Single link transmission zero-trust continuous verification method for intelligent information system
By defining trust age and average trust age in an intelligent information system, we propose dual-objective optimization problems, and using weighted sum method and reinforced Q learning methods, we find the optimal trust verification solution, which solves the problem of excessive resource consumption of zero-trust continuous verification, and achieves efficient resource utilization and network performance improvement.
Patent Information
- Application Number
- CN202411882226.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-19
- Publication Date
- 2025-03-25
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
While achieving continuous zero-trust verification, how to efficiently utilize available resources to avoid network performance degradation caused by excessive resource consumption.
By defining trust age and average trust age, a dual-objective optimization problem is proposed, which maximizes throughput while minimizing the average trust age, uses weighted sum method to solve the optimization problem, and uses different methods in different service processes, including periodic verification and reinforcement Q learning, to find the optimal trust verification solution.
It achieves the minimization of average trust age while maximizing throughput, improves the transmission efficiency of continuous verification, and reduces the cost of zero-trust continuous verification.
Smart Images
Figure CN119697644A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of wireless communication security transmission, and relates to a single-link transmission zero-trust continuous verification method for an intelligent information system. Background Art
[0002] As the cornerstone of wireless networks, multiple security paradigms have developed and evolved over time, some of which have been cleverly embedded in various communication standards such as WiFi, NearLink, and 5G to ensure the security of various data transmissions, including enterprise services and personal privacy information, in the environment of the present invention. The traditional security paradigm advocates the entry point authentication principle, that is, once a user is authorized to enter the network, he will always be trusted throughout the network coverage until he exits. However, this paradigm has a potential crisis, that is, authorized users may be hijacked by malicious attackers, resulting in information leakage and illegal occupation of resources, which in turn leads to destructive consequences.
[0003] Zero trust is an emerging security assurance concept that is widely regarded as an effective alternative to traditional entry point verification mechanisms, as the latter face an increasingly severe trust crisis after a one-time initial verification. Zero trust emphasizes "never trust, always verify" and has great potential in improving the resilience of next-generation wireless communication networks. Zero trust networks assume that everything is always untrustworthy, even if you are already inside the network. Specifically, zero trust attempts to minimize the attack surface through three approaches: least privilege access, micro-segmentation, and continuous trust verification. The core concept of the zero trust concept is "trust but verify" to deal with potential threats such as internal attacks and eavesdropping brought about by the use of traditional trust verification principles. In the field of least privilege access, some scholars have proposed a mandatory verification method for each access request, even if the target is a federal partner in the military Internet of Things. In the field of micro-segmentation, some scholars have verified that the use of such measures can significantly improve the security performance of data center networks with low time cost. In the field of continuous verification, some scholars have proposed a continuous verification scheme based on channel state information for status update systems, in which one round of verification takes only 1.5 milliseconds. In addition, some literature discusses the significant delay introduced by data verification under the zero trust architecture in large networks. In addition, there is a lot of work devoted to fully realizing zero trust. Continuous trust verification in wireless networks often requires a certain amount of resources, such as time, spectrum, and energy, to verify the exchange of information. In the traditional one-time entry point verification principle, this resource consumption may sometimes be negligible.
[0004] However, in continuous trust verification, once the resources consumed reach a certain level, other regular network performance (such as transmission efficiency) may be affected due to the reduction in available resources. This is because the more frequent the verification, the more resources are consumed. Therefore, it is extremely challenging to efficiently utilize available resources while achieving zero trust, which also limits the security level that can be achieved by many applications (such as the Internet of Things). Sometimes, zero trust is achieved by verifying the identity of each interaction, but this can lead to huge costs and reduce the transmission efficiency of regular services.
[0005] Therefore, a verification method that can achieve zero-trust continuous verification while efficiently utilizing available resources is needed to solve the above technical problems. Summary of the invention
[0006] The technical solution adopted by the present invention to solve the technical problem is: a single-link transmission zero-trust continuous verification method for an intelligent information system, comprising the following steps:
[0007] Step 1: Define the average trust age △ as:
[0008]
[0009] In formula (4), T represents the duration of the concerned time period, and δ(t) represents the trust age;
[0010] Step 2: Express the throughput η as:
[0011]
[0012] In formula (5), represents the indicator function, μ(t) represents the instantaneous service rate;
[0013] Step 3: Propose a dual-objective optimization problem of maximizing throughput while minimizing the average trust age, denoted as P1:
[0014]
[0015] Step 4: Use the weighted sum method to solve the bi-objective optimization problem proposed in step 3 and transform P1 into P2, where P2 is:
[0016]
[0017] In formula (7), α represents the weighting factor associated with the trust age, α ≥ 0;
[0018] Step 5: Classify and solve to find the optimal trust verification solution; the classification includes three cases: a constant service process, a random service process with a known average service rate, and a random service process with a known instantaneous service rate.
[0019] Preferably, in step 1, the trust age δ(t) is expressed as:
[0020]
[0021] In formula (3), represents the indicator function, Indicates the verification of the receiver's identity in the tth time slot, Indicates normal data service.
[0022] Preferably, in step 1, the indicator function for:
[0023]
[0024] In formula (2), the indicator function Indicates whether authentication is in progress at the tth time slot.
[0025] Preferably, in step 5, for a constant service process, the optimal verification period is:
[0026]
[0027] In formula (8), and Represents the rounding up and rounding down operations respectively.
[0028] Preferably, in step 5, for a random service process with a known average service rate, the verification period of the optimal verification scheme is:
[0029] or
[0030] In formula (9), and Represents the rounding up and rounding down operations respectively.
[0031] Preferably, in step 5, for the random service process with known instantaneous service rate, a reinforced Q learning method is used to solve the problem; the core elements of reinforced Q learning include: environment space, action space, reward and value function;
[0032] Based on the above core elements, the optimal trust verification scheme is found according to the following steps: First: randomly generate a greedy probability ε between 0 and 1, and according to the "greedy strategy", select an arbitrary action or an action that maximizes the value function; second, update the trust age, calculate the reward, and update the value of the value function; after several iterations, update the greedy probability accordingly; third, enter the next time slot and repeat the above process; fourth, until the value function converges, the optimal trust verification scheme is obtained.
[0033] More preferably, for a random service process with a known instantaneous service rate, the environment space is:
[0034] S={s t |s t =(μ(t),δ(t-1))} (10)
[0035] In formula (10), s t is the environmental state at time slot t.
[0036] More preferably, for a random service process with a known instantaneous service rate, the action space is:
[0037]
[0038] In formula (11), a t Represents the selection action for time slot t.
[0039] More preferably, for a random service process with a known instantaneous service rate, the reward is:
[0040]
[0041] In formula (12), r(s t ,a t ) is the reward value.
[0042] More preferably, for a random service process with a known instantaneous service rate, the value function is:
[0043]
[0044] In formula (13), Q(s t ,a t ) is the value function, which also represents the long-term benefit of the current action, which is updated through the state transfer equation.
[0045] The beneficial effects of the present invention are:
[0046] The present invention promotes and applies the trust age and average trust age, designs an optimal solution for zero-trust continuous verification for single-link transmission with arbitrary service processes, verifies the effectiveness of the proposed solution through simulation, and demonstrates a reasonable trade-off between the average trust time and the system throughput, so that continuous verification can maximize throughput while minimizing the average trust age, thereby improving the transmission efficiency of continuous verification and reducing the cost of zero-trust continuous verification. BRIEF DESCRIPTION OF THE DRAWINGS
[0047] Figure 1 It is a schematic diagram of the AoT process of a single-link transmission zero-trust continuous verification method for an intelligent information system of the present invention;
[0048] Figure 2 It is the continuous trust verification diagram in the constant service process of the present invention; in the figure, μ(t)=7, α=1
[0049] Figure 3 It is the continuous trust verification diagram in the random service process of the present invention; in the figure, α=1
[0050] Figure 4 This is a performance comparison diagram of the solution proposed by the present invention for a constant service process; in the figure, μ(t)=7
[0051] Figure 5 It is a comparison diagram of the trade-off relationship between average AoT and throughput when the proposed solution is adopted in the present invention. DETAILED DESCRIPTION
[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the relevant technologies in the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0053] In modern wireless networks, the longer the time since the last trust verification, the higher the potential risk. The present invention proposes the concept of Age of Trust (AoT), which is defined as the time since the target user's trust was last verified plus an initial age, which depends on the trust assessed at the time of verification. Figure 1 The process of Age of Trust (AoT) is visualized in i represents the time of the i-th verification. The trust age AoT at time t is denoted as δ(t). Once the trust of the target user is verified, at the end of the verification, the trust age δ(t) will be updated to the initial age, denoted as δ i δ i Determined by the result of the trust evaluation, the higher the trust of the evaluation, the lower the initial age. If the target user is fully trusted, the initial age will be zero. In the interval between two adjacent verifications, δ(t) increases linearly with time. In order to evaluate the long-term AoT performance, the present invention defines the average trust age, denoted as △, which is defined as:
[0054]
[0055] Where T represents the duration of the time period of interest.
[0056] According to the definition of average AoT, the present invention studies the problem of zero-trust continuous verification in the process of single-link transmission in intelligent information systems, proposes a continuous trust verification method in the process of single-link transmission, and realizes the trade-off between average AoT and throughput in single-link transmission.
[0057] Consider a wireless transceiver system in which time is discretized into time slots of equal length, with t representing the time slot index, where t = 1, 2, 3... The service rate of the transmitter at the tth time slot is denoted by μ(t). Since the duration of a time slot is very short, it is assumed that the service rate is constant within a time slot, but it will change between different time slots. During data transmission, the identity of the receiver needs to be continuously verified to prevent man-in-the-middle attacks (MITM). The present invention adopts hardware fingerprint measures to verify the identity of the receiver, and the verification process will consume a time slot, during which the receiver transmits specific data to the sender for extracting the hardware fingerprint. While the verification process is in progress, the wireless channel is occupied and the regular data service from the transmitter to the receiver will be suspended. The present invention defines the indicator function Indicates whether authentication is in progress at the tth time slot, that is:
[0058]
[0059] in, Indicates the verification of the receiver's identity in the tth time slot, Indicates regular data service. Therefore, the trust age of the tth time slot is recorded as δ(t), which is expressed as:
[0060]
[0061] The average trust age △ is expressed as:
[0062]
[0063] In addition, the throughput is recorded as Indicator function And the function of the instantaneous service rate μ(t), namely:
[0064]
[0065] Formula (5) shows that if the identity is being verified, the service rate is zero. The goal of this invention is to find a verification scheme that can minimize the average age of trust (AoT) while maximizing the throughput. This is a bi-objective optimization (BOO) problem, denoted as P1, and is expressed as follows:
[0066]
[0067] In order to indicate the goal of minimizing AoT, a negative sign is added before the average AoT. Considering its easy implementation, the weighted sum method is used to solve the dual-objective optimization problem, transforming P1 into P2, and substituting equations (4) and (5) into the objective function to obtain:
[0068]
[0069] Where α≥0 is a weighting factor associated with AoT. Since the trust age process is a Markov process, P2 is a Markov decision process (MDP) problem. Next, the present invention will solve P2 for the constant service process and the random service process respectively.
[0070] Consider Figure 2 The constant service process shown in FIG. 1 is an example of a service rate of 7 and a weighting factor of 1. Since P2 is an MDP problem and the corresponding state is a deterministically changing instantaneous trust age, the optimal trust verification scheme must be periodic. The verification period is denoted as λ in the present invention. Figure 2 As shown in Figure 2, during the verification cycle, the trust age increases linearly and is updated to zero when the next cycle begins to verify. The shaded part of each time slot in the figure corresponds to The value of can be viewed as the instantaneous reward associated with the MDP problem. In particular, if Indicates that the decision to verify the identity in this time slot, the instantaneous reward is zero. The goal of P2 is to find a verification scheme that maximizes the long-term reward. This is equivalent to finding a verification cycle that maximizes the area of the shaded area at all times. For a constant service process, the optimal verification cycle can be found using a graphical method:
[0071] or
[0072] in and Represents the rounding up and rounding down operations respectively.
[0073] For the random service process, we consider two processes, one with known average service rate and one with known instantaneous service rate. The optimal verification scheme for the random service process with known average service rate is the same as that for the constant service process. The reason is that the instantaneous return in this case is in Represents the mathematical expectation. This is similar to the constant service process, in which the instantaneous return only changes with the instantaneous age of trust AoT, but has nothing to do with the instantaneous service rate because the present invention cannot capture it in time. The verification cycle of the optimal verification scheme in this case is:
[0074] or
[0075] For a random service process with a known instantaneous service rate, the present invention can further optimize the trust verification scheme. Figure 3 An example of a random service process and an AoT process is shown, where the weighting factor α = 1. In this example, the instantaneous reward is It is jointly determined by the instantaneous service rate and the instantaneous AoT. Unlike the constant process case, it is difficult to find the optimal verification solution using graphical methods in this case. As an alternative, since this is an MDP problem, the present invention will use the reinforcement Q learning method to solve this problem. Reinforcement Q learning includes four core elements, namely environment space, action space, reward and value function.
[0076] 1) Environment space: According to question P2, the observable environment states include the instantaneous service rate of the current time slot and the AoT of the previous time slot. Therefore, the environment space is given by:
[0077]
[0078] where s t is the environmental state at time slot t.
[0079] 2) Action space: The present invention can choose between two candidate actions, namely, performing verification or performing regular data transmission, which corresponds to the indicator function defined above Therefore, the action space It is expressed as:
[0080]
[0081] where a t Represents the selection action for time slot t.
[0082] 3) Reward: After selecting an action in the current environment state, you can get a reward to score the action. For P2, the reward value r(s t ,a t ) is defined as:
[0083]
[0084] 4) Value function: In Q-learning, the value function is expressed as Q(s t ,a t ), indicating the long-term reward, corresponding to the goal of the MDP problem, is obtained
[0085]
[0086] The value function also represents the long-term benefit of the current action, which is updated through the state transition equation, namely
[0087]
[0088] Here, γ is the discount factor.
[0089] Based on the above four preset mappings, the present invention searches for the optimal trust verification scheme according to the following steps. First, a greedy probability ε between 0 and 1 is randomly generated, and according to the "greedy strategy", an arbitrary action is selected or the Q function Q(s t ,a t ) is maximized. Then, AoT is updated, the reward is calculated, and the value of the Q function is updated. After several iterations, the greedy probability is updated accordingly. Then, the next time slot is entered and the above process is repeated. Until Q(s t ,a t ) converges, that is, the optimal trust verification scheme is obtained.
[0090] In order to verify the effectiveness of the proposed scheme, the performance of the proposed scheme for continuous trust verification in single-link transmission is evaluated through performance simulation.
[0091] Figure 4 The objective performance of the proposed Q-learning-based scheme and the periodic verification scheme in dealing with the P2 problem in the constant service process is demonstrated. It can be seen that both schemes can maximize the objective of the P2 problem. At the same time, as the average AoT weighting factor increases, the objective value gradually decreases. This is because as the weighting factor increases, more frequent verification is required, resulting in more consumption of time resources originally used for regular service transmission, thereby reducing throughput.
[0092] Figure 5 The trade-off between the average AoT and throughput of the proposed scheme is shown. Figure 4 It has been shown that both the proposed Q-learning-based scheme and the periodic verification scheme can achieve the same goal of the P2 problem. Figure 5 In the above figure, the average access latency and throughput show the same trade-off when using these two schemes.
[0093] In summary, the present invention designs an optimal solution for zero-trust continuous verification for single-link transmission with arbitrary service processes through the promotion and application of trust age and average trust age, verifies the effectiveness of the proposed solution through simulation, and demonstrates a reasonable trade-off relationship between the average trust time and the system throughput, so that continuous verification can maximize throughput while minimizing the average trust age, thereby improving the transmission efficiency of continuous verification and reducing the cost of zero-trust continuous verification.
[0094] It should be emphasized that the above are only preferred embodiments of the present invention and do not limit the present invention in any form. Any simple modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention are still within the scope of the technical solution of the present invention.
Claims
1. A single-link transmission zero-trust continuous verification method for intelligent information systems, characterized in that: The following steps are involved: Step 1: Define the average trust age △ as: In formula (4), T represents the duration of the concerned time period, and δ(t) represents the trust age; Step 2: Express the throughput η as: In formula (5), represents the indicator function, μ(t) represents the instantaneous service rate; Step 3: Propose a dual-objective optimization problem of maximizing throughput while minimizing the average trust age, denoted as P1: Step 4: Use the weighted sum method to solve the bi-objective optimization problem proposed in step 3, and transform P1 into problem P2, which is expressed as: In formula (7), α represents the weighting factor associated with the trust age, α ≥ 0; Step 5: Classify and solve to find the optimal trust verification solution; the classification includes three cases: a constant service process, a random service process with a known average service rate, and a random service process with a known instantaneous service rate.
2. According to claim 1, a single-link transmission zero-trust continuous verification method for intelligent information systems is characterized in that: In step 1, the trust age δ(t) is expressed as: In formula (3), represents the indicator function, Indicates the verification of the receiver's identity in the tth time slot, Indicates normal data service.
3. According to claim 2, a single-link transmission zero-trust continuous verification method for intelligent information systems is characterized in that: In step 1, the indicator function for: In formula (2), the indicator function Indicates whether authentication is in progress at the tth time slot.
4. According to claim 1, a single-link transmission zero-trust continuous verification method for intelligent information systems is characterized in that: In step 5, for the constant service process, the optimal verification period is: In formula (8), and Represents the rounding up and rounding down operations respectively.
5. According to claim 1, a single-link transmission zero-trust continuous verification method for intelligent information systems is characterized in that: In step 5, for the random service process with a known average service rate, the verification period of the optimal verification scheme is: In formula (9), and Represents the rounding up and rounding down operations respectively.
6. According to claim 1, a single-link transmission zero-trust continuous verification method for intelligent information systems is characterized in that: In step 5, the random service process with known instantaneous service rate is solved by using a reinforced Q learning method; the core elements of the reinforced Q learning include: environment space, action space, reward and value function; Based on the core elements, the optimal trust verification scheme is found according to the following steps: first: randomly generate a greedy probability ε between 0 and 1, and according to the "greedy strategy", select an arbitrary action or an action that maximizes the value function; second, update the trust age, calculate the reward, and update the value of the value function; after several iterations, update the greedy probability accordingly; third, enter the next time slot and repeat the above process; fourth, until the value function converges, the optimal trust verification scheme is obtained.
7. A single-link transmission zero-trust continuous verification method for intelligent information systems according to claim 6, characterized in that: For a random service process with a known instantaneous service rate, the environment space is: In formula (10), s t is the environmental state at time slot t.
8. A single-link transmission zero-trust continuous verification method for intelligent information systems according to claim 6, characterized in that: For a random service process with a known instantaneous service rate, the action space is: In formula (11), a t Represents the selection action for time slot t.
9. A single-link transmission zero-trust continuous verification method for intelligent information systems according to claim 6, characterized in that: For a random service process with a known instantaneous service rate, the reward is: In formula (12), r(s t ,a t ) is the reward value.
10. A single-link transmission zero-trust continuous verification method for intelligent information systems according to claim 6, characterized in that: For a random service process with a known instantaneous service rate, the value function is: In formula (13), Q(s t ,a t ) is the value function, which also represents the long-term benefit of the current action, which is updated through the state transfer equation.