Edge cloud dynamic access control method and system based on trust evaluation

Abstract

The invention discloses an edge cloud dynamic access control method and system based on trust evaluation, relates to the field of edge cloud computing, and is used for solving the problems of insufficient self-adaptability, difficulty in avoiding behavior contour counterfeiting and difficulty in manual marking in an edge cloud environment. According to the method, the anomaly detection models of different roles are constructed according to the historical access behavior data of the user, so that the current access behavior data of the user is evaluated; evaluating access environment data of the user by adopting an analytic hierarchy process; and performing security level judgment on the trust values evaluated twice, and adjusting the access permission of the user according to the trust value when the corresponding access strategy is not met. According to the method, the effects and influences of time, space, access behaviors and access environments in trust evaluation and access control are fully considered, compared with the prior art, the method has finer access control granularity and higher practicability and flexibility, and the adaptability, safety and accuracy of access control are improved through role isolation.

Description

Technical Field

[0001] The present invention relates to the field of edge cloud computing, and in particular to an edge cloud dynamic access control method and system based on trust evaluation. Background Art

[0002] User behavior in edge cloud computing application scenarios is random and diverse, and dynamic access control is required to provide continuous and effective supervision of user resource access.

[0003] At present, the mainstream edge cloud dynamic access control methods are divided into two categories: those based on the extension of the traditional access control model and those based on machine learning. Among them, the method based on the extension of the traditional access control model performs dynamic access control according to preset rules or trust indicators, which is not adaptive enough and has the problems of the traditional access control model itself, such as the role explosion problem of RBAC. The method based on machine learning performs dynamic access control by extracting the user behavior profile to determine whether the current access behavior is legal. There is a problem of profile forgery. For example, malicious users may deliberately control access behavior in the latent stage to pollute historical data, making the behavior profile itself inaccurate. In addition, due to the diversity and randomness of user behavior, some algorithms have the problem of difficulty in manual labeling in application. Summary of the invention

[0004] The purpose of the present invention is to provide an edge cloud dynamic access control method and system based on trust evaluation to address all or part of the above-mentioned problems, so as to overcome the problems of insufficient adaptability of existing dynamic access control technologies in edge cloud environments, difficulty in avoiding behavior profile forgery and difficulty in manual labeling.

[0005] The technical solution adopted by the present invention is as follows:

[0006] A trust evaluation-based edge cloud dynamic access control method, comprising:

[0007] S1. Perform trust evaluation on the user's current access behavior data and access environment data to obtain the user's access behavior trust value T(S) and access environment trust value T(E) respectively; for users of different roles, the current access behavior data of the users are trusted by the anomaly detection model under their respective roles;

[0008] S2. Determine whether the access behavior trust value T(S) and the access environment trust value T(E) meet the set access security requirements. If not, adjust the user's access rights to match the current access behavior trust value T(S) and the access environment trust value T(E) according to the set access control policy.

[0009] Furthermore, the method for constructing the anomaly detection model includes:

[0010] Get the user's historical access behavior data set;

[0011] Compare the historical access behavior data set with the established role set, divide it according to different roles, and obtain a subset of historical access behavior data for each role;

[0012] K-means clustering is performed on each preprocessed subset of historical access behavior data to obtain an anomaly detection model for each role.

[0013] Furthermore, the method for performing trust evaluation on the user's current access behavior data includes:

[0014] Using the anomaly detection model under the user's role, determine whether each access behavior in the user's current access behavior data is normal;

[0015] The ratio of the number of normal access behaviors to the number of all access behaviors is taken as the user's access behavior trust value T(S).

[0016] Furthermore, the analytic hierarchy process is used to conduct trust evaluation on the user's access environment data.

[0017] Furthermore, the method for performing trust evaluation on the user's access environment data includes:

[0018] Constructing an AHP evaluation index system, the AHP evaluation index system includes at least one first-level index, and each first-level index includes at least one second-level index;

[0019] Determine whether each secondary indicator in the user's access environment data meets the set security standard. If yes, set the secondary indicator to 1, otherwise set it to 0;

[0020] According to the weight of each first-level indicator and the weight of each second-level indicator in the first-level indicator, the weight of each second-level indicator in the AHP evaluation index system is calculated. Then, according to the value of each second-level indicator, the sub-trust value of each first-level indicator is weighted and obtained. The sub-trust values ​​of all first-level indicators are summed to obtain the trust value of the access environment.

[0021] The present invention also provides an edge cloud dynamic access control system based on trust evaluation, which includes a data acquisition module, a detection system construction module, an access behavior evaluation module, an access environment evaluation module and an access permission adjustment module; wherein:

[0022] The data collection module is configured to: collect user access behavior data and access environment data;

[0023] The detection system construction module is configured to: extract historical access behavior data of users and construct different anomaly detection models for different roles;

[0024] The access behavior evaluation module is configured to: extract the user's current access behavior data, perform trust evaluation on the user's current access behavior data using an anomaly detection model under the user's role, and obtain the user's access behavior trust value T(S);

[0025] The access environment evaluation module is configured to: extract the user's access environment data, perform trust evaluation on the access environment data, and obtain an access environment trust value T(E);

[0026] The access permission adjustment module is configured to: determine whether the access behavior trust value T(S) and the access environment trust value T(E) meet the set access security requirements; if not, adjust the user's access permissions to match the current access behavior trust value T(S) and the access environment trust value T(E) according to the set access control policy.

[0027] Furthermore, the detection system building module builds an anomaly detection model according to the following configuration:

[0028] Extract users’ historical access behavior data;

[0029] Compare the historical access behavior data set with the established role set, divide it according to different roles, and obtain a subset of historical access behavior data for each role;

[0030] K-means clustering is performed on each preprocessed subset of historical access behavior data to obtain an anomaly detection model for each role.

[0031] Furthermore, the access behavior evaluation module performs trust evaluation on the user's current access behavior data according to the following configuration:

[0032] Using the anomaly detection model under the user's role, determine whether each access behavior in the user's current access behavior data is normal;

[0033] The ratio of the number of normal access behaviors to the number of all access behaviors is taken as the user's access behavior trust value T(S).

[0034] Furthermore, the access environment evaluation module performs trust evaluation on the user's access environment data according to the configured analytic hierarchy process.

[0035] Furthermore, the access environment evaluation module performs trust evaluation on the user's access environment data according to the following configuration:

[0036] Receiving a configuration of an AHP evaluation index system, the AHP evaluation index system comprising at least one first-level index, each of which comprises at least one second-level index;

[0037] Determine whether each secondary indicator in the user's access environment data meets the set security standard. If yes, set the secondary indicator to 1, otherwise set it to 0;

[0038] According to the weight of each first-level indicator and the weight of each second-level indicator in the first-level indicator, the weight of each second-level indicator in the AHP evaluation index system is calculated. Then, according to the value of each second-level indicator, the sub-trust value of each first-level indicator is weighted and obtained. The sub-trust values ​​of all first-level indicators are summed to obtain the trust value of the access environment.

[0039] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0040] 1. The present invention designs a dual trust evaluation system for access behavior and access environment, fully considering the role and influence of time, space, access behavior and access environment in trust evaluation and access control. Compared with existing methods, it has finer access control granularity, higher practicality and flexibility.

[0041] 2. The present invention combines traditional methods with machine learning, evaluates user access behavior through the role-isolated K-means algorithm, effectively solves problems such as profile forgery and difficulty in manual marking, and has higher adaptability, security and accuracy than existing methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The present invention will now be described by way of example with reference to the accompanying drawings, in which:

[0043] Figure 1 This is a design schematic diagram of the edge cloud dynamic access control method based on trust assessment.

[0044] Figure 2 This is an execution flow chart of the edge cloud dynamic access control method based on trust evaluation.

[0045] Figure 3 It is a flow chart for accessing behavioral data credit assessment.

[0046] Figure 4 It is a flow chart for accessing environmental data credit assessment.

[0047] Figure 5 It is a schematic diagram of the AHP evaluation index system.

[0048] Figure 6 This is a diagram of the edge cloud dynamic access control system based on trust evaluation. DETAILED DESCRIPTION

[0049] All features disclosed in this specification, or steps in all methods or processes disclosed, except mutually exclusive features and / or steps, can be combined in any manner.

[0050] Any feature disclosed in this specification (including any additional claims and abstract), unless otherwise stated, may be replaced by other equivalent or alternative features having similar purposes. That is, unless otherwise stated, each feature is only an example of a series of equivalent or similar features.

[0051] The design concept of the present invention is as follows Figure 1 As shown, the user's credit is first evaluated to obtain a trust value, and then it is determined whether the trust value meets the access policy specified by the access security requirements. If it does not meet the requirements, the user's access policy is adjusted to match its trust value according to the set access control policy library.

[0052] To realize the above idea, the present invention constructs three evaluation systems to perform dynamic access control on edge cloud.

[0053] 1) Dual trust evaluation system.

[0054] By analyzing actual application needs, a dual trust evaluation system of "statistics based on time sliding" and "instant feedback required" is built to conduct trust evaluation on user access behavior data and access environment data. Among them, the user's access behavior is a series of random and diverse system access events, which need to be evaluated according to time periods, and its trust value is based on time sliding statistics. The user's access environment is relatively fixed, the evaluation criteria are relatively clear, and ensuring that the user's access environment is trustworthy is a prerequisite for user security access, and its trust value requires instant feedback. Through the dual trust evaluation system, a comprehensive and efficient evaluation of the user's access behavior and environment can be carried out, and dynamic access control can be implemented based on the evaluation results.

[0055] 2) K-means access behavior trust evaluation system based on role isolation.

[0056] By introducing the role concept of RBAC into the K-means clustering algorithm, users are divided, the same role is assigned to users with similar responsibilities or similar access behaviors, and behavioral profiles are extracted according to the roles to determine whether the user's access behavior is abnormal, calculate the trust value of the user's access behavior, and implement dynamic access control of users based on the evaluation results. Compared with traditional technologies, it has higher adaptability and fits the random and diverse access behaviors of edge cloud users. Compared with technologies that only use machine learning, it has higher security and accuracy. Users with the same role supervise each other, avoiding the risk of behavioral profile forgery. In addition, the unsupervised nature of K-means also solves the problem of difficult manual labeling.

[0057] 3) Access environment trust evaluation system based on AHP.

[0058] By setting detailed AHP trust indicators, establishing an AHP judgment matrix and solving indicator weights based on actual needs, the trust value of the user access environment is calculated, and dynamic access control of users is achieved based on the evaluation results. This has a finer control granularity than traditional technologies and provides a supplement to access control technology using machine learning. The evaluation indicators can be expanded and customized according to actual needs, and it has high practicality.

[0059] Example 1

[0060] This embodiment introduces a trust evaluation-based edge cloud dynamic access control method. Figure 2 As shown, the following steps are included:

[0061] S1. Perform trust evaluation on the user's current access behavior data and access environment data to obtain the user's access behavior trust value T(S) and access environment trust value T(E) respectively.

[0062] As mentioned above, the present invention adopts a dual trust evaluation system to perform trust evaluation on user access behavior data and access environment data respectively, and obtains the access behavior trust value T(S) (corresponding to the evaluation of access behavior data) and the access environment trust value T(E) (corresponding to the evaluation of access environment data).

[0063] For the trust evaluation of access behavior data, in this embodiment, a K-means access behavior trust evaluation system based on role isolation is adopted, that is, for users with different roles, the current access behavior data of the users is trusted by the anomaly detection model under their roles. The user's role can be determined through log files or by configuring the access period.

[0064] In some embodiments, Figure 3 As shown, the trust of the user's current access behavior data is evaluated by constructing anomaly detection models corresponding to different roles.

[0065] Methods for building anomaly detection models include:

[0066] Obtain the user's historical access behavior data set; compare the historical access behavior data set with the established role set, divide it according to different roles, and obtain the historical access behavior data subset for each role; perform K-means clustering on each pre-processed historical access behavior data subset to obtain an anomaly detection model under each role.

[0067] For example, methods for building anomaly detection models and using them to evaluate users' current access behavior data include:

[0068] 1) Obtain the user's historical access behavior data, with A representing the user's access behavior. The set of user's access behaviors within a certain observation period can be represented as S:

[0069] S= 1 ,A 2 ,...,A n >, A i =(t i ,s i ,o i ),

[0070] Where t represents time, s represents space, o represents operation, and n is the length of the access behavior set.

[0071] 2) Compare the established role sets and divide S according to the roles. The divided S can be expressed as:

[0072]

[0073] Among them, a and b represent two roles of users. It represents a subset of historical access behavior data.

[0074] 3) Preprocess the divided S and convert it into an integer or floating-point eigenvalue to form an access behavior matrix for building an anomaly detection model. For example, t is converted according to time period, s is converted according to workplace, and o is converted according to operation type. The conversion rules can be set according to actual needs.

[0075] 4) Perform K-means clustering on the historical access behavior data subset. The steps are as follows:

[0076] a. For each role’s historical access behavior data subset, randomly select k cluster centroids, then traverse all historical access behavior data (i.e., sample points) in the historical access behavior data subset, calculate the distance between the sample points and each cluster centroid, and assign them to the nearest cluster centroid.

[0077] b. Calculate the mean of sample points in each cluster and update the cluster centroid.

[0078] c. Repeat a and b until the centroid position of the cluster no longer changes.

[0079] d. Establish an anomaly detection model for access behaviors isolated at the role level.

[0080] 5) Using the anomaly detection model under the user's role, determine whether each access behavior in the user's current access behavior data is normal; the ratio of the number of normal access behaviors to the number of all access behaviors is used as the user's access behavior trust value T(S).

[0081] The calculation formula of T(S) is:​

[0082]

[0083] Where n represents the total number of access behaviors, and I(X) represents the indicator function of whether X is normal, that is:

[0084]

[0085] In some implementations, the trust evaluation of the user's access environment data is performed using the analytic hierarchy process (AHP).

[0086] Specifically, if Figure 4 As shown, the method for trust evaluation of user access environment data includes:

[0087] 1) Construct an AHP evaluation index system, which includes at least one first-level index, and each first-level index includes at least one second-level index.

[0088] For example, Figure 5 As shown, in this embodiment, the constructed AHP evaluation index system is divided into three first-level indicators: security measures, monitoring and auditing, and vulnerability and virus conditions. Among them, the security measures include four second-level indicators: anti-virus software update, firewall settings, data encryption measures, and port service settings. The monitoring and auditing includes four second-level indicators: log settings, traffic monitoring, system audit mechanism, and compliance report. The vulnerability and virus situation includes two second-level indicators: vulnerability statistics and virus statistics. Obviously, this is just an example of an evaluation index system, which can be changed according to actual needs.

[0089] 2) Determine whether each secondary indicator in the user's access environment data meets the set security standard. If yes, set the secondary indicator to 1, otherwise set it to 0.

[0090] For the access environment data collected, taking the indicator system constructed above as an example, set B = [B 1 ,B 2 ,B 3 ,B 4 ] is the data collected on safety measures, among which B 1 Represents the anti-virus software update status, B 2 Represents the firewall settings, B 3 Indicates the deployment of data encryption measures, B 4 Indicates the port service settings. Similarly, the monitoring audit status C=[C 1 ,C 2 ,C 3 ,C 4 ]、Vulnerability virus situation D=[D 1,D 2 ], where C 1 Represents the log settings, C 2 Represents the traffic monitoring situation, C 3 Represents the deployment of the system audit mechanism, C 4 Representative compliance report reflects the situation, D 1 Represents vulnerability statistics, D 2 Represents virus statistics.

[0091] The collected access environment data is converted into a form that supports matrix multiplication operations for the trust value calculation of the AHP algorithm. x , C y , D z ; x, y∈[1,4], z∈[1,2] are set to 1 if they meet the security standards, and 0 if they do not meet the security requirements. For example, if a high-risk vulnerability is found in the system, D 1 Set to 0, otherwise to 1; if a Trojan virus program is found in the system, D 2 Set to 0, otherwise set to 1.

[0092] 3) According to the weight of each first-level indicator and the weight of each second-level indicator in the first-level indicator, the weight of each second-level indicator in the AHP evaluation index system is calculated, and then according to the value of each second-level indicator, the sub-trust value of each first-level indicator is weighted to obtain the trust value of the access environment by summing up the sub-trust values ​​of all first-level indicators.

[0093] The calculation of weights is already part of the configuration of the AHP. The AHP is a systematic approach that combines qualitative and quantitative analysis. The method addresses complex decision problems by establishing a multi-level framework to simplify the decision-making process using limited data. It formalizes the decision-maker's thought process and provides a clear solution to complex decisions that involve multiple objectives, criteria, or are inherently ill-structured.

[0094] In the hierarchical analysis method, decision makers break down the problem into several components and organize them hierarchically according to the interrelationships and impact of these components, transforming complex decision problems into determining the relative importance weights of the underlying elements (such as decision plans, measures, etc.) relative to the top-level goals (such as overall goals), or arranging their relative order of merit.

[0095] Judgment matrix: compare the importance of the elements of the criterion layer to the target layer in pairs, and refer to the weight scale system table to express the importance relationship between the elements in the form of a matrix. The weight scale reference system is shown in Table 1:

[0096] Table 1 AHP ​​weight scale

[0097] Scale meaning 1 Equally important 3 Slightly important 5 Clearly important 7 Strongly important 9 Extremely important 2,4,6,8 The median of the two adjacent judgments above reciprocal If the scale of A to B is X, then the scale of B to A is 1 / X

[0098] Based on Table 1, we can construct the judgment matrix A=(a ij ) n×n , where n represents the order of the matrix, that is, the number of elements that constitute the judgment matrix. ij Indicates the importance relationship between elements, satisfying:

[0099] a ij >0;a ii =1;

[0100] The judgment matrix is ​​shown in Table 2:

[0101] Table 2 Judgment matrix example

[0102] A B C D E A 1 1 / 2 5 B 2 1 C 1 / 5 1 D 1 E 1

[0103] Calculate weights: solve the weights ω of each element in the judgment matrix i ω i The square root method is usually used for calculation. The specific calculation process is as follows:

[0104] Calculate the square root of the product of each row of the judgment matrix

[0105]

[0106] Will Standardize and get the corresponding weight ω i :

[0107]

[0108] Assume that the judgment matrix of the access environment is represented by Q A Since security measures, monitoring and auditing, and vulnerability and virus conditions are all important for the trust judgment of the access environment, they should have similar weights. 1 =A 2 =A 3 , Q A All elements of are set to 1, and we have:

[0109]

[0110] According to formula (1) and formula (2), the weight of each primary indicator can be solved respectively: the weight of safety measures ω A1 , weight of monitoring audit situationω A2 , weight of vulnerability virus situationω A3 .

[0111] Similarly, as an example, by analyzing each secondary indicator of the safety measures, assuming that its importance level B 1 =B 2 >B 3 =B 4 , we can get the judgment matrix Q of safety measures B (Example) is as follows:

[0112]

[0113] According to formula (1) and formula (2), the weights ω of the four secondary indicators under the safety measures can be solved respectively: B1 ,ω B2 ,ω B3 ,ω B4 , then the weight of the secondary indicator of each safety measure in the AHP evaluation index system is: ω A1 ω B1 ,ω A1 ω B2 ,ω A1 ω B3 ,ω A1 ω B4 The ranking vector J of each weight is recorded as the weight vector of the safety measure index:

[0114] J=(ω A1 ω B1 ,ω A1 ω B2 ,ω A1 ω B3 ,ω A1 ω B4 ).

[0115] Similarly, the importance of each secondary indicator in the case of monitoring audit is C 1 >C 2 >C 3 =C 4 , we can get the judgment matrix Q for monitoring audit situation C as follows:

[0116]

[0117] According to formula (1) and formula (2), the weight of each secondary indicator in the monitoring audit can be solved as follows: C1 ,ω C2 ,ω C3 ,ω C4 The weight ranking vector K of the safety measures is recorded as:

[0118] K=(ω A2 ω C1 ,ω A2 ω C2 ,ωA2 ω C3 ,ω A2 ω C4 ).

[0119] In the case of vulnerabilities and viruses, vulnerability statistics and virus statistics should have the same importance. 1 =D 2 , we can get the judgment matrix Q of the copper leakage virus situation D as follows:

[0120]

[0121] According to formula (1) and formula (2), the weights of each secondary index in the case of vulnerability virus can be solved: D1 ,ω D2 The weight ranking vector of the safety measures is recorded as:

[0122] L=(ω A3 ω D1 ,ω A3 ω D2 ).

[0123] The above steps respectively obtain the binary security measures B = [B 1 ,B 2 ,B 3 ,B 4 ]、Monitoring and auditing situation C=[C 1 ,C 2 ,C 3 ,C 4 ] and vulnerability virus situation D=[D 1 ,D 2 ], then according to the weights calculated above, the sub-trust value of each first-level indicator can be obtained by weighting:

[0124] T(E 1 )=J×B T , T(E 2 )=K×C T , T(E 3 )=L×D T .

[0125] The trust value of the access environment is obtained by summing up the sub-trust values ​​of all first-level indicators:

[0126] T(E)=T(E 1 )+T(E 2 )+T(E 3 ).

[0127] S2. Determine whether the access behavior trust value T(S) and the access environment trust value T(E) meet the set access security requirements. If not, adjust the user's access rights to match the current access behavior trust value T(S) and the access environment trust value T(E) according to the set access control policy.

[0128] Access security requirements are set based on actual conditions. Access security requirements include security requirements for access behavior and security requirements for the access environment.

[0129] For example, the access behavior trust value T(S) is divided into three levels: high, medium, and low. The comparison relationship between the trust value and the trust level is shown in Table 3.

[0130] Table 3 Access behavior trust level table

[0131] Behavior trust value T(S) Behavioral Trust Level [0.6,1.0] high [0.3,0.6) middle [0.0,0.3) Low

[0132] Among them, users with a high access behavior trust level have all their access rights. For users with a medium access behavior trust level, their exercisable permissions will be cut. For example, a user originally had access to sensitive data, but because the access behavior trust level is medium, the user's access will be restricted to ensure the security of important data. In addition, for users with a low access behavior trust level, the system will temporarily revoke all the user's access rights to prevent risks such as data leakage caused by user violations or malicious attacks.

[0133] As for the access environment trust value T(E), it is divided into two levels: trusted and untrusted. The relationship between the trust value and the trust level is shown in Table 4.

[0134] Table 4 Access environment trust level table

[0135] Environmental trust value T(E) Environmental Trust Level [0.5,1.0] Trustworthy [0.0,0.5) Untrustworthy

[0136] When the access environment trust level is trusted, the user can exercise all personal permissions. When the access environment trust level is untrusted, the user's access environment is considered to be insufficiently secure, and the system will temporarily freeze all the user's access permissions to prevent risks such as data leakage and malicious tampering.

[0137] Example 2

[0138] This embodiment introduces an edge cloud dynamic access control system based on trust evaluation. Figure 6 As shown, the system includes a data acquisition module, a detection system construction module, an access behavior evaluation module, an access environment evaluation module and an access permission adjustment module; wherein:

[0139] The data collection module is configured to collect user access behavior data and access environment data. The user's access behavior data here includes historical access behavior data and current access behavior data, wherein the historical access behavior data is used to build an anomaly detection model, and the current access behavior data is used as an evaluation object to dynamically adjust the use of permissions.

[0140] The detection system construction module is configured to extract the historical access behavior data of users and construct different anomaly detection models for different roles. The relevant algorithms configured for the construction of anomaly detection models can be found in Example 1, and will not be described in detail here.

[0141] The access behavior evaluation module is configured to extract the user's current access behavior data, perform trust evaluation on the user's current access behavior data using the anomaly detection model under the user's role, and obtain the user's access behavior trust value T(S). The configuration algorithm for trust evaluation using the anomaly detection model and the algorithm for calculating the access behavior trust value T(S) configuration can also be found in Example 1, and will not be described in detail here.

[0142] The access environment evaluation module is configured to extract the user's access environment data, perform trust evaluation on the access environment data, and obtain the access environment trust value T(E). The access environment data can be trusted using the hierarchical analysis method. The specific configuration of the evaluation algorithm can be found in Example 1, which will not be described in detail here.

[0143] The access permission adjustment module is configured to: determine whether the access behavior trust value T(S) and the access environment trust value T(E) meet the set access security requirements. If not, adjust the user's access permissions to match the current access behavior trust value T(S) and the access environment trust value T(E) according to the set access control policy. For the judgment of whether the access behavior trust value T(S) and the access environment trust value T(E) meet the access security requirements, and the understanding of the adjustment of the corresponding permissions, please refer to the example in Example 1. Obviously, the judgment criteria and adjustment strategies can be configured accordingly according to actual needs. The examples in the embodiments are only for the convenience of understanding the solution.

[0144] The present invention is not limited to the above-mentioned specific embodiments, but extends to any new features or any new combination disclosed in this specification, as well as any new method or process steps or any new combination disclosed.

Claims

1. A trust evaluation-based edge cloud dynamic access control method, characterized in that: include: S1. Perform trust evaluation on the user's current access behavior data and access environment data to obtain the user's access behavior trust value T(S) and access environment trust value T(E) respectively; for users of different roles, the current access behavior data of the users are trusted by the anomaly detection model under their respective roles; S2. Determine whether the access behavior trust value T(S) and the access environment trust value T(E) meet the set access security requirements. If not, adjust the user's access rights to match the current access behavior trust value T(S) and the access environment trust value T(E) according to the set access control policy.

2. The edge cloud dynamic access control method based on trust evaluation according to claim 1, characterized in that: The method for constructing the anomaly detection model includes: Get the user's historical access behavior data set; Compare the historical access behavior data set with the established role set, divide it according to different roles, and obtain a subset of historical access behavior data for each role; K-means clustering is performed on each preprocessed subset of historical access behavior data to obtain an anomaly detection model for each role.

3. The edge cloud dynamic access control method based on trust evaluation as claimed in claim 2, characterized in that: Methods for trust evaluation of the user's current access behavior data include: Using the anomaly detection model under the user's role, determine whether each access behavior in the user's current access behavior data is normal; The ratio of the number of normal access behaviors to the number of all access behaviors is taken as the user's access behavior trust value T(S).

4. The edge cloud dynamic access control method based on trust evaluation as claimed in claim 1, characterized in that: The analytic hierarchy process is used to conduct trust evaluation on the user's access environment data.

5. The edge cloud dynamic access control method based on trust evaluation as claimed in claim 4, characterized in that: Methods for trust evaluation of user access environment data include: Constructing an AHP evaluation index system, the AHP evaluation index system includes at least one first-level index, and each first-level index includes at least one second-level index; Determine whether each secondary indicator in the user's access environment data meets the set security standard. If yes, set the secondary indicator to 1, otherwise set it to 0; According to the weight of each first-level indicator and the weight of each second-level indicator in the first-level indicator, the weight of each second-level indicator in the AHP evaluation index system is calculated. Then, according to the value of each second-level indicator, the sub-trust value of each first-level indicator is weighted and obtained. The sub-trust values ​​of all first-level indicators are summed to obtain the trust value of the access environment.

6. An edge cloud dynamic access control system based on trust evaluation, characterized in that: It includes data collection module, detection system construction module, access behavior evaluation module, access environment evaluation module and access permission adjustment module; among which: The data collection module is configured to: collect user access behavior data and access environment data; The detection system construction module is configured to: extract historical access behavior data of users and construct different anomaly detection models for different roles; The access behavior evaluation module is configured to: extract the user's current access behavior data, perform trust evaluation on the user's current access behavior data using an anomaly detection model under the user's role, and obtain the user's access behavior trust value T(S); The access environment evaluation module is configured to: extract the user's access environment data, perform trust evaluation on the access environment data, and obtain an access environment trust value T(E); The access permission adjustment module is configured to: determine whether the access behavior trust value T(S) and the access environment trust value T(E) meet the set access security requirements; if not, adjust the user's access permissions to match the current access behavior trust value T(S) and the access environment trust value T(E) according to the set access control policy.

7. The edge cloud dynamic access control system based on trust evaluation as claimed in claim 6, characterized in that: The detection system building module builds an anomaly detection model according to the following configuration: Extract users’ historical access behavior data; Compare the historical access behavior data set with the established role set, divide it according to different roles, and obtain a subset of historical access behavior data for each role; K-means clustering is performed on each preprocessed subset of historical access behavior data to obtain an anomaly detection model for each role.

8. The edge cloud dynamic access control system based on trust evaluation as claimed in claim 7, characterized in that: The access behavior evaluation module performs trust evaluation on the user's current access behavior data according to the following configuration: Using the anomaly detection model under the user's role, determine whether each access behavior in the user's current access behavior data is normal; The ratio of the number of normal access behaviors to the number of all access behaviors is taken as the user's access behavior trust value T(S).

9. The edge cloud dynamic access control system based on trust evaluation as claimed in claim 6, characterized in that: The access environment evaluation module performs trust evaluation on the user's access environment data according to the configured hierarchical analysis method.

10. The edge cloud dynamic access control system based on trust evaluation as claimed in claim 9, characterized in that: The access environment evaluation module performs trust evaluation on the user's access environment data according to the following configuration: Receiving a configuration of an AHP evaluation index system, the AHP evaluation index system comprising at least one first-level index, each of which comprises at least one second-level index; Determine whether each secondary indicator in the user's access environment data meets the set security standard. If yes, set the secondary indicator to 1, otherwise set it to 0; According to the weight of each first-level indicator and the weight of each second-level indicator in the first-level indicator, the weight of each second-level indicator in the AHP evaluation index system is calculated. Then, according to the value of each second-level indicator, the sub-trust value of each first-level indicator is weighted and obtained. The sub-trust values ​​of all first-level indicators are summed to obtain the trust value of the access environment.

Images