Dynamic access control system and method based on continuous trust

Abstract

The invention discloses a dynamic access control system based on continuous trust, which is used for solving the security problem caused by insufficient traditional boundary protection means in an electric power system terminal environment, and is used for solving the security problem by combining attribute-based access control (ABAC) and an introspection variational auto-encoder (I ntroVAE). And dynamic access control in a power system terminal environment is realized. According to the system, firstly, attributes of access requests are preliminarily screened and filtered through a rule matching mechanism, and it is ensured that the requests conform to a basic access strategy; and then, the system performs in-depth behavior analysis on the screened requests by using an I ntroVAE model. The model detects potential abnormal behaviors by analyzing a normal behavior mode of a user so as to prevent unauthorized access, and the dynamic access control system can effectively improve data security in a power system terminal environment and prevent data leakage or system damage caused by internal or external malicious behaviors.

Description

Technical Field

[0001] The present invention relates to the technical field of access control, and in particular to a dynamic access control system and method based on continuous trust. Background Art

[0002] In recent years, with the widespread application of information technology and the Internet, power system terminals have played an increasingly important role in daily life.

[0003] In the traditional network security architecture, security measures mainly rely on clear network boundaries, that is, protecting internal network resources from external threats through firewalls, VPNs and other means. However, with the popularization of technologies such as remote office and cloud computing, network boundaries have gradually blurred, and users can access through various devices at any time and place. The traditional boundary-based security model has been unable to effectively respond to security threats to power system terminal access. In this environment, attackers can use vulnerabilities, credential theft, phishing and other means to bypass peripheral protection and directly penetrate into the enterprise network, resulting in sensitive data leakage, system damage or business interruption.

[0004] To cope with this complex network security challenge, Zero Trust Architecture (ZTA) has gradually become a new security strategy. The core idea of ​​​​Continuous Trust is "Don't trust anyone, always verify", that is, no longer assume that any internal user or device is trustworthy. Every access request, whether from external or internal sources, must undergo strict identity authentication and permission verification. Continuous trust requires that each access be controlled in a fine-grained manner to ensure that only authorized users and devices can access resources within the legal scope.

[0005] In addition, in the power system terminal environment, the dynamic changes in user behavior make it impossible for traditional static access control methods to detect and respond to potential security threats in a timely manner. To solve this problem, dynamic access control mechanism has become a key technology. By combining multi-dimensional information such as user attributes, device information, network environment and behavior patterns, the system can evaluate and make decisions in real time to ensure that only legitimate requests are allowed to enter the system. Behavioral analysis technology can also help the system identify abnormal behavior and prevent malicious access.

[0006] To this end, this paper proposes a dynamic access control method for power system terminals that combines attribute-based access control (ABAC) and introspective variational autoencoder (IntroVAE). This method preliminarily screens the attributes of users and devices through predefined strategies, and dynamically monitors access requests in combination with behavioral analysis technology to ensure that corresponding security measures are taken in a timely manner after any abnormal behavior is detected. In addition, by introducing an incremental learning mechanism, the system can automatically update the model and adapt to new threat environments according to the continuous changes in user behavior. This incremental learning mechanism does not require retraining the entire model, reduces the complexity of model maintenance, and can maintain the efficiency and flexibility of the system.

[0007] In general, the present invention aims to build a highly secure dynamic access control system that can flexibly adapt to the power system terminal environment through the application of continuous trust. The system not only improves the protection capability against power system terminal security threats, but also enables it to adapt to the increasingly complex network environment through incremental learning and behavior analysis, significantly improving the security of enterprise data and systems. Summary of the invention

[0008] The purpose of the present invention is to provide a dynamic access control system and method based on continuous trust, which can perform strict dynamic evaluation on each access request through fine-grained access policy control and behavior analysis technology, and timely detect and respond to abnormal behavior, thereby improving the security of the power system terminal environment. The present invention relates to the field of network security technology, and in particular to a dynamic access control system for power system terminals based on continuous trust, which can perform real-time evaluation and dynamic management of user access requests in the power system terminal environment, and effectively defend against potential security threats.

[0009] The purpose of the present invention can be achieved through the following technical solutions:

[0010] A dynamic access control system based on continuous trust, comprising:

[0011] An attribute extraction module, used to extract subject attributes, object attributes, environment attributes and operation attributes from the access request;

[0012] A rule matching module is used to match the extracted attributes according to the predefined access control policy to preliminarily screen the access request;

[0013] The behavior analysis module includes an introspective variational autoencoder IntroVAE model, which is used to analyze the access requests matched by the rules and detect whether there are abnormal behaviors;

[0014] The incremental learning module is used to update the IntroVAE model in the behavior analysis module according to the newly added user behavior data to adapt to the changes in user behavior patterns.

[0015] As a further solution of the present invention: the attributes extracted by the attribute extraction module include user group, access resource ID, operation type, access time, used device, request interval and request frequency.

[0016] As a further solution of the present invention: the rule matching module determines whether the access request complies with a preset access policy set based on the dynamic policy in the continuous trust, and filters out the requests that do not comply with the rules.

[0017] As a further solution of the present invention: the IntroVAE model in the behavior analysis module establishes a normal behavior pattern through the following formula;

[0018] The formula is used to establish the true distribution of the data p(x), which is obtained by integral calculation:

[0019] p(x)=∫p(z)p(x|z)dz

[0020] Among them, p(x) represents the probability distribution of input data x, p(z) represents the prior distribution of latent variables, and p(x|z) represents the conditional probability distribution of data x given latent variable z;

[0021] The loss function of the model is calculated using the variational autoencoder (VAE) formula:

[0022] -L=KL(q(z|x)||p(z))-Ez[p(x|z)]

[0023] Where L represents the loss function, KL represents the Kullback-Leibler divergence, which is used to measure the difference between two probability distributions, q(z|x) represents the approximate posterior distribution of the encoder for the hidden variable, and E z [p(x|z)] represents the expected reconstruction error of the latent variables;

[0024] The reparameterization formula is used to determine the latent variable z:

[0025]

[0026] Among them, ∈ represents the random noise of standard normal distribution, e 2-2 represents the variance vector generated by the encoder, e 2-1 represents the mean vector generated by the encoder, and z is the reparameterized latent variable used to input the decoder to generate output samples.

[0027] As a further solution of the present invention: when the reconstruction error of the access request exceeds a preset threshold, the behavior analysis module marks the request as abnormal behavior and triggers a decision to deny access. The MSE calculation formula is as follows:

[0028]

[0029] Where MSE stands for mean square error, x is the input feature vector, y is the output vector generated by the decoder, n is the dimension of the feature, and x is the i and i denote the i-th component of the input and output vectors respectively.

[0030] As a further solution of the present invention: the incremental learning module updates the IntroVAE model of the behavior analysis module through the following steps:

[0031] Generate a sample dataset with the same distribution as the historical dataset and calculate the loss function of the new encoder and decoder:

[0032] L E =KL(z1,z2)+βMSE(x,y)+α([m-loss rec ] + +[m-loss fake ] + )

[0033] Among them, L E is the loss function of the encoder, KL(z1,z2) is the Kullback-Leibler divergence of the latent variable, β is the weight coefficient of the mean square error, α is the weight coefficient of the generated loss, m is the threshold of the decision boundary, and loss rec is the reconstruction loss, loss fake is the loss of the discriminator to fake samples;

[0034] Update the model parameters according to the optimized loss function to ensure that the system can adapt to new user behavior patterns.

[0035] As a further solution of the present invention: the incremental learning adopts a replay-based learning mechanism, by generating sample data with the same distribution as the historical data set, and updating the model using the following formula:

[0036] L D =βMSE(x,y)+α(loss rec +loss fake )

[0037] Among them, L D is the loss function of the decoder, MSE(x,y) is the mean square error, β and α are weight coefficients, and loss recis the reconstruction loss, loss fake is the generation loss of the discriminator.

[0038] As a further solution of the present invention: it also includes an access control decision output module, which is used to finally decide whether to allow the access request based on the judgment results of the rule matching module and the behavior analysis module.

[0039] As a further solution of the present invention: the process of matching the extracted attributes by the rule matching module includes:

[0040] Calculate each extracted attribute to obtain the information entropy, which is:

[0041]

[0042] Among them, p(x i ) means that the index x takes the value x i The probability of

[0043] Then calculate the weight corresponding to each extracted attribute according to the information entropy Hx, specifically:

[0044]

[0045] Among them, Wi represents the weight of the i-th attribute;

[0046] The weight score of each attribute is recorded as Si, and the total score of the attribute is:

[0047]

[0048] The total score of the attribute is compared with the preset threshold to determine the matching result.

[0049] As a further solution of the present invention: a dynamic access control method based on continuous trust, the method comprises the following steps:

[0050] Step 1: Extract the attributes of the access request;

[0051] Step 2: Preliminary screening of requests based on preset rules;

[0052] Step 3: Use the IntroVAE model to perform behavioral analysis on the filtered requests;

[0053] Step 4: Deny access to detected abnormal requests;

[0054] Step 5: For newly added normal behavior samples, perform incremental learning to update the model.

[0055] Beneficial effects of the invention: The present invention provides a dynamic access control system and method for power system terminals based on continuous trust, which can significantly improve the security in the power system terminal environment. By performing user behavior analysis through the Introspective Variational Autoencoder (IntroVAE) model, the system can effectively identify abnormal behavior and prevent potential security threats. At the same time, through the incremental learning mechanism, the system can adapt to changes in user behavior and maintain efficient response when facing new threat scenarios. The present invention is suitable for various power system terminal environments that require high security requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The present invention will be further described below in conjunction with the accompanying drawings.

[0057] Figure 1 It is a flow chart of the method for implementing dynamic access control of the present invention. DETAILED DESCRIPTION

[0058] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0059] Example 1

[0060] See also Figure 1 As shown, the present invention is a dynamic access control system based on continuous trust, comprising:

[0061] An attribute extraction module, used to extract subject attributes, object attributes, environment attributes and operation attributes from the access request;

[0062] A rule matching module is used to match the extracted attributes according to the predefined access control policy to preliminarily screen the access request;

[0063] The behavior analysis module includes an introspective variational autoencoder IntroVAE model, which is used to analyze the access requests matched by the rules and detect whether there are abnormal behaviors;

[0064] The incremental learning module is used to update the IntroVAE model in the behavior analysis module according to the newly added user behavior data to adapt to the changes in user behavior patterns.

[0065] The attributes extracted by the attribute extraction module include user group, access resource ID, operation type, access time, used device, request interval and request frequency.

[0066] The rule matching module determines whether the access request complies with a preset access policy set based on the dynamic policy in the continuous trust, and filters out requests that do not comply with the rules.

[0067] The IntroVAE model in the behavior analysis module establishes a normal behavior pattern through the following formula;

[0068] The formula is used to establish the true distribution of the data p(x), which is obtained by integral calculation:

[0069] p(x)=∫p(z)p(x|z)dz

[0070] Among them, p(x) represents the probability distribution of input data x, p(z) represents the prior distribution of latent variables, and p(x|z) represents the conditional probability distribution of data x given latent variable z;

[0071] The loss function of the model is calculated using the variational autoencoder (VAE) formula:

[0072] -L=KL(q(z|x)||p(z))-Ez[p(x|z)]

[0073] Where L represents the loss function, KL represents the Kullback-Leibler divergence, which is used to measure the difference between two probability distributions, q(z|x) represents the approximate posterior distribution of the encoder for the hidden variable, and E z [p(x|z)] represents the expected reconstruction error of the latent variables;

[0074] The reparameterization formula is used to determine the latent variable z:

[0075]

[0076] Among them, ∈ represents the random noise of standard normal distribution, e 2-2 represents the variance vector generated by the encoder, e 2-1 represents the mean vector generated by the encoder, and z is the reparameterized latent variable used to input the decoder to generate output samples.

[0077] When the reconstruction error of an access request exceeds a preset threshold, the behavior analysis module marks the request as abnormal behavior and triggers a decision to deny access. The MSE calculation formula is as follows:

[0078]

[0079] Where MSE stands for mean square error, x is the input feature vector, y is the output vector generated by the decoder, n is the dimension of the feature, and x is the i and i denote the i-th component of the input and output vectors respectively.

[0080] The incremental learning module updates the IntroVAE model of the behavior analysis module through the following steps:

[0081] Generate a sample dataset with the same distribution as the historical dataset and calculate the loss function of the new encoder and decoder:

[0082] L E =KL(z1,z2)+βMSE,y)+α([m-loss rec ] + +[m-loss fake ] + )

[0083] Among them, L E is the loss function of the encoder, KL(z1,z2) is the Kullback-Leibler divergence of the latent variable, β is the weight coefficient of the mean square error, α is the weight coefficient of the generated loss, m is the threshold of the decision boundary, and loss rec is the reconstruction loss, loss fake is the loss of the discriminator to fake samples;

[0084] Update the model parameters according to the optimized loss function to ensure that the system can adapt to new user behavior patterns.

[0085] The incremental learning described above adopts a replay-based learning mechanism, which generates sample data with the same distribution as the historical data set and updates the model using the following formula:

[0086] L D =βMSE(x,y)+α(loss rec +loss fake )

[0087] Among them, L D is the loss function of the decoder, MSE(x,y) is the mean square error, β and α are weight coefficients, and loss rec is the reconstruction loss, loss fake is the generation loss of the discriminator.

[0088] It also includes an access control decision output module, which is used to ultimately decide whether to allow the access request based on the judgment results of the rule matching module and the behavior analysis module.

[0089] The rule matching module matches the extracted attributes in the following process:

[0090] Calculate each extracted attribute to obtain the information entropy, which is:

[0091]

[0092] Among them, p(x i ) means that the index x takes the value x i The probability of

[0093] Then calculate the weight corresponding to each extracted attribute according to the information entropy Hx, specifically:

[0094]

[0095] Among them, Wi represents the weight of the i-th attribute;

[0096] The weight score of each attribute is recorded as Si, and the total score of the attribute is:

[0097]

[0098] The total score of the attribute is compared with the preset threshold to determine the matching result.

[0099] Example 2

[0100] See also Figure 1 As shown, the present invention is a dynamic access control method based on continuous trust, which combines attribute-based access control (ABAC) and introspective variational autoencoder (IntroVAE) model to realize dynamic security control of user access requests. The method mainly includes the following five steps, which describe the process from receiving access requests to making access decisions in turn. Specifically:

[0101] Step 1: Access request attribute extraction:

[0102] In the power system terminal environment, each access request contains information such as the user's identity, the resources accessed, and the current operation. The system analyzes each access request through the attribute extraction module and specifically extracts the following types of attributes:

[0103] Subject attributes: such as user ID, role, permission level, etc.;

[0104] Object attributes: such as the resource type and resource ID requested for access;

[0105] Environmental attributes: such as the time, location, IP address, device type, etc. of the access request;

[0106] Operation attributes: such as the specific operation type of the access request, including read, write, delete, etc.

[0107] These attributes are extracted through network protocol parsing or access log analysis and stored in the system's access control engine, providing basic data for subsequent policy matching and behavior analysis.

[0108] Step 2: Rule matching:

[0109] After the system completes the attribute extraction, it enters the rule matching stage. This stage mainly performs attribute matching through the attribute-based access control (ABAC) model. The system pre-configures multiple policy rules, each of which consists of multiple dimensions such as subject, object, environment, and operation.

[0110] Rule example: System administrators can access the company database during office hours on weekdays, but are prohibited from accessing it during non-business hours and in external network environments.

[0111] The core process of rule matching is as follows:

[0112] The system finds entries that match the conditions defined by the rule from the extracted attribute set and uses the following formula to calculate the attribute match:

[0113] The rule matching module matches the extracted attributes in the following process:

[0114] Calculate each extracted attribute to obtain the information entropy, which is:

[0115]

[0116] Among them, p(x i ) means that the index x takes the value x i The probability of

[0117] Then calculate the weight corresponding to each extracted attribute according to the information entropy Hx, specifically:

[0118]

[0119] Among them, Wi represents the weight of the i-th attribute;

[0120] The weight score of each attribute is recorded as Si, and the total score of the attribute is:

[0121]

[0122] Compare the total score of the attribute with the preset threshold to determine the matching result;

[0123] In this way, the system can quickly determine whether the current access request complies with the defined access policy. If the match is successful, the access request will enter the next step of behavioral analysis; if the match fails, the system will directly deny access.

[0124] Step 3: User behavior analysis steps:

[0125] The request matched by the rule enters the behavior analysis module. The behavior analysis module uses the IntroVAE (IntroVAE) to deeply detect user behavior. The specific steps are as follows:

[0126] Step 3.1: Training phase. The system first trains the IntroVAE model based on historical access data to build a baseline model of normal user behavior. The system generates a latent variable representation of the input data using the following formula:

[0127] p(x)=∫p(z)p(x|z)dz

[0128] Among them, p(x) is the probability distribution of the input data, p(z) is the prior distribution of the latent variable, and p(x|z) represents the conditional probability distribution of the data given the latent variable.

[0129] Step 3.2: Detection phase. When a new access request arrives, the system compares it with the baseline model and calculates the reconstruction error of its behavior. The system determines whether the current behavior is abnormal using the following mean square error (MSE) formula:

[0130]

[0131] Where x is the input feature vector, y is the reconstructed output, and n is the dimension of the feature vector. When the reconstruction error exceeds the preset threshold, the system marks the request as abnormal behavior.

[0132] Step 4: Incremental learning steps:

[0133] To ensure that the system can continuously adapt to changes in user behavior, the behavior analysis module is equipped with an incremental learning mechanism. Under normal circumstances, user behavior patterns may change over time. Through incremental learning, the system can automatically update the behavior analysis model to cope with these changes. The specific steps include:

[0134] Step 4.1: Add new data collection. The system will collect new user behavior data periodically or according to configuration conditions;

[0135] Step 4.2: Lightweight model update. Update the IntroVAE model using the following loss function:

[0136] L E =KL(q(z|x)||p(z))+β·MSE(x,y)

[0137] Where, represents the Kullback-Leibler divergence, which is used to measure the difference between the approximate posterior distribution q(z|x) and the prior distribution p(z), MSE represents the mean square error, and β is a weight factor used to balance the influence of the divergence and reconstruction error.

[0138] Step 5: Access control decision output steps:

[0139] Based on the results of rule matching and behavior analysis, the system finally makes an access control decision. This step includes the following scenarios:

[0140] Allow access: When the rule matches successfully and the behavior analysis does not detect anomalies, the system allows the user's access request.

[0141] Deny access: When a rule fails to match or behavior analysis detects an anomaly, the system denies the access request and records detailed denial reasons and security logs.

[0142] Trigger additional verification: For some suspicious access requests, the system can enhance security through measures such as multi-factor authentication and further permission restrictions.

[0143] Through the above steps, the system can dynamically manage access requests in the power system terminal environment to ensure that only legitimate and well-behaved visitors can access sensitive resources.

[0144] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A dynamic access control system based on continuous trust, characterized in that: include: An attribute extraction module, used to extract subject attributes, object attributes, environment attributes and operation attributes from the access request; A rule matching module is used to match the extracted attributes according to the predefined access control policy to preliminarily screen the access request; The behavior analysis module includes an introspective variational autoencoder IntroVAE model, which is used to perform behavior analysis on access requests matched by rules and detect whether there is abnormal behavior; The incremental learning module is used to update the IntroVAE model in the behavior analysis module according to the newly added user behavior data to adapt to the changes in user behavior patterns.

2. A dynamic access control system based on continuous trust according to claim 1, characterized in that: The attributes extracted by the attribute extraction module include user group, access resource ID, operation type, access time, used device, request interval and request frequency.

3. A dynamic access control system based on continuous trust according to claim 1, characterized in that: The rule matching module determines whether the access request complies with a preset access policy set based on the dynamic policy in the continuous trust, and filters out requests that do not comply with the rules.

4. A dynamic access control system based on continuous trust according to claim 1, characterized in that: The IntroVAE model in the behavior analysis module establishes a normal behavior pattern through the following formula; The formula is used to establish the true distribution of the data p(x), which is obtained by integral calculation: p(x)=∫p(z)p(x|z)dz Among them, p(x) represents the probability distribution of input data x, p(z) represents the prior distribution of latent variables, and p(x|z) represents the conditional probability distribution of data x given latent variable z; The loss function of the model is calculated using the variational autoencoder (VAE) formula: -L=KL(q(z|x)||p(z))-E z [p(x|z)] Where L represents the loss function, KL represents the Kullback-Leibler divergence, which is used to measure the difference between two probability distributions, q(z|x) represents the approximate posterior distribution of the encoder for the hidden variable, and E z [p(x|z)] represents the expected reconstruction error of the latent variables; The reparameterization formula is used to determine the latent variable z: Among them, ∈ represents the random noise of standard normal distribution, e 2-2 represents the variance vector generated by the encoder, e 2-1 represents the mean vector generated by the encoder, and z is the reparameterized latent variable used to input the decoder to generate output samples.

5. A dynamic access control system based on continuous trust according to claim 4, characterized in that: When the reconstruction error of an access request exceeds a preset threshold, the behavior analysis module marks the request as abnormal behavior and triggers a decision to deny access. The MSE calculation formula is as follows: Where MSE stands for mean square error, x is the input feature vector, y is the output vector generated by the decoder, n is the dimension of the feature, and x is the i and i denote the i-th component of the input and output vectors respectively.

6. A dynamic access control system based on continuous trust according to claim 5, characterized in that: The incremental learning module updates the IntroVAE model of the behavior analysis module through the following steps: Generate a sample dataset with the same distribution as the historical dataset and calculate the loss function of the new encoder and decoder: L E =KL(z1,z2)+βMSE(x,y)+α([m-loss rec ] + +[m-loss fake ] + ) Among them, L E is the loss function of the encoder, KL(z1,z2) is the Kullback-Leibler divergence of the latent variable, β is the weight coefficient of the mean square error, α is the weight coefficient of the generated loss, m is the threshold of the decision boundary, and loss rec is the reconstruction loss, loss fake is the loss of the discriminator to fake samples; Update the model parameters according to the optimized loss function to ensure that the system can adapt to new user behavior patterns.

7. A dynamic access control system based on continuous trust according to claim 5, characterized in that: The incremental learning described above adopts a replay-based learning mechanism, which generates sample data with the same distribution as the historical data set and updates the model using the following formula: L D =βMSE(x,y)+α(loss rec +loss fake ) Among them, L D is the loss function of the decoder, MSE(x,y) is the mean square error, β and α are weight coefficients, and loss rec is the reconstruction loss, loss fake is the generation loss of the discriminator.

8. A dynamic access control system based on continuous trust according to claims 1-7, characterized in that: It also includes an access control decision output module, which is used to ultimately decide whether to allow the access request based on the judgment results of the rule matching module and the behavior analysis module.

9. A dynamic access control system based on continuous trust according to claim 8, characterized in that: The rule matching module matches the extracted attributes in the following process: Calculate each extracted attribute to obtain the information entropy, which is: Among them, p(x i ) means that the index x takes the value x i probability; Then calculate the weight corresponding to each extracted attribute according to the information entropy Hx, specifically: Among them, Wi represents the weight of the i-th attribute; The weight score of each attribute is recorded as Si, and the total score of the attribute is: The total score of the attribute is compared with the preset threshold to determine the matching result.

10. A dynamic access control method based on continuous trust, characterized in that: The following steps are involved: Step 1: Extract the attributes of the access request; Step 2: Preliminary screening of requests based on preset rules; Step 3: Use the IntroVAE model to perform behavioral analysis on the filtered requests; Step 4: Deny access to detected abnormal requests; Step 5: For newly added normal behavior samples, perform incremental learning to update the model.

Images