An access control method, apparatus, electronic device, and storage medium

Abstract

This application discloses an access control method, apparatus, electronic device, and storage medium. The method involves acquiring behavioral data of a target user within the current time period and a preset number of behavioral data of the target user within historical time periods; acquiring the security status information of the target user's terminal device and the status information of the target cloud server within the current time period; determining the trust level of the target user in the current time period based on the behavioral data of the target user in the current time period, the behavioral data of the target user in the preset number of historical time periods, the security status information of the target user's terminal device, and the status information of the target cloud server; inputting the trust level of the target user in the current time period into a trust prediction model to obtain the trust level of the target user in the next time period; determining the access policy corresponding to the next time period based on the predicted trust level of the target user in the next time period; and performing access control on the target user in the next time period based on the access policy.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an access control method, apparatus, electronic device and storage medium. Background Technology

[0002] In many applications, data interaction between user terminals and servers needs to be based on trust. In the cloud environment, the cloud platform, as the intermediate hub to ensure the security of interaction between cloud user entities and cloud service entities, adopts dynamic access control policies to ensure user identity authentication and permission control, and also needs to ensure the trustworthiness of the interaction process between user terminals and cloud servers.

[0003] In related technologies, trust-based access control policies typically only consider one-way user trust levels. Once a user's access permissions are authorized, the user's identity is assumed to be valid for subsequent authorizations. However, malicious operations by legitimate but malicious users can still occur during the access process, thus posing security risks to user terminals when accessing cloud servers. Summary of the Invention

[0004] To address the security risks posed by existing access control methods when user terminals access cloud servers, this application provides an access control method, apparatus, electronic device, and storage medium.

[0005] In a first aspect, embodiments of this application provide an access control method, including:

[0006] Acquire the behavioral data of the target user within the current time period and a preset number of behavioral data of the target user within historical time periods;

[0007] Obtain the terminal device security status information and target cloud server status information of the target user within the current time period;

[0008] Based on the target user's behavior data within the current time period, the target user's behavior data within the preset number of historical time periods, the target user's terminal device security status information and target cloud server status information within the current time period, the trust level of the target user in the current time period is determined, and the target user's trust level represents the degree of trustworthiness of the target user;

[0009] The trust level of the target user in the current time period is input into the trust level prediction model to obtain the trust level of the target user in the next time period. The trust level prediction model is used to predict the trust level of the target user in the next time period based on the trust level of the target user in the current time period.

[0010] Based on the predicted trust level of the target user in the next time period, the access strategy corresponding to the next time period is determined, and access control is performed on the target user in the next time period based on the access strategy.

[0011] In one implementation, the trust level of the target user in the current time period is determined based on the target user's behavior data within the current time period, the target user's behavior data within a preset number of historical time periods, the target user's terminal device security status information and target cloud server status information within the current time period. This specifically includes:

[0012] Based on the target user's behavioral data within the preset number of historical time periods, determine the direct trust level of the target user in the current time period;

[0013] Based on the target user's behavioral data within the current time period, the target user's terminal device security status information and the target cloud server status information within the current time period, the indirect trust level of the target user within the current time period is determined.

[0014] Based on the target user's direct trust level and indirect trust level, determine the target user's overall trust level for the current time period; and

[0015] The trust level of the target user in the current time period is input into the trust prediction model to obtain the trust level of the target user in the next time period, specifically including:

[0016] Input the overall trust level of the target user in the current time period into the trust prediction model to obtain the overall trust level of the target user in the next time period.

[0017] In one implementation, determining the direct trust level of the target user in the current time period based on the target user's behavioral data within the preset number of historical time periods specifically includes:

[0018] For each historical time period, based on the correspondence between user behavior and trust penalty factor, the trust penalty factor corresponding to the target user's behavior data within the historical time period is determined. The trust penalty factor characterizes the degree of influence of the target user's behavior on the target user's direct trust level.

[0019] Based on the direct trust level of the target user in each historical time period, the trust penalty factor corresponding to the behavioral data of the target user in each historical time period, and the time sensitivity corresponding to the current time period, the direct trust level of the target user in the current time period is determined. The time sensitivity corresponding to the current time period represents the degree of influence of the current time period on the direct trust level of the target user in time.

[0020] In one implementation, the direct trust level of the target user in the current time period is determined based on the direct trust level of the target user in each historical time period, the trust penalty factor corresponding to the behavioral data of the target user in each historical time period, and the time sensitivity corresponding to the current time period. Specifically, this includes:

[0021] The direct trust level of the target user within the current time period is calculated using the following formula:

[0022]

[0023] Wherein, E represents the direct trust level of the target user within the current time period;

[0024] E k This represents the direct trust level of the target user within the k-th historical time period, where k = 1, 2, ..., N, and N represents the number of historical time periods.

[0025] δ represents the time sensitivity corresponding to the current time period;

[0026] V k This represents the trust level penalty factor corresponding to the target user's behavioral data within the k-th historical time period.

[0027] In one implementation, the indirect trust level of the target user within the current time period is determined based on the target user's behavioral data, the target user's terminal device security status information, and the target cloud server status information within the current time period. Specifically, this includes:

[0028] Based on the target user's behavior data within the current time period, the target user's terminal device security status information within the current time period, and the target cloud server status information, the corresponding current user behavior score, terminal status score, and server status score are determined respectively.

[0029] The current user behavior score, terminal status score, and server status score are normalized respectively to obtain the normalized current user behavior score, normalized terminal status score, and normalized server status score.

[0030] The indirect trust level of the target user within the current time period is obtained by weighting the normalized current user behavior score, the normalized terminal status score, and the normalized server status score with their respective weights.

[0031] In one implementation, the overall trust level of the target user for the current time period is determined based on the target user's direct trust level and the target user's indirect trust level, specifically including:

[0032] The overall trust level of the target user in the current time period is calculated using the following formula:

[0033] CT = γαIT + βDT

[0034] Wherein, CT represents the overall trust level of the target user in the current time period;

[0035] γ represents the dynamic adjustment factor;

[0036] IT represents the indirect trust level of the target user within the current time period, and α represents the weight of the indirect trust level of the target user within the current time period.

[0037] DT represents the direct trust level of the target user within the current time period, and β represents the weight of the direct trust level of the target user within the current time period.

[0038] In one implementation, determining the access strategy for the next time period based on the predicted trust level of the target user for the next time period specifically includes:

[0039] The status of the target user in the next time period is determined based on the predicted overall trust level of the target user in the next time period.

[0040] Based on the state of the target user in the next time period and the correspondence between the user's state and the access policy, the access policy corresponding to the state of the target user in the next time period is determined.

[0041] In one implementation, determining the state of the target user in the next time period based on the predicted overall trust level of the target user in the next time period specifically includes:

[0042] Obtain the overall trust level of the target users mentioned in the previous time period;

[0043] The difference between the overall trust level of the target user in the current time period and the overall trust level of the target user in the previous time period is used as the trust difference threshold.

[0044] The status of the target user in the next time period is determined based on the target user's overall trust level, the trust difference threshold, the first preset threshold, and the second preset threshold.

[0045] In one implementation, determining the status of the target user in the next time period based on the target user's overall trust level, the trust difference threshold, a first preset threshold, and a second preset threshold specifically includes:

[0046] When the overall trust level of the target user in the predicted next time period is greater than the first preset threshold, if it is determined that the trust difference threshold is less than a specified value, the target user is determined to be trustworthy; if it is determined that the trust difference threshold is greater than or equal to the specified value, the target user is determined to be suspicious.

[0047] When the overall trust value of the target user in the predicted next time period is greater than the second preset threshold and less than or equal to the first preset threshold, if it is determined that the trust difference threshold is less than the specified value, then the state of the target user is determined to be suspicious; if it is determined that the trust difference threshold is greater than or equal to the specified value, then the state of the target user is determined to be untrustworthy.

[0048] When the overall trust value of the target user in the predicted next time period is less than or equal to the second preset threshold, if it is determined that the trust difference threshold is less than the specified value, then the target user's status is determined to be untrustworthy; if it is determined that the trust difference threshold is greater than or equal to the specified value, then the target user's status is determined to be suspicious.

[0049] Secondly, embodiments of this application provide an access control device, including:

[0050] The first acquisition module is used to acquire the behavioral data of the target user in the current time period and the behavioral data of the target user in a preset number of historical time periods.

[0051] The second acquisition module is used to acquire the terminal device security status information and target cloud server status information of the target user within the current time period.

[0052] The trust assessment module is used to determine the trust level of the target user in the current time period based on the target user's behavior data in the current time period, the target user's behavior data in the preset number of historical time periods, the target user's terminal device security status information and target cloud server status information in the current time period. The trust level of the target user represents the degree of trustworthiness of the target user.

[0053] The prediction module is used to input the trust level of the target user in the current time period into the trust prediction model to obtain the trust level of the target user in the next time period. The trust prediction model is used to predict the trust level of the target user in the next time period based on the trust level of the target user in the current time period.

[0054] The control module is used to determine the access policy corresponding to the next time period based on the predicted trust level of the target user in the next time period, and to perform access control on the target user in the next time period based on the access policy.

[0055] In one implementation, the trust assessment module is specifically used to determine the direct trust level of the target user in the current time period based on the target user's behavioral data within the preset number of historical time periods; to determine the indirect trust level of the target user in the current time period based on the target user's behavioral data, the target user's terminal device security status information, and the target cloud server status information; and to determine the comprehensive trust level of the target user in the current time period based on the target user's direct trust level and the target user's indirect trust level.

[0056] The prediction module is specifically used to input the comprehensive trust level of the target user in the current time period into the trust prediction model to obtain the comprehensive trust level of the target user in the next time period.

[0057] In one implementation, the trust assessment module is specifically used to, for each historical time period, determine the trust penalty factor corresponding to the target user's behavior data within the historical time period based on the correspondence between user behavior and trust penalty factor, wherein the trust penalty factor characterizes the degree of influence of the target user's behavior on the target user's direct trust level; and determine the target user's direct trust level in the current time period based on the target user's direct trust level in each historical time period, the trust penalty factor corresponding to the target user's behavior data in each historical time period, and the time sensitivity corresponding to the current time period, wherein the time sensitivity corresponding to the current time period characterizes the degree of influence of the current time period on the target user's direct trust level over time.

[0058] In one implementation, the trust assessment module is specifically used to calculate the direct trust level of the target user within the current time period using the following formula:

[0059]

[0060] Wherein, E represents the direct trust level of the target user within the current time period;

[0061] E k This represents the direct trust level of the target user within the k-th historical time period, where k = 1, 2, ..., N, and N represents the number of historical time periods.

[0062] δ represents the time sensitivity corresponding to the current time period;

[0063] V k This represents the trust level penalty factor corresponding to the target user's behavioral data within the k-th historical time period.

[0064] In one implementation, the trust assessment module is specifically used to determine the corresponding current user behavior score, terminal status score, and server status score based on the target user's behavior data, terminal device security status information, and target cloud server status information within the current time period; normalize the current user behavior score, terminal status score, and server status score to obtain normalized current user behavior score, normalized terminal status score, and normalized server status score; and perform a weighted average of the normalized current user behavior score, normalized terminal status score, and normalized server status score with their respective weights to obtain the indirect trust level of the target user within the current time period.

[0065] In one implementation, the trust assessment module is specifically used to calculate the overall trust level of the target user for the current time period using the following formula:

[0066] CT = γαIT + βDT

[0067] Wherein, CT represents the overall trust level of the target user in the current time period;

[0068] γ represents the dynamic adjustment factor;

[0069] IT represents the indirect trust level of the target user within the current time period, and α represents the weight of the indirect trust level of the target user within the current time period.

[0070] DT represents the direct trust level of the target user within the current time period, and β represents the weight of the direct trust level of the target user within the current time period.

[0071] In one implementation, the control module is specifically configured to determine the state of the target user in the next time period based on the predicted comprehensive trust level of the target user in the next time period; and to determine the access policy corresponding to the state of the target user in the next time period based on the state of the target user in the next time period and the correspondence between the user's state and the access policy.

[0072] In one implementation, the control module is specifically configured to: acquire the overall trust level of the target user in the previous time period; use the difference between the overall trust level of the target user in the current time period and the overall trust level of the target user in the previous time period as a trust difference threshold; and determine the status of the target user in the next time period based on the overall trust level of the target user in the next time period, the trust difference threshold, a first preset threshold, and a second preset threshold.

[0073] In one implementation, the control module is specifically configured to: when the overall trust level of the target user in the predicted next time period is greater than a first preset threshold, if the trust difference threshold is determined to be less than a specified value, then determine the target user's status as trustworthy; if the trust difference threshold is determined to be greater than or equal to the specified value, then determine the target user's status as suspicious; when the overall trust level of the target user in the predicted next time period is greater than a second preset threshold and less than or equal to the first preset threshold, if the trust difference threshold is determined to be less than the specified value, then determine the target user's status as suspicious; if the trust difference threshold is determined to be greater than or equal to the specified value, then determine the target user's status as untrustworthy; when the overall trust level of the target user in the predicted next time period is less than or equal to the second preset threshold, if the trust difference threshold is determined to be less than the specified value, then determine the target user's status as untrustworthy; if the trust difference threshold is determined to be greater than or equal to the specified value, then determine the target user's status as suspicious.

[0074] Thirdly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the access control method described in this application.

[0075] Fourthly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the access control method described in this application.

[0076] The beneficial effects of this application are as follows:

[0077] The access control method, apparatus, electronic device, and storage medium provided in this application embodiment involve: a cloud platform acquiring behavioral data of a target user within the current time period and a preset number of behavioral data of the target user within historical time periods; acquiring the security status information of the target user's terminal device and the status information of the target cloud server within the current time period; determining the trust level of the target user in the current time period based on the behavioral data of the target user in the current time period, the behavioral data of the target user in the preset number of historical time periods, the security status information of the target user's terminal device, and the status information of the target cloud server; inputting the trust level of the target user in the current time period into a trust level prediction model to obtain the trust level of the target user in the next time period; the trust level prediction model is used to predict the trust level of the target user in the next time period based on the trust level of the target user in the current time period; determining the access policy corresponding to the next time period based on the predicted trust level of the target user in the next time period, and performing access control on the target user in the next time period based on the access policy. In this embodiment, the trust level of the target user in the current time period is evaluated from multiple dimensions, including the target user's behavior data in the current time period, the target user's behavior data in several historical time periods, the target user's terminal device security status in the current time period, and the target cloud server status information in the current time period. Based on a pre-trained trust prediction model and the target user's trust level in the current time period, the trust level of the target user in the next time period is predicted. Thus, based on the predicted trust level of the target user in the next time period, an early warning is given for user access, and the corresponding access strategy for the next time period is determined. When the next period arrives, access control is implemented for the target user based on the access strategy. Therefore, the access control strategy for users is dynamically adjusted according to the time sliding window granularity, which improves the security of the user terminal accessing the cloud server.

[0078] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0079] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0080] Figure 1 This is a schematic diagram illustrating an application scenario of the access control method provided in the embodiments of this application;

[0081] Figure 2 A flowchart illustrating the access control method provided in an embodiment of this application;

[0082] Figure 3 A flowchart illustrating the process of determining the trust level of a target user in the current time period, provided for an embodiment of this application;

[0083] Figure 4 A flowchart illustrating the process of determining the direct trust level of a target user within the current time period, provided for an embodiment of this application;

[0084] Figure 5 A flowchart illustrating the process of determining the indirect trust level of a target user within the current time period, as provided in an embodiment of this application;

[0085] Figure 6 A flowchart illustrating the process of determining the access strategy corresponding to the next time period, as provided in an embodiment of this application;

[0086] Figure 7 A flowchart illustrating the process of determining the status of a target user in the next time period, provided in an embodiment of this application;

[0087] Figure 8 This is a schematic diagram of the structure of the access control device provided in the embodiments of this application;

[0088] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0089] To address the security risks posed by existing access control methods when user terminals access cloud servers, this application provides an access control method, apparatus, electronic device, and storage medium.

[0090] The preferred embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit this application. Furthermore, the embodiments and features in the embodiments of this application can be combined with each other without conflict.

[0091] First refer to Figure 1This is a schematic diagram of an application scenario of the access control method provided in the embodiments of this application. It may include a terminal device 101, a cloud platform 102, and a cloud server 103. The terminal device 101 and the cloud platform 102 are connected through a network, and the cloud platform 102 and the cloud server 103 are connected through a network. The cloud platform 102 is a platform that provides cloud infrastructure and provides monitoring and management of cloud resources (such as cloud servers, networks, and security policies). When a user accesses the cloud server 103 through their terminal device 101, they must first go through the cloud platform 102. The cloud platform 102 controls the user's access behavior. The cloud platform 102 acquires the target user's behavior data within the current time period and a preset number of target user behavior data within historical time periods, as well as the security status information of the target user's terminal device 101 and the status information of the target cloud server 103 within the current time period. Based on the target user's behavior data within the current time period, the preset number of target user behavior data within historical time periods, the target user's terminal device security status information, and the target cloud server status information, the cloud platform 102 determines the target user's trust level for the current time period. Then, it inputs the target user's trust level for the current time period into a trust level prediction model to obtain the target user's trust level for the next time period. Subsequently, the cloud platform 102 determines the access policy corresponding to the target user for the next time period based on the predicted trust level of the target user for the next time period, and performs access control on the target user in the next time period based on the access policy. Thus, the access control policy for users is dynamically adjusted according to the time sliding window granularity, achieving the effect of pre-intervention and improving the security of the user terminal accessing the cloud server.

[0092] The terminal device 101 may be, but is not limited to, a smartphone, tablet computer, laptop computer, desktop computer, etc., but this application embodiment does not limit it.

[0093] Based on the above application scenarios, the following will refer to the appendix. Figures 2-7 The exemplary embodiments of this application are described in more detail below. It should be noted that the above application scenarios are shown only to facilitate understanding of the spirit and principles of this application, and the implementation methods of this application are not limited in any way. On the contrary, the implementation methods of this application can be applied to any applicable scenario.

[0094] like Figure 2 The diagram shown illustrates the implementation flow of the access control method provided in this application embodiment. This access control method can be applied to the cloud platform 102 described above, and specifically includes the following steps:

[0095] S21. The cloud platform obtains the target user's behavior data within the current time period and a preset number of target user behavior data within the historical time period.

[0096] In practice, the cloud platform records user logs during the communication process between the target user and the target server through their terminal device. The user logs include various behavioral data such as the target user's login, access, and operation. The target user's operation behavior data includes, but is not limited to, normal operation behavior data and abnormal operation behavior data. Abnormal operation behavior data includes, for example, suspicious access behaviors such as accessing the target server during unusual time periods or from unusual addresses, as well as malicious attacks, intrusions, and scanning operations launched by the target user against the target server.

[0097] In this step, the cloud platform obtains the target user's behavior data within the current time period and a preset number of historical time periods from the target user's user logs. The duration and preset number of time periods can be set arbitrarily, such as 1 hour, half an hour, or 10 minutes, or any other arbitrary duration. The preset number is set to N, but this embodiment does not limit this. The preset number of historical time periods refers to the N historical time periods preceding the current time period. Assuming N is 10, the preset number of historical time periods would be the 10 historical time periods preceding the current time period.

[0098] Specifically, the cloud platform can use open-source detection tools (such as Nmap, X-Scan, etc.) to collect port data and use intrusion prevention systems or network threat analyzers to detect unauthorized access behavior of target users within the current time period and record it in the user log.

[0099] S22. Obtain the security status information of the target user's terminal device and the status information of the target cloud server within the current time period.

[0100] In practice, the data acquisition module on the target user's terminal device can monitor the terminal device's operating status in real time, i.e., the terminal device's security status. This security status includes whether the terminal device is running suspicious or malicious processes, services, or applications, and whether there are external devices connected, dangerous ports open, or firewall protection enabled, among other security baseline checks. The target cloud server monitors its own status, including whether the load is abnormal, whether the network is stable, and CPU utilization.

[0101] In this step, the cloud platform obtains the current security status information of the target user's terminal device and the current status information of the target cloud server from the target cloud server.

[0102] In practice, the execution order of steps S21 and S22 is not restricted in the embodiments of this application, and these two steps can be executed simultaneously.

[0103] S23. Based on the target user's behavior data within the current time period, the target user's behavior data within a preset number of historical time periods, the target user's terminal device security status information and the target cloud server status information within the current time period, determine the target user's trust level for the current time period.

[0104] Among them, the target user's trust level represents the degree of credibility of the target user, which is also the target user's overall trust level.

[0105] In specific implementation, it can be done according to the following: Figure 3 The process shown determines the trust level of the target user in the current time period, including the following steps:

[0106] S31. Based on the behavioral data of target users within a preset number of historical time periods, determine the direct trust level of target users within the current time period.

[0107] In specific implementation, it can be done according to the following: Figure 4 The process shown determines the direct trust level of the target user within the current time period, including the following steps:

[0108] S41. For each historical time period, determine the trust penalty factor corresponding to the target user's behavior data within the historical time period based on the correspondence between user behavior and trust penalty factor.

[0109] In specific implementation, the cloud platform pre-sets trust penalty factors corresponding to user behaviors. The trust penalty factor represents the degree of influence of the user's behavior on the user's direct trust level. The larger the penalty factor, the smaller the influence on the user's direct trust level, and the smaller the penalty factor, the greater the influence on the user's direct trust level. In implementation, different trust penalty factors can be set according to the level of malicious behavior. For example, the trust penalty factor for attempting to crack and download encrypted data can be set to 0.3, and the penalty factor for attempting to brute-force login behavior can be set to 0.3, etc. This application embodiment does not limit this.

[0110] In this step, for each historical time period, the cloud platform queries the pre-defined correspondence between user behavior and trust penalty factors to determine the corresponding trust penalty factor for the target user's behavior data within that historical time period. The trust penalty factor for the target user's behavior data characterizes the degree to which the target user's behavior directly impacts the target user's trust level. Thus, the trust penalty factor corresponding to the target user's behavior data for each historical time period can be obtained.

[0111] S42. Determine the direct trust level of the target user in the current time period based on the direct trust level of the target user in each historical time period, the trust level penalty factor corresponding to the behavioral data of the target user in each historical time period, and the time sensitivity corresponding to the current time period.

[0112] The time sensitivity corresponding to the current time period represents the degree of time-related impact of the current time period on the target user's direct trust level. The time sensitivity is related to the time period index, meaning that the closer to the current time period, the greater the time sensitivity value. This is because the user behavior that has just occurred has a greater impact on trust assessment, and the impact decreases as we trace back further. It can be set by the user during implementation.

[0113] During implementation, the direct trust level of the target user within the current time period can be calculated using the following formula:

[0114]

[0115] Where E represents the direct trust level of the target user within the current time period;

[0116] E k This represents the direct trust level of the target user within the k-th historical time period, where k = 1, 2, ..., N, and N represents the number of historical time periods. The N-th historical time period is the previous time period of the current time period; E k The initial value can be set to 0.5;

[0117] δ represents the time sensitivity corresponding to the current time period;

[0118] V k This represents the trust level penalty factor corresponding to the target user's behavioral data within the k-th historical time period.

[0119] S32. Based on the target user's behavior data, the target user's terminal device security status information, and the target cloud server status information within the current time period, determine the target user's indirect trust level within the current time period.

[0120] When implementing, it can be done according to the following: Figure 5 The process shown determines the indirect trust level of a target user within the current time period, including the following steps:

[0121] S51. Based on the target user's behavior data, the target user's terminal device security status information, and the target cloud server status information within the current time period, determine the corresponding current user behavior score, terminal status score, and server status score.

[0122] In practice, the cloud platform pre-sets the initial user behavior score, initial terminal status score, and initial server status score to be the same fixed value under normal conditions. For example, the initial user behavior score, initial terminal status score, and initial server status score can all be set to 100 points. For user behavior data, the cloud platform pre-sets corresponding scores for different abnormal operation behaviors. When determining the current user behavior score, the initial user behavior score is obtained by subtracting the scores corresponding to each abnormal operation behavior included in the target user behavior data within the current time period. For example, if the target user's behavior within the current time period includes accessing the target server during unusual times and launching a malicious attack on the target server, then the initial user behavior score is subtracted from the score corresponding to accessing the target server during unusual times and the score corresponding to the malicious attack on the target server to obtain the current user behavior score. Regarding terminal device security status information, the cloud platform pre-sets corresponding scores for different insecure states of the terminal device. When determining the current terminal status score, the initial terminal status score is subtracted from the scores corresponding to each insecure state included in the target user's terminal device security status information for the current time period. For example, if an external device is detected on the terminal device or a malicious process is running on the terminal device, the initial terminal status score is subtracted from the scores corresponding to the presence of an external device and the running of a malicious process to obtain the current terminal status score. Similarly, regarding server status information, the cloud platform pre-sets corresponding scores for different abnormal server states. When determining the current server status score, the initial server status score is subtracted from the scores corresponding to each abnormal state included in the target server status information for the current time period. For example, if the current target server state includes abnormal load and network instability, the initial server status score is subtracted from the scores corresponding to abnormal load and network instability to obtain the current server status score.

[0123] S52. Normalize the current user behavior score, terminal status score, and server status score respectively to obtain the normalized current user behavior score, normalized terminal status score, and normalized server status score.

[0124] In practical implementation, the cloud platform can use a normalization algorithm to normalize the current user behavior score, terminal status score, and server status score respectively, obtaining the normalized current user behavior score, normalized terminal status score, and normalized server status score. In this embodiment, any normalization algorithm can be used to normalize the current user behavior score, terminal status score, and server status score to the range [0,1].

[0125] S53. The indirect trust level of the target user within the current time period is obtained by weighting the normalized current user behavior score, the normalized terminal status score, and the normalized server status score with their respective weights.

[0126] In practice, the cloud platform can calculate the indirect trust level of the target user within the current time period using the following formula:

[0127] IT = ω1*T1 + ω2*T2 + ω3*T3

[0128] IT represents the indirect trust level of the target user within the current time period;

[0129] T1 represents the normalized current user behavior score, and ω1 represents the weight of the user behavior score.

[0130] T2 represents the normalized terminal state score, and ω2 represents the weight of the terminal state score.

[0131] T3 represents the normalized server state score, and ω3 represents the weight of the server state score.

[0132] ω1+ω2+ω3=1.

[0133] In implementation, the values ​​of ω1, ω2 and ω3 can be set according to requirements, and this application embodiment does not limit this.

[0134] S33. Determine the overall trust level of the target users for the current time period based on their direct trust level and indirect trust level.

[0135] In practice, the cloud platform can calculate the overall trust level of the target user in the current time period using the following formula:

[0136] CT = γαIT + βDT

[0137] CT represents the overall trust level of the target user in the current time period;

[0138] γ represents the dynamic adjustment factor;

[0139] IT represents the indirect trust level of the target user within the current time period, and α represents the weight of the indirect trust level of the target user within the current time period.

[0140] DT represents the direct trust level of the target user within the current time period, and β represents the weight of the direct trust level of the target user within the current time period.

[0141] γα+β=1.

[0142] In practice, α and β are correction coefficients, and the values ​​of γ, α and β can be set by the user. This application does not limit this.

[0143] In this embodiment, the direct trust level of the target user within the current time period is determined by the target user's historical behavior data. Combined with current multi-source data, namely the target user's behavior data, terminal security status information, and target server status information within the current time period, the indirect trust level of the target user within the current time period is determined. Based on the dynamic changes in the access environment, the indirect and direct trust levels of the target user within the current time period are adjusted by a dynamic weighting factor to determine the comprehensive trust level of the target user within the current time period, thereby improving the accuracy of the trust level assessment of the target user.

[0144] S24. Input the trust level of the target user in the current time period into the trust prediction model to obtain the trust level of the target user in the next time period.

[0145] In practical implementation, the cloud platform pre-trains a trust prediction model based on a preset neural network model. It calculates the overall trust level of a large number of sample users in adjacent time periods, inputs the overall trust level of sample users from earlier time periods into the preset neural network model, and predicts the overall trust level of sample users from later time periods. The parameters of the preset neural network model are adjusted based on the deviation between the predicted and actual values ​​of the overall trust level of sample users from later time periods until the model converges, resulting in the trained trust prediction model. The neural network model can be, but is not limited to, a Convolutional Neural Network (CNN) model, a Bidirectional Long Short-Term Memory (BiLSTM) model, or any other neural network model; this application embodiment does not limit this.

[0146] In this step, the cloud platform inputs the overall trust level of the target user in the current time period into the trust prediction model to obtain the overall trust level of the target user in the next time period. The trust prediction model is used to predict the trust level of the target user in the next time period based on the trust level of the target user in the current time period.

[0147] S25. Determine the access policy for the next time period based on the predicted trust level of the target user in the next time period, and implement access control for the target user in the next time period based on the access policy.

[0148] In specific implementation, it can be done according to the following: Figure 6 The process shown determines the access policy for the next time period, including the following steps:

[0149] S61. Determine the status of the target users in the next time period based on the predicted overall trust level of the target users in the next time period.

[0150] The target user's status indicates whether the target user is a trustworthy user. The target user's status includes a trustworthy status, a suspicious status, and an untrustworthy status. Among them, the suspicious status means that it is impossible to confirm whether the user is trustworthy.

[0151] In specific implementation, it can be done according to the following: Figure 7 The process shown determines the status of the target user in the next time period, including the following steps:

[0152] S71. Obtain the overall trust level of the target users in the previous time period.

[0153] In practice, the cloud platform stores the overall trust level of the target user for each historical time period.

[0154] S72. The difference between the overall trust level of the target user in the current time period and the overall trust level of the target user in the previous time period is used as the trust difference threshold.

[0155] S73. Determine the status of the target user in the next time period based on the comprehensive trust level, trust difference threshold, first preset threshold and second preset threshold of the target user in the next time period.

[0156] In specific implementation, when the predicted overall trust level of the target user in the next time period is greater than the first preset threshold, if the trust difference threshold is determined to be less than a specified value, the target user's status is determined to be trustworthy; if the trust difference threshold is determined to be greater than or equal to the specified value, the target user's status is determined to be suspicious. Similarly, when the predicted overall trust level of the target user in the next time period is greater than the second preset threshold and less than or equal to the first preset threshold, if the trust difference threshold is determined to be less than the specified value, the target user's status is determined to be suspicious; if the trust difference threshold is determined to be greater than or equal to the specified value, the target user's status is determined to be untrustworthy. Likewise, when the predicted overall trust level of the target user in the next time period is less than or equal to the second preset threshold, if the trust difference threshold is determined to be less than the specified value, the target user's status is determined to be untrustworthy; if the trust difference threshold is determined to be greater than or equal to the specified value, the target user's status is determined to be suspicious. The first preset threshold, the second preset threshold, and the specified value can be set according to requirements. The first preset threshold is greater than the second preset threshold, and the specified value can be set to a smaller value. For example, the first preset threshold can be set to 0.7, the second preset threshold to 0.4, and the specified value to 0.1. This embodiment does not limit this.

[0157] In this embodiment, the trust difference threshold affects the status of the target user in the next time period. If the predicted overall trust level of the target user in the next time period is greater than a first preset threshold and the trust difference threshold is small, the target user's status is considered trustworthy; if the trust difference threshold is large, the target user's status is considered suspicious. If the predicted overall trust level of the target user in the next time period is greater than a second preset threshold but less than or equal to the first preset threshold and the trust difference threshold is small, the target user's status is considered suspicious; if the trust difference threshold is large, the target user's status is considered untrustworthy. If the predicted overall trust level of the target user in the next time period is less than or equal to the second preset threshold and the trust difference threshold is small, the target user's status is considered untrustworthy; if the trust difference threshold is large, the target user's status is considered suspicious. This improves the accuracy of determining the target user's status in the next time period.

[0158] S62. Based on the status of the target user in the next time period and the correspondence between the user's status and the access policy, determine the access policy corresponding to the status of the target user in the next time period.

[0159] In practice, the cloud platform pre-sets access policies corresponding to different user states. For example, when a user's state is trusted, the corresponding access policy is set to "accept access"; when a user's state is suspicious, the corresponding access policy is set to "re-authenticate," that is, re-authenticate the user's identity; and when a user's state is untrusted, the corresponding policy is "deny access."

[0160] In this step, the cloud platform determines the access policy corresponding to the target user's status in the next time period based on the preset correspondence between user status and access policy. If the target user's status in the next time period is trusted, the access policy is: accept access; if the target user's status is suspicious, the access policy is: re-authenticate to re-authenticate the target user's identity; if the target user's status is untrusted, the access policy is: deny access.

[0161] Therefore, when the next time period arrives, the cloud platform will control access to the target user in the next time period based on the access policy corresponding to the target user's status in the next time period.

[0162] The access control method provided in this application involves a cloud platform acquiring behavioral data of a target user within the current time period and a preset number of behavioral data of the target user within historical time periods; acquiring the security status information of the target user's terminal device and the status information of the target cloud server within the current time period; determining the trust level of the target user in the current time period based on the behavioral data of the target user in the current time period, the behavioral data of the target user in the preset number of historical time periods, the security status information of the target user's terminal device, and the status information of the target cloud server; inputting the trust level of the target user in the current time period into a trust prediction model to obtain the trust level of the target user in the next time period; the trust prediction model is used to predict the trust level of the target user in the next time period based on the trust level of the target user in the current time period; determining the access policy corresponding to the next time period based on the predicted trust level of the target user in the next time period, and performing access control on the target user in the next time period based on the access policy. In this embodiment, the trust level of the target user in the current time period is evaluated from multiple dimensions, including the target user's behavior data in the current time period, the target user's behavior data in several historical time periods, the target user's terminal device security status in the current time period, and the target cloud server status information in the current time period. Based on a pre-trained trust prediction model and the target user's trust level in the current time period, the trust level of the target user in the next time period is predicted. Thus, based on the predicted trust level of the target user in the next time period, an early warning is given for user access, and the corresponding access strategy for the next time period is determined. When the next period arrives, access control is implemented for the target user based on the access strategy. Therefore, the access control strategy for users is dynamically adjusted according to the time sliding window granularity, which improves the security of the user terminal accessing the cloud server.

[0163] Based on the same inventive concept, this application also provides an access control device. Since the principle of the access control device in solving the problem is similar to that of the access control method, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0164] like Figure 8 As shown, this is a schematic diagram of the access control device provided in an embodiment of this application, which can be applied to, for example... Figure 1 In the cloud platform 102 shown, the device includes:

[0165] The first acquisition module 81 is used to acquire the target user's behavior data within the current time period and a preset number of the target user's behavior data within historical time periods;

[0166] The second acquisition module 82 is used to acquire the terminal device security status information and target cloud server status information of the target user within the current time period.

[0167] The trust assessment module 83 is used to determine the trust level of the target user in the current time period based on the target user's behavior data in the current time period, the target user's behavior data in the preset number of historical time periods, the target user's terminal device security status information and target cloud server status information in the current time period. The trust level of the target user represents the degree of trustworthiness of the target user.

[0168] Prediction module 84 is used to input the trust level of the target user in the current time period into the trust prediction model to obtain the trust level of the target user in the next time period. The trust prediction model is used to predict the trust level of the target user in the next time period based on the trust level of the target user in the current time period.

[0169] The control module 85 is used to determine the access policy corresponding to the next time period based on the predicted trust level of the target user in the next time period, and to perform access control on the target user in the next time period based on the access policy.

[0170] In one implementation, the trust assessment module 83 is specifically used to determine the direct trust level of the target user in the current time period based on the target user's behavior data within the preset number of historical time periods; to determine the indirect trust level of the target user in the current time period based on the target user's behavior data, the target user's terminal device security status information, and the target cloud server status information; and to determine the comprehensive trust level of the target user in the current time period based on the target user's direct trust level and the target user's indirect trust level.

[0171] The prediction module 84 is specifically used to input the comprehensive trust level of the target user in the current time period into the trust prediction model to obtain the comprehensive trust level of the target user in the next time period.

[0172] In one implementation, the trust assessment module 83 is specifically used to, for each historical time period, determine the trust penalty factor corresponding to the target user's behavior data within the historical time period based on the correspondence between the user's behavior and the trust penalty factor, wherein the trust penalty factor characterizes the degree of influence of the target user's behavior on the target user's direct trust level; and determine the target user's direct trust level in the current time period based on the target user's direct trust level in each historical time period, the trust penalty factor corresponding to the target user's behavior data in each historical time period, and the time sensitivity corresponding to the current time period, wherein the time sensitivity corresponding to the current time period characterizes the degree of influence of the current time period on the target user's direct trust level over time.

[0173] In one implementation, the trust assessment module 83 is specifically used to calculate the direct trust level of the target user within the current time period using the following formula:

[0174]

[0175] Wherein, E represents the direct trust level of the target user within the current time period;

[0176] E k This represents the direct trust level of the target user within the k-th historical time period, where k = 1, 2, ..., N, and N represents the number of historical time periods.

[0177] δ represents the time sensitivity corresponding to the current time period;

[0178] V k This represents the trust level penalty factor corresponding to the target user's behavioral data within the k-th historical time period.

[0179] In one implementation, the trust assessment module 83 is specifically used to determine the corresponding current user behavior score, terminal status score, and server status score based on the target user's behavior data, terminal device security status information, and target cloud server status information within the current time period; normalize the current user behavior score, terminal status score, and server status score to obtain normalized current user behavior score, normalized terminal status score, and normalized server status score; and perform a weighted average of the normalized current user behavior score, normalized terminal status score, and normalized server status score with their respective weights to obtain the indirect trust level of the target user within the current time period.

[0180] In one implementation, the trust assessment module 83 is specifically used to calculate the overall trust level of the target user in the current time period using the following formula:

[0181] CT = γαIT + βDT

[0182] Wherein, CT represents the overall trust level of the target user in the current time period;

[0183] γ represents the dynamic adjustment factor;

[0184] IT represents the indirect trust level of the target user within the current time period, and α represents the weight of the indirect trust level of the target user within the current time period.

[0185] DT represents the direct trust level of the target user within the current time period, and β represents the weight of the direct trust level of the target user within the current time period.

[0186] In one implementation, the control module 85 is specifically configured to determine the state of the target user in the next time period based on the predicted comprehensive trust level of the target user in the next time period; and to determine the access policy corresponding to the state of the target user in the next time period based on the state of the target user in the next time period and the correspondence between the user's state and the access policy.

[0187] In one embodiment, the control module 85 is specifically used to obtain the overall trust level of the target user in the previous time period; use the difference between the overall trust level of the target user in the current time period and the overall trust level of the target user in the previous time period as a trust difference threshold; and determine the status of the target user in the next time period based on the overall trust level of the target user in the next time period, the trust difference threshold, a first preset threshold, and a second preset threshold.

[0188] In one implementation, the control module 85 is specifically configured to: when the overall trust level of the target user in the predicted next time period is greater than a first preset threshold, if the trust difference threshold is determined to be less than a specified value, then determine the target user's status as trustworthy; if the trust difference threshold is determined to be greater than or equal to the specified value, then determine the target user's status as suspicious; when the overall trust level of the target user in the predicted next time period is greater than a second preset threshold and less than or equal to the first preset threshold, if the trust difference threshold is determined to be less than the specified value, then determine the target user's status as suspicious; if the trust difference threshold is determined to be greater than or equal to the specified value, then determine the target user's status as untrustworthy; when the overall trust level of the target user in the predicted next time period is less than or equal to the second preset threshold, if the trust difference threshold is determined to be less than the specified value, then determine the target user's status as untrustworthy; if the trust difference threshold is determined to be greater than or equal to the specified value, then determine the target user's status as suspicious.

[0189] Based on the same technical concept, this application also provides an electronic device 900, referring to... Figure 9 As shown, the electronic device 900 is used to implement the access control method described in the above-described method embodiments. The electronic device 900 in this embodiment may include: a memory 901, a processor 902, and a computer program, such as an access control program, stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps in the various access control method embodiments described above.

[0190] This application embodiment does not limit the specific connection medium between the memory 901 and the processor 902. This application embodiment... Figure 9 The memory 901 and the processor 902 are connected via a bus 903, and the bus 903 is in Figure 9 The connections between other components are shown in bold lines only and are not intended to be limiting. The bus 903 can be divided into address bus, data bus, control bus, etc. For ease of illustration, Figure 9 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0191] Memory 901 may be volatile memory, such as random-access memory (RAM); memory 901 may also be non-volatile memory, such as read-only memory, flash memory, hard disk drive (HDD), or solid-state drive (SSD); or memory 901 may be any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. Memory 901 may be a combination of the above-mentioned memories.

[0192] The processor 902 is used to implement the access control method provided in the embodiments of this application.

[0193] This application also provides a computer-readable storage medium storing computer-executable instructions required to execute the processor, including a program required to execute the processor.

[0194] In some possible implementations, various aspects of the access control method provided in this application may also be implemented as a program product comprising program code that, when the program product is run on an electronic device, causes the electronic device to perform the steps of the access control method according to the various exemplary embodiments of this application described above.

[0195] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0196] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (devices), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0197] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0198] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0199] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0200] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. An access control method, characterized in that, include: Acquire the behavioral data of the target user within the current time period and a preset number of behavioral data of the target user within historical time periods; Obtain the terminal device security status information and target cloud server status information of the target user within the current time period; Based on the target user's behavioral data within the current time period, the target user's behavioral data within a preset number of historical time periods, the target user's terminal device security status information, and the target cloud server status information within the current time period, the trust level of the target user in the current time period is determined. Specifically, this includes: determining the direct trust level of the target user in the current time period based on the target user's behavioral data within the preset number of historical time periods; determining the indirect trust level of the target user in the current time period based on the target user's behavioral data, terminal device security status information, and target cloud server status information within the current time period; and determining the comprehensive trust level of the target user in the current time period based on the direct and indirect trust levels. The target user's trust level characterizes the degree of trustworthiness of the target user. The comprehensive trust level of the target user in the current time period is input into the trust prediction model to obtain the comprehensive trust level of the target user in the next time period. The trust prediction model is used to predict the trust level of the target user in the next time period based on the trust level of the target user in the current time period. Based on the predicted trust level of the target user in the next time period, the access policy corresponding to the next time period is determined, and access control is performed on the target user in the next time period based on the access policy.

2. The method as described in claim 1, characterized in that, Based on the target user's behavioral data within the preset number of historical time periods, the direct trust level of the target user in the current time period is determined, specifically including: For each historical time period, based on the correspondence between user behavior and trust penalty factor, the trust penalty factor corresponding to the target user's behavior data within the historical time period is determined. The trust penalty factor characterizes the degree of influence of the target user's behavior on the target user's direct trust level. Based on the direct trust level of the target user in each historical time period, the trust penalty factor corresponding to the behavioral data of the target user in each historical time period, and the time sensitivity corresponding to the current time period, the direct trust level of the target user in the current time period is determined. The time sensitivity corresponding to the current time period represents the degree of influence of the current time period on the direct trust level of the target user in time.

3. The method as described in claim 2, characterized in that, Based on the direct trust level of the target user in each historical time period, the trust penalty factor corresponding to the behavioral data of the target user in each historical time period, and the time sensitivity corresponding to the current time period, the direct trust level of the target user in the current time period is determined, specifically including: The direct trust level of the target user within the current time period is calculated using the following formula: Wherein, E represents the direct trust level of the target user within the current time period; E k This represents the direct trust level of the target user within the k-th historical time period, where k = 1, 2, ..., N, and N represents the number of historical time periods. δ represents the time sensitivity corresponding to the current time period; V k This represents the trust level penalty factor corresponding to the target user's behavioral data within the k-th historical time period.

4. The method as described in claim 1, characterized in that, Based on the target user's behavioral data within the current time period, the target user's terminal device security status information within the current time period, and the target cloud server status information, the indirect trust level of the target user within the current time period is determined, specifically including: Based on the target user's behavior data within the current time period, the target user's terminal device security status information within the current time period, and the target cloud server status information, the corresponding current user behavior score, terminal status score, and server status score are determined respectively. The current user behavior score, terminal status score, and server status score are normalized respectively to obtain the normalized current user behavior score, normalized terminal status score, and normalized server status score. The indirect trust level of the target user within the current time period is obtained by weighting the normalized current user behavior score, the normalized terminal status score, and the normalized server status score with their respective weights.

5. The method according to any one of claims 2 to 4, characterized in that, Based on the target user's direct trust level and indirect trust level, the overall trust level of the target user for the current time period is determined, specifically including: The overall trust level of the target user in the current time period is calculated using the following formula: CT = γαIT + βDT Wherein, CT represents the overall trust level of the target user in the current time period; γ represents the dynamic adjustment factor; IT represents the indirect trust level of the target user within the current time period, and α represents the weight of the indirect trust level of the target user within the current time period; DT represents the direct trust level of the target user within the current time period, and β represents the weight of the direct trust level of the target user within the current time period.

6. The method as described in claim 1, characterized in that, Based on the predicted trust level of the target users in the next time period, the access strategy for the next time period is determined, specifically including: The status of the target user in the next time period is determined based on the predicted overall trust level of the target user in the next time period. Based on the state of the target user in the next time period and the correspondence between the user's state and the access policy, the access policy corresponding to the state of the target user in the next time period is determined.

7. The method as described in claim 6, characterized in that, The status of the target user in the next time period is determined based on the predicted overall trust level of the target user in the next time period, specifically including: Obtain the overall trust level of the target users mentioned in the previous time period; The difference between the overall trust level of the target user in the current time period and the overall trust level of the target user in the previous time period is used as the trust difference threshold. The status of the target user in the next time period is determined based on the target user's overall trust level, the trust difference threshold, the first preset threshold, and the second preset threshold.

8. The method as described in claim 7, characterized in that, The first preset threshold is greater than the second preset threshold; Based on the target user's overall trust level in the next time period, the trust difference threshold, the first preset threshold, and the second preset threshold, the status of the target user in the next time period is determined, specifically including: When the overall trust level of the target user in the predicted next time period is greater than the first preset threshold, if it is determined that the trust difference threshold is less than a specified value, the target user is determined to be trustworthy; if it is determined that the trust difference threshold is greater than or equal to the specified value, the target user is determined to be suspicious. When the overall trust value of the target user in the predicted next time period is greater than the second preset threshold and less than or equal to the first preset threshold, if it is determined that the trust difference threshold is less than the specified value, then the state of the target user is determined to be suspicious; if it is determined that the trust difference threshold is greater than or equal to the specified value, then the state of the target user is determined to be untrustworthy. When the overall trust value of the target user in the predicted next time period is less than or equal to the second preset threshold, if it is determined that the trust difference threshold is less than the specified value, then the target user's status is determined to be untrustworthy; if it is determined that the trust difference threshold is greater than or equal to the specified value, then the target user's status is determined to be suspicious.

9. An access control device, characterized in that, include: The first acquisition module is used to acquire the behavioral data of the target user in the current time period and the behavioral data of the target user in a preset number of historical time periods. The second acquisition module is used to acquire the terminal device security status information and target cloud server status information of the target user within the current time period. The trust assessment module is used to determine the trust level of the target user in the current time period based on the target user's behavior data in the current time period, the target user's behavior data in the preset number of historical time periods, the target user's terminal device security status information and target cloud server status information in the current time period. The trust level of the target user represents the degree of trustworthiness of the target user. The trust assessment module is specifically used to determine the direct trust level of the target user in the current time period based on the target user's behavior data in the preset number of historical time periods; and to determine the indirect trust level of the target user in the current time period based on the target user's behavior data in the current time period, the target user's terminal device security status information and the target cloud server status information in the current time period. Based on the target user's direct trust level and the target user's indirect trust level, determine the target user's overall trust level for the current time period; The prediction module is used to input the comprehensive trust level of the target user in the current time period into the trust prediction model to obtain the comprehensive trust level of the target user in the next time period. The trust prediction model is used to predict the trust level of the target user in the next time period based on the trust level of the target user in the current time period. The control module is used to determine the access policy corresponding to the next time period based on the predicted trust level of the target user in the next time period, and to perform access control on the target user in the next time period based on the access policy.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the access control method as described in any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the access control method as described in any one of claims 1 to 8.

Images