero Trust is to no longer assume that any network or device is trusted by default, but to require strict identity authentication and security assessment before each access to resources. Through continuous monitoring and real-time analysis, Zero Trust Architecture can effectively detect and prevent potential internal and external threats, thereby improving system security.

[0004] At the same time, Trusted Computing Technology provides a secure computing foundation for the system by introducing hardware security modules (such as TPM, Trusted Platform Module). Trusted computing technology can ensure the secure storage and operation of sensitive data in the system, and prevent malware or unauthorized access through hardware-level protection. The trusted computing environment can also realize remote verification of devices to ensure that the devices are in a trusted state.

[0005] Although zero-trust architecture and trusted computing technology each have significant advantages, in the IoT scenario, how to effectively combine the two to deal with complex security threats is still a current technical difficulty. There are a large number of IoT devices and they are highly heterogeneous. Zero-trust architecture needs to be organically combined with trusted computing technology to achieve more refined access control and real-time protection. Summary of the invention

[0006] The embodiments of the present application provide a trusted management and control method, device, storage medium and electronic device based on a zero-trust architecture to solve the technical problems existing in the prior art.

[0007] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0008] According to a first aspect of an embodiment of the present application, a trusted management and control method based on a zero-trust architecture is provided, including:

[0009] Authenticate IoT devices based on a distributed identity management system;

[0010] Use dynamic security posture assessment to analyze IoT device access resource requests in real time and dynamically adjust access permissions based on the IoT device's behavior, environment, and contextual conditions;

[0011] Generate trusted computing modules and security keys, and perform sensitive computing tasks in a trusted computing environment.

[0012] In some embodiments of the present application, based on the aforementioned solution, the identity authentication of the IoT device based on the distributed identity management system includes:

[0013] When an IoT device first accesses the network, the IoT device generates a unique decentralized identifier and submits the device information of the IoT device to the decentralized identity registry;

[0014] The IoT device sends an authentication request to the network for authentication, which includes a decentralized identifier and a cryptographic signature;

[0015] The distributed identity management system calculates and updates the trust score of IoT devices based on their registration information, historical behavior, and feedback from other devices, and decides whether to allow IoT devices to access the network.

[0016] In some embodiments of the present application, based on the above solution, the use of dynamic security situation assessment to perform real-time analysis on requests for IoT devices to access resources includes:

[0017] Analyze user profiles of IoT devices, including login behavior information, network behavior information, operation behavior information, and other behavior information;

[0018] Determine the trust evaluation factors of each dimension of the user portrait based on the degree of deviation between the current behavior data and the historical behavior data of the user portrait;

[0019] The user's behavior trust is confirmed based on the trust evaluation factor, and the behavior trust of the current period is determined.

[0020] In some embodiments of the present application, based on the above solution, confirming the user's behavior trust based on the trust evaluation factor includes:

[0021] Based on the trust evaluation factors of each dimension of the user portrait and the weight ratio of each dimension of the user portrait, the user's behavioral trust BT is confirmed using formula (1);

[0022]

[0023] Among them, n represents the dimension of behavioral characteristics, S i represents the trust evaluation factor of each dimension of user portrait, W i Indicates the weight of each dimension of the user portrait.

[0024] In some embodiments of the present application, based on the above solution, determining the trustworthiness of the behavior in the current cycle includes:

[0025] Introducing the time decay factor, based on the behavior trust of the previous cycle, the behavior trust of the current cycle BT is calculated using formula (2) K ;

[0026] BT K =γBT K-1 + (1-γ)BT; (2)

[0027] Among them, BT K-1 represents the behavior trust of the last cycle, γ represents the time decay factor, and K represents the cycle.

[0028] In some embodiments of the present application, based on the above solution, generating a trusted computing module and a security key, and executing sensitive computing tasks in a trusted computing environment, includes:

[0029] Integrate a trusted computing module into every IoT device;

[0030] Generate and store security keys for IoT devices using the trusted computing module;

[0031] The IoT device performs sensitive computing tasks under the protection of the trusted computing module.

[0032] According to a second aspect of an embodiment of the present application, a trusted management and control device based on a zero-trust architecture is provided, including:

[0033] An authentication unit, used to authenticate the IoT device based on a distributed identity management system;

[0034] An analysis unit, used for real-time analysis of requests for access to resources by IoT devices using dynamic security situation assessment;

[0035] An adjustment unit for dynamically adjusting the access rights of IoT devices based on their behavior, environment, and contextual conditions;

[0036] A generating unit, used for generating a trusted computing module and a security key;

[0037] An execution unit is used to perform sensitive computing tasks in a trusted computing environment.

[0038] According to a third aspect of an embodiment of the present application, a computer-readable storage medium is provided, wherein the storage medium stores computer instructions, and when the computer instructions are executed on a computer, the computer executes the method according to the first aspect.

[0039] According to a fourth aspect of the embodiments of the present application, there is provided an electronic device, including: a memory and a processor;

[0040] The memory is used to store computer instructions;

[0041] The processor is used to call the computer instructions stored in the memory so that the electronic device executes the method as described in the first aspect.

[0042] The technical solution of the present application realizes the full life cycle management and security protection of IoT devices and their data by combining the zero-trust dynamic authentication mechanism and the hardware-level security guarantee of trusted computing; this method can not only improve the security of the IoT system, but also effectively reduce the risk of internal and external attacks, and ensure the stable and reliable operation of IoT applications.

[0043] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0045] Figure 1 A flow chart of a trusted management and control method based on a zero-trust architecture according to an embodiment of the present application is shown;

[0046] Figure 2 A block diagram of a trusted management and control device based on a zero-trust architecture according to an embodiment of the present application is shown;

[0047] Figure 3 A block diagram of an electronic device according to an embodiment of the present application is shown;

[0048] Figure 4A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown. DETAILED DESCRIPTION

[0049] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more comprehensive and complete and fully convey the concept of example embodiments to those skilled in the art.

[0050] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0051] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0052] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0053] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution in the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is only a part of the embodiment of the present invention, not all the embodiments. Based on the embodiment of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] Some embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. In the absence of conflict, the following embodiments and features in the embodiments may be combined with each other.

[0055] See also Figure 1 , shows a flow chart of a trusted management and control method based on a zero-trust architecture according to an embodiment of the present application.

[0056] like Figure 1 As shown, a trusted management and control method based on a zero-trust architecture is demonstrated, which specifically includes steps S100 to S300.

[0057] refer to Figure 1 , step S100, performing identity authentication on the IoT device based on the distributed identity management system.

[0058] It is understandable that all IoT devices need to be authenticated before accessing the network. Using a distributed identity management system for identity authentication can ensure the uniqueness and non-tamperability of the device identity.

[0059] In some feasible embodiments, based on the above solution, the identity authentication of the IoT device based on the distributed identity management system includes:

[0060] When an IoT device first accesses the network, the IoT device generates a unique decentralized identifier and submits the device information of the IoT device to the decentralized identity registry;

[0061] The IoT device sends an authentication request to the network for authentication, which includes a decentralized identifier and a cryptographic signature;

[0062] The distributed identity management system calculates and updates the trust score of IoT devices based on their registration information, historical behavior, and feedback from other devices, and decides whether to allow IoT devices to access the network.

[0063] It should be noted that the device information of IoT devices includes device type and manufacturer information.

[0064] It can be understood that after the IoT device sends an authentication request to the network for authentication, the network node ensures the legitimacy of the device identity by verifying the authenticity of the decentralized identifier.

[0065] refer to Figure 1 ,Step S200, a dynamic security situation assessment is used to perform real-time analysis on the request of the IoT device to access resources, and its access rights are dynamically adjusted according to the behavior, environment and context conditions of the IoT device.

[0066] It should be noted that since there are no trusted devices, trusted systems, or trusted users in a zero trust architecture, all access and device-to-device communication requests need to be monitored and granted only if they are tested as valid access requests.

[0067] In some feasible embodiments, based on the above solution, the use of dynamic security situation assessment to perform real-time analysis on requests for IoT devices to access resources includes:

[0068] Analyze user profiles of IoT devices, including login behavior information, network behavior information, operation behavior information, and other behavior information;

[0069] Determine the trust evaluation factors of each dimension of the user portrait based on the degree of deviation between the current behavior data and the historical behavior data of the user portrait;

[0070] The user's behavior trust is confirmed based on the trust evaluation factor, and the behavior trust of the current period is determined.

[0071] It should be noted that the most important part of trust calculation is behavioral analysis, which is performed based on the request history of users accessing the device. The device access history helps determine the baseline behavior of each device, so the device access history is regularly saved in IPFS storage.

[0072] A new trust score is generated for each device by comparing the device's current behavior to the baseline behavior. Drastic changes in behavior result in a decrease in its trust level, while sustained behavior increases the device's trust level.

[0073] It should be noted that login behavior records the user's login method, login time, login duration, login device, login IP, etc. Network behavior records the user's upstream traffic, downstream traffic, TCP connection density, etc. Operation behavior records the name of the resource accessed, historical operations, etc.

[0074] It can be understood that the trust evaluation factor has three evaluation values: trust (corresponding to value 1), partially trusted (corresponding to value 0.5) and untrusted (corresponding to value 0). The trust evaluation factor of each dimension of the user portrait is determined based on the degree of deviation between the current behavior data and the historical behavior data.

[0075] Taking login behavior as an example, a history set T of login duration is generated, and the symbol t represents the login duration.

[0076] T={t 1 ,t 2 ,t 3 ,....,t n-1};

[0077] The mean μ and standard deviation σ of the login duration are calculated. The current login deviation t is standardized.

[0078]

[0079] Δt1 is a general upper limit, Δt 2 is the maximum upper limit if t′≤Δt 1 , then the current behavior is considered to deviate from the historical behavior to a small extent, and the corresponding trust evaluation factor is set to 1. 1 <t′≤Δt 2 , it means that the current behavior deviates from the historical behavior within a certain range, and the corresponding trust evaluation factor is 0.5. 2 , it means that the current behavior deviates too much from the historical behavior, and the corresponding trust evaluation factor is zero.

[0080] In some feasible embodiments, based on the above solution, confirming the user's behavior trust based on the trust evaluation factor includes:

[0081] Based on the trust evaluation factors of each dimension of the user portrait and the weight ratio of each dimension of the user portrait, the user's behavioral trust BT is confirmed using formula (1);

[0082]

[0083] Among them, n represents the dimension of behavioral characteristics, S i represents the trust evaluation factor of each dimension of user portrait, W i Indicates the weight of each dimension of the user portrait.

[0084] It should be noted that the weights will be adjusted dynamically according to changes in the system security environment.

[0085] In some feasible embodiments, based on the above solution, determining the behavior trustworthiness of the current cycle includes:

[0086] Introducing the time decay factor, based on the behavior trust of the previous cycle, the behavior trust of the current cycle BT is calculated using formula (2) K ;

[0087] BT K =γBT K-1 + (1-γ)BT; (2)

[0088] Among them, BT K-1 represents the behavior trust of the last cycle, γ represents the time decay factor, and K represents the cycle.

[0089] It is understandable that the access control and authorization system regularly calculates the behavioral trust of the accessed user. At the same time, the trust threshold of each permission is dynamically adjusted according to the environment to achieve refined and dynamic access control.

[0090] refer to Figure 1, step S300, generating a trusted computing module and a security key, and executing sensitive computing tasks in a trusted computing environment.

[0091] It can be understood that step S300 can ensure the integrity of sensitive data and the security of operations.

[0092] In some feasible embodiments, based on the above scheme, generating a trusted computing module and a security key, and executing sensitive computing tasks in a trusted computing environment, includes:

[0093] Integrate a trusted computing module into every IoT device;

[0094] Generate and store security keys for IoT devices using the trusted computing module;

[0095] The IoT device performs sensitive computing tasks under the protection of the trusted computing module.

[0096] It should be noted that the purpose of integrating a trusted computing module into each IoT device is to ensure that the trusted computing module can communicate effectively with the device's operating system and applications.

[0097] It should be noted that security keys are used for security operations such as data encryption, signing and identity authentication.

[0098] It should be noted that the purpose of the IoT device performing sensitive computing tasks under the protection of the trusted computing module is to ensure that these operations are performed in a trusted environment to prevent interference from malware; wherein the sensitive computing tasks refer to accessing keys, processing user data, etc.

[0099] The following describes an embodiment of the device of the present application, which can be used to execute a trusted management and control method based on a zero-trust architecture in the above embodiment of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the above method of the present application.

[0100] Reference Figure 2 As shown, according to an embodiment of the present application, a trusted management and control device 200 based on a zero-trust architecture includes:

[0101] An authentication unit 201 is used to authenticate the IoT device based on a distributed identity management system;

[0102] An analysis unit 202, configured to perform real-time analysis on requests for access to resources by IoT devices using dynamic security situation assessment;

[0103] An adjustment unit 203, configured to dynamically adjust the access rights of the IoT device according to its behavior, environment and context conditions;

[0104] A generating unit 204, configured to generate a trusted computing module and a security key;

[0105] The execution unit 205 is used to execute sensitive computing tasks in a trusted computing environment.

[0106] like Figure 3 As shown, an embodiment of the present application also provides an electronic device 300, including a memory 310, a processor 320, and a computer program 311 stored in the memory 310 and executable on the processor. When the processor 320 executes the computer program 311, the steps of the above-mentioned trusted management and control method based on the zero trust architecture are implemented.

[0107] Since the electronic device introduced in this embodiment is a device used to implement a trusted management and control device based on a zero-trust architecture in the embodiment of the present application, based on the method introduced in the embodiment of the present application, the technical personnel in this field can understand the specific implementation mode of the electronic device of this embodiment and its various variations. Therefore, how the electronic device implements the method in the embodiment of the present application is not introduced in detail here. As long as the equipment used by the technical personnel in this field to implement the method in the embodiment of the present application is within the scope of protection of this application.

[0108] During the specific implementation process, when the computer program 311 is executed by a processor, any implementation method in the embodiments corresponding to the first aspect can be implemented.

[0109] Figure 4 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown.

[0110] It should be noted that Figure 4 The computer system 400 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0111] like Figure 4 As shown, the computer system 400 includes a central processing unit (CPU) 401, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 402 or the program loaded from the storage part 408 to the random access memory (RAM) 403, such as executing the method described in the above embodiment. In the RAM 403, various programs and data required for system operation are also stored. The CPU 401, ROM 402 and RAM 403 are connected to each other through a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0112] The following components are connected to the I / O interface 405: an input section 406 including a keyboard, a mouse, etc.; an output section 407 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 408 including a hard disk, etc.; and a communication section 409 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the I / O interface 405 as needed. A removable medium 411, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 410 as needed so that a computer program read therefrom is installed into the storage section 408 as needed.

[0113] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 409, and / or installed from a removable medium 411. When the computer program is executed by a central processing unit (CPU) 401, various functions defined in the system of the present application are executed.

[0114] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0115] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0116] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0117] As another aspect, the present application further provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes a trusted management and control method based on a zero-trust architecture described in the above embodiment.

[0118] As another aspect, the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements a trusted management and control method based on a zero-trust architecture described in the above embodiment.

[0119] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0120] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0121] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the embodiments disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary techniques in the art that are not disclosed in the present application. It should be understood that the present application is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A trusted management and control method based on zero trust architecture, characterized in that: include: Authenticate IoT devices based on a distributed identity management system; Use dynamic security posture assessment to analyze IoT device access resource requests in real time and dynamically adjust access permissions based on the IoT device's behavior, environment, and contextual conditions; Generate trusted computing modules and security keys, and perform sensitive computing tasks in a trusted computing environment.

2. The method according to claim 1, characterized in that The identity authentication of the IoT device based on the distributed identity management system includes: When an IoT device first accesses the network, the IoT device generates a unique decentralized identifier and submits the device information of the IoT device to the decentralized identity registry; The IoT device sends an authentication request to the network for authentication, which includes a decentralized identifier and a cryptographic signature; The distributed identity management system calculates and updates the trust score of IoT devices based on their registration information, historical behavior, and feedback from other devices, and decides whether to allow IoT devices to access the network.

3. The method according to claim 1, characterized in that The dynamic security situation assessment is used to perform real-time analysis on the request of the IoT device to access resources, including: Analyze user profiles of IoT devices, including login behavior information, network behavior information, operation behavior information, and other behavior information; Determine the trust evaluation factors of each dimension of the user portrait based on the degree of deviation between the current behavior data and the historical behavior data of the user portrait; The user's behavior trust is confirmed based on the trust evaluation factor, and the behavior trust of the current period is determined.

4. The method according to claim 3, characterized in that The confirming the user's behavior trustworthiness based on the trust evaluation factor includes: Based on the trust evaluation factors of each dimension of the user portrait and the weight ratio of each dimension of the user portrait, the user's behavioral trust BT is confirmed using formula (1); Among them, n represents the dimension of behavioral characteristics, S i represents the trust evaluation factor of each dimension of user portrait, W i Indicates the weight of each dimension of the user portrait.

5. The method according to claim 4, characterized in that Determining the behavior trustworthiness of the current cycle includes: Introducing the time decay factor, based on the behavior trust of the previous cycle, the behavior trust of the current cycle BT is calculated using formula (2) K ; BT K =γBT K-1 + (1-γ)BT; (2) Among them, BT K-1 represents the behavior trust of the last cycle, γ represents the time decay factor, and K represents the cycle.

6. The method according to claim 1, characterized in that The generating of a trusted computing module and a security key and executing sensitive computing tasks in a trusted computing environment includes: Integrate a trusted computing module into every IoT device; Generate and store security keys for IoT devices using the trusted computing module; The IoT device performs sensitive computing tasks under the protection of the trusted computing module.

7. A trusted management and control device based on zero trust architecture, characterized in that: include: An authentication unit, used to authenticate the IoT device based on a distributed identity management system; An analysis unit, used for real-time analysis of requests for access to resources by IoT devices using dynamic security situation assessment; An adjustment unit for dynamically adjusting the access rights of IoT devices based on their behavior, environment, and contextual conditions; A generating unit, used for generating a trusted computing module and a security key; An execution unit is used to perform sensitive computing tasks in a trusted computing environment.

8. A computer-readable storage medium, characterized in that: The storage medium stores computer instructions, and when the computer instructions are executed on a computer, the computer is enabled to execute the method according to any one of claims 1 to 6.

9. An electronic device, characterized in that: include: Memory and processor; The memory is used to store computer instructions; The processor is used to call the computer instructions stored in the memory so that the electronic device executes the method as described in any one of claims 1-6.

Images