Zero-trust architecture network security protection method and system, medium and program product

Abstract

The invention discloses a zero-trust architecture network security protection method and system, a medium and a program product, and the method comprises the steps: obtaining an access request; extracting credit characteristics, and calculating a user trust index according to the credit characteristics; constructing a directed trust transfer graph; calculating a trust attenuation coefficient of each trust transfer edge; according to the trust attenuation coefficient, calculating along the directed trust transfer graph to obtain a node trust value; constructing a relation similarity matrix; clustering according to the relationship similarity matrix to obtain a plurality of trust groups; calculating a group trust threshold according to the node trust value in each trust group; judging whether the node trust value of each trust node in the trust group in which the target resource is located is greater than a group trust threshold value corresponding to the trust group in which the target resource is located; if yes, safety verification is passed; and if not, updating the transmission path information and returning to execute the step of constructing the directed trust transfer graph according to the transmission path information. According to the invention, the security of the network is improved, and the network security protection effect is further improved.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a zero-trust architecture network security protection method, system, medium, program product method and system. Background Art

[0002] With the rapid development of information technology and the increasing popularity of network applications, the traditional network security model based on border protection can no longer meet the needs of the current complex and changing network environment. The traditional network security model is based on the wall thinking, which protects internal resources by deploying security devices such as firewalls at the network border. This model has the problem of focusing on the border and neglecting the internal. Once the border is breached, the internal system will face serious security threats. At the same time, with the application of new technologies such as cloud computing and mobile office, network boundaries are becoming increasingly blurred, and traditional border protection methods are difficult to effectively respond to security challenges such as internal threats and precision strikes.

[0003] In related technologies, fine-grained control of network resources can be achieved by continuously verifying user identities and dynamically adjusting access rights in combination with user behavior feature analysis. This method breaks the traditional static trust boundary and establishes an identity-based dynamic trust mechanism, which can effectively prevent unauthorized access and potential security threats.

[0004] However, when users access target resources through multiple system nodes, the trust status between nodes is difficult to effectively transfer and share, resulting in security vulnerabilities in a certain link of the trust chain. The defects of this trust transfer mechanism not only increase the management complexity of the system, but also may cause inconsistent implementation of security policies, reduce network security, and thus reduce the effectiveness of network security protection. Summary of the invention

[0005] The present application provides a zero-trust architecture network security protection method, system, medium and program product for improving the security of the network and thereby improving the effectiveness of network security protection.

[0006] In a first aspect, the present application provides a zero-trust architecture network security protection method, which obtains an access request from a target user, the access request includes identity information of the target user, target resource information, and transmission path information, and the transmission path information includes node identifiers of multiple system nodes; Extracting credit features from a preset user credit database based on identity information, and calculating the user trust index based on the credit features; A directed trust transfer graph is constructed based on the transmission path information, each node identifier is mapped to a trust node in the directed trust transfer graph, and trust transfer edges are established between adjacent trust nodes; Obtain the historical security event data of each trust node, and calculate the trust attenuation coefficient of each trust transfer edge based on the historical security event data; The user trust index is used as the initial trust value of the starting trust node, and the node trust value of each trust node is calculated along the directed trust transfer graph according to the trust attenuation coefficient; Construct a relational similarity matrix based on the connection relationship of each trust transfer edge; Cluster the trust nodes according to the relationship similarity matrix to obtain multiple trust groups; The group trust threshold corresponding to each trust group is calculated based on the distribution characteristics of the node trust values ​​in each trust group; Determine whether the node trust value of each trust node in the trust group where the target resource is located is greater than the group trust threshold corresponding to the trust group where the target resource is located; If so, it is determined that the access request passes the security verification; If not, update the transmission path information and return to execute the step of constructing a directed trust transfer graph according to the transmission path information.

[0007] By adopting the above technical solution, the access request of the target user is obtained and the user trust index is extracted. A directed trust transfer graph is constructed in combination with the transmission path information, the trust decay coefficient and the node trust value are calculated, and then the trust nodes are clustered based on the relationship similarity matrix and the group trust threshold is calculated to achieve security verification of the access request. In the verification process, multi-dimensional information such as user credibility, transmission path credibility, and node group characteristics are considered, making the security verification more comprehensive and accurate. The attenuation transmission of the trust value is quantified by the trust decay coefficient of the trust transmission edge, which accurately reflects the impact of different transmission paths on the system security. The clustering method is used to group the trust nodes and set differentiated group trust thresholds, which not only ensures the unified management within the similar node group, but also realizes differentiated control between different groups. When the verification fails, the system will automatically update the transmission path and re-verify, which improves the fault tolerance and availability of the system, improves the system security while also improving flexibility, thereby improving the effect of network security protection.

[0008] In conjunction with some embodiments of the first aspect, in some embodiments, calculating the user trust index according to the credit feature specifically includes: Construct an N-dimensional feature vector based on the credit characteristics, where N is a positive integer; Performing weighted calculation on each dimension of the N-dimensional feature vector based on a preset weight coefficient to obtain a weighted feature vector; Input the weighted feature vector into a preset trust evaluation model, which is trained based on historical user credit characteristics and security event data; The user trust index is determined based on the output results of the preset trust evaluation model.

[0009] By adopting the above technical solution, an N-dimensional feature vector is constructed to quantify the credit characteristics of users, and a preset weight coefficient is introduced to perform weighted calculation on the feature vector, so that the degree of influence of different dimensional features on the final trust index can be reasonably distinguished. Through the close cooperation of feature vector quantization, weight weighting and model evaluation, the scientific transformation of user credit characteristics to trust index is realized, and the accuracy of the obtained trust index is improved. The training process of the model integrates the credit characteristics and security event data of historical users, so that the evaluation results take into account the inherent credit characteristics of users and combine the actual security performance, improving the accuracy and reliability of the trust index.

[0010] In conjunction with some embodiments of the first aspect, in some embodiments, calculating the trust decay coefficient of each trust transfer edge according to historical security event data specifically includes: Obtain security event data of each trusted node within a first preset time window; Identify the abnormal behavior types of each trust node based on security event data; Construct a security risk scoring matrix based on abnormal behavior types; The trust attenuation coefficient of the corresponding trust transfer edge is calculated according to the security risk score of the adjacent trust nodes.

[0011] By adopting the above technical solution, the security event data of the trust node is collected within the preset time window, the abnormal behavior type is identified and the security risk scoring matrix is ​​constructed. Finally, the trust attenuation coefficient of the trust transfer edge is calculated based on the risk score of the adjacent node, so that the attenuation degree of the trust value is closely related to the actual security risk of the node. By mapping the abnormal behavior type to the security risk scoring matrix, a quantitative relationship between security events and risk levels is established, making the calculation of trust attenuation more objective. The comprehensive consideration of the risk scores of adjacent nodes ensures that the attenuation coefficient of the trust transfer edge can reflect the actual security risk on the transmission path, thereby providing a more accurate attenuation basis for the subsequent trust value transfer calculation.

[0012] In combination with some embodiments of the first aspect, in some embodiments, before constructing the directed trust transfer graph according to the transmission path information, the method further includes: Obtaining network topology information of each system node in the transmission path information; Construct an initial path map based on network topology information; Determine whether there is a loop in the initial path graph; If so, adjusting the transmission path information to remove the loop; If not, execute the step of constructing a directed trust transfer graph according to the transmission path information.

[0013] By adopting the above technical solution, the network topology information of the system nodes is obtained to construct the initial path graph, and loop detection and processing are performed on it, ensuring that the directed trust transfer graph finally constructed has a good topological structure. The loop detection mechanism can promptly discover the circular dependency problem in the transmission path, and the loop removal operation ensures the unidirectionality and terminability of the trust value transfer process, reduces the problems of circular calculation or dead loop in the trust transfer process, and improves the efficiency and accuracy of subsequent trust value calculation. By optimizing the network topology structure, the authenticity of the trust transfer relationship between system nodes reflected by the directed trust transfer graph is improved.

[0014] In conjunction with some embodiments of the first aspect, in some embodiments, determining whether there is a loop in the initial path graph specifically includes: Perform a depth-first traversal of the initial path graph and record the system nodes visited during the traversal; Determine whether the currently accessed system node is among the recorded system nodes; If so, it is determined that there is a loop in the initial path graph; If not, then execute the step of depth-first traversal of the initial path graph; When the depth-first traversal is completed, if the currently visited system node is not in the recorded system nodes, it is determined that there is no loop in the initial path graph.

[0015] By adopting the above technical solution, a depth-first traversal of the initial path graph is performed and the visited system nodes are recorded, so that whether there is a loop in the transmission path can be systematically detected. When it is found that the currently visited system node is already in the record list, it indicates that there is a loop, which improves the accuracy of identifying loop conditions in various complex topologies. The existence of loops will cause data packets to be transmitted repeatedly in the network, which not only wastes network resources, but also may cause network congestion and affect the overall transmission performance. By timely discovering and eliminating loops, the rationality and efficiency of the data transmission path can be improved.

[0016] In combination with some embodiments of the first aspect, in some embodiments, after calculating the group trust threshold corresponding to each trust group according to the distribution characteristics of the node trust values ​​in each trust group, the method further includes: Obtain node trust value change data and access records of each trust group within a second preset time window; The group stability index of each trust group is calculated based on the node trust value change data. The group stability index is used to characterize the fluctuation degree of the node trust value in the trust group; The group trust threshold is weighted and modified based on the group stability index to obtain a dynamic trust threshold; Correlate and analyze the dynamic trust threshold with the security event data in the access record to generate a threshold optimization strategy; The dynamic trust threshold is calibrated according to the threshold optimization strategy to obtain the final group trust threshold.

[0017] By adopting the above technical solution, a group stability index is introduced to characterize the degree of fluctuation of the trust value of nodes in the trust group, and the group trust threshold is dynamically adjusted in combination with the historical change data of the node trust value. This threshold correction mechanism based on historical data can adapt to the dynamic change characteristics of the network environment, making the setting of the trust threshold more in line with the actual situation. By correlating and analyzing the dynamic trust threshold with the security event data in the access record, the system can identify the key factors affecting the threshold setting and generate a scientific and reasonable threshold optimization strategy based on these factors. The optimized group trust threshold not only maintains the effective identification ability of abnormal access behavior, but also reduces the problem of normal access being misjudged due to overly strict threshold settings. This adaptive threshold adjustment mechanism improves the accuracy and reliability of the system, while reducing the workload of security managers, making the access control of the zero-trust architecture more accurate and efficient.

[0018] In conjunction with some embodiments of the first aspect, in some embodiments, the dynamic trust threshold is associated with the security event data in the access record and analyzed to generate a threshold optimization strategy, which specifically includes: Extract the occurrence time of various security events in the access records and the corresponding dynamic trust thresholds; Construct a time series correlation matrix, and calculate the correlation coefficient between various security events and dynamic trust thresholds based on the time series correlation matrix; Identify key security event types that affect dynamic trust thresholds based on correlation coefficients; Construct a threshold adjustment function based on the historical distribution patterns of key security event types; Generate a threshold optimization strategy based on the threshold adjustment function.

[0019] By adopting the above technical solution, a time-series correlation matrix is ​​constructed to analyze the correlation between security events and dynamic trust thresholds, which can accurately identify the types of key security events that have a significant impact on threshold settings. The threshold adjustment function is constructed based on the historical distribution law of key security events, so that the threshold optimization strategy has quantifiable and predictable characteristics, reducing the deviation that may be caused by subjective experience judgment, and can capture the actual impact of different types of security events on the security status of the system. Through the calculation and analysis of correlation coefficients, the system can promptly discover the potential correlation pattern between security events and trust thresholds, which helps to predictively adjust threshold parameters, improve the system's ability to identify and respond to different security threats, and improve the protection effect of the zero-trust architecture in complex network environments.

[0020] In second aspect, an embodiment of the present application provides a zero-trust architecture network security protection system, which zero-trust architecture network security protection system includes: one or more processors and a memory; the memory is coupled to one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and one or more processors call computer instructions to enable the system to execute the method described in the first aspect and any possible implementation method of the first aspect.

[0021] In a third aspect, an embodiment of the present application provides a computer-readable storage medium, comprising instructions, which, when executed on a system, causes the system to execute the method described in the first aspect and any possible implementation of the first aspect.

[0022] In a fourth aspect, an embodiment of the present application provides a computer program product, characterized in that when the computer program product runs on a system, the system executes the method described in any possible implementation manner in the first aspect.

[0023] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages: 1. The present application provides a zero-trust architecture network security protection method, which obtains the access request of the target user and extracts the user trust index, constructs a directed trust transfer graph in combination with the transmission path information, calculates the trust decay coefficient and the node trust value, and then clusters the trust nodes based on the relationship similarity matrix and calculates the group trust threshold to achieve security verification of the access request. In the verification process, multi-dimensional information such as user credibility, transmission path credibility, and node group characteristics are considered, making the security verification more comprehensive and accurate. The attenuation transmission of the trust value is quantified by the trust decay coefficient of the trust transmission edge, accurately reflecting the impact of different transmission paths on the system security. The clustering method is used to group the trust nodes and set differentiated group trust thresholds, which not only ensures the unified management within the similar node group, but also realizes differentiated control between different groups. When the verification fails, the system will automatically update the transmission path and re-verify, which improves the fault tolerance and availability of the system, improves the system security while also improving the flexibility, thereby improving the effect of network security protection.

[0024] 2. The present application provides a zero-trust architecture network security protection method, which obtains the network topology information of the system nodes to construct an initial path graph, and performs loop detection and processing on it, ensuring that the directed trust transfer graph finally constructed has a good topological structure. The loop detection mechanism can promptly discover the circular dependency problem in the transmission path, and the loop removal operation ensures the unidirectionality and terminability of the trust value transfer process, reduces the problems of circular calculation or dead loop in the trust transfer process, and improves the efficiency and accuracy of subsequent trust value calculations. By optimizing the network topology structure, the authenticity of the trust transfer relationship between system nodes reflected in the directed trust transfer graph is improved.

[0025] 3. The present application provides a zero-trust architecture network security protection method, which introduces a group stability index to characterize the degree of fluctuation of the trust value of the node in the trust group, and dynamically adjusts the group trust threshold based on the historical change data of the node trust value. This threshold correction mechanism based on historical data can adapt to the dynamic change characteristics of the network environment, so that the setting of the trust threshold is more in line with the actual situation. By correlating and analyzing the dynamic trust threshold with the security event data in the access record, the system can identify the key factors affecting the threshold setting, and generate a scientific and reasonable threshold optimization strategy based on these factors. The optimized group trust threshold not only maintains the effective identification ability of abnormal access behavior, but also reduces the problem of normal access being misjudged due to overly strict threshold settings. This adaptive threshold adjustment mechanism improves the accuracy and reliability of the system, while reducing the workload of security managers, making the access control of the zero-trust architecture more accurate and efficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a flow chart of a zero-trust architecture network security protection method in an embodiment of the present application.

[0027] Figure 2 It is a flow chart of a transmission path preprocessing method in an embodiment of the present application.

[0028] Figure 3 It is a schematic diagram of the physical device structure of a zero-trust architecture network security protection system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] The terms used in the following embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to be used as limitations to the present application. As used in the specification and appended claims of the present application, the singular expressions "one", "a kind of", "said", "above", "the" and "this" are intended to also include plural expressions, unless there is a clear indication to the contrary in the context. It should also be understood that the term "and / or" used in the present application refers to any or all possible combinations comprising one or more listed items.

[0030] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

[0031] The following uses an embodiment and combines Figure 1 , a zero-trust architecture network security protection method is described in an embodiment of the present application: See also Figure 1 , which is a flow chart of a zero-trust architecture network security protection method in an embodiment of the present application.

[0032] S101, extracting credit features from a preset user credit database based on identity information, and calculating a user trust index based on the credit features; Before implementing this step, the system first obtains the target user's access request, which includes the target user's identity information, target resource information, and transmission path information. The transmission path information includes node identifiers of multiple system nodes. Then the system extracts credit features from the preset user credit database based on the identity information, and calculates the user trust index based on the credit features. Specifically: construct an N-dimensional feature vector based on the credit features, where N is a positive integer; Performing weighted calculation on each dimension of the N-dimensional feature vector based on a preset weight coefficient to obtain a weighted feature vector; Input the weighted feature vector into a preset trust evaluation model, which is trained based on historical user credit characteristics and security event data; The user trust index is determined based on the output results of the preset trust evaluation model.

[0033] This step first obtains the target user's access request, which contains the target user's identity information, target resource information, and transmission path information, where the transmission path information includes the node identifiers of multiple system nodes. Based on the target user's identity information, the system extracts the user's corresponding credit features from the preset user credit database, and then calculates the user trust index based on the extracted credit features to quantify the user's trustworthiness.

[0034] In specific implementation, the system can construct an N-dimensional feature vector based on the credit characteristics, where N is a positive integer and each dimension represents a credit characteristic. Then, the system performs weighted calculation on each dimension of the constructed N-dimensional feature vector based on the preset weight coefficient to obtain a weighted feature vector. Next, the weighted feature vector is input into a preset trust evaluation model, which is trained based on the credit characteristics of historical users and security event data. Finally, the system determines the user trust index based on the output result of the trust evaluation model.

[0035] In this step, when calculating the user trust index, the system can consider introducing the user's behavior pattern analysis, and evaluate the user's trust risk by analyzing the abnormality of the user's historical behavior. The system can also track user behavior in real time and dynamically adjust the user trust index to adapt to changes in user behavior. In addition, when building a trust evaluation model, the system can make full use of machine learning algorithms to improve the accuracy and generalization ability of the model.

[0036] S102, constructing a directed trust transfer graph according to the transmission path information, mapping each node identifier to a trust node in the directed trust transfer graph, and establishing trust transfer edges between adjacent trust nodes; This step builds a directed trust transfer graph based on the transmission path information in the access request. The system maps each node identifier on the transmission path to a trust node in the directed trust transfer graph, and establishes trust transfer edges between adjacent trust nodes to represent the trust transfer relationship between nodes.

[0037] When constructing a directed trust transfer graph, the system can use graph database technology to store and manage trust nodes and trust transfer edges in the form of a graph structure. Through the graph database, the system can efficiently traverse, query, and update the graph. In addition, the system can also introduce graph embedding technology to map trust nodes to a low-dimensional vector space, measure the similarity between nodes by the distance between vectors, and facilitate subsequent trust transfer calculations.

[0038] S103, obtaining historical security event data of each trust node, and calculating the trust attenuation coefficient of each trust transfer edge according to the historical security event data; The system obtains the historical security event data of each trust node, and calculates the trust attenuation coefficient of each trust transfer edge based on the historical security event data. Specifically: the security event data of each trust node within the first preset time window is obtained; Identify the abnormal behavior types of each trust node based on security event data; Construct a security risk scoring matrix based on abnormal behavior types; The trust attenuation coefficient of the corresponding trust transfer edge is calculated according to the security risk score of the adjacent trust nodes.

[0039] This step obtains the historical security event data of each trust node in the directed trust transfer graph, and calculates the trust attenuation coefficient of each trust transfer edge based on the historical security event data, which is used to quantify the degree of attenuation of trust during the transfer process.

[0040] Specifically, the system first obtains the security event data of each trust node within the first preset time window, such as abnormal access, data leakage and other security events. Then, the system identifies the abnormal behavior type of each trust node based on the security event data, and builds a security risk scoring matrix based on the abnormal behavior type. Finally, the system calculates the trust attenuation coefficient of the trust transfer edge between adjacent trust nodes based on the security risk scores of them.

[0041] When calculating the trust decay coefficient, the system can use a variety of decay functions, such as exponential decay, linear decay, etc., and select the appropriate decay function according to the actual scenario. In addition, the system can also introduce a time decay factor to consider the impact of the time when the security incident occurred on the trust decay. The earlier the security incident occurs, the smaller the impact on the current trust decay.

[0042] In this step, when the system obtains security event data, it may face problems such as incomplete data and high data noise, which will affect the calculation accuracy of the trust decay coefficient. In order to solve this problem, the system can use data cleaning and data completion technology to filter out noisy data, complete missing data, and improve data quality.

[0043] S104, using the user trust index as the initial trust value of the starting trust node, and calculating the node trust value of each trust node along the directed trust transfer graph according to the trust attenuation coefficient; This step uses the user trust index calculated in step S101 as the initial trust value of the starting trust node in the directed trust transfer graph, and then performs trust transfer calculation along the directed trust transfer graph according to the trust attenuation coefficient calculated in step S103 to obtain the node trust value of each trust node in the graph, indicating the degree of trustworthiness of the node.

[0044] When calculating trust transfer, the system can use a recursive algorithm or an iterative algorithm to gradually transfer the trust value to adjacent nodes starting from the starting node until the trust values ​​of all nodes converge or the preset number of iterations is reached. During the transfer process, the system performs a decay calculation on the transferred trust value according to the direction of the trust transfer edge and the trust decay coefficient to obtain the trust value of the next node.

[0045] In order to improve the efficiency of trust transfer calculation, the system can use parallel computing technology to divide the trust transfer graph into multiple subgraphs, perform calculations separately, and finally merge the calculation results. At the same time, the system can also introduce a random walk algorithm to simulate the random walk process of trust in the graph, approximate the trust value of the node, and reduce the calculation complexity.

[0046] S105, constructing a relationship similarity matrix based on the connection relationship of each trust transfer edge, and clustering the trust nodes according to the relationship similarity matrix to obtain multiple trust groups; This step builds a relational similarity matrix based on the connection relationship of each trust transfer edge in the directed trust transfer graph to measure the similarity between trust nodes. Then, the system clusters the trust nodes according to the relational similarity matrix, aggregates nodes with high similarity into the same trust group, and obtains multiple trust groups.

[0047] When constructing the relationship similarity matrix, the system can use various similarity measurement methods, such as the shared neighbor method, the Jaccard coefficient method, etc., to calculate the similarity between nodes based on the connection relationship of the trust transfer edge. For clustering algorithms, the system can use density-based clustering algorithms (such as DBSCAN), hierarchical clustering algorithms (such as AGNES), etc., to cluster nodes according to the similarity between nodes.

[0048] In order to improve the clustering effect, the system can introduce multi-view clustering technology, comprehensively consider multiple similarity metrics between nodes, such as trust transfer similarity, attribute similarity, etc., and obtain more accurate clustering results through multi-view fusion. At the same time, the system can also use incremental clustering algorithms. When the trust transfer graph changes, only the affected local areas are re-clustered to improve the real-time performance of clustering.

[0049] S106, calculating the group trust threshold corresponding to each trust group according to the distribution characteristics of the node trust values ​​in each trust group; This step analyzes the distribution characteristics of the trust values ​​of the nodes in each trust group obtained in step S105, such as the mean value, variance, etc., and then calculates the group trust threshold corresponding to the trust group based on the distribution characteristics as a basis for determining whether the nodes in the group are trustworthy.

[0050] When calculating the group trust threshold, the system can use a variety of threshold calculation methods, such as threshold calculation based on mean and standard deviation, threshold calculation based on quantile, etc., to adaptively determine the threshold according to the distribution characteristics of the node trust value. At the same time, the system can also introduce a dynamic threshold adjustment mechanism to dynamically adjust the group trust threshold according to the changing trend of the node trust value in the group, thereby improving the adaptability of the threshold.

[0051] S107, determining whether the node trust value of each trust node in the trust group where the target resource is located is greater than the group trust threshold corresponding to the trust group where the target resource is located; This step determines whether the node trust value of each trust node in the trust group where the target resource in the access request is located is greater than the group trust threshold corresponding to the trust group. Only when the trust values ​​of all nodes in the group exceed the threshold, the access request is considered to have passed the trust verification, otherwise it is considered to have failed the verification.

[0052] S108, updating transmission path information; If the judgment result in step S107 is no, the transmission path information is updated and the process returns to step S102, that is, there is a node in the trust group where the target resource is located whose node trust value is less than the group trust threshold, indicating that the current transmission path is not secure and reliable. At this time, the system needs to update the transmission path information, reselect a more secure transmission path, and then return to step S102 to re-perform trust transfer and trust evaluation.

[0053] When updating the transmission path, the system can use a variety of path selection algorithms, such as Dijkstra algorithm, Floyd algorithm, etc., to select the optimal transmission path based on factors such as the trust relationship between nodes and path length. At the same time, the system can also introduce a path diversity mechanism to select multiple alternative paths. When a path has a security problem, it can quickly switch to an alternative path to improve the reliability of transmission.

[0054] In order to improve the security of the transmission path, the system can introduce path encryption technology to encrypt the data on the transmission path to prevent the data from being stolen or tampered with during the transmission process. In addition, the system can also adopt a path dynamic adjustment mechanism to dynamically adjust the transmission path according to changes in the network environment and changes in node trust values ​​to ensure the real-time credibility of the transmission path.

[0055] S109: Determine whether the access request passes the security verification.

[0056] If the judgment result in step S107 is yes, the system determines that the access request has passed the security verification. That is, the trust values ​​of all nodes in the trust group where the target resource is located are greater than the group trust threshold, indicating that the current transmission path is safe and reliable. At this time, the system determines that the access request has passed the security verification and allows the target user to access the target resource in the request.

[0057] When performing security verification and confirmation, the system can use digital signature technology to sign the verification results to ensure the authenticity and non-tamperability of the verification results. At the same time, the system can also generate a security access token to authorize the target user to access the target resource within a certain period of time, simplifying the subsequent access control process.

[0058] In order to improve the security of the system, after confirming that the access request has been verified, the system can also continuously monitor the access behavior of the target user, evaluate the user's trust status in real time, and take corresponding security measures in time once abnormal behavior is found, such as disconnecting the user connection, restricting user access, etc. In addition, the system can also use active defense technology to strengthen the security of the access request that has passed the verification, and improve the system's resistance.

[0059] In the above embodiment, the access request of the target user is obtained and the user trust index is extracted. A directed trust transfer graph is constructed in combination with the transmission path information, the trust decay coefficient and the node trust value are calculated, and then the trust nodes are clustered based on the relationship similarity matrix and the group trust threshold is calculated to realize the security verification of the access request. In the verification process, multi-dimensional information such as user credibility, transmission path credibility and node group characteristics are considered, making the security verification more comprehensive and accurate. The attenuation transmission of the trust value is quantified by the trust decay coefficient of the trust transmission edge, which accurately reflects the impact of different transmission paths on the system security. The clustering method is used to group the trust nodes and set differentiated group trust thresholds, which not only ensures the unified management within the similar node group, but also realizes the differentiated control between different groups. When the verification fails, the system will automatically update the transmission path and re-verify, which improves the fault tolerance and availability of the system, improves the system security while also improving the flexibility, thereby improving the effect of network security protection.

[0060] In the above embodiments, the basic process of zero-trust network security protection is described, including the calculation of user trust index and final security verification. However, in actual applications, there may be loop problems in the transmission path, which will affect the accuracy and efficiency of trust transfer. Therefore, before constructing a directed trust transfer graph, the transmission path needs to be preprocessed to ensure the rationality of its topological structure. Figure 2 , a transmission path preprocessing method in an embodiment of the present application is described: See also Figure 2, which is a flow chart of a transmission path preprocessing method in an embodiment of the present application.

[0061] S201, obtaining network topology information of each system node in the transmission path information; This step obtains the network topology information of each system node involved in the transmission path information, including the connection relationship between nodes, node attribute information, etc. The network topology information reflects the organizational structure and mutual relationship of nodes in the transmission path, and is the basis for building a path map.

[0062] When obtaining network topology information, the system can use a variety of methods, such as active detection, passive monitoring, etc. Active detection means that the system actively sends detection packets to the network and infers the connection relationship between nodes based on the returned response information; passive monitoring means that the system extracts the communication information between nodes by analyzing the data traffic in the network, thereby inferring the connection relationship between nodes. In addition, the system can also directly obtain the attribute information and connection relationship of the node by accessing the configuration information of the network device and the database of the network management system.

[0063] S202, constructing an initial path map based on network topology information; This step builds an initial path graph of the transmission path based on the network topology information obtained in step S201. The initial path graph is a directed graph, where nodes represent system nodes in the transmission path, edges represent connection relationships between nodes, and the direction of the edges represents the direction of data transmission.

[0064] When constructing the initial path graph, the system can use data structures such as adjacency matrix or adjacency list to represent the graph. The adjacency matrix is ​​a two-dimensional array, where rows and columns represent nodes in the graph, and the matrix elements indicate whether there is a connection relationship between the nodes; the adjacency list is an array, where each element corresponds to a node and stores the information of the node's adjacent nodes. The system can generate the corresponding adjacency matrix or adjacency list based on the network topology information to construct the initial path graph.

[0065] S203, determining whether there is a loop in the initial path graph; The system determines whether there is a loop in the initial path graph. Specifically, the initial path graph is traversed in depth first and the system nodes visited during the traversal are recorded. Determine whether the currently accessed system node is among the recorded system nodes; If so, it is determined that there is a loop in the initial path graph; If not, then execute the step of depth-first traversal of the initial path graph; When the depth-first traversal is completed, if the currently visited system node is not in the recorded system nodes, it is determined that there is no loop in the initial path graph.

[0066] This step determines whether there is a loop in the initial path graph, that is, whether there is a path starting from a node, passing through a series of nodes and then returning to the node. The existence of a loop will lead to an infinite cycle of trust transfer, affecting the accuracy and efficiency of trust evaluation.

[0067] When determining a loop, the system can use a depth-first traversal algorithm. Specifically, the system starts from the starting node of the initial path graph and recursively traverses each node in the graph. During the traversal process, the system maintains an access mark set to record the nodes that have been visited. When traversing to a certain node, the system first determines whether the node is in the access mark set. If it is, it means that there is a loop; if not, the node is added to the access mark set and its adjacent nodes are continued to be traversed. If there are no duplicate nodes in the access mark set after traversing all nodes, it means that there is no loop in the initial path graph.

[0068] In this step, when judging the loop, the system may face problems such as repeated access to nodes and long traversal time during the traversal process, which will affect the efficiency and accuracy of the judgment. In order to solve this problem, the system can introduce pruning optimization technology. During the traversal process, by recording the access status of the node, it can avoid repeated access and reduce unnecessary traversal overhead; at the same time, the system can also adopt parallel traversal technology, using multi-threading or distributed computing, etc., to traverse multiple nodes at the same time, improving the parallelism and efficiency of the traversal. The system can timely discover loop problems in the transmission path through efficient and accurate loop judgment, and provide decision-making basis for subsequent path optimization.

[0069] S204: Adjust the transmission path information to remove loops.

[0070] If the determination result in step S203 is yes, the system adjusts the transmission path information to remove the loop. If the determination result in step S203 is no, the system re-executes step S102.

[0071] If the judgment result of step S203 is yes, that is, there is a loop in the initial path diagram, the system needs to adjust the transmission path information to remove the loop and ensure the rationality of the path.

[0072] When adjusting the transmission path information, the system can adopt multiple strategies. One strategy is loop disconnection, that is, selecting an edge in the loop and removing it from the path to break the loop. The selection of edges can be based on factors such as edge weights and the trust values ​​of nodes on the edges, and the edges with the least impact on the path are preferentially deleted. Another strategy is loop merging, that is, merging the nodes in the loop into a super node, connecting the edges entering the loop and the edges leaving the loop to the super node, thereby eliminating the loop. The system can flexibly select loop removal strategies and adjust the transmission path information according to actual conditions.

[0073] In the above embodiment, the network topology information of the system nodes is obtained to construct the initial path graph, and loop detection and processing are performed on it, ensuring that the directed trust transfer graph finally constructed has a good topological structure. The loop detection mechanism can timely discover the circular dependency problem in the transmission path, and the loop removal operation ensures the unidirectionality and terminability of the trust value transfer process, reduces the problems of circular calculation or dead loop in the trust transfer process, and improves the efficiency and accuracy of subsequent trust value calculation. By optimizing the network topology structure, the authenticity of the trust transfer relationship between system nodes reflected by the directed trust transfer graph is improved.

[0074] Furthermore, in another embodiment, after calculating the group trust threshold corresponding to each trust group according to the distribution characteristics of the node trust values ​​in each trust group, the method further includes: Obtain node trust value change data and access records of each trust group within a second preset time window; The group stability index of each trust group is calculated based on the node trust value change data. The group stability index is used to characterize the fluctuation degree of the node trust value in the trust group; The group trust threshold is weighted and modified based on the group stability index to obtain a dynamic trust threshold; The dynamic trust threshold is correlated with the security event data in the access record to generate a threshold optimization strategy. Specifically, the occurrence time of various security events in the access record and the corresponding dynamic trust threshold are extracted; Construct a time series correlation matrix, and calculate the correlation coefficient between various security events and dynamic trust thresholds based on the time series correlation matrix; Identify key security event types that affect dynamic trust thresholds based on correlation coefficients; Construct a threshold adjustment function based on the historical distribution patterns of key security event types; Generate a threshold optimization strategy based on the threshold adjustment function; The dynamic trust threshold is calibrated according to the threshold optimization strategy to obtain the final group trust threshold.

[0075] In this embodiment, after calculating the group trust threshold corresponding to each trust group, the system further optimizes the group trust threshold so that it can dynamically adapt to changes in the network environment and improve the accuracy and reliability of trust evaluation.

[0076] First, the system obtains the node trust value change data and access records of each trust group within the second preset time window. The node trust value change data reflects the stability of the node trust value within the trust group, and the access record contains information on various security events that occurred in the network. By analyzing these two types of data, the system can evaluate the rationality of the group trust threshold and make corresponding optimization adjustments.

[0077] Then, the system calculates the group stability index of each trust group based on the node trust value change data. The group stability index characterizes the degree of fluctuation of the trust value of nodes within the trust group, which can be quantified by calculating statistics such as the standard deviation and coefficient of variation of the node trust value. The higher the group stability index, the greater the fluctuation of the trust value of nodes within the group, and the lower the reliability of the group trust threshold.

[0078] Next, the system performs a weighted correction on the group trust threshold based on the group stability index to obtain a dynamic trust threshold. The purpose of weighted correction is to dynamically adjust the trust threshold according to the stability of the group. For groups with poor stability, the trust threshold is appropriately lowered, and for groups with good stability, the trust threshold is appropriately increased. Weighted correction can be performed using linear weighting, nonlinear weighting, etc. According to the size of the group stability index, the weighting coefficient is calculated and multiplied by the original group trust threshold to obtain a dynamic trust threshold.

[0079] After obtaining the dynamic trust threshold, the system associates it with the security event data in the access record and generates a threshold optimization strategy. Specifically, the system first extracts the occurrence time of various security events in the access record and the corresponding dynamic trust threshold, and constructs a time series association matrix. The rows of the time series association matrix represent different time windows, the columns represent different types of security events and dynamic trust thresholds, and the matrix elements represent the number of occurrences of the corresponding type of security events or the value of the dynamic trust threshold in the corresponding time window.

[0080] Then, the system calculates the correlation coefficient between each type of security event and the dynamic trust threshold based on the time series correlation matrix. The correlation coefficient measures the linear correlation between the security event and the dynamic trust threshold. The larger the correlation coefficient, the stronger the correlation between the two. By analyzing the correlation coefficient, the system can identify the key security event types that affect the dynamic trust threshold.

[0081] Next, the system constructs a threshold adjustment function based on the historical distribution of key security event types. The threshold adjustment function defines the mapping relationship between the number or frequency of key security events and the dynamic trust threshold, and can be in the form of linear function, logarithmic function, exponential function, etc. By fitting the historical distribution data of key security events, the system can obtain the parameters of the threshold adjustment function and generate a threshold optimization strategy based on the function.

[0082] Finally, the system calibrates the dynamic trust threshold according to the threshold optimization strategy to obtain the final group trust threshold. The calibration process is to apply the threshold optimization strategy to the dynamic trust threshold and calculate the adjusted trust threshold according to the current security event status. The calibrated group trust threshold can better adapt to the current network security situation and dynamically reflect the trustworthiness of the trust group.

[0083] In the above embodiment, a group stability index is introduced to characterize the degree of fluctuation of the trust value of the node in the trust group, and the group trust threshold is dynamically adjusted in combination with the historical change data of the node trust value. This threshold correction mechanism based on historical data can adapt to the dynamic change characteristics of the network environment, so that the setting of the trust threshold is more in line with the actual situation. By correlating and analyzing the dynamic trust threshold with the security event data in the access record, the system can identify the key factors affecting the threshold setting, and generate a scientific and reasonable threshold optimization strategy based on these factors. The optimized group trust threshold not only maintains the effective identification ability of abnormal access behavior, but also reduces the problem of normal access being misjudged due to overly strict threshold settings. This adaptive threshold adjustment mechanism improves the accuracy and reliability of the system, while reducing the workload of security managers, making the access control of the zero-trust architecture more accurate and efficient.

[0084] The following describes the system in the embodiment of the present invention from the perspective of hardware processing. Figure 3 , which is a schematic diagram of the physical device structure of a zero-trust architecture network security protection system provided in an embodiment of the present application.

[0085] It should be noted that Figure 3 The structure of the system shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0086] like Figure 3 As shown, the system includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 302 or the program loaded from the storage part 308 to the random access memory (RAM) 303, such as executing the method in the above embodiment. In RAM 303, various programs and data required for system operation are also stored. CPU 301, ROM 302 and RAM 303 are connected to each other through a bus 304. Input / output (I / O) interface 305 is also connected to bus 304.

[0087] The following components are connected to the I / O interface 305: an input section 306 including a camera, an infrared sensor, etc.; an output section 307 including a liquid crystal display (LCD) and a speaker, etc.; a storage section 308 including a hard disk, etc.; and a communication section 309 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as needed. A removable medium 311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 310 as needed so that a computer program read therefrom is installed into the storage section 308 as needed.

[0088] In particular, according to an embodiment of the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through the communication part 309, and / or installed from a removable medium 311. When the computer program is executed by the central processing unit (CPU) 301, various functions defined in the present invention are performed.

[0089] It should be noted that the computer-readable medium shown in the embodiment of the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable computer program. Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing.

[0090] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. Among them, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0091] As another aspect, the present invention further provides a computer-readable storage medium, which may be included in the system described in the above embodiment; or may exist independently without being assembled into the system. The above storage medium carries one or more computer programs, and when the above one or more computer programs are executed by a processor of a system, the system implements the method provided in the above embodiment.

[0092] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0093] As used in the above embodiments, the term "when..." may be interpreted to mean "if..." or "after..." or "in response to determining..." or "in response to detecting...", depending on the context. Similarly, the phrases "upon determining..." or "if (the stated condition or event) is detected" may be interpreted to mean "if determining..." or "in response to determining..." or "upon detecting (the stated condition or event)" or "in response to detecting (the stated condition or event)", depending on the context.

[0094] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk), etc.

[0095] Those skilled in the art can understand that to implement all or part of the processes in the above-mentioned embodiments, the processes can be completed by computer programs to instruct related hardware, and the programs can be stored in computer-readable storage media. When the programs are executed, they can include the processes of the above-mentioned method embodiments. The aforementioned storage media include: ROM or random access memory RAM, magnetic disk or optical disk and other media that can store program codes.

Claims

1. A zero-trust architecture network security protection method, characterized in that: include: Obtaining an access request of a target user, wherein the access request includes identity information of the target user, target resource information, and transmission path information, wherein the transmission path information includes node identifiers of multiple system nodes; Extracting credit features from a preset user credit database based on the identity information, and calculating a user trust index based on the credit features; Constructing a directed trust transfer graph according to the transmission path information, mapping each node identifier to a trust node in the directed trust transfer graph, and establishing trust transfer edges between adjacent trust nodes; Acquire historical security event data of each of the trust nodes, and calculate the trust attenuation coefficient of each of the trust transfer edges according to the historical security event data; The user trust index is used as the initial trust value of the starting trust node, and the node trust value of each trust node is calculated along the directed trust transfer graph according to the trust decay coefficient; Constructing a relationship similarity matrix based on the connection relationship of each of the trust transfer edges; Clustering the trust nodes according to the relationship similarity matrix to obtain multiple trust groups; Calculate the group trust threshold corresponding to each trust group according to the distribution characteristics of the node trust values ​​in each trust group; Determine whether the node trust value of each of the trust nodes in the trust group where the target resource is located is greater than the group trust threshold corresponding to the trust group where the target resource is located; If yes, determining that the access request passes the security verification; If not, update the transmission path information and return to execute the step of constructing a directed trust transfer graph according to the transmission path information.

2. The method according to claim 1, characterized in that The calculating the user trust index according to the credit characteristics specifically includes: Constructing an N-dimensional feature vector according to the credit feature, where N is a positive integer; Performing weighted calculation on each dimension of the N-dimensional feature vector based on a preset weight coefficient to obtain a weighted feature vector; Inputting the weighted feature vector into a preset trust evaluation model, wherein the preset trust evaluation model is trained based on the credit characteristics of historical users and security event data; The user trust index is determined according to the output result of the preset trust evaluation model.

3. The method according to claim 1, characterized in that: The calculating the trust attenuation coefficient of each trust transfer edge according to the historical security event data specifically includes: Acquire security event data of each of the trusted nodes within a first preset time window; Identify the abnormal behavior type of each of the trust nodes according to the security event data; Constructing a security risk scoring matrix based on the abnormal behavior types; The trust attenuation coefficient of the trust transfer edge corresponding to the trust node is calculated according to the security risk score of the adjacent trust node.

4. The method according to claim 1, characterized in that Before constructing a directed trust transfer graph according to the transmission path information, the method further includes: Acquire network topology information of each of the system nodes in the transmission path information; Constructing an initial path graph based on the network topology information; Determine whether there is a loop in the initial path graph; If so, adjusting the transmission path information to remove the loop; If not, execute the step of constructing a directed trust transfer graph according to the transmission path information.

5. The method according to claim 4, characterized in that The determining whether there is a loop in the initial path graph specifically includes: Performing a depth-first traversal on the initial path graph, and recording the system nodes visited during the traversal; Determine whether the system node currently being accessed is among the recorded system nodes; If yes, it is determined that there is a loop in the initial path graph; If not, executing the step of performing depth-first traversal on the initial path graph; When the depth-first traversal is completed, if the currently visited system node is not in the recorded system nodes, it is determined that the initial path graph does not have the loop.

6. The method according to claim 1, characterized in that After calculating the group trust threshold corresponding to each trust group according to the distribution characteristics of the node trust values ​​in each trust group, the method further includes: Obtaining node trust value change data and access records of each of the trust groups within a second preset time window; Calculating a group stability index of each of the trust groups according to the node trust value change data, wherein the group stability index is used to characterize the degree of fluctuation of the trust values ​​of the nodes in the trust group; Performing weighted correction on the group trust threshold based on the group stability index to obtain a dynamic trust threshold; Correlate and analyze the dynamic trust threshold with the security event data in the access record to generate a threshold optimization strategy; The dynamic trust threshold is calibrated according to the threshold optimization strategy to obtain a final group trust threshold.

7. The method according to claim 6, characterized in that The correlating analysis of the dynamic trust threshold with the security event data in the access record to generate a threshold optimization strategy specifically includes: Extracting the occurrence time of various security events in the access record and the corresponding dynamic trust threshold; Constructing a time series correlation matrix, and calculating the correlation coefficient between the various security events and the dynamic trust threshold based on the time series correlation matrix; Identify the key security event type that affects the dynamic trust threshold according to the correlation coefficient; Constructing a threshold adjustment function based on the historical distribution law of the key security event types; A threshold optimization strategy is generated according to the threshold adjustment function.

8. A zero-trust architecture network security protection system, characterized in that: The system comprises: One or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to cause the system to execute the method as described in any one of claims 1-7.

9. A computer-readable storage medium comprising instructions, characterized in that: When the instructions are executed on a system, the system is caused to execute the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that When the computer program product is run on a system, the system is caused to execute the method according to any one of claims 1 to 7.

Images