Access control method and device, electronic equipment and storage medium

Abstract

The invention discloses an access control method and device, electronic equipment and a storage medium. Behavior data of a target user in a current time period and behavior data of the target user in a preset number of historical time periods are acquired; acquiring terminal equipment security state information and target cloud server state information of the target user in the current time period; determining the credibility of the target user in the current time period according to the behavior data of the target user in the current time period, the behavior data of the target user in a preset number of historical time periods, the terminal equipment security state information of the target user in the current time period and the target cloud server state information; inputting the credibility of the target user in the current time period into a credibility prediction model to obtain the credibility of the target user in the next time period; and determining an access strategy corresponding to the next time period according to the predicted trust degree of the target user in the next time period, and performing access control on the target user in the next time period based on the access strategy.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an access control method, device, electronic device and storage medium. Background Art

[0002] In many applications, data interaction between user terminals and servers must be based on trust. In a cloud environment, the cloud platform serves as an intermediate hub to ensure the security of interactions between cloud user entities and cloud service entities. It adopts dynamic access control strategies to ensure user identity authentication and permission control, and also needs to ensure the credibility of the interaction between user terminals and cloud servers.

[0003] In the related art, trust-based access control strategies usually only consider the user trust in one direction. Once the user access rights are authorized, the default user identity is valid for the authorized identity thereafter. However, there are still malicious operations of legitimate and malicious users during the access process, which makes the user terminal face security risks when accessing the cloud server. Summary of the invention

[0004] In order to solve the problem that existing access control methods cause security risks to user terminals when accessing cloud servers, embodiments of the present application provide an access control method, device, electronic device, and storage medium.

[0005] In a first aspect, an embodiment of the present application provides an access control method, including:

[0006] Obtaining the behavior data of the target user in the current time period and the behavior data of the target user in a preset number of historical time periods;

[0007] Obtaining terminal device security status information and target cloud server status information of the target user within the current time period;

[0008] Determine the trustworthiness of the target user in the current time period according to the target user's behavior data in the current time period, the target user's behavior data in the preset number of historical time periods, the target user's terminal device security status information and the target cloud server status information in the current time period, wherein the target user's trustworthiness represents the target user's credibility;

[0009] Inputting the trustworthiness of the target user in the current time period into a trustworthiness prediction model to obtain the trustworthiness of the target user in the next time period, wherein the trustworthiness prediction model is used to predict the trustworthiness of the target user in the next time period based on the trustworthiness of the target user in the current time period;

[0010] An access policy corresponding to the next time period is determined according to the predicted trust level of the target user in the next time period, and access control is performed on the target user in the next time period based on the access policy.

[0011] In one embodiment, determining the trustworthiness of the target user in the current time period according to the behavior data of the target user in the current time period, the behavior data of the target user in the preset number of historical time periods, the terminal device security status information of the target user in the current time period, and the target cloud server status information, specifically includes:

[0012] Determining the direct trust of the target user in the current time period according to the behavior data of the target user in the preset number of historical time periods;

[0013] Determine the indirect trust of the target user in the current time period according to the behavior data of the target user in the current time period, the terminal device security status information of the target user in the current time period, and the target cloud server status information;

[0014] Determining the comprehensive trust of the target user in the current time period according to the direct trust of the target user and the indirect trust of the target user; and

[0015] Inputting the trustworthiness of the target user in the current time period into the trustworthiness prediction model to obtain the trustworthiness of the target user in the next time period specifically includes:

[0016] The comprehensive trust of the target user in the current time period is input into the trust prediction model to obtain the comprehensive trust of the target user in the next time period.

[0017] In one implementation, determining the direct trust of the target user in the current time period according to the behavior data of the target user in the preset number of historical time periods specifically includes:

[0018] For each historical time period, according to the correspondence between the user's behavior and the trust penalty factor, determine the trust penalty factor corresponding to the behavior data of the target user in the historical time period, wherein the trust penalty factor represents the degree of influence of the target user's behavior on the direct trust of the target user;

[0019] The direct trust of the target user in the current time period is determined based on the direct trust of the target user in each historical time period, the trust penalty factor corresponding to the behavior data of the target user in each historical time period, and the time sensitivity corresponding to the current time period. The time sensitivity corresponding to the current time period represents the degree of influence of the current time period on the direct trust of the target user in time.

[0020] In one implementation, the direct trust of the target user in the current time period is determined according to the direct trust of the target user in each historical time period, the trust penalty factor corresponding to the behavior data of the target user in each historical time period, and the time sensitivity corresponding to the current time period, specifically including:

[0021] The direct trust of the target user in the current time period is calculated by the following formula:

[0022]

[0023] Wherein, E represents the direct trust of the target user in the current time period;

[0024] E k represents the direct trust of the target user in the kth historical time period, k=1, 2, ..., N, N represents the number of historical time periods;

[0025] δ represents the time sensitivity corresponding to the current time period;

[0026] V k Represents the trust penalty factor corresponding to the behavior data of the target user in the kth historical time period.

[0027] In one implementation, determining the indirect trust of the target user in the current time period according to the target user's behavior data in the current time period, the terminal device security status information of the target user in the current time period, and the target cloud server status information in the current time period specifically includes:

[0028] Determine the corresponding current user behavior score, terminal status score and server status score according to the target user's behavior data in the current time period, the terminal device security status information of the target user in the current time period and the target cloud server status information;

[0029] Normalizing the current user behavior score, the terminal status score, and the server status score respectively to obtain a normalized current user behavior score, a normalized terminal status score, and a normalized server status score;

[0030] The indirect trust of the target user in the current time period is obtained by taking a weighted average of the normalized current user behavior score, the normalized terminal status score and the normalized server status score and their corresponding weights.

[0031] In one implementation, determining the comprehensive trust of the target user in the current time period according to the direct trust of the target user and the indirect trust of the target user specifically includes:

[0032] The comprehensive trust of the target user in the current time period is calculated by the following formula:

[0033] CT=γαIT+βDT

[0034] Wherein, CT represents the comprehensive trust of the target user in the current time period;

[0035] γ represents the dynamic regulatory factor;

[0036] IT represents the indirect trust of the target user in the current time period, and α represents the weight of the indirect trust of the target user in the current time period;

[0037] DT represents the direct trust of the target user in the current time period, and β represents the weight of the direct trust of the target user in the current time period.

[0038] In one implementation, determining an access policy corresponding to the next time period according to the predicted trust level of the target user in the next time period specifically includes:

[0039] Determine the state of the target user in the next time period according to the predicted comprehensive trust of the target user in the next time period;

[0040] The access policy corresponding to the state of the target user in the next time period is determined according to the state of the target user in the next time period and the correspondence between the state of the user and the access policy.

[0041] In one implementation, determining the state of the target user in the next time period according to the predicted comprehensive trust of the target user in the next time period specifically includes:

[0042] Obtain the comprehensive trust of the target user in the previous time period;

[0043] The difference between the comprehensive trust of the target user in the current time period and the comprehensive trust of the target user in the previous time period is used as a trust difference threshold;

[0044] The state of the target user in the next time period is determined according to the comprehensive trust of the target user in the next time period, the trust difference threshold, the first preset threshold and the second preset threshold.

[0045] In one implementation, determining the state of the target user in the next time period according to the comprehensive trust of the target user in the next time period, the trust difference threshold, the first preset threshold, and the second preset threshold specifically includes:

[0046] When the comprehensive trust of the target user in the predicted next time period is greater than a first preset threshold, if it is determined that the trust difference threshold is less than a specified value, the state of the target user is determined to be trustworthy; if it is determined that the trust difference threshold is greater than or equal to the specified value, the state of the target user is determined to be suspicious;

[0047] When the predicted comprehensive trust value of the target user in the next time period is greater than the second preset threshold and less than or equal to the first preset threshold, if it is determined that the trust difference threshold is less than the specified value, the state of the target user is determined to be suspicious; if it is determined that the trust difference threshold is greater than or equal to the specified value, the state of the target user is determined to be untrustworthy;

[0048] When the predicted comprehensive trust value of the target user in the next time period is less than or equal to the second preset threshold, if it is determined that the trust difference threshold is less than the specified value, the status of the target user is judged to be untrustworthy; if it is determined that the trust difference threshold is greater than or equal to the specified value, the status of the target user is judged to be suspicious.

[0049] In a second aspect, an embodiment of the present application provides an access control device, including:

[0050] A first acquisition module is used to acquire the behavior data of the target user in the current time period and the behavior data of the target user in a preset number of historical time periods;

[0051] The second acquisition module is used to obtain the terminal device security status information of the target user and the target cloud server status information within the current time period;

[0052] A trust evaluation module, used to determine the trust of the target user in the current time period according to the target user's behavior data in the current time period, the target user's behavior data in the preset number of historical time periods, the target user's terminal device security status information and the target cloud server status information in the current time period, wherein the target user's trust represents the trustworthiness of the target user;

[0053] A prediction module, used to input the trust of the target user in the current time period into a trust prediction model to obtain the trust of the target user in the next time period, wherein the trust prediction model is used to predict the trust of the target user in the next time period based on the trust of the target user in the current time period;

[0054] The control module is used to determine the access policy corresponding to the next time period according to the predicted trust level of the target user in the next time period, and perform access control on the target user in the next time period based on the access policy.

[0055] In one embodiment, the trust evaluation module is specifically used to determine the direct trust of the target user in the current time period based on the behavior data of the target user in the preset number of historical time periods; determine the indirect trust of the target user in the current time period based on the behavior data of the target user in the current time period, the terminal device security status information of the target user in the current time period, and the target cloud server status information; determine the comprehensive trust of the target user in the current time period based on the direct trust of the target user and the indirect trust of the target user;

[0056] The prediction module is specifically used to input the comprehensive trust of the target user in the current time period into the trust prediction model to obtain the comprehensive trust of the target user in the next time period.

[0057] In one embodiment, the trust evaluation module is specifically used to determine, for each historical time period, the trust penalty factor corresponding to the behavior data of the target user in the historical time period according to the correspondence between the user's behavior and the trust penalty factor, wherein the trust penalty factor represents the degree of influence of the target user's behavior on the direct trust of the target user; and to determine the direct trust of the target user in the current time period according to the direct trust of the target user in each historical time period, the trust penalty factor corresponding to the behavior data of the target user in each historical time period, and the time sensitivity corresponding to the current time period, wherein the time sensitivity corresponding to the current time period represents the degree of influence of the current time period on the direct trust of the target user in time.

[0058] In one implementation, the trust evaluation module is specifically configured to calculate the direct trust of the target user in the current time period by using the following formula:

[0059]

[0060] Wherein, E represents the direct trust of the target user in the current time period;

[0061] E k represents the direct trust of the target user in the kth historical time period, k=1, 2, ..., N, N represents the number of historical time periods;

[0062] δ represents the time sensitivity corresponding to the current time period;

[0063] V k Represents the trust penalty factor corresponding to the behavior data of the target user in the kth historical time period.

[0064] In one embodiment, the trust evaluation module is specifically used to determine the corresponding current user behavior score, terminal status score and server status score according to the behavior data of the target user in the current time period, the terminal device security status information of the target user in the current time period and the target cloud server status information; normalize the current user behavior score, terminal status score and server status score respectively to obtain the normalized current user behavior score, normalized terminal status score and normalized server status score; and perform weighted averaging based on the normalized current user behavior score, the normalized terminal status score and the normalized server status score and their respective corresponding weights to obtain the indirect trust of the target user in the current time period.

[0065] In one implementation, the trust evaluation module is specifically configured to calculate the comprehensive trust of the target user in the current time period using the following formula:

[0066] CT=γαIT+βDT

[0067] Wherein, CT represents the comprehensive trust of the target user in the current time period;

[0068] γ represents the dynamic regulatory factor;

[0069] IT represents the indirect trust of the target user in the current time period, and α represents the weight of the indirect trust of the target user in the current time period;

[0070] DT represents the direct trust of the target user in the current time period, and β represents the weight of the direct trust of the target user in the current time period.

[0071] In one embodiment, the control module is specifically used to determine the state of the target user in the next time period based on the predicted comprehensive trust of the target user in the next time period; and determine the access policy corresponding to the state of the target user in the next time period based on the state of the target user in the next time period and the correspondence between the user's state and the access policy.

[0072] In one embodiment, the control module is specifically used to obtain the comprehensive trust of the target user in the previous time period; use the difference between the comprehensive trust of the target user in the current time period and the comprehensive trust of the target user in the previous time period as a trust difference threshold; and determine the state of the target user in the next time period based on the comprehensive trust of the target user in the next time period, the trust difference threshold, the first preset threshold and the second preset threshold.

[0073] In one embodiment, the control module is specifically used to, when the comprehensive trust of the target user in the next predicted time period is greater than a first preset threshold, if it is determined that the trust difference threshold is less than a specified value, determine that the state of the target user is trustworthy, and if it is determined that the trust difference threshold is greater than or equal to the specified value, determine that the state of the target user is suspicious; when the comprehensive trust value of the target user in the next predicted time period is greater than a second preset threshold and less than or equal to the first preset threshold, if it is determined that the trust difference threshold is less than the specified value, determine that the state of the target user is suspicious, and if it is determined that the trust difference threshold is greater than or equal to the specified value, determine that the state of the target user is untrustworthy; when the comprehensive trust value of the target user in the next predicted time period is less than or equal to the second preset threshold, if it is determined that the trust difference threshold is less than the specified value, determine that the state of the target user is untrustworthy, and if it is determined that the trust difference threshold is greater than or equal to the specified value, determine that the state of the target user is suspicious.

[0074] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the access control method described in the present application when executing the program.

[0075] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the access control method described in the present application.

[0076] The beneficial effects of this application are as follows:

[0077] The access control method, device, electronic device and storage medium provided by the embodiments of the present application, the cloud platform obtains the behavior data of the target user in the current time period and the behavior data of the target user in a preset number of historical time periods; obtains the terminal device security status information and the target cloud server status information of the target user in the current time period; determines the trust of the target user in the current time period based on the behavior data of the target user in the current time period, the behavior data of the target user in a preset number of historical time periods, the terminal device security status information and the target cloud server status information of the target user in the current time period, and the trust of the target user represents the trustworthiness of the target user; inputs the trust of the target user in the current time period into a trust prediction model to obtain the trust of the target user in the next time period, and the trust prediction model is used to predict the trust of the target user in the next time period based on the trust of the target user in the current time period; determines the access policy corresponding to the next time period based on the predicted trust of the target user in the next time period, and performs access control on the target user in the next time period based on the access policy. In an embodiment of the present application, the trust of the target user in the current time period is evaluated in multiple dimensions by combining the behavior data of the target user in the current time period, the behavior data of the target users in several historical time periods, the security status of the terminal device of the target user in the current time period, and the status information of the target cloud server in the current time period, and the trust of the target user in the next time period is predicted based on the pre-trained trust prediction model and the trust of the target user in the current time period. Thus, according to the predicted trust of the target user in the next time period, user access is warned in advance, the access policy corresponding to the next time period is determined, and access control is performed on the target user based on the access policy when the next period arrives. Thus, dynamic adjustment of the user's access control policy is achieved according to the granularity of the time sliding window, thereby improving the security of the process of user terminal access to the cloud server.

[0078] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0080] Figure 1 A schematic diagram of an application scenario of the access control method provided in an embodiment of the present application;

[0081] Figure 2 A flowchart of an access control method provided in an embodiment of the present application;

[0082] Figure 3 A schematic diagram of a process for determining the trustworthiness of a target user in the current time period provided in an embodiment of the present application;

[0083] Figure 4 A schematic diagram of a process for determining the direct trustworthiness of a target user within a current time period provided in an embodiment of the present application;

[0084] Figure 5 A schematic diagram of a process for determining the indirect trust of a target user within a current time period provided in an embodiment of the present application;

[0085] Figure 6 A schematic diagram of a process for determining an access policy corresponding to a next time period provided in an embodiment of the present application;

[0086] Figure 7 A schematic diagram of a process for determining the state of a target user in the next time period provided in an embodiment of the present application;

[0087] Figure 8 A schematic diagram of the structure of an access control device provided in an embodiment of the present application;

[0088] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0089] In order to solve the problem that existing access control methods cause security risks to user terminals when accessing cloud servers, embodiments of the present application provide an access control method, device, electronic device, and storage medium.

[0090] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0091] First reference Figure 1, which is a schematic diagram of an application scenario of the access control method provided in an embodiment of the present application, and may include a terminal device 101, a cloud platform 102 and a cloud server 103. The terminal device 101 and the cloud platform 102 are connected via a network, and the cloud platform 102 and the cloud server 103 are connected via a network. The cloud platform 102 is a platform that provides cloud infrastructure and provides monitoring and management of cloud resources (such as cloud servers, networks, and security policies). When a user accesses the cloud server 103 through his terminal device 101, he must first pass through the cloud platform 102, and the cloud platform 102 controls the user's access behavior. The cloud platform 102 obtains the behavior data of the target user in the current time period and the behavior data of the target users in a preset number of historical time periods, as well as the security status information of the terminal device 101 of the target user and the status information of the target cloud server 103 in the current time period. The cloud platform 102 determines the trust of the target user in the current time period based on the behavior data of the target user in the current time period, the behavior data of the target users in a preset number of historical time periods, the security status information of the terminal device of the target user in the current time period, and the status information of the target cloud server. Then, the trust of the target user in the current time period is input into the trust prediction model to obtain the trust of the target user in the next time period. Then, the cloud platform 102 determines the access policy corresponding to the next time period based on the predicted trust of the target user in the next time period, and performs access control on the target user in the next time period based on the access policy. Thus, the dynamic adjustment of the user's access control policy is realized according to the granularity of the time sliding window, so as to achieve the effect of prior intervention and improve the security of the user terminal access to the cloud server.

[0092] The terminal device 101 may be, but is not limited to, a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., and this embodiment of the present application does not limit this.

[0093] Based on the above application scenarios, the following will refer to the attached Figures 2 to 7 The exemplary embodiments of the present application are described in more detail. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principle of the present application, and the implementation of the present application is not limited in any way. On the contrary, the implementation of the present application can be applied to any applicable scenario.

[0094] like Figure 2 As shown, it is a schematic diagram of the implementation process of the access control method provided in the embodiment of the present application. The access control method can be applied to the above-mentioned cloud platform 102, and specifically may include the following steps:

[0095] S21. The cloud platform obtains the behavior data of the target user in the current time period and the behavior data of the target user in a preset number of historical time periods.

[0096] During specific implementation, the cloud platform records the user logs of the target user during the communication between the target user and the target server through his terminal device. The user logs include various behavioral data such as login, access and operation of the target user. The operational behavior data of the target user includes but is not limited to: normal operational behavior data and abnormal operational behavior data. Abnormal operational behavior data includes: suspicious access behaviors such as accessing the target server during uncommon time periods and accessing the target server from uncommon addresses, malicious attacks and intrusions launched by the target user on the target server, scanning and other operational behaviors.

[0097] In this step, the cloud platform obtains the behavior data of the target user in the current time period and the behavior data of the target user in a preset number of historical time periods from the user log of the target user, wherein the duration and preset number of the time period can be set by oneself, such as the time period can be set to 1 hour, half an hour or 10 minutes, etc., and can also be set to any other duration, and the preset number is set to N, which is not limited in the embodiment of the present application. The preset number of historical time periods is the N historical time periods before the current time period. Assuming N is 10, the preset number of historical time periods is the first 10 historical time periods of the current time period.

[0098] Specifically, the cloud platform can use open source detection tools (such as Nmap, X-Scan and other scanning tools) to collect ports and use tools such as intrusion prevention systems or network threat analyzers to detect illegal access behavior of target users in the current time period and record it in the user log.

[0099] S22. Obtain the target user's terminal device security status information and the target cloud server status information within the current time period.

[0100] In specific implementation, the data collection module on the terminal device of the target user can monitor the operating status of the terminal device in real time, that is, the terminal device security status, which includes: whether the terminal device is running suspicious or malicious processes, services, applications, etc., and whether there are external devices on the terminal device, whether dangerous ports are open, whether firewall protection and other security baseline tests are turned on, etc. The target cloud server monitors its own status, which includes: whether the load is abnormal, whether the network is stable, CPU occupancy, etc.

[0101] In this step, the cloud platform obtains the current terminal device security status information from the target user's terminal device, and obtains the current target cloud server status information from the target cloud server.

[0102] During implementation, the embodiment of the present application does not limit the execution order of step S21 and step S22, and these two steps can also be executed simultaneously.

[0103] S23. Determine the trustworthiness of the target user in the current time period based on the target user's behavior data in the current time period, the target user's behavior data in a preset number of historical time periods, the target user's terminal device security status information in the current time period, and the target cloud server status information.

[0104] The target user's trustworthiness represents the target user's credibility, and the target user's trustworthiness is also: the target user's comprehensive trustworthiness.

[0105] When implementing it specifically, you can follow the following steps: Figure 3 The process shown determines the trust level of the target user in the current time period, including the following steps:

[0106] S31. Determine the direct trust of the target user in the current time period based on the behavior data of the target user in a preset number of historical time periods.

[0107] When implementing it specifically, you can follow the following steps: Figure 4 The process shown determines the direct trust of the target user in the current time period, including the following steps:

[0108] S41. For each historical time period, according to the corresponding relationship between the user's behavior and the trust penalty factor, determine the trust penalty factor corresponding to the behavior data of the target user in the historical time period.

[0109] During specific implementation, the cloud platform pre-sets a trust penalty factor corresponding to the user's behavior. The trust penalty factor corresponding to the user's behavior represents the degree of influence of the user's behavior on the user's direct trust. The larger the penalty factor, the smaller the influence on the user's direct trust, and the smaller the penalty factor, the greater the influence on the user's direct trust. During implementation, different trust penalty factors can be set according to the level of malicious behavior. For example, the trust penalty factor corresponding to the behavior of attempting to crack and download encrypted data can be set to 0.3, and the penalty factor for attempting to brute force login can be set to 0.3, etc. The embodiments of the present application do not limit this.

[0110] In this step, for each historical time period, the cloud platform queries the trust penalty factor corresponding to the behavior data of the target user in the historical time period from the preset correspondence between the user's behavior and the trust penalty factor. The trust penalty factor corresponding to the behavior data of the target user represents the degree of influence of the target user's behavior on the direct trust of the target user. Thus, the trust penalty factor corresponding to the behavior data of the target user in each historical time period can be obtained.

[0111] S42. Determine the direct trust of the target user in the current time period according to the direct trust of the target user in each historical time period, the trust penalty factor corresponding to the behavior data of the target user in each historical time period, and the time sensitivity corresponding to the current time period.

[0112] Among them, the time sensitivity corresponding to the current time period represents the degree of influence of the current time period on the direct trust of the target user in time. Time sensitivity is related to the time period index, that is, the closer to the current time period, the greater the time sensitivity value. This is because the user behavior that has just occurred has a greater impact on the trust evaluation, and the further back in time, the smaller the impact. It can be set by yourself during implementation.

[0113] During implementation, the direct trust of the target user in the current time period may be calculated by the following formula:

[0114]

[0115] Among them, E represents the direct trust of the target user in the current time period;

[0116] E k represents the direct trust of the target user in the kth historical time period, k = 1, 2, ..., N, N represents the number of historical time periods, and the Nth historical time period is the previous time period of the current time period; E k The initial value of can be set to 0.5;

[0117] δ represents the time sensitivity corresponding to the current time period;

[0118] V k Represents the trust penalty factor corresponding to the target user's behavior data in the kth historical time period.

[0119] S32. Determine the indirect trust of the target user in the current time period based on the target user's behavior data in the current time period, the target user's terminal device security status information in the current time period, and the target cloud server status information.

[0120] In implementation, the following Figure 5 The process shown determines the indirect trust of the target user in the current time period, including the following steps:

[0121] S51. Determine the corresponding current user behavior score, terminal status score and server status score according to the target user's behavior data in the current time period, the target user's terminal device security status information in the current time period and the target cloud server status information.

[0122] In specific implementation, the cloud platform pre-sets the initial user behavior score, initial terminal status score and initial server status score in the normal state to the same fixed score, such as setting the initial user behavior score, initial terminal status score and initial server status score to 100 points. For the user's behavior data, the cloud platform pre-sets corresponding scores for different abnormal operation behavior data. When determining the current user behavior score, the initial user behavior score can be subtracted from the score corresponding to each abnormal operation behavior contained in the target user behavior data in the current time period to obtain the user behavior score. For example, if the target user's behavior in the current time period includes accessing the target server during an uncommon period and the target user launching a malicious attack on the target server, the initial user behavior score is subtracted from the score corresponding to accessing the target server during an uncommon period and the score of the target user launching a malicious attack on the target server to obtain the current user behavior score. For the terminal device security status information, the cloud platform sets corresponding scores for different unsafe states of the terminal device in advance. When determining the current terminal status score, the initial terminal status score can be subtracted from the scores corresponding to each unsafe state contained in the terminal device security status information of the target user in the current time period to obtain the terminal status score. For example, if it is detected that the terminal device has an external device and the terminal device is running a malicious process, the score corresponding to the external device and the score corresponding to the terminal device running a malicious process are subtracted from the initial terminal status score to obtain the current terminal status score. For the server status information, the cloud platform sets corresponding scores for different abnormal states of the server in advance. When determining the current server status score, the initial server status score is subtracted from the scores of each abnormal state contained in the target server status information in the current time period to obtain the server status score. For example, if the current target server status includes load abnormality and network instability, the score corresponding to the load abnormality and the score corresponding to the network instability are subtracted from the initial server status score to obtain the current server status score.

[0123] S52: Normalize the current user behavior score, the terminal status score, and the server status score respectively to obtain a normalized current user behavior score, a normalized terminal status score, and a normalized server status score.

[0124] In specific implementation, the cloud platform can use a normalization algorithm to normalize the current user behavior score, the terminal status score, and the server status score, respectively, to obtain the normalized current user behavior score, the normalized terminal status score, and the normalized server status score. In the embodiment of the present application, any normalization algorithm can be used to normalize the current user behavior score, the terminal status score, and the server status score to between [0,1].

[0125] S53: performing weighted average according to the normalized current user behavior score, the normalized terminal status score and the normalized server status score and their corresponding weights to obtain the indirect trust of the target user in the current time period.

[0126] In specific implementation, the cloud platform can calculate the indirect trust of the target user in the current time period through the following formula:

[0127] IT=ω1*T1+ω2*T2+ω3*T3

[0128] Among them, IT represents the indirect trust of the target user in the current time period;

[0129] T1 represents the normalized current user behavior score, and ω1 represents the weight of the user behavior score;

[0130] T2 represents the normalized terminal state score, and ω2 represents the weight of the terminal state score;

[0131] T3 represents the normalized server status score, and ω3 represents the weight of the server status score;

[0132] ω1+ω2+ω3=1.

[0133] During implementation, the values ​​of ω1, ω2 and ω3 may be set as required, and this embodiment of the present application does not limit this.

[0134] S33. Determine the comprehensive trust of the target user in the current time period according to the direct trust of the target user and the indirect trust of the target user.

[0135] In specific implementation, the cloud platform can calculate the comprehensive trust of the target user in the current time period through the following formula:

[0136] CT=γαIT+βDT

[0137] Among them, CT represents the comprehensive trust of the target user in the current time period;

[0138] γ represents the dynamic regulatory factor;

[0139] IT represents the indirect trust of the target user in the current time period, and α represents the weight of the indirect trust of the target user in the current time period;

[0140] DT represents the direct trust of the target user in the current time period, and β represents the weight of the direct trust of the target user in the current time period;

[0141] γα+β=1.

[0142] During implementation, α and β are correction coefficients, and the values ​​of γ, α and β can be set by oneself, which is not limited in the embodiment of the present application.

[0143] In an embodiment of the present application, the direct trust of the target user in the current time period is determined through the historical behavior data of the target user, and the indirect trust of the target user in the current time period is determined in combination with the current multi-source data, namely: the behavior data of the target user in the current time period, the terminal security status information and the target server status information. According to the dynamic changes of the access environment, the indirect trust and direct trust of the target user in the current time period are adjusted through dynamic weighting factors to determine the comprehensive trust of the target user in the current time period, thereby improving the accuracy of the trust evaluation of the target user.

[0144] S24: Input the trustworthiness of the target user in the current time period into a trustworthiness prediction model to obtain the trustworthiness of the target user in the next time period.

[0145] In specific implementation, the cloud platform trains the trust prediction model in advance according to the preset neural network model, and can calculate the comprehensive trust of a large number of sample users in adjacent time periods, input the comprehensive trust of sample users in the earlier time period in the adjacent time period into the preset neural network model, predict the comprehensive trust of sample users in the later time period, and adjust the parameters of the preset neural network model according to the deviation between the predicted value and the actual value of the comprehensive trust of sample users in the later time period until the model converges to obtain the trained trust prediction model. The neural network model can be, but is not limited to, a convolutional neural network (CNN) model, a bidirectional long short-term memory network (Bidirectional Long Short-Term Memory, BiLSTM) model, or any other neural network model, and the embodiments of the present application are not limited to this.

[0146] In this step, the cloud platform inputs the comprehensive trust of the target user in the current time period into the trust prediction model to obtain the comprehensive trust of the target user in the next time period, wherein the trust prediction model is used to predict the trust of the target user in the next time period based on the trust of the target user in the current time period.

[0147] S25. Determine an access policy corresponding to the next time period according to the predicted trust level of the target user in the next time period, and perform access control on the target user in the next time period based on the access policy.

[0148] When implementing it specifically, you can follow the following steps: Figure 6 The process shown determines the access policy corresponding to the next time period, including the following steps:

[0149] S61 : Determine the state of the target user in the next time period according to the predicted comprehensive trust of the target user in the next time period.

[0150] The state of the target user indicates whether the target user is a trustworthy user. The state of the target user includes a trustworthy state, a suspicious state, and an untrustworthy state. The suspicious state indicates that it is impossible to confirm whether the target user is trustworthy.

[0151] When implementing it specifically, you can follow the following steps: Figure 7 The process shown determines the state of the target user in the next time period, including the following steps:

[0152] S71. Obtain the comprehensive trust of the target user in the previous time period.

[0153] In specific implementation, the cloud platform stores the comprehensive trust of the target user in each historical time period.

[0154] S72: Taking the difference between the comprehensive trust of the target user in the current time period and the comprehensive trust of the target user in the previous time period as a trust difference threshold.

[0155] S73: Determine the state of the target user in the next time period according to the comprehensive trust of the target user in the next time period, the trust difference threshold, the first preset threshold, and the second preset threshold.

[0156] In specific implementation, when the predicted comprehensive trust of the target user in the next time period is greater than the first preset threshold, if the trust difference threshold is determined to be less than the specified value, the state of the target user is determined to be credible, and if the trust difference threshold is determined to be greater than or equal to the specified value, the state of the target user is determined to be suspicious; when the predicted comprehensive trust value of the target user in the next time period is greater than the second preset threshold and less than or equal to the first preset threshold, if the trust difference threshold is determined to be less than the specified value, the state of the target user is determined to be suspicious, and if the trust difference threshold is determined to be greater than or equal to the specified value, the state of the target user is determined to be untrustworthy; when the predicted comprehensive trust value of the target user in the next time period is less than or equal to the second preset threshold, if the trust difference threshold is determined to be less than the specified value, the state of the target user is determined to be untrustworthy, and if the trust difference threshold is determined to be greater than or equal to the specified value, the state of the target user is determined to be suspicious. Among them, the first preset threshold, the second preset threshold and the specified value can be set according to the needs, the first preset threshold is greater than the second preset threshold, and the specified value can be set to a smaller value. For example, the first preset threshold can be set to 0.7, the second preset threshold can be set to 0.4, and the specified value can be set to 0.1, which is not limited in the embodiment of the present application.

[0157] In the embodiment of the present application, the trust difference threshold affects the state of the target user in the next time period. If the predicted comprehensive trust of the target user in the next time period is greater than the first preset threshold, and the trust difference threshold is small, the state of the target user is a trusted state. If the trust difference threshold is large, the state of the target user is determined to be a suspicious state. If the predicted comprehensive trust value of the target user in the next time period is greater than the second preset threshold and less than or equal to the first preset threshold, and the trust difference threshold is small, the state of the target user is determined to be a suspicious state. If the trust difference threshold is large, the state of the target user is determined to be untrustworthy. If the predicted comprehensive trust value of the target user in the next time period is less than or equal to the second preset threshold, and the trust difference threshold is small, the state of the target user is determined to be an untrustworthy state. If the trust difference threshold is large, the state of the target user is determined to be suspicious. Thereby, the determination accuracy of the state of the target user in the next time period is improved.

[0158] S62: Determine the access policy corresponding to the state of the target user in the next time period according to the state of the target user in the next time period and the correspondence between the state of the user and the access policy.

[0159] During specific implementation, the cloud platform pre-sets access policies corresponding to different user statuses. For example, when the user's status is a trusted state, the corresponding access policy is set to: accept access; when the user's status is a suspicious state, the corresponding access policy is set to: re-authentication, that is, re-authenticating the user; when the user's status is an untrustworthy state, the corresponding policy is set to deny access.

[0160] In this step, the cloud platform determines the access policy corresponding to the state of the target user in the next time period according to the preset correspondence between the state of the user and the access policy. If the state of the target user in the next time period is a trusted state, the access policy corresponding to the state of the target user in the next time period is: accept access; if the state of the target user in the next time period is a suspicious state, the access policy corresponding to the state of the target user in the next time period is re-authentication, so as to re-authenticate the target user; if the state of the target user in the next time period is an untrustworthy state, the access policy corresponding to the state of the target user in the next time period is to deny access.

[0161] Furthermore, when the next time period arrives, the cloud platform performs access control on the target user in the next time period based on the access policy corresponding to the state of the target user in the next time period.

[0162] In the access control method provided by the embodiment of the present application, the cloud platform obtains the behavior data of the target user in the current time period and the behavior data of the target user in a preset number of historical time periods; obtains the terminal device security status information and the target cloud server status information of the target user in the current time period; determines the trust of the target user in the current time period based on the behavior data of the target user in the current time period, the behavior data of the target user in a preset number of historical time periods, the terminal device security status information and the target cloud server status information of the target user in the current time period, wherein the trust of the target user represents the degree of trustworthiness of the target user; inputs the trust of the target user in the current time period into a trust prediction model to obtain the trust of the target user in the next time period, wherein the trust prediction model is used to predict the trust of the target user in the next time period based on the trust of the target user in the current time period; determines the access policy corresponding to the next time period based on the predicted trust of the target user in the next time period, and performs access control on the target user in the next time period based on the access policy. In an embodiment of the present application, the trust of the target user in the current time period is evaluated in multiple dimensions by combining the behavior data of the target user in the current time period, the behavior data of the target users in several historical time periods, the security status of the terminal device of the target user in the current time period, and the status information of the target cloud server in the current time period, and the trust of the target user in the next time period is predicted based on the pre-trained trust prediction model and the trust of the target user in the current time period. Thus, according to the predicted trust of the target user in the next time period, user access is warned in advance, the access policy corresponding to the next time period is determined, and access control is performed on the target user based on the access policy when the next period arrives. Thus, dynamic adjustment of the user's access control policy is achieved according to the granularity of the time sliding window, thereby improving the security of the process of user terminal access to the cloud server.

[0163] Based on the same inventive concept, the embodiment of the present application also provides an access control device. Since the principle of solving the problem by the above-mentioned access control device is similar to that of the above-mentioned access control method, the implementation of the above-mentioned device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0164] like Figure 8 As shown, it is a schematic diagram of the structure of the access control device provided in the embodiment of the present application, which can be applied to Figure 1 In the cloud platform 102 shown, the device includes:

[0165] A first acquisition module 81 is used to acquire the behavior data of the target user in the current time period and the behavior data of the target user in a preset number of historical time periods;

[0166] The second acquisition module 82 is used to obtain the terminal device security status information of the target user and the target cloud server status information within the current time period;

[0167] The trust evaluation module 83 is used to determine the trust of the target user in the current time period according to the behavior data of the target user in the current time period, the behavior data of the target user in the preset number of historical time periods, the terminal device security status information of the target user in the current time period, and the target cloud server status information, wherein the trust of the target user represents the credibility of the target user;

[0168] Prediction module 84, used for inputting the trust of the target user in the current time period into a trust prediction model to obtain the trust of the target user in the next time period, wherein the trust prediction model is used for predicting the trust of the target user in the next time period based on the trust of the target user in the current time period;

[0169] The control module 85 is used to determine the access policy corresponding to the next time period according to the predicted trust level of the target user in the next time period, and perform access control on the target user in the next time period based on the access policy.

[0170] In one embodiment, the trust evaluation module 83 is specifically used to determine the direct trust of the target user in the current time period based on the behavior data of the target user in the preset number of historical time periods; determine the indirect trust of the target user in the current time period based on the behavior data of the target user in the current time period, the terminal device security status information of the target user in the current time period, and the target cloud server status information; determine the comprehensive trust of the target user in the current time period based on the direct trust of the target user and the indirect trust of the target user;

[0171] The prediction module 84 is specifically used to input the comprehensive trust of the target user in the current time period into the trust prediction model to obtain the comprehensive trust of the target user in the next time period.

[0172] In one embodiment, the trust evaluation module 83 is specifically used to determine, for each historical time period, the trust penalty factor corresponding to the behavior data of the target user in the historical time period according to the correspondence between the user's behavior and the trust penalty factor, wherein the trust penalty factor represents the degree of influence of the target user's behavior on the direct trust of the target user; determine the direct trust of the target user in the current time period according to the direct trust of the target user in each historical time period, the trust penalty factor corresponding to the behavior data of the target user in each historical time period, and the time sensitivity corresponding to the current time period, wherein the time sensitivity corresponding to the current time period represents the degree of influence of the current time period on the direct trust of the target user in time.

[0173] In one implementation, the trust evaluation module 83 is specifically configured to calculate the direct trust of the target user in the current time period by using the following formula:

[0174]

[0175] Wherein, E represents the direct trust of the target user in the current time period;

[0176] E k represents the direct trust of the target user in the kth historical time period, k=1, 2, ..., N, N represents the number of historical time periods;

[0177] δ represents the time sensitivity corresponding to the current time period;

[0178] V k Represents the trust penalty factor corresponding to the behavior data of the target user in the kth historical time period.

[0179] In one embodiment, the trust evaluation module 83 is specifically used to determine the corresponding current user behavior score, terminal status score and server status score according to the behavior data of the target user in the current time period, the terminal device security status information of the target user in the current time period and the target cloud server status information; normalize the current user behavior score, terminal status score and server status score respectively to obtain the normalized current user behavior score, the normalized terminal status score and the normalized server status score; and perform weighted averaging based on the normalized current user behavior score, the normalized terminal status score and the normalized server status score and their respective corresponding weights to obtain the indirect trust of the target user in the current time period.

[0180] In one implementation, the trust evaluation module 83 is specifically configured to calculate the comprehensive trust of the target user in the current time period using the following formula:

[0181] CT=γαIT+βDT

[0182] Wherein, CT represents the comprehensive trust of the target user in the current time period;

[0183] γ represents the dynamic regulatory factor;

[0184] IT represents the indirect trust of the target user in the current time period, and α represents the weight of the indirect trust of the target user in the current time period;

[0185] DT represents the direct trust of the target user in the current time period, and β represents the weight of the direct trust of the target user in the current time period.

[0186] In one embodiment, the control module 85 is specifically used to determine the state of the target user in the next time period based on the predicted comprehensive trust of the target user in the next time period; and determine the access policy corresponding to the state of the target user in the next time period based on the state of the target user in the next time period and the correspondence between the user's state and the access policy.

[0187] In one embodiment, the control module 85 is specifically used to obtain the comprehensive trust of the target user in the previous time period; use the difference between the comprehensive trust of the target user in the current time period and the comprehensive trust of the target user in the previous time period as a trust difference threshold; and determine the state of the target user in the next time period based on the comprehensive trust of the target user in the next time period, the trust difference threshold, the first preset threshold and the second preset threshold.

[0188] In one embodiment, the control module 85 is specifically used to, when the comprehensive trust of the target user in the next predicted time period is greater than a first preset threshold, if it is determined that the trust difference threshold is less than a specified value, determine that the state of the target user is trustworthy, and if it is determined that the trust difference threshold is greater than or equal to the specified value, determine that the state of the target user is suspicious; when the comprehensive trust value of the target user in the next predicted time period is greater than a second preset threshold and less than or equal to the first preset threshold, if it is determined that the trust difference threshold is less than the specified value, determine that the state of the target user is suspicious, and if it is determined that the trust difference threshold is greater than or equal to the specified value, determine that the state of the target user is untrustworthy; when the comprehensive trust value of the target user in the next predicted time period is less than or equal to the second preset threshold, if it is determined that the trust difference threshold is less than the specified value, determine that the state of the target user is untrustworthy, and if it is determined that the trust difference threshold is greater than or equal to the specified value, determine that the state of the target user is suspicious.

[0189] Based on the same technical concept, the embodiment of the present application also provides an electronic device 900, referring to Fig. 9 As shown, the electronic device 900 is used to implement the access control method described in the above method embodiment. The electronic device 900 of this embodiment may include: a memory 901, a processor 902, and a computer program stored in the memory and executable on the processor, such as an access control program. When the processor executes the computer program, the steps in the above access control method embodiments are implemented.

[0190] The specific connection medium between the memory 901 and the processor 902 is not limited in the embodiment of the present application. Fig. 9 In the embodiment, the memory 901 and the processor 902 are connected via a bus 903. The bus 903 is Fig. 9 The connection between other components is shown by bold lines, and is not intended to be limiting. The bus 903 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig. 9 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0191] The memory 901 may be a volatile memory, such as a random-access memory (RAM); the memory 901 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), or the memory 901 may be any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 901 may be a combination of the above memories.

[0192] Processor 902 is used to implement the access control method provided in the embodiment of the present application.

[0193] An embodiment of the present application also provides a computer-readable storage medium that stores computer-executable instructions required to execute the above-mentioned processor, which includes a program for executing the above-mentioned processor.

[0194] In some possible implementations, various aspects of the access control method provided by the present application may also be implemented in the form of a program product, which includes a program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the access control method according to various exemplary implementations of the present application described above in this specification.

[0195] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0196] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (apparatus), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0197] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0198] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0199] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0200] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An access control method, characterized in that: include: Obtaining the behavior data of the target user in the current time period and the behavior data of the target user in a preset number of historical time periods; Obtaining terminal device security status information and target cloud server status information of the target user within the current time period; Determine the trustworthiness of the target user in the current time period according to the target user's behavior data in the current time period, the target user's behavior data in the preset number of historical time periods, the target user's terminal device security status information and the target cloud server status information in the current time period, wherein the target user's trustworthiness represents the target user's credibility; Inputting the trustworthiness of the target user in the current time period into a trustworthiness prediction model to obtain the trustworthiness of the target user in the next time period, wherein the trustworthiness prediction model is used to predict the trustworthiness of the target user in the next time period based on the trustworthiness of the target user in the current time period; An access policy corresponding to the next time period is determined according to the predicted trust level of the target user in the next time period, and access control is performed on the target user in the next time period based on the access policy.

2. The method according to claim 1, characterized in that Determining the trustworthiness of the target user in the current time period according to the target user's behavior data in the current time period, the target user's behavior data in the preset number of historical time periods, the target user's terminal device security status information in the current time period, and the target cloud server status information, specifically includes: Determining the direct trust of the target user in the current time period according to the behavior data of the target user in the preset number of historical time periods; Determine the indirect trust of the target user in the current time period according to the behavior data of the target user in the current time period, the terminal device security status information of the target user in the current time period, and the target cloud server status information; Determining the comprehensive trust of the target user in the current time period according to the direct trust of the target user and the indirect trust of the target user; and Inputting the trustworthiness of the target user in the current time period into the trustworthiness prediction model to obtain the trustworthiness of the target user in the next time period specifically includes: The comprehensive trust of the target user in the current time period is input into the trust prediction model to obtain the comprehensive trust of the target user in the next time period.

3. The method according to claim 2, characterized in that Determining the direct trust of the target user in the current time period according to the behavior data of the target user in the preset number of historical time periods specifically includes: For each historical time period, according to the correspondence between the user's behavior and the trust penalty factor, determine the trust penalty factor corresponding to the behavior data of the target user in the historical time period, wherein the trust penalty factor represents the degree of influence of the target user's behavior on the direct trust of the target user; The direct trust of the target user in the current time period is determined based on the direct trust of the target user in each historical time period, the trust penalty factor corresponding to the behavior data of the target user in each historical time period, and the time sensitivity corresponding to the current time period. The time sensitivity corresponding to the current time period represents the degree of influence of the current time period on the direct trust of the target user in time.

4. The method according to claim 3, characterized in that Determine the direct trust of the target user in the current time period according to the direct trust of the target user in each historical time period, the trust penalty factor corresponding to the behavior data of the target user in each historical time period, and the time sensitivity corresponding to the current time period, specifically including: The direct trust of the target user in the current time period is calculated by the following formula: Wherein, E represents the direct trust of the target user in the current time period; E k represents the direct trust of the target user in the kth historical time period, k=1, 2, ..., N, N represents the number of historical time periods; δ represents the time sensitivity corresponding to the current time period; V k Represents the trust penalty factor corresponding to the behavior data of the target user in the kth historical time period.

5. The method according to claim 2, characterized in that Determining the indirect trust of the target user in the current time period according to the behavior data of the target user in the current time period, the terminal device security status information of the target user in the current time period, and the target cloud server status information, specifically includes: Determine the corresponding current user behavior score, terminal status score and server status score according to the target user's behavior data in the current time period, the terminal device security status information of the target user in the current time period and the target cloud server status information; Normalizing the current user behavior score, the terminal status score, and the server status score respectively to obtain a normalized current user behavior score, a normalized terminal status score, and a normalized server status score; The indirect trust degree of the target user in the current time period is obtained by taking a weighted average of the normalized current user behavior score, the normalized terminal status score and the normalized server status score and their corresponding weights.

6. The method according to any one of claims 2 to 5, characterized in that: Determining the comprehensive trust of the target user in the current time period according to the direct trust of the target user and the indirect trust of the target user, specifically includes: The comprehensive trust of the target user in the current time period is calculated by the following formula: CT=γαIT+βDT Wherein, CT represents the comprehensive trust of the target user in the current time period; γ represents the dynamic regulatory factor; IT represents the indirect trust of the target user in the current time period, and α represents the weight of the indirect trust of the target user in the current time period; DT represents the direct trust of the target user in the current time period, and β represents the weight of the direct trust of the target user in the current time period.

7. The method according to claim 2, characterized in that Determining the access strategy corresponding to the next time period according to the predicted trust level of the target user in the next time period specifically includes: Determine the state of the target user in the next time period according to the predicted comprehensive trust of the target user in the next time period; The access policy corresponding to the state of the target user in the next time period is determined according to the state of the target user in the next time period and the correspondence between the state of the user and the access policy.

8. The method according to claim 7, characterized in that Determining the state of the target user in the next time period according to the predicted comprehensive trust of the target user in the next time period specifically includes: Obtain the comprehensive trust of the target user in the previous time period; The difference between the comprehensive trust of the target user in the current time period and the comprehensive trust of the target user in the previous time period is used as a trust difference threshold; The state of the target user in the next time period is determined according to the comprehensive trust of the target user in the next time period, the trust difference threshold, the first preset threshold and the second preset threshold.

9. The method according to claim 8, characterized in that Determining the state of the target user in the next time period according to the comprehensive trust of the target user in the next time period, the trust difference threshold, the first preset threshold and the second preset threshold specifically includes: When the comprehensive trust of the target user in the predicted next time period is greater than a first preset threshold, if it is determined that the trust difference threshold is less than a specified value, the state of the target user is determined to be trustworthy; if it is determined that the trust difference threshold is greater than or equal to the specified value, the state of the target user is determined to be suspicious; When the predicted comprehensive trust value of the target user in the next time period is greater than the second preset threshold and less than or equal to the first preset threshold, if it is determined that the trust difference threshold is less than the specified value, the state of the target user is determined to be suspicious; if it is determined that the trust difference threshold is greater than or equal to the specified value, the state of the target user is determined to be untrustworthy; When the predicted comprehensive trust value of the target user in the next time period is less than or equal to the second preset threshold, if it is determined that the trust difference threshold is less than the specified value, the status of the target user is judged to be untrustworthy; if it is determined that the trust difference threshold is greater than or equal to the specified value, the status of the target user is judged to be suspicious.

10. An access control device, characterized in that: include: A first acquisition module is used to acquire the behavior data of the target user in the current time period and the behavior data of the target user in a preset number of historical time periods; The second acquisition module is used to obtain the terminal device security status information of the target user and the target cloud server status information within the current time period; A trust evaluation module, used to determine the trust of the target user in the current time period according to the target user's behavior data in the current time period, the target user's behavior data in the preset number of historical time periods, the target user's terminal device security status information and the target cloud server status information in the current time period, wherein the target user's trust represents the trustworthiness of the target user; A prediction module, used to input the trust of the target user in the current time period into a trust prediction model to obtain the trust of the target user in the next time period, wherein the trust prediction model is used to predict the trust of the target user in the next time period based on the trust of the target user in the current time period; The control module is used to determine the access policy corresponding to the next time period according to the predicted trust level of the target user in the next time period, and perform access control on the target user in the next time period based on the access policy.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the access control method according to any one of claims 1 to 9 is implemented.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the access control method according to any one of claims 1 to 9 are implemented.

Images