Terminal access permission analysis method and system based on zero-trust ABAC model

Abstract

The application discloses a terminal access permission analysis method and system based on a zero-trust ABAC model, and the method comprises the following steps: a user terminal sends a resource access request; a policy enforcement point (PEP) receives the resource access request sent by the user terminal; according to a preset collection requirement, multi-dimensional attributes are extracted from the user request, the user request is converted into an attribute request, and the attribute request is sent to a policy decision point (PDP); the attributes comprise user attributes, environment attributes, operation attributes and object attributes; the PDP performs access permission analysis by using a policy administration point (PAP) based on the attribute request, obtains an access permission analysis result, and feeds back the access permission analysis result to the PEP; the information fed back by the PDP to the PEP comprises permission, rejection, inapplicability and unknown; and the PEP executes the resource access request according to the feedback information received from the PDP. The application is based on a zero-trust technical framework, and fine management of permissions is realized by ABAC, so that the changing business requirements and security challenges can be effectively coped with.

Description

Technical Field

[0001] This invention relates to the field of access permission analysis technology, and specifically to a terminal access permission analysis method and system based on a zero-trust ABAC model. Background Technology

[0002] The various operations of a power company are always at the core of security assurance, and the security and stability of these operations require the support of various security protection technologies. However, because external business operations, such as website systems, are directly exposed to the internet, while this facilitates use by ordinary business users, it also brings many security risks. The existing security access control for the power company's operations is inadequate, lacking dynamic access control and authorization, resulting in high security risks for the company's power business. Summary of the Invention

[0003] To address the problems existing in the prior art, this invention provides a terminal access permission analysis method and system based on a zero-trust ABAC model. The technical solution is as follows:

[0004] Firstly, a terminal access permission analysis method based on the zero-trust ABAC model is provided, which includes the following steps:

[0005] The user terminal sends a resource access request;

[0006] The policy execution point (PEP) receives resource access requests sent by user terminals; based on the user requests and according to preset collection requirements, it extracts multi-dimensional attributes from the user requests, converts the user requests into attribute requests, and sends them to the policy decision point (PDP); the attributes include user attributes, environment attributes, operation attributes, and object attributes.

[0007] PDP performs access permission analysis based on attribute requests using the Policy Management Point (PAP), obtains the access permission analysis results, and feeds the access permission analysis results back to PEP. The information that PDP feeds back to PEP includes allow, deny, not applicable, and unknown.

[0008] The PEP executes the request to allow or deny the resource access based on the feedback information received from the PDP.

[0009] In some implementations, the step of extracting multi-dimensional attributes from a user request according to preset collection requirements includes:

[0010] Extract keywords based on the current resource access request;

[0011] Perform part-of-speech analysis and attribute type classification on keywords;

[0012] For user access requests, multi-dimensional attributes are extracted according to a preset attribute path; the extraction of multi-dimensional attributes according to user access requests includes:

[0013] Based on user access requests, after word embedding, a multi-head self-attention mechanism is used to capture the dependencies between words at different positions in the access request. The multi-head attention results are then transmitted to a decoding network via a feedforward neural network for decoding to obtain the descriptive features of the user access request.

[0014] Based on the descriptive features of the user access request, a corresponding preset attribute path is matched, and multi-dimensional attributes in the user access request are extracted according to the matched preset attribute path.

[0015] In some implementations, the use of Policy Management Points (PAPs) for access control analysis includes:

[0016] Obtain multi-dimensional attribute data of user access requests, input them into a preset access permission policy reasoning model for analysis, and obtain the user access permission analysis results;

[0017] The preset access permission policy reasoning model includes: an input module, a data logic module, an access permission policy module, and a reasoning module. The reasoning module combines the data logically processed by the data logic module with the access permission policy module based on the multi-dimensional attribute data of the user access request to perform access permission reasoning.

[0018] In some implementations, the policy management point (PAP) is pre-designed with an attribute access control policy. The generation process of the attribute access control policy includes determining the order of different attributes in the attribute access control policy based on a combination of the importance of different attributes and the data distribution complexity of different attributes.

[0019] In some implementations, methods for obtaining the data distribution complexity of different attributes include:

[0020] Based on historical access data, multi-dimensional attributes and access request execution status are extracted from the access requests of each access record and used as training samples.

[0021] Based on historical data, the range of attribute values ​​corresponding to the same attribute is obtained, and the data distribution complexity of the attribute is determined according to the range of attribute values. The complexity is determined based on the number of attribute values ​​and whether the boundaries between different values ​​are clear.

[0022] In some implementations, methods for determining the importance of different attributes include:

[0023] The multi-dimensional attributes contained in different access requests are denoted as an access request attribute set; the set includes attributes and their corresponding attribute values;

[0024] Calculate the similarity of different access request attribute sets and the difference in access request execution for the corresponding different access requests;

[0025] The importance of an attribute is determined by comparing the similarity between different sets of access request attributes with the differences in the execution of the corresponding access requests.

[0026] In some implementations, determining the importance of an attribute based on the similarity between different sets of access request attributes and the difference in the execution of corresponding different access requests includes:

[0027] Based on historical access data, an attribute access control analysis model is trained to output a binary classification result of whether access is allowed, based on multi-dimensional attributes in the access request as input. The output result includes a probability value of allowing access and a probability value of disallowing access. When the probability value of allowing access is greater than the probability value of disallowing access, the result of allowing access is output; otherwise, the result of disallowing access is output.

[0028] Based on different sets of access request attributes, the attribute access control analysis model is used to obtain the execution result of the access request target;

[0029] Select at least one attribute from all attributes as an attribute combination, and sort the different attribute combinations in descending order of the number of attributes in the combination;

[0030] Based on the order of the attribute combinations, starting from the first attribute combination, for different access request attribute sets, multiple access request attribute sets with the same attribute values ​​in the attribute combination are grouped into one set; for the second attribute combination, multiple access request attribute sets with the same attribute values ​​in the attribute combination are grouped into another set, wherein the access request attribute set obtained based on the second attribute combination belongs to the set obtained based on the first attribute combination, or the access request attribute set obtained based on the second attribute combination does not belong to the set obtained based on the first attribute combination;

[0031] For multiple access request attribute sets in a class of data, one access request attribute set and its corresponding access request target execution result are used as reference data, and the remaining access request attribute sets and their corresponding access request target execution results are used as auxiliary data. Based on the difference between the access request attribute sets in the reference data and the access request attribute sets in the auxiliary data, and the difference between the access request target execution results corresponding to the access request attribute sets in the reference data and the access request target execution results corresponding to the access request attribute sets in the auxiliary data, the importance of different dimensions of attributes to the access request target execution results is linearly fitted.

[0032] In some implementations, after the PDP performs access permission analysis based on the attribute request using the Policy Management Point (PAP), it further includes: determining whether to allow the resource access request based on the stability of the user access environment and the security of the user access behavior; if allowed, then determining that the resource access request is permitted.

[0033] In some implementations, the method for obtaining the stability of the user access environment includes:

[0034] Obtain multi-dimensional attribute information of the access environment from the user's historical access requests;

[0035] The stability of the environmental attribute value is determined based on the temporal distribution of different attribute values ​​of the same environmental attribute. The stability of the environmental attribute value is determined based on the diversity of the attribute value, the frequency of occurrence of different attribute values, and the number of times the same attribute value appears consecutively within a preset sliding time window that is greater than a preset value. In particular, the greater the diversity of the attribute value, the smaller the stability; the greater the frequency of occurrence of different attribute values, the greater the stability; and the greater the number of times the same attribute value appears consecutively within a preset sliding time window that is greater than a preset value, the greater the stability.

[0036] The stability of the user access environment is determined by fusing the attribute value stability results of different environmental attributes based on the contribution of different environmental attributes to the stability of the user access environment.

[0037] In some implementations, the method for obtaining the security level of user access behavior includes:

[0038] Based on users' historical access behavior, the temporal characteristics of illegal connections, attempts to exceed permissions, and failed connections are obtained. The temporal characteristics include the frequency of occurrence of the behavior, the frequency of occurrence of the behavior, and the distribution characteristics of the time of occurrence of the behavior.

[0039] Based on the fusion analysis of the temporal characteristics of illegal user connections, attempted privilege escalation, and failed user connections, the relationship between these temporal characteristics and the security level of user access behavior is obtained through nonlinear or linear fitting. The nonlinear fitting includes a fitting model obtained by training a neural network model with samples, while the linear fitting includes configuring corresponding importance coefficients based on the importance of different temporal characteristics and performing linear fitting based on an importance system. The linear fitting also includes the importance of the temporal characteristics of illegal user connections, attempted privilege escalation, and failed user connections based on the time difference between the occurrence time of these behaviors and the current time.

[0040] Secondly, a terminal access permission analysis system based on the zero-trust ABAC model is provided, which includes:

[0041] The access request acquisition unit is used to acquire resource access requests sent by user terminals;

[0042] A multi-dimensional attribute extraction unit is used to receive resource access requests sent by user terminals through the policy execution point (PEP); based on the user request and according to preset collection requirements, extract multi-dimensional attributes from the user request, convert the user request into an attribute request, and send it to the policy decision point (PDP); the attributes include user attributes, environment attributes, operation attributes, and object attributes;

[0043] The access permission analysis unit is used to perform access permission analysis based on attribute requests using the policy management point (PAP) through the PDP, obtain the access permission analysis results, and feed the access permission analysis results back to the PEP. The information fed back by the PDP to the PEP includes allow, deny, not applicable, and unknown.

[0044] The access request execution unit is used to execute the resource access request to allow or deny the resource access based on the feedback information received from the PDP via the PEP.

[0045] This invention provides a terminal access permission analysis method and system based on a zero-trust ABAC model, which offers the following advantages: Based on the zero-trust technical framework, it addresses the security protection issues of various external businesses of power companies, focuses on the key threats to user access control in business security protection, and solves practical business security problems using the zero-trust concept. Through the terminal access permission analysis method based on the zero-trust ABAC model provided in the application embodiments, it prevents illegal activities by legitimate users and achieves zero-trust full-lifecycle security control for all business operations. ABAC enables fine-grained management of permissions, effectively responding to constantly changing business needs and security challenges. Attached Figure Description

[0046] Figure 1This is a flowchart illustrating the terminal access permission analysis method based on the zero-trust ABAC model in the embodiments of this application;

[0047] Figure 2 This is a flowchart illustrating the method for obtaining the importance of different attributes in embodiments of this application;

[0048] Figure 3 This is a flowchart illustrating the method for obtaining the stability of the user access environment in an embodiment of this application;

[0049] Figure 4 This is a schematic diagram of the terminal access permission analysis system based on the zero-trust ABAC model in the embodiments of this application. Detailed Implementation

[0050] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0051] This application provides a terminal access permission analysis method based on a zero-trust ABAC model, which includes the following steps:

[0052] Step 1: The user terminal sends a resource access request;

[0053] Step 2: The policy execution point (PEP) receives a resource access request sent by the user terminal; based on the user request and according to preset collection requirements, it extracts multi-dimensional attributes from the user request, converts the user request into an attribute request, and sends it to the policy decision point (PDP); the attributes include user attributes, environment attributes, operation attributes, and object attributes.

[0054] Step 3: The PDP performs access permission analysis based on the attribute request using the Policy Management Point (PAP), obtains the access permission analysis results, and feeds the access permission analysis results back to the PEP. The information fed back by the PDP to the PEP includes allow, deny, not applicable, and unknown.

[0055] Step 4: PEP executes the request to allow or deny the resource access based on the feedback information received from PDP.

[0056] This application embodiment is based on a zero-trust technical framework, focusing on the security protection issues of various external businesses of power companies. It addresses key threats to user access control in business security protection, using the zero-trust concept to solve practical business security problems. Through the terminal access permission analysis method based on the zero-trust ABAC model provided in this application embodiment, it prevents illegal behavior by legitimate users and achieves zero-trust full business lifecycle security control. ABAC enables fine-grained management of permissions, precisely specifying who can access which resources under specific conditions. Based on adaptability and fine-grained control, it effectively responds to constantly changing business needs and security challenges. Environmental attributes include location information, operating system version, and time information; operation attributes include read, write, delete, and modify; and object attributes are the attribute information of the accessed resources.

[0057] In one implementation, step 2 above, which involves extracting multi-dimensional attributes from a user request according to preset collection requirements, includes the following steps:

[0058] Step 21: Extract keywords based on the current resource access request;

[0059] Step 22: Perform part-of-speech analysis and attribute type classification on the keywords, where attribute types include user attributes, environment attributes, operation attributes, and object attributes;

[0060] Step 23: For user access requests, extract multi-dimensional attributes according to preset attribute paths; the extraction of multi-dimensional attributes for user access requests according to preset attribute paths includes:

[0061] Step 231: Based on the user access request, after word embedding, a multi-head self-attention mechanism is used to capture the dependency relationship of words at different positions in the access request. The multi-head attention result is transmitted to the decoding network through a feedforward neural network for decoding to obtain the descriptive features of the user access request.

[0062] Step 232: Based on the descriptive features of the user access request, match the corresponding preset attribute path, and extract the multi-dimensional attributes in the user access request according to the matched preset attribute path.

[0063] In this embodiment, when extracting attributes from user access requests, the method of extracting attributes word by word is not adopted. Instead, attributes are extracted according to a preset attribute path adapted to the semantics and type of the access request. This ensures ordered extraction and allows the preset attribute path to be set sequentially based on attributes such as importance and complexity. This makes the attribute data extracted from user access requests easier to analyze in subsequent access permission policy matching. It can be understood that the greater the attribute complexity, the later it is extracted, thus increasing the probability that access permission policy matching analysis can be completed with simpler attribute data. Conversely, the greater the attribute importance, the greater its influence on the results during access permission policy matching analysis.

[0064] In this embodiment, the user access request is analyzed by encoding and decoding to determine the type and semantic features of the access request, i.e., the descriptive features of the user access request. Based on these descriptive features, a corresponding preset attribute path is further adapted. User access requests with different descriptive features have different preset attribute paths when extracting attributes. It can be understood that different user access requests may have different user attributes, different environments, and different resource attributes, which may lead to different attributes being prioritized or different attributes having different importance in access permission policy analysis.

[0065] In one implementation, step 3 above, which uses the Policy Management Point (PAP) to perform access permission analysis, includes the following steps:

[0066] Step 31: Obtain multi-dimensional attribute data of user access requests, input them into a preset access permission policy reasoning model for analysis, and obtain the user access permission analysis results;

[0067] The preset access permission policy reasoning model includes: an input module, a data logic module, an access permission policy module, and a reasoning module. The reasoning module combines the data logically processed by the data logic module based on the multi-dimensional attribute data of the user access request with the access permission policy module to perform access permission reasoning.

[0068] In this embodiment, the multi-dimensional attribute data of the user access request is processed by data logic to obtain the attribute data logic expression data corresponding to the user access request. It can be understood that the data logic module is mainly for numerical data, but text attribute values ​​can also be processed by logic. The text attribute values ​​are converted into numerical data by logic processing. For numerical data, logic processing can be performed by the range to which the data belongs, whether it is greater than a preset value, whether it is less than a preset value, etc.

[0069] Based on the user access request attribute data after data logical processing, a matching analysis is performed with the access permission policies pre-stored in the access permission policy module to obtain the access permission reasoning result of the user access request.

[0070] In one implementation, the policy management point (PAP) in step 3 above is pre-designed with an attribute access control policy. The generation process of the attribute access control policy includes: determining the order of different attributes in the attribute access control policy based on a combination of the importance of different attributes and the data distribution complexity of different attributes.

[0071] In this embodiment, the order of different attributes in the attribute access control policy is determined by combining the importance of different attributes with the data distribution complexity of different attributes. Specifically, when analyzing whether access permissions are granted based on multi-dimensional attribute data of a real-time access request using the attribute access control policy, the multi-dimensional attributes of the real-time access request are matched sequentially with the attributes in the attribute access control policy to determine the appropriate attribute access control policy. This order of consideration is based on a combination of the importance of different attributes and the data distribution complexity of different attributes.

[0072] In one implementation, the method for obtaining the data distribution complexity of different attributes during the generation of the above-mentioned attribute access control policy includes:

[0073] Step 301: Based on historical access data, extract multi-dimensional attributes and access request execution status from the access request of each access record as training samples;

[0074] Step 302: Based on historical data, obtain the range of attribute values ​​corresponding to the same attribute. Determine the data distribution complexity of the attribute based on the range of attribute values. The complexity is determined based on the number of attribute values ​​and whether the boundaries between different values ​​are clear. The more attribute values ​​there are, the greater the data distribution complexity. However, if the original range of attribute values ​​is large, but the number of logically expressed values ​​after logical processing to correspond with the access permission policy module is small, the data distribution complexity will be high. Whether the boundaries between different values ​​are clear is also important. For example, after the attribute values ​​of some attributes are converted into logical expressions, multiple logical expressions may have inclusion relationships, intersection relationships, etc., meaning the boundaries between different values ​​are not clear.

[0075] In one implementation, the method for obtaining the importance of different attributes during the generation of the above-mentioned attribute access control policy includes:

[0076] Step 303: Record the multi-dimensional attributes contained in different access requests as an access request attribute set; the set includes attributes and corresponding attribute values;

[0077] Step 304: Calculate the similarity of different access request attribute sets and the difference in the execution of access requests for the corresponding different access requests;

[0078] Step 305: Determine the importance of attributes based on the similarity between different sets of access request attributes and the differences in the execution of access requests for the corresponding different access requests.

[0079] In this embodiment, the importance of an attribute is determined by considering the similarity between different sets of access request attributes and the differences in the execution of corresponding different access requests. For example, in one scenario, if the number of identical attribute values ​​in multiple sets of access request attributes exceeds a first preset value, and the differences in the execution of corresponding different access requests exceed a second preset value, then the attribute with different values ​​in the multiple sets of access request attributes can be determined as an important attribute. Further, for example, if there is only one attribute with different values ​​in multiple sets of access request attributes, and the differences in the execution of corresponding different access requests are determined by this attribute with different values, then this attribute with different values ​​is an important attribute. Conversely, if the number of identical attribute values ​​in multiple sets of access request attributes exceeds a first preset value, and the differences in the execution of corresponding different access requests are less than a third preset value, then the attribute with different values ​​in the multiple sets of access request attributes can be determined as an unimportant attribute.

[0080] In one implementation, step 313 above, determining the importance of an attribute based on the similarity between different sets of access request attributes and the difference in the execution of corresponding different access requests, includes:

[0081] Step 3051: Based on historical access data, train an attribute access control analysis model to output a binary classification result of whether access is allowed based on the multi-dimensional attributes in the access request as input. The output result includes the probability value of allowing access and the probability value of disallowing access. When the probability value of allowing access is greater than the probability value of disallowing access, the result of allowing access is output; otherwise, the result of disallowing access is output.

[0082] Step 3052: Based on different sets of access request attributes, use the attribute access control analysis model to obtain the execution result of the access request target;

[0083] Step 3053: Select at least one attribute from all attributes as an attribute combination, and sort the different attribute combinations in descending order of the number of attributes in the combination;

[0084] Step 3054: Based on the order of the attribute combinations, starting from the first attribute combination, according to the attributes in the attribute combination, for different access request attribute sets, obtain multiple access request attribute sets where the attribute values ​​of the attributes in the attribute combination are all the same and classify them into one set; for the second attribute combination, analyze and obtain multiple access request attribute sets where the attribute values ​​of the attributes in the attribute combination are all the same and classify them into one set. Among them, the access request attribute set obtained based on the second attribute combination belongs to the set obtained based on the first attribute combination, or the access request attribute set obtained based on the second attribute combination does not belong to the set obtained based on the first attribute combination, and so on, to obtain the set corresponding to different attribute combinations;

[0085] Step 3055: For multiple access request attribute sets in a class of sets, use one access request attribute set and its corresponding access request target execution result as reference data, and use the remaining access request attribute sets and their corresponding access request target execution results as auxiliary data; based on the difference between the access request attribute sets in the reference data and the access request attribute sets in the auxiliary data, and the difference between the access request target execution results corresponding to the access request attribute sets in the reference data and the access request target execution results corresponding to the access request attribute sets in the auxiliary data, linearly fit the importance of attributes of different dimensions to the access request target execution results.

[0086] When the number of access request attribute sets in a set corresponding to the first attribute combination is less than a preset value, the set corresponding to the first attribute combination is recorded as invalid.

[0087] It is immediately clear that the number of attributes in an attribute combination cannot be too small, that is, it must be no less than the second preset value.

[0088] The design of the attribute combination in the embodiments of this application ensures that the attribute values ​​of several attributes in different access request attribute sets in a certain type of set are the same.

[0089] It is understandable that, based on reference and auxiliary data within a set, a linear fit can be made to determine the importance of other attributes outside the attribute combination to the execution result of the access request target, given that the attribute values ​​of the attributes in that attribute combination are fixed. Based on different attribute combinations resulting in different sets, the importance of each attribute to the execution result of the access request target can be obtained through linear fitting using reference and auxiliary data within those sets.

[0090] In one implementation, after the PDP performs access permission analysis based on attribute requests using the Policy Management Point (PAP), step 3 above further includes:

[0091] Step 32: Further determine whether to allow the resource access request based on the stability of the user access environment and the security of the user access behavior; if allowed, then determine that the resource access request is allowed.

[0092] In this embodiment, addressing the business security issues of power companies, after considering permission analysis based on attribute-based access control policies, it also considers the security risks posed by dynamic environmental changes and the individual user's access security level, achieving more effective and secure dynamic control of terminal access permissions. After performing permission policy analysis using Policy Management Points (PAPs), if an access request is determined to be allowed, further determination is made based on the stability of the user's access environment and the security level of the user's access behavior to determine whether the resource access request should be allowed; if allowed, then the resource access request is confirmed to be permitted.

[0093] In one implementation, the method for obtaining the stability of the user access environment in step 32 above includes:

[0094] Step 3211: Obtain multi-dimensional attribute information of the access environment from the user's historical access requests;

[0095] Step 3212: Determine the stability of the environmental attribute value based on the temporal distribution of different attribute values ​​of the same environmental attribute. The stability of the environmental attribute value is determined based on the diversity of the attribute value, the frequency of occurrence of different attribute values, and the number of times the same attribute value appears consecutively within a preset sliding time window that is greater than a preset value. The greater the diversity of the attribute value, the smaller the stability; the greater the frequency of occurrence of different attribute values, the greater the stability; and the greater the number of times the same attribute value appears consecutively within a preset sliding time window that is greater than a preset value, the greater the stability.

[0096] Step 3213: Based on the attribute value stability results of different environmental attributes, the stability of the user access environment is comprehensively decided. The fusion includes fusing the attribute value stability results of different environmental attributes based on the contribution of different environmental attributes to the stability of the user access environment.

[0097] In this embodiment of the application, the stability of the user access environment is determined based on the diversity of attribute values, the frequency of occurrence of different attribute values, and the number of times the same attribute value appears consecutively within a preset sliding time window. It can be understood that the greater the user access security, the less the user access environment changes or the more fixed it is.

[0098] In one implementation, the method for obtaining the user access behavior security level in step 32 above includes:

[0099] Step 3221: Based on the user's historical access behavior, obtain the time sequence characteristics of the user's illegal connection, the time sequence characteristics of the attempted unauthorized behavior, and the time sequence characteristics of the user's connection failure. The time sequence characteristics include the frequency of behavior occurrence, the frequency of behavior occurrence, and the time distribution characteristics of behavior occurrence.

[0100] Step 3222: Based on the fusion analysis of the time sequence characteristics of illegal user connections, the time sequence characteristics of attempted unauthorized behavior, and the time sequence characteristics of failed user connections, the user access behavior security level is obtained by nonlinear fitting or linear fitting of the relationship between the time sequence characteristics and the user access behavior security level.

[0101] Nonlinear fitting includes fitting models obtained by training samples based on neural network models;

[0102] The linear fitting process includes configuring importance coefficients based on the importance of different temporal features and performing linear fitting based on the importance system. The linear fitting process also includes the importance of temporal features of behaviors occurring at different times, based on the time decay of the occurrence time of the user's illegal connection, the attempt to escalate privileges, and the user's connection failure.

[0103] In this embodiment, the security level of user access behavior is comprehensively considered from the time-series data of unauthorized connection behavior, attempted privilege escalation behavior, and failed connection behavior. The higher the frequency and number of these insecure behaviors, and the more recent they occur, the lower the security level of user access behavior. In this embodiment, the time distribution characteristics of the behaviors may include the periodicity of behavior occurrence and the regularity of different text occurrence times. It should be noted that if a linear fit is made between the time-series characteristics of unauthorized connection, attempted privilege escalation, and failed connection behavior and the security level of user access behavior, the time of occurrence of each behavior needs to be considered during the linear fit; recent insecure behaviors are more important for assessing the security level of user access behavior.

[0104] Specifically, it includes:

[0105] For the time sequence characteristics of illegal user connections, attempted unauthorized behavior, and failed user connections within time periods of different lengths from the current time, the decay calculation is performed according to a preset time decay algorithm. The preset time decay algorithm satisfies the condition that the longer the time of the behavior is from the current time, the greater the decay.

[0106] The relationship between the temporal characteristics of illegal user connections, attempted unauthorized behavior, and failed user connections (after attenuation calculation) and the user access behavior security level is obtained by linear fitting.

[0107] This application provides a terminal access permission analysis system based on a zero-trust ABAC model, the system comprising:

[0108] The access request acquisition unit is used to acquire resource access requests sent by user terminals;

[0109] A multi-dimensional attribute extraction unit is used to receive resource access requests sent by user terminals through the policy execution point (PEP); based on the user request and according to preset collection requirements, extract multi-dimensional attributes from the user request, convert the user request into an attribute request, and send it to the policy decision point (PDP); the attributes include user attributes, environment attributes, operation attributes, and object attributes;

[0110] The access permission analysis unit is used to perform access permission analysis based on attribute requests using the policy management point (PAP) through the PDP, obtain the access permission analysis results, and feed the access permission analysis results back to the PEP. The information fed back by the PDP to the PEP includes allow, deny, not applicable, and unknown.

[0111] The access request execution unit is used to execute the resource access request to allow or deny the resource access based on the feedback information received from the PDP via the PEP.

[0112] Specific limitations regarding the terminal access permission analysis system based on the zero-trust ABAC model can be found in the limitations of the terminal access permission analysis method based on the zero-trust ABAC model mentioned above, and will not be repeated here. Each unit in the aforementioned terminal access permission analysis system based on the zero-trust ABAC model can be implemented entirely or partially through software, hardware, or a combination thereof. These units can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each unit.

[0113] This invention is not limited to the specific embodiments described above. Any modifications made by those skilled in the art based on the above concept without creative effort are within the scope of protection of this invention.

Claims

1. A terminal access permission analysis method based on a zero-trust ABAC model, characterized in that, The method comprises the following steps: a user terminal sends a resource access request; a policy enforcement point (PEP) receives the resource access request sent by the user terminal; based on the user request, multi-dimensional attributes are extracted from the user request according to preset collection requirements, and the user request is converted into an attribute request and sent to a policy decision point (PDP); the attributes include user attributes, environmental attributes, operation attributes and object attributes; the PDP performs access permission analysis based on the attribute request by using a policy administration point (PAP), obtains an access permission analysis result, and feeds back the access permission analysis result to the PEP, wherein the information fed back by the PDP to the PEP includes permission, rejection, inapplicability and unknown; the PEP executes permission or prohibition of the resource access request according to the feedback information received from the PDP; the step of extracting multi-dimensional attributes from the user request according to preset collection requirements based on the user request comprises the following steps: extracting keywords based on the current resource access request; performing part-of-speech analysis and attribute type classification on the keywords; and extracting multi-dimensional attributes according to a preset attribute path for the user access request; the step of extracting multi-dimensional attributes according to a preset attribute path for the user access request comprises the following steps: capturing the dependency relationship of words at different positions in the access request by using a multi-head self-attention mechanism after word embedding based on the user access request, transmitting the multi-head attention result to a decoding network through a feedforward neural network for decoding to obtain the description features of the user access request; and matching the corresponding preset attribute path based on the description features of the user access request, and extracting the multi-dimensional attributes in the user access request according to the matched preset attribute path; the PAP is pre-designed with an attribute access control policy, and the generation process of the attribute access control policy comprises the following steps: determining the order of different attributes in the attribute access control policy based on the importance of different attributes and the data distribution complexity of different attributes; the method for obtaining the importance of different attributes comprises the following steps: regarding the multi-dimensional attributes contained in different access requests as an access request attribute set; the set includes attributes and corresponding attribute values; calculating the similarity of different access request attribute sets and the difference degree of the access request execution situations of corresponding different access requests; and determining the importance of the attributes based on the similarity of different access request attribute sets and the difference degree of the access request execution situations of corresponding different access requests.

2. The method of claim 1, wherein the method is based on a zero-trust ABAC model. the step of performing access permission analysis by using the PAP comprises the following steps: obtaining multi-dimensional attribute data of the user access request, inputting the multi-dimensional attribute data into a preset access permission strategy reasoning model for analysis, and obtaining an access permission analysis result of the user; the preset access permission strategy reasoning model comprises an input module, a data logic module, an access permission strategy module and a reasoning module, wherein the reasoning module combines the data processed by the data logic module based on the multi-dimensional attribute data of the user access request with the access permission strategy module to perform access permission reasoning.

3. The method of claim 1, wherein the method further comprises: the method for obtaining the data distribution complexity of different attributes comprises the following steps: based on historical access data, multi-dimensional attributes in access requests and access request execution situations of each access record are extracted as training samples; Based on historical data, the value range of the attribute value corresponding to the same attribute is obtained, and the data distribution complexity of the attribute is determined according to the value range of the attribute value, wherein the complexity is based on the number of attribute value and whether the different values are clear.

4. The method of claim 1, wherein the method further comprises: The importance of the attribute is determined based on the similarity of different access request attribute sets and the difference degree of the access request execution of the corresponding different access requests, including: Based on historical access data, an attribute access control analysis model is trained, which is used to output a binary classification result of whether to allow access based on multi-dimensional attributes in the access request as input, and the output result contains probability values of allowing access and probability values of not allowing access. When the probability value of allowing access is greater than the probability value of not allowing access, the output is an access allowed result, otherwise, the output is an access not allowed result; Based on different access request attribute sets, the attribute access control analysis model is used to obtain the target execution result of the access request; At least one attribute is selected from all attributes as an attribute combination, and different attribute combinations are sorted according to the number of attributes in the combination from large to small; According to the sorting of the attribute combination, starting from the first attribute combination, according to the attributes in the attribute combination, the multiple access request attribute sets with the same attribute values in the attribute combination are divided into a class set for different access request attribute sets; the second attribute combination is analyzed to obtain the multiple access request attribute sets with the same attribute values in the attribute combination, which are divided into a class set, wherein the access request attribute set obtained based on the second attribute combination belongs to the class set obtained based on the first attribute combination, or the access request attribute set obtained based on the second attribute combination does not belong to the class set obtained based on the first attribute combination; For multiple access request attribute sets in a class set, an access request attribute set and the corresponding access request target execution result are used as reference data, and the remaining access request attribute sets and the corresponding access request target execution results are used as auxiliary data; Based on the difference degree of the reference data access request attribute set and the access request attribute set in the auxiliary data, the difference degree of the reference data access request attribute set corresponding to the access request target execution result and the difference degree of the reference data access request attribute set corresponding to the access request target execution result, the importance degree of different dimensional attributes to the access request target execution result is linearly fitted.

5. The method of claim 1, wherein the method further comprises: After the PDP performs access permission analysis on the attribute request using the policy management point PAP, it further includes: further determining whether to allow the resource access request according to the user access environment stability and the user access behavior security degree; if allowed, the resource access request is allowed.

6. The method of claim 5, wherein the method further comprises: The method for obtaining the user access environment stability includes: Obtain multi-dimensional attribute information of the access environment in the user's historical access request; Obtain multi-dimensional attribute information of the access environment in the user's historical access request; Determine the attribute value stationarity of the environment attribute based on the time sequence distribution of different attribute values of the same environment attribute, the attribute value stationarity of the environment attribute being determined based on the diversity of attribute values, the occurrence frequency of different attribute values, and the number of times that the number of consecutive occurrences of the same attribute value within a preset length sliding time window is greater than a preset value, wherein the greater the diversity of attribute values, the smaller the stationarity, the greater the occurrence frequency of different attribute values, the greater the stationarity, and the greater the number of times that the number of consecutive occurrences of the same attribute value within a preset length sliding time window is greater than a preset value, the greater the stationarity; Fuse the attribute value stationarity results of different environment attributes based on the contribution of different environment attributes to user access environment stability to comprehensively determine the user access environment stability.

7. The method of claim 5, wherein the method further comprises: The method for obtaining the user access behavior security degree comprises: Based on the user historical access behavior, obtain the user illegal connection time sequence feature, the attempt to exceed authority behavior time sequence feature, and the user connection failure time sequence feature, wherein the time sequence feature comprises behavior occurrence frequency, behavior occurrence frequency, and behavior occurrence time distribution feature; Fuse and analyze the user illegal connection time sequence feature, the attempt to exceed authority behavior time sequence feature, and the user connection failure time sequence feature, and obtain the user access behavior security degree through nonlinear fitting or linear fitting of the relationship between the time sequence feature and the user access behavior security degree, wherein the nonlinear fitting comprises a fitting model obtained based on a neural network model through sample training, the linear fitting comprises configuring importance coefficients based on the importance of different time sequence features and performing linear fitting based on the importance system, and the linear fitting further comprises configuring the importance of the behavior time sequence feature occurring at different times based on the time length decay of the behavior occurrence time of the user illegal connection time sequence feature, the attempt to exceed authority behavior time sequence feature, and the user connection failure time sequence feature from the current time. 8.A terminal access permission analysis system based on a zero-trust ABAC model, characterized in that, The method comprises: An access request acquisition unit configured to acquire a resource access request sent by a user terminal; A multi-dimensional attribute extraction unit configured to receive the resource access request sent by the user terminal through a policy enforcement point (PEP); Based on the user request, extract multi-dimensional attributes according to preset collection requirements, and convert the user request into an attribute request and send it to a policy decision point (PDP); the attributes comprise user attributes, environment attributes, operation attributes, and object attributes; An access permission analysis unit configured to perform access permission analysis based on the attribute request through the PDP using a policy administration point (PAP), acquire an access permission analysis result, and feed back the access permission analysis result to the PEP; the information fed back by the PDP to the PEP comprises permission, rejection, inapplicability, and unknown; An access request execution unit configured to execute the resource access request based on the feedback information received from the PDP through the PEP. The multi-dimensional attribute extraction unit extracts multi-dimensional attributes from the user request according to preset collection requirements based on the user request, including: extracting keywords based on the current resource access request; performing part-of-speech analysis and attribute type classification on the keywords; extracting multi-dimensional attributes according to a preset attribute path for the user access request; the multi-dimensional attribute extraction according to the preset attribute path for the user access request includes: based on the user access request, after word embedding, the dependency relationship of words at different positions in the access request is captured by using a multi-head self-attention mechanism, the multi-head attention result is transmitted to a decoding network for decoding through a feedforward neural network to obtain the description features of the user access request; based on the description features of the user access request, the corresponding preset attribute path is matched, and the multi-dimensional attributes in the user access request are extracted according to the matched preset attribute path; In the access permission analysis unit, the policy management point PAP is pre-designed with an attribute access control strategy, and the generation process of the attribute access control strategy includes: determining the order of different attributes in the attribute access control strategy based on the importance of different attributes and the data distribution complexity of different attributes; the method for obtaining the importance of different attributes includes: regarding the multi-dimensional attributes contained in different access requests as an access request attribute set; the set includes attributes and corresponding attribute values; calculating the similarity of different access request attribute sets and the difference degree of the access request execution situations of corresponding different access requests; determining the importance of the attributes based on the similarity of different access request attribute sets and the difference degree of the access request execution situations of corresponding different access requests.

Images