Access control method and system based on zero-trust architecture SPA technology

Abstract

The invention discloses an access control method and system based on a zero-trust architecture SPA technology, and the method comprises the steps: receiving a service access request sent by an access terminal, and carrying out the identity verification through a trusted console; obtaining an access control strategy of the access terminal based on the access behavior data of the access terminal; based on an access control strategy, the trusted console and the access terminal establish SPA single packet authentication, and the trusted proxy gateway calculates an access trust value according to an SPA authentication packet to establish a data interaction channel; and the trusted environment perception center collects access environment information in real time, dynamically updates an access trust value to adjust the access control strategy, and controls the data interaction process of the access terminal and the service data end. According to the method, the accessible service data is adjusted in real time through risk assessment of user behaviors in combination with real-time environment perception and dynamic strategy control, and the prior early warning processing of service data interaction is effectively realized in combination with an SPA-based single packet access technology, so that the harm of risk intrusion is reduced to the greatest extent.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an access control method and system based on zero trust architecture (SPA) technology. Background Art

[0002] At present, the general deployment mode of power companies' business is level one deployment, level two deployment and level three deployment. Each level will have corresponding border security protection equipment deployed, but most of the businesses adopt B / S architecture, and the external portal websites are generally directly exposed to the Internet, and the vulnerabilities of the WEB itself can easily cause the website to be attacked. Since the attack behaviors basically simulate the legitimate operations of business users, the border security protection equipment cannot play a protective role, and even because of the negligence caused to security operations and business operations, a large number of data leakage cases at home and abroad fully illustrate that the existing border security protection measures cannot meet the needs of business security.

[0003] Therefore, how to solve the most basic business hiding, minimized permission management, and real-time and continuous security behavior monitoring, effectively prevent business exposure and being targeted by attackers, prevent illegal behavior of legitimate users, and zero-trust security management of the entire business life cycle urgently requires effective technical solutions. Summary of the invention

[0004] In response to the problems existing in the above-mentioned prior art, the present invention provides an access control method and system based on zero-trust architecture SPA technology, the purpose of which is to evaluate whether the request to access the terminal is safe through risk assessment of user behavior combined with real-time environmental perception and dynamic policy control. The zero-trust control center can dynamically adjust permissions or intervene based on the behavior and environmental perception results. Once there is a security risk in the access environment, the accessible business data is adjusted in real time, effectively achieving pre-warning and disposal, and minimizing the harm of risk intrusion.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] In a first aspect, the present invention provides an access control method based on zero-trust architecture SPA technology, wherein the zero-trust architecture includes: an access terminal, a trusted console, a trusted environment perception center, a trusted proxy gateway, and a business data terminal, and the method includes:

[0007] S1, the trusted console accepts the service access request sent by the access terminal client and authenticates the access terminal;

[0008] S2, after the identity authentication of the access terminal is passed, obtaining the access control policy of the access terminal based on the access behavior data of the access terminal;

[0009] S3, based on the access control policy, the trusted console establishes SPA single package authentication with the access terminal, and the trusted proxy gateway calculates the access trust value according to the SPA authentication package to establish a data interaction channel;

[0010] S4, the trusted environment perception center collects access environment information in real time, dynamically updates the access trust value to adjust the access control policy, and controls the data interaction process between the access terminal and the business data terminal.

[0011] Preferably, the step S2 of acquiring the access control policy of the access terminal based on the access behavior data of the access terminal specifically includes:

[0012] If the access terminal sends an access request for the first time, obtaining user attribute information and access behavior data of the access terminal to determine the authorization level of the access terminal, and allocating an access control policy to the access terminal based on the authorization level;

[0013] If the access terminal is not sending an access request for the first time, historical access behavior data of the access user of the current access terminal is obtained, access behavior evaluation data is generated, and the current access control policy of the access terminal is formulated based on the access behavior evaluation data.

[0014] Preferably, obtaining the user attribute information and access behavior data of the access terminal to determine the authorization level of the access terminal includes:

[0015] Acquire access traffic data and access behavior data of a preset time period before the current time of the access terminal, and perform structured processing on the access behavior data;

[0016] The structured access behavior data is divided into risk information dataset and access content dataset based on text features;

[0017] Mapping the access traffic data into an access scope to draw a trust circle;

[0018] narrowing the trust circle based on the correlation between the risk information dataset, the access content dataset and the service access request;

[0019] Mapping the trust circle to a behavior trust level according to a preset mapping rule, wherein the area of ​​the trust circle corresponds to the level of the behavior trust level;

[0020] Extracting the access user attribute information of the access terminal, and searching the business system for the user level of the attribute information based on the access user identity information;

[0021] The authorization level of the access terminal is obtained by combining the user level and the behavior trust level.

[0022] Preferably, the narrowing of the trust circle based on the correlation between the risk information data set, the access content data set and the service access request is specifically:

[0023] Acquire the risk rate of the access terminal according to the risk information data set;

[0024] Based on the service access request sent by the access terminal, obtain the target service data of the access request, and extract the feature description word vector of the target service data;

[0025] Segmenting the access content data set by a word segmenter to obtain a plurality of keywords, and converting the plurality of keywords into a plurality of keyword vectors;

[0026] Calculating the similarity between the feature description word vector of the target business data and the keyword vector of the access content data set;

[0027] The radius reduction coefficient of the trust circle is calculated based on the risk rate and similarity using the following formula:

[0028]

[0029] Among them, μ is the radius reduction coefficient, n is the amount of risk data of the access terminal within the preset time period, m is the total number of visits of the access terminal within the time period, ε is the similarity between the feature description word vector of the target business data and the keyword vector of the access content data set, and α and β are preset weighted weights.

[0030] Preferably, the generating access behavior evaluation data based on the historical behavior access data includes:

[0031] Obtain the historical access behavior data of all access users who have established data interaction channels with the business data end;

[0032] Extracting feature words of any of the historical access behavior data, classifying the historical access behavior data according to the feature words and generating corresponding behavior tags to profile the access user;

[0033] Extract the common behavior tags of all access users who have established data interaction channels with the business data end;

[0034] Calculate the difference between the behavior label of the access user currently accessing the terminal and the shared behavior label;

[0035] Based on the difference and the authorization level of the current access terminal, access behavior evaluation data of the access user of the access terminal is generated.

[0036] Preferably, the trusted environment perception center collects access environment information in real time, including access terminal environment information, user change information, and network environment dynamic information;

[0037] The adjusting the access control policy comprises:

[0038] Based on the access environment information, the trusted environment perception center performs data modeling analysis to evaluate the possibility of access turbulence, and sends the evaluation results to the trusted console in real time;

[0039] The trusted console adjusts the access control policy according to preset evaluation result matching rules and dynamically intervenes in the interaction process.

[0040] Preferably, the dynamically updating the access trust value includes:

[0041] Extracting historical trust values ​​in a time sliding window based on a preset adjustment interval;

[0042] Calculate the time decay factor based on the probability of access turbulence;

[0043] The trust value is updated according to the historical trust value and the time decay factor.

[0044] In a second aspect, the present invention provides an access control system based on zero trust architecture SPA technology, including:

[0045] An identity authentication module, used to accept a service access request sent by an access terminal, and the trusted console authenticates the access terminal;

[0046] A control policy formulation module, used to obtain the access control policy of the access terminal based on the access behavior data of the access terminal after the identity authentication of the access terminal is passed;

[0047] An interactive channel establishment module is used to establish a SPA single package authentication between the trusted console and the access terminal based on the access control policy, and the trusted proxy gateway calculates the access trust value according to the SPA authentication package to establish a data interactive channel;

[0048] The dynamic adjustment module is used for the trusted environment perception center to collect access environment information in real time, dynamically update the access trust value to adjust the access control policy, and control the data interaction process between the access terminal and the business data terminal.

[0049] In a third aspect, the present invention provides an electronic device, comprising:

[0050] A memory for storing executable instructions;

[0051] The processor is used to implement the aforementioned access control method based on zero trust architecture SPA technology when running the executable instructions stored in the memory.

[0052] In a fourth aspect, the present invention provides a computer-readable storage medium storing executable instructions, which, when executed by a processor, implements the aforementioned access control method based on zero trust architecture SPA technology.

[0053] The access control method and system based on zero-trust architecture SPA technology of the present invention have the following beneficial effects:

[0054] The present invention analyzes the historical access behavior data of the access user, sets different authorization levels for the access requests of the same access user on different access terminals, and evaluates the possibility of risk attacks on the current terminal. The access behavior is continuously monitored in real time in combination with the access terminal environment information, user change information, and access environment information of the network environment dynamic information. Based on the zero-trust technical framework and assisted by SPA technology, the permission management strategy of business data is effectively improved, and the zero-trust full-business lifecycle security management of business data is realized from the three key threats of business exposure, user permission management, and continuous business behavior monitoring of business security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 It is a schematic diagram of a zero-trust architecture provided by the present invention;

[0056] Figure 2 It is a flow chart of an access control method based on zero trust architecture SPA technology of the present invention;

[0057] Figure 3 It is a structural block diagram of an access control system based on zero trust architecture SPA technology of the present invention. DETAILED DESCRIPTION

[0058] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0059] First, this embodiment explains the zero trust architecture. Figure 1 As shown, this embodiment provides a zero-trust architecture framework, including: an access terminal client, a trusted console, a trusted environment perception center, a trusted proxy gateway, and a business data terminal.

[0060] Using this architecture, the zero-trust access process provided by this embodiment may specifically include:

[0061] One or more Zero Trust Connection Accepting Hosts (AHs) come online. These hosts connect to and are authenticated by the controller. However, they do not answer communications from any other hosts, nor respond to non-preassigned requests.

[0062] Each Zero Trust Connection Initiator Host (IH) that comes online connects to the Zero Trust Controller and authenticates.

[0063] After verifying the zero trust connection initiating host (IH), the zero trust controller determines a list of zero trust connection accepting hosts (AH) that the zero trust connection initiating host (IH) can be authorized to communicate with.

[0064] The Zero Trust Controller informs the Zero Trust Connection Accepting Host (AH) to accept communications from the Zero Trust Connection Initiating Host (IH) along with any optional security policies required to encrypt communications.

[0065] The Zero Trust Controller sends a list of Zero Trust Connect Hosts (AH) that can accept connections, along with optional security policies, to the Zero Trust Connect Initiator Host (IH).

[0066] The zero-trust connection initiating host (IH) initiates a single-packet authorization to each zero-trust connection accepting host (AH) that can accept the connection, and creates a two-way TLS connection with these zero-trust connection accepting hosts (AH).

[0067] Therefore, in order to achieve business data security management and control of zero-trust architecture, the embodiment of the present invention provides an access control method based on zero-trust architecture SPA technology, such as Figure 2 As shown, including:

[0068] S1, the trusted console receives a service access request sent by an access terminal client and performs identity authentication on the access terminal; identity authentication is to verify whether the user account used by the access terminal is a legitimate account.

[0069] S2, after the identity authentication of the access terminal is passed, obtaining the access control policy of the access terminal based on the access behavior data of the access terminal; the access control policy may include blocking access, allowing access, continuing access, allowing and recording, allowing and reviewing, allowing and isolating, and allowing and restricting;

[0070] S3, based on the access control policy, the trusted console establishes SPA single package authentication with the access terminal, and the trusted proxy gateway calculates the access trust value according to the SPA authentication package to establish a data interaction channel;

[0071] S4, the trusted environment perception center collects access environment information in real time, dynamically updates the access trust value to adjust the access control policy, and controls the data interaction process between the access terminal and the business data terminal.

[0072] Preferably, the step S2 of acquiring the access control policy of the access terminal based on the access behavior data of the access terminal specifically includes:

[0073] If the access terminal sends an access request for the first time, obtaining user attribute information and access behavior data of the access terminal to determine the authorization level of the access terminal, and allocating an access control policy to the access terminal based on the authorization level;

[0074] If the access terminal is not sending an access request for the first time, historical access behavior data of the access user of the current access terminal is obtained, access behavior evaluation data is generated, and the current access control policy of the access terminal is formulated based on the access behavior evaluation data.

[0075] During the user's use, the terminal user's access to the service can be dynamically controlled through real-time inspection policies, allowing or blocking the user's access to the service from dimensions such as time, source IP, user access behavior, etc. The service can only be accessed normally when all the conditions for allowing access to the service are met.

[0076] For services with a higher security level, after the user completes the login authentication, the user can be asked to perform a second authentication when using specific services to implement a more flexible access control strategy.

[0077] This method is based on the separation of access terminals and access users, that is, even if a user account that has passed identity authentication is used, it is not necessarily a safe user. Using risky terminals or user accounts that are stolen and used for external logins or intercepted, forging normal interactive information to confuse the identity authentication process, etc., there is also the possibility of data leakage and attack intrusion.

[0078] Therefore, this embodiment needs to determine the access authorization level of the terminal after the terminal user passes the identity authentication.

[0079] Preferably, specifically including:

[0080] Acquiring user attribute information and access behavior data of the access terminal to determine the authorization level of the access terminal includes:

[0081] Acquire access traffic data and access behavior data of a preset time period before the current time of the access terminal, and perform structured processing on the access behavior data;

[0082] It should be noted that the access flow data represents the total number of accesses of the access terminal within a preset time period, and the access behavior data represents whether the access of the access terminal within the preset time period is in compliance with regulations.

[0083] The structured access behavior data is divided into risk information dataset and access content dataset based on text features;

[0084] It should be noted that the risk information data set refers to the access records of the access terminal before that are marked as risk records or records of accessing risky URLs. For example, when the domain name visited by the user is on the network blacklist, a reminder will be received from the browser or system to inform the user of the possible risks of continuing to visit the website. When this method is applied to some business systems with high confidentiality requirements, it can access the risk library of the national network information department, such as the national information security vulnerability library, the management records of the online alarm center, the URL legal certificate information library, etc. to screen the past access records of the access terminal.

[0085] The access content data set refers to the website, web page content, data records, etc. that the access terminal has visited before.

[0086] Mapping the access traffic data into an access scope to draw a trust circle;

[0087] It should be noted that if the access terminal has almost no access traffic data before, this method adheres to the principle of zero trust and eliminates any possible risks. That is, the area of ​​the trust circle of the access terminal is 0, the first access authorization level of the terminal is low, and the access rights are strictly controlled.

[0088] In order to steal data and invade the network, attackers usually perform a large number of crawler operations, that is, the network access traffic data is huge, but the access content involves a wide range of categories. This method verifies the access content of the access terminal. If the access terminal has previously involved a large number of bad access records or the access content is irrelevant to the target data of this access request, the authorization level allowed this time is limited. Specifically, in this embodiment, the following steps are included:

[0089] narrowing the trust circle based on the correlation between the risk information dataset, the access content dataset and the service access request;

[0090] The trust circle is mapped to a behavior trust level according to a preset mapping rule, wherein the area of ​​the trust circle corresponds to the level of the behavior trust level; the larger the area of ​​the trust circle after the association processing, the higher the behavior trust level.

[0091] Extracting the access user attribute information of the access terminal, and searching the business system for the user level of the attribute information based on the access user identity information;

[0092] The authorization level of the access terminal is obtained by combining the user level and the behavior trust level.

[0093] Preferably, the narrowing of the trust circle based on the correlation between the risk information data set, the access content data set and the service access request is specifically:

[0094] Acquire the risk rate of the access terminal according to the risk information data set;

[0095] Based on the service access request sent by the access terminal, obtain the target service data of the access request, and extract the feature description word vector of the target service data;

[0096] It should be noted that the business data stored in the business data terminal usually has category labels and description documents, and the feature description word vector of the business data can be extracted based on the category labels and description documents.

[0097] In some embodiments where business data generally do not contain category labels and description documents, the feature description word vector of the target business data may also adopt the following method for extracting the keyword vector of the access content data set.

[0098] Segmenting the access content data set by a word segmenter to obtain a plurality of keywords, and converting the plurality of keywords into a plurality of keyword vectors;

[0099] It should be noted that the access content data set includes a plurality of description documents of the access content. The word segmentation process may adopt the word segmentation technology in the prior art. Optionally, in this embodiment, the jieba technology may be adopted to perform word segmentation process on the documents in the access content data set.

[0100] Calculating the similarity between the feature description word vector of the target business data and the keyword vector of the access content data set;

[0101] In this embodiment, the similarity is calculated using the cosine similarity formula.

[0102] The radius reduction coefficient of the trust circle is calculated based on the risk rate and similarity using the following formula:

[0103]

[0104] Among them, μ is the radius reduction coefficient, n is the amount of risk data of the access terminal within the preset time period, m is the total number of visits of the access terminal within the time period, ε is the similarity between the feature description word vector of the target business data and the keyword vector of the access content data set, and α and β are preset weighted weights.

[0105] Furthermore, in this embodiment, the step of extracting keywords from the access content data set includes:

[0106] (1) A clustering algorithm is used to classify each document in the access content dataset, and the classification accuracy of each document is determined based on the Euclidean distance from the document to the classification center to which the document belongs.

[0107] (2) For the word segmentation results of each document in the access content dataset, count all the high-frequency words of each document.

[0108] (3) Select a high-frequency word, calculate the frequency difference of the high-frequency word in documents of different categories, and the difference in the average distance between the high-frequency word and other high-frequency words in documents of different categories, and obtain the representation ability value of the high-frequency word.

[0109] It should be noted that when the frequency difference of a high-frequency word in documents of different categories is smaller, that is, it appears multiple times in documents of multiple categories, it means that the high-frequency word only appears frequently but cannot distinguish the categories of documents, so its representation ability is poor; when the difference in the average distance between a high-frequency word and other high-frequency words in documents of different categories is larger, it means that the high-frequency word is more prominent than other high-frequency words, and the more it can represent that the content of the document where the high-frequency word is located is different from others.

[0110] Optionally, in this embodiment, the average distance / frequency difference may be calculated using variance.

[0111] (4) Repeat step (3) and calculate the representation ability values ​​of all high-frequency words in turn.

[0112] (5) The criticality of high-frequency words is calculated based on the classification accuracy of each document and the representation ability value of the high-frequency words in the document.

[0113] (6) All high-frequency words in the same category of documents are sorted based on the key values ​​of the high-frequency words, multiple keywords of the category of documents are screened out according to the sorting results, and the multiple keywords are converted into multiple keyword vectors.

[0114] The keyword extraction method provided in this embodiment extracts keywords based on document categories. The more prominent the high-frequency words are in a category of documents, the more likely they are to be keywords for that category of documents. However, the premise of this division is whether the classification of the documents is accurate. If a document is at the edge of a category, it means that the classification boundary of the document is fuzzy, the features are not clear enough, and it has common features of documents of multiple categories. In this case, even if the representation ability of the high-frequency words extracted from the document is higher, it is difficult to represent the overall features of a category of documents, and it is far less representative than the high-frequency words in the documents at the classification center. Therefore, this embodiment uses the classification accuracy of each document and the representation ability value of the high-frequency words in the document as the basis for measuring the criticality of the high-frequency words.

[0115] This method continuously collects the terminal's past access information through the client software installed on the access terminal, and analyzes and evaluates whether the terminal is safe based on whether the terminal's access behavior is standardized and the correlation between past access and target data, effectively preventing the behavior of forging or stealing normal user identities to steal data.

[0116] Preferably, the generating access behavior evaluation data based on the historical behavior access data includes:

[0117] Obtain the historical access behavior data of all access users who have established data interaction channels with the business data end;

[0118] In some embodiments, the historical access behavior data may include the amount of data accessed, access time information, web page information browsed before and after sending the access request, and the like.

[0119] It should be understood that the access user who has established a data interaction channel with the business data end is the user who has accessed normally before.

[0120] Extracting feature words of any of the historical access behavior data, classifying the historical access behavior data according to the feature words and generating corresponding behavior tags to profile the access user;

[0121] Extract the common behavior tags of all access users who have established data interaction channels with the business data end;

[0122] Calculate the difference between the behavior label of the access user currently accessing the terminal and the shared behavior label;

[0123] Based on the difference and the authorization level of the current access terminal, access behavior evaluation data of the access user of the access terminal is generated.

[0124] After considering whether the access terminal of the legal user account is legal, this method also considers whether the user's access behavior is legal for the legal access terminal. Specifically, the normal access user is used as a template to analyze the access user of the current access terminal, and combined with the user's authorization level to determine whether the access exceeds the limit, so as to analyze the user's access behavior intention, and then accurately lock the illegal access behavior of the legal user.

[0125] Preferably, the trusted environment perception center collects access environment information in real time, including access terminal environment information, user change information, and network environment dynamic information;

[0126] The Trusted Environment Perception Center collects access terminal environment information in real time and dynamically, including terminal poisoning information, virus database update information, security baseline information, etc.

[0127] Secondly, trusted environment perception collects information related to changes in user accounts. For example, if an account is authenticated in different areas within a short time interval, it can be determined that the account has security risks.

[0128] Finally, the trusted environment perception center collects dynamic information about the network environment, which in some embodiments may include dynamic data on abnormal alarms of the business system network, dynamic data on vulnerability monitoring, and dynamic data on attack frequency.

[0129] The adjusting the access control policy comprises:

[0130] Based on the access environment information, the trusted environment perception center performs data modeling analysis to evaluate the possibility of access turbulence, and sends the evaluation results to the trusted console in real time;

[0131] The trusted console adjusts the access control policy according to preset evaluation result matching rules and dynamically intervenes in the interaction process.

[0132] The trusted console can match the local dynamic control policy rules based on the access environment results analyzed by the trusted environment perception center. Once the evaluation results trigger a dynamic control policy rule, the trusted console will issue a command to the trusted proxy gateway to intervene in access rights in real time. Intervention actions include forced secondary authentication, forced password modification, and disconnection of access connections.

[0133] It should be understood that based on the access environment information, the access permissions are finally given after judging from multiple dimensions such as user attributes, environment attributes, operation attributes, and object attributes. This controls the minimum set of services that the terminal can access, and terminals without permission cannot be connected at all, which effectively avoids the problem of lateral movement of east-west security risks after VPN access to the data center network.

[0134] Preferably, the dynamically updating the access trust value includes:

[0135] Extracting historical trust values ​​in a time sliding window based on a preset adjustment interval;

[0136] The time decay factor is calculated based on the access behavior data of the access terminal; in this embodiment, the time decay factor calculation formula is:

[0137]

[0138] Among them, θ(t) is the time decay factor, riskbehavior t Indicates the number of visits to turbulence within time t, behavior t Represents the total number of access behaviors within time t.

[0139] The trust value is updated according to the historical trust value and the time decay factor.

[0140] In this embodiment, the formula for updating the trust value is:

[0141]

[0142] Among them, T i (i=1,2,…,h) represents the historical trust value, and h is the number of times the time sliding window moves forward.

[0143] It can be understood that as the time interval t increases, the time decay parameter decreases, and at the same time, the weight of the historical trust value in the final trust value gradually decreases.

[0144] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0145] Based on the same inventive concept, the embodiment of the present application also provides an operating system for implementing the access control method involved above. The implementation scheme for solving the problem provided by the system is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more access control system embodiments based on zero trust architecture SPA technology provided below can refer to the limitations of the access control method based on zero trust architecture SPA technology above, and will not be repeated here.

[0146] like Figure 3 As shown, the present invention also provides an access control system based on zero trust architecture SPA technology, including:

[0147] An identity authentication module, used to accept a service access request sent by an access terminal, and the trusted console authenticates the access terminal;

[0148] A control policy formulation module, used to obtain the access control policy of the access terminal based on the access behavior data of the access terminal after the identity authentication of the access terminal is passed;

[0149] An interactive channel establishment module is used to establish a SPA single package authentication between the trusted console and the access terminal based on the access control policy, and the trusted proxy gateway calculates the access trust value according to the SPA authentication package to establish a data interactive channel;

[0150] The dynamic adjustment module is used for the trusted environment perception center to collect access environment information in real time, dynamically update the access trust value to adjust the access control policy, and control the data interaction process between the access terminal and the business data terminal.

[0151] It should be noted that: the access control system based on zero-trust architecture SPA technology provided in this embodiment is only illustrated by the division of the above-mentioned functional modules. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the system can be divided into different functional modules. Each functional module can be composed of a single execution unit, or it can be integrated into a functional module by two or more execution units to realize all the functions of the functional module.

[0152] An embodiment of the present invention provides an electronic device, including:

[0153] A memory for storing executable instructions;

[0154] The processor is used to implement the aforementioned access control method based on zero trust architecture SPA technology when running the executable instructions stored in the memory.

[0155] An embodiment of the present invention also provides a computer-readable storage medium storing executable instructions, which, when executed by a processor, implements the aforementioned access control method based on zero trust architecture SPA technology.

[0156] Those skilled in the art will appreciate that the above modules may be implemented in whole or in part by software, hardware, or a combination thereof. The above modules may be embedded in or independent of a processor in a computer device in the form of hardware, or may be stored in a memory in a computer device in the form of software, so that the processor may call and execute operations corresponding to the above modules.

[0157] The present invention is not limited to the above-mentioned specific implementation modes. Various changes made by ordinary technicians in this field based on the above-mentioned concepts without creative work are all within the protection scope of the present invention.

Claims

1. An access control method based on zero trust architecture SPA technology, the zero trust architecture comprising: Access terminal client, trusted console, trusted environment perception center, trusted proxy gateway, business data terminal, characterized in that the method comprises the following steps: S1, the trusted console accepts the service access request sent by the access terminal client and authenticates the access terminal; S2, after the identity authentication of the access terminal is passed, obtaining the access control policy of the access terminal based on the access behavior data of the access terminal; S3, based on the access control policy, the trusted console establishes SPA single package authentication with the access terminal, and the trusted proxy gateway calculates the access trust value according to the SPA authentication package to establish a data interaction channel; S4, the trusted environment perception center collects access environment information in real time, dynamically updates the access trust value to adjust the access control policy, and controls the data interaction process between the access terminal and the business data terminal.

2. The access control method based on zero trust architecture SPA technology according to claim 1 is characterized in that: The step S2 of acquiring the access control policy of the access terminal based on the access behavior data of the access terminal specifically includes: If the access terminal sends an access request for the first time, obtaining user attribute information and access behavior data of the access terminal to determine the authorization level of the access terminal, and allocating an access control policy to the access terminal based on the authorization level; If the access terminal is not sending an access request for the first time, historical access behavior data of the access user of the current access terminal is obtained, access behavior evaluation data is generated, and the current access control policy of the access terminal is formulated based on the access behavior evaluation data.

3. The access control method based on zero trust architecture SPA technology according to claim 2 is characterized in that: The obtaining of user attribute information and access behavior data of the access terminal to determine the authorization level of the access terminal includes: Acquire access traffic data and access behavior data of a preset time period before the current time of the access terminal, and perform structured processing on the access behavior data; The structured access behavior data is divided into risk information dataset and access content dataset based on text features; Mapping the access traffic data into an access scope to draw a trust circle; narrowing the trust circle based on the correlation between the risk information dataset, the access content dataset and the service access request; Mapping the trust circle to a behavior trust level according to a preset mapping rule, wherein the area of ​​the trust circle corresponds to the level of the behavior trust level; Extracting the access user attribute information of the access terminal, and searching the business system for the user level of the attribute information based on the access user identity information; The authorization level of the access terminal is obtained by combining the user level and the behavior trust level.

4. The access control method based on zero trust architecture SPA technology according to claim 3 is characterized in that: The narrowing of the trust circle based on the correlation between the risk information dataset, the access content dataset and the service access request is specifically: Acquire the risk rate of the access terminal according to the risk information data set; Based on the service access request sent by the access terminal, obtain the target service data of the access request, and extract the feature description word vector of the target service data; Segmenting the access content data set by a word segmenter to obtain a plurality of keywords, and converting the plurality of keywords into a plurality of keyword vectors; Calculating the similarity between the feature description word vector of the target business data and the keyword vector of the access content data set; The radius reduction coefficient of the trust circle is calculated based on the risk rate and similarity using the following formula: Among them, μ is the radius reduction coefficient, n is the amount of risk data of the access terminal within the preset time period, m is the total number of visits of the access terminal within the time period, ε is the similarity between the feature description word vector of the target business data and the keyword vector of the access content data set, and α and β are preset weighted weights.

5. The access control method based on zero trust architecture SPA technology according to claim 2 is characterized in that: The generating access behavior evaluation data based on the historical behavior access data includes: Obtain the historical access behavior data of all access users who have established data interaction channels with the business data end; Extracting feature words of any of the historical access behavior data, classifying the historical access behavior data according to the feature words and generating corresponding behavior tags to profile the access user; Extract the common behavior tags of all access users who have established data interaction channels with the business data end; Calculate the difference between the behavior label of the access user currently accessing the terminal and the shared behavior label; Based on the difference and the authorization level of the current access terminal, access behavior evaluation data of the access user of the access terminal is generated.

6. The access control method based on zero trust architecture SPA technology according to claim 1 is characterized in that: The trusted environment perception center collects access environment information in real time, including access terminal environment information, user change information, and network environment dynamic information; The adjusting the access control policy comprises: Based on the access environment information, the trusted environment perception center performs data modeling analysis to evaluate the possibility of access turbulence, and sends the evaluation results to the trusted console in real time; The trusted console adjusts the access control policy according to preset evaluation result matching rules and dynamically intervenes in the interaction process.

7. The access control method based on zero trust architecture SPA technology according to claim 6 is characterized in that: The dynamically updating the access trust value comprises: Extracting historical trust values ​​in a time sliding window based on a preset adjustment interval; Calculate the time decay factor based on the probability of access turbulence; The trust value is updated according to the historical trust value and the time decay factor.

8. An access control system based on zero trust architecture SPA technology, characterized in that: include: An identity authentication module, used to accept a service access request sent by an access terminal, and the trusted console authenticates the access terminal; A control policy formulation module, used to obtain the access control policy of the access terminal based on the access behavior data of the access terminal after the identity authentication of the access terminal is passed; An interactive channel establishment module is used to establish a SPA single package authentication between the trusted console and the access terminal based on the access control policy, and the trusted proxy gateway calculates the access trust value according to the SPA authentication package to establish a data interactive channel; The dynamic adjustment module is used for the trusted environment perception center to collect access environment information in real time, dynamically update the access trust value to adjust the access control policy, and control the data interaction process between the access terminal and the business data terminal.

9. An electronic device, characterized in that: The electronic device comprises: A memory for storing executable instructions; The processor is used to implement the access control method based on zero trust architecture SPA technology as described in any one of claims 1 to 7 when running the executable instructions stored in the memory.

10. A computer-readable storage medium storing executable instructions, characterized in that: When the executable instructions are executed by the processor, an access control method based on zero trust architecture SPA technology as described in any one of claims 1 to 7 is implemented.

Images