Zero-trust architecture network security protection methods, systems, media and program products

Abstract

A zero-trust architecture network security protection method, system, medium and program product, in which an access request is obtained; credit features are extracted, and a user trust index is calculated based on the credit features; a directed trust transfer graph is constructed; the trust attenuation coefficient of each trust transfer edge is calculated; the node trust value is calculated along the directed trust transfer graph based on the trust attenuation coefficient; a relationship similarity matrix is ​​constructed; multiple trust groups are obtained by clustering the relationship similarity matrix; a group trust threshold is calculated based on the node trust value in each trust group; it is determined whether the node trust value of each trust node in the trust group where the target resource is located is greater than the group trust threshold corresponding to the trust group where the target resource is located; if so, security verification is passed; if not, the transmission path information is updated and the step of constructing a directed trust transfer graph based on the transmission path information is returned. This application improves the security of the network, thereby improving the effect of network security protection.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a zero-trust architecture network security protection method, system, medium, and program product method and system. Background Art

[0002] With the rapid development of information technology and the increasing popularity of network applications, the traditional perimeter-based network security model is no longer able to meet the demands of today's complex and ever-changing network environment. Traditional network security models, based on a wall-like approach, rely on deploying security devices such as firewalls at the network perimeter to protect internal resources. However, this model prioritizes the perimeter over the internal. Once the perimeter is breached, internal systems face serious security threats. Furthermore, with the adoption of new technologies such as cloud computing and mobile office, network perimeters are becoming increasingly blurred, making traditional perimeter protection approaches ineffective in addressing security challenges such as internal threats and targeted attacks.

[0003] Related technologies enable fine-grained control of network resources by continuously verifying user identities and analyzing user behavior to dynamically adjust access permissions. This approach breaks through traditional static trust boundaries and establishes a dynamic, identity-based trust mechanism, effectively preventing unauthorized access and potential security threats.

[0004] However, when users access target resources through multiple system nodes, the trust status between nodes is difficult to effectively transmit and share, resulting in security vulnerabilities at certain links in the trust chain. This flaw in the trust transmission mechanism not only increases system management complexity but also can lead to inconsistent security policy enforcement, reducing network security and ultimately diminishing the effectiveness of network security protection. Summary of the Invention

[0005] The present application provides a zero-trust architecture network security protection method, system, medium and program product for improving network security and thereby improving the effectiveness of network security protection.

[0006] In a first aspect, the present application provides a zero-trust architecture network security protection method, which obtains an access request from a target user, the access request including the target user's identity information, target resource information, and transmission path information, and the transmission path information includes node identifiers of multiple system nodes;

[0007] Extracting credit features from a preset user credit database based on identity information, and calculating the user trust index based on the credit features;

[0008] A directed trust transfer graph is constructed based on the transmission path information, each node identifier is mapped to a trust node in the directed trust transfer graph, and trust transfer edges are established between adjacent trust nodes;

[0009] Obtain historical security event data of each trust node, and calculate the trust attenuation coefficient of each trust transfer edge based on the historical security event data;

[0010] The user trust index is used as the initial trust value of the starting trust node, and the node trust value of each trust node is calculated along the directed trust transfer graph according to the trust attenuation coefficient;

[0011] Construct a relationship similarity matrix based on the connection relationship of each trust transfer edge;

[0012] Cluster the trust nodes according to the relationship similarity matrix to obtain multiple trust groups;

[0013] The group trust threshold corresponding to each trust group is calculated based on the distribution characteristics of the node trust values ​​in each trust group;

[0014] Determine whether the node trust value of each trust node in the trust group where the target resource is located is greater than the group trust threshold corresponding to the trust group where the target resource is located;

[0015] If so, it is determined that the access request passes the security verification;

[0016] If not, update the transmission path information and return to the step of constructing a directed trust transfer graph based on the transmission path information.

[0017] By employing the above technical solution, the target user's access request is obtained and the user's trust index is extracted. A directed trust transfer graph is constructed based on the transmission path information, and the trust decay coefficient and node trust value are calculated. Trust nodes are then clustered based on the relationship similarity matrix and the group trust threshold is calculated to achieve secure verification of the access request. The verification process considers multiple dimensions, including user trustworthiness, transmission path trustworthiness, and node group characteristics, making security verification more comprehensive and accurate. The trust decay coefficient of the trust transfer edge is used to quantify the decay of trust values, accurately reflecting the impact of different transmission paths on system security. Clustering is used to group trust nodes and differentiate group trust thresholds are set, ensuring unified management within similar node groups while enabling differentiated control across different groups. If verification fails, the system automatically updates the transmission path and re-verifies, improving the system's fault tolerance and availability, enhancing both system security and flexibility, and ultimately enhancing network security protection.

[0018] In conjunction with some embodiments of the first aspect, in some embodiments, calculating the user trust index based on the credit characteristics specifically includes:

[0019] Construct an N-dimensional feature vector based on the credit characteristics, where N is a positive integer;

[0020] Perform weighted calculation on each dimension of the N-dimensional feature vector based on a preset weight coefficient to obtain a weighted feature vector;

[0021] Input the weighted feature vector into a preset trust evaluation model, which is trained based on historical user credit characteristics and security incident data;

[0022] The user trust index is determined based on the output results of the preset trust evaluation model.

[0023] By employing the aforementioned technical solution, an N-dimensional feature vector is constructed to quantify a user's credit characteristics. Pre-set weight coefficients are introduced to weight the feature vectors, allowing for a reasonable differentiation of the impact of different dimensional features on the final trust index. Through the close coordination of feature vector quantization, weighting, and model evaluation, a scientific transformation of user credit characteristics into a trust index is achieved, improving the accuracy of the resulting trust index. The model training process integrates historical user credit characteristics and security incident data, ensuring that the evaluation results not only consider the user's inherent credit characteristics but also incorporate their actual security performance, thereby enhancing the accuracy and reliability of the trust index.

[0024] In conjunction with some embodiments of the first aspect, in some embodiments, calculating the trust decay coefficient of each trust transfer edge based on historical security event data specifically includes:

[0025] Obtain security event data of each trusted node within a first preset time window;

[0026] Identify abnormal behavior types of each trust node based on security event data;

[0027] Build a security risk scoring matrix based on abnormal behavior types;

[0028] The trust attenuation coefficient of the corresponding trust transfer edge is calculated according to the security risk score of the adjacent trust nodes.

[0029] By employing this technical solution, security event data from trusted nodes is collected within a preset time window. Abnormal behavior types are identified and a security risk scoring matrix is ​​constructed. Finally, the trust decay coefficient of the trust transfer edge is calculated based on the risk scores of adjacent nodes. This ensures that the degree of trust value decay is closely correlated with the node's actual security risk. By mapping abnormal behavior types to the security risk scoring matrix, a quantitative relationship between security events and risk levels is established, making the calculation of trust decay more objective. This comprehensive consideration of adjacent node risk scores ensures that the decay coefficient of the trust transfer edge reflects the actual security risk along the transmission path, providing a more accurate decay basis for subsequent trust value transfer calculations.

[0030] In conjunction with some embodiments of the first aspect, in some embodiments, before constructing the directed trust transfer graph according to the transmission path information, the method further includes:

[0031] Obtaining network topology information of each system node in the transmission path information;

[0032] Construct an initial path graph based on network topology information;

[0033] Determine whether there is a loop in the initial path graph;

[0034] If so, adjusting the transmission path information to remove the loop;

[0035] If not, execute the step of constructing a directed trust transfer graph according to the transmission path information.

[0036] By employing the above technical solution, network topology information of system nodes is obtained to construct an initial path graph, which is then subjected to loop detection and processing, ensuring that the resulting directed trust transfer graph possesses a well-defined topological structure. The loop detection mechanism promptly identifies circular dependencies within the transmission path, while loop removal ensures the unidirectionality and terminability of the trust value transfer process, reducing the risk of circular calculations or dead loops during the trust transfer process and improving the efficiency and accuracy of subsequent trust value calculations. By optimizing the network topology, the directed trust transfer graph enhances its authenticity in reflecting the trust transfer relationships between system nodes.

[0037] In conjunction with some embodiments of the first aspect, in some embodiments, determining whether there is a loop in the initial path graph specifically includes:

[0038] Perform a depth-first traversal of the initial path graph and record the system nodes visited during the traversal;

[0039] Determine whether the currently accessed system node is among the recorded system nodes;

[0040] If so, it is determined that there is a loop in the initial path graph;

[0041] If not, then perform the step of depth-first traversal of the initial path graph;

[0042] When the depth-first traversal is completed, if the currently visited system node is not in the recorded system nodes, it is determined that there is no loop in the initial path graph.

[0043] By employing this technical solution, a depth-first traversal of the initial path graph and recording the system nodes visited can systematically detect loops in the transmission path. If the currently visited system node is found in the recorded list, a loop is present, improving the accuracy of loop detection in complex topologies. Loops can cause data packets to be repeatedly transmitted within the network, wasting network resources and potentially causing congestion, impacting overall transmission performance. By promptly detecting and eliminating loops, the rationality and efficiency of data transmission paths can be improved.

[0044] In conjunction with some embodiments of the first aspect, in some embodiments, after calculating the group trust threshold corresponding to each trust group based on the distribution characteristics of the node trust values ​​within each trust group, the method further includes:

[0045] Obtain node trust value change data and access records of each trust group within a second preset time window;

[0046] The group stability index of each trust group is calculated based on the node trust value change data. The group stability index is used to represent the degree of fluctuation of the trust value of nodes in the trust group.

[0047] The group trust threshold is weighted and modified based on the group stability index to obtain a dynamic trust threshold;

[0048] Correlate and analyze dynamic trust thresholds with security event data in access records to generate threshold optimization strategies;

[0049] The dynamic trust threshold is calibrated according to the threshold optimization strategy to obtain the final group trust threshold.

[0050] By adopting the above technical solution, a group stability index is introduced to characterize the degree of fluctuation of the trust value of nodes within the trust group, and the group trust threshold is dynamically adjusted in combination with the historical change data of the node trust value. This threshold correction mechanism based on historical data can adapt to the dynamic changes of the network environment, making the setting of the trust threshold more in line with the actual situation. By correlating and analyzing the dynamic trust threshold with the security event data in the access record, the system can identify the key factors affecting the threshold setting and generate a scientific and reasonable threshold optimization strategy based on these factors. The optimized group trust threshold not only maintains the effective identification ability of abnormal access behavior, but also reduces the problem of normal access being misjudged due to overly strict threshold settings. This adaptive threshold adjustment mechanism improves the accuracy and reliability of the system, while reducing the workload of security management personnel, making the access control of the zero-trust architecture more accurate and efficient.

[0051] In conjunction with some embodiments of the first aspect, in some embodiments, a dynamic trust threshold is associated with security event data in access records and analyzed to generate a threshold optimization strategy, specifically including:

[0052] Extract the occurrence time of various security events and the corresponding dynamic trust thresholds in access records;

[0053] Construct a time series correlation matrix and calculate the correlation coefficient between various security events and dynamic trust thresholds based on the time series correlation matrix;

[0054] Identify key security event types that affect dynamic trust thresholds based on correlation coefficients;

[0055] Construct a threshold adjustment function based on the historical distribution patterns of key security event types;

[0056] Generate a threshold optimization strategy based on the threshold adjustment function.

[0057] By adopting the above technical solution, a time-series correlation matrix is ​​constructed to analyze the correlation between security events and dynamic trust thresholds, which can accurately identify the types of critical security events that have a significant impact on threshold settings. The threshold adjustment function is constructed based on the historical distribution pattern of key security events, making the threshold optimization strategy quantifiable and predictable, reducing the deviation that may be caused by subjective experience judgment, and being able to capture the actual impact of different types of security events on the system security status. Through the calculation and analysis of correlation coefficients, the system can promptly discover the potential correlation pattern between security events and trust thresholds, which helps to predictively adjust threshold parameters, improve the system's ability to identify and respond to different security threats, and improve the protection effect of the zero-trust architecture in complex network environments.

[0058] In second aspect, an embodiment of the present application provides a zero-trust architecture network security protection system, which includes: one or more processors and a memory; the memory is coupled to one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and one or more processors call computer instructions to enable the system to execute the method described in the first aspect and any possible implementation method of the first aspect.

[0059] In a third aspect, an embodiment of the present application provides a computer-readable storage medium comprising instructions, which, when executed on a system, enables the system to execute the method described in the first aspect and any possible implementation of the first aspect.

[0060] In a fourth aspect, an embodiment of the present application provides a computer program product, characterized in that when the computer program product is run on a system, the system executes the method described in any possible implementation manner in the first aspect.

[0061] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0062] 1. The present application provides a zero-trust architecture network security protection method, which obtains the access request of the target user and extracts the user trust index, constructs a directed trust transfer graph based on the transmission path information, calculates the trust decay coefficient and the node trust value, and then clusters the trust nodes based on the relationship similarity matrix and calculates the group trust threshold to achieve security verification of the access request. During the verification process, multi-dimensional information such as user credibility, transmission path credibility, and node group characteristics are taken into account, making the security verification more comprehensive and accurate. The attenuation transfer of the trust value is quantified by the trust decay coefficient of the trust transfer edge, accurately reflecting the impact of different transmission paths on the system security. The trust nodes are grouped in a clustering manner and differentiated group trust thresholds are set, which not only ensures unified management within the similar node group, but also realizes differentiated control between different groups. When the verification fails, the system will automatically update the transmission path and re-verify, which improves the fault tolerance and availability of the system, improves the system security while also improving flexibility, thereby improving the effect of network security protection.

[0063] 2. This application provides a zero-trust architecture network security protection method, which obtains the network topology information of the system nodes to construct an initial path diagram, and performs loop detection and processing on it, ensuring that the directed trust transfer graph finally constructed has a good topological structure. The loop detection mechanism can promptly discover the circular dependency problem in the transmission path, and the loop removal operation ensures the unidirectionality and terminability of the trust value transfer process, reduces the problems of circular calculation or dead loop in the trust transfer process, and improves the efficiency and accuracy of subsequent trust value calculations. By optimizing the network topology structure, the authenticity of the trust transfer relationship between system nodes reflected by the directed trust transfer graph is improved.

[0064] 3. The present application provides a zero-trust architecture network security protection method, which introduces a group stability index to characterize the degree of fluctuation of the trust value of nodes in the trust group, and dynamically adjusts the group trust threshold based on the historical change data of the node trust value. This threshold correction mechanism based on historical data can adapt to the dynamic change characteristics of the network environment, so that the setting of the trust threshold is more in line with the actual situation. By correlating and analyzing the dynamic trust threshold with the security event data in the access record, the system can identify the key factors affecting the threshold setting and generate a scientific and reasonable threshold optimization strategy based on these factors. The optimized group trust threshold not only maintains the effective identification ability of abnormal access behavior, but also reduces the problem of normal access being misjudged due to overly strict threshold settings. This adaptive threshold adjustment mechanism improves the accuracy and reliability of the system, while reducing the workload of security management personnel, making the access control of the zero-trust architecture more accurate and efficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 This is a flow chart of a zero-trust architecture network security protection method in an embodiment of the present application.

[0066] Figure 2 It is a flow chart of a transmission path preprocessing method in an embodiment of the present application.

[0067] Figure 3 This is a schematic diagram of the physical device structure of a zero-trust architecture network security protection system provided by an embodiment of the present application. DETAILED DESCRIPTION

[0068] The terms used in the following examples of the present application are only for the purpose of describing specific embodiments and are not intended to limit the present application. As used in the specification and appended claims of this application, the singular expressions "a," "an," "said," "above," "the," and "this" are intended to include plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in this application refers to any or all possible combinations comprising one or more of the listed items.

[0069] In the following, the terms "first" and "second" are used for descriptive purposes only and should not be understood to imply or suggest relative importance or implicitly indicate the number of the technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of this application, unless otherwise specified, "plurality" means two or more.

[0070] The following uses an embodiment and combines Figure 1, describes a zero-trust architecture network security protection method in an embodiment of the present application:

[0071] See also Figure 1 , which is a flow chart of a zero-trust architecture network security protection method in an embodiment of the present application.

[0072] S101, extracting credit features from a preset user credit database based on identity information, and calculating a user trust index based on the credit features;

[0073] Before implementing this step, the system first obtains the target user's access request, which includes the target user's identity information, target resource information, and transmission path information. The transmission path information includes the node identifiers of multiple system nodes. The system then extracts credit features from a preset user credit database based on the identity information and calculates the user trust index based on the credit features. Specifically, an N-dimensional feature vector is constructed based on the credit features, where N is a positive integer.

[0074] Perform weighted calculation on each dimension of the N-dimensional feature vector based on a preset weight coefficient to obtain a weighted feature vector;

[0075] Input the weighted feature vector into a preset trust evaluation model, which is trained based on historical user credit characteristics and security incident data;

[0076] The user trust index is determined based on the output results of the preset trust evaluation model.

[0077] This step first obtains the target user's access request, which includes the target user's identity information, target resource information, and transmission path information. The transmission path information includes the node identifiers of multiple system nodes. Based on the target user's identity information, the system extracts the user's corresponding credit characteristics from a preset user credit database. The system then calculates the user trust index based on these extracted credit characteristics, which quantifies the user's trustworthiness.

[0078] In specific implementations, the system constructs an N-dimensional feature vector based on credit characteristics, where N is a positive integer and each dimension represents a credit characteristic. The system then performs a weighted calculation on each dimension of the constructed N-dimensional feature vector using preset weight coefficients to produce a weighted feature vector. This weighted feature vector is then input into a preset trust assessment model, which is trained based on historical user credit characteristics and security incident data. Finally, the system determines the user's trust index based on the output of the trust assessment model.

[0079] In this step, the system can consider analyzing user behavior patterns when calculating the user trust index. By analyzing the degree of abnormality in a user's historical behavior, the system can assess the user's trustworthiness risk. The system can also track user behavior in real time and dynamically adjust the user trust index to adapt to changes in user behavior. Furthermore, when building the trust assessment model, the system can fully utilize machine learning algorithms to improve the model's accuracy and generalization capabilities.

[0080] S102: Construct a directed trust transfer graph based on the transmission path information, map each node identifier to a trust node in the directed trust transfer graph, and establish trust transfer edges between adjacent trust nodes;

[0081] This step constructs a directed trust transitive graph based on the transmission path information in the access request. The system maps each node identifier on the transmission path to a trusted node in the directed trust transitive graph and establishes trust transitive edges between adjacent trusted nodes, representing the trust transitive relationship between the nodes.

[0082] When constructing a directed trust transfer graph, the system can utilize graph database technology to store and manage trust nodes and trust transfer edges in a graph structure. This allows the system to efficiently traverse, query, and update the graph. Furthermore, the system can incorporate graph embedding technology to map trust nodes into a low-dimensional vector space. The distance between these vectors can be used to measure node similarity, facilitating subsequent trust transfer calculations.

[0083] S103: Obtain historical security event data of each trust node, and calculate the trust attenuation coefficient of each trust transfer edge based on the historical security event data;

[0084] The system obtains the historical security event data of each trust node and calculates the trust attenuation coefficient of each trust transfer edge based on the historical security event data. Specifically: the security event data of each trust node within the first preset time window is obtained;

[0085] Identify abnormal behavior types of each trust node based on security event data;

[0086] Build a security risk scoring matrix based on abnormal behavior types;

[0087] The trust attenuation coefficient of the corresponding trust transfer edge is calculated according to the security risk score of the adjacent trust nodes.

[0088] This step obtains the historical security event data of each trust node in the directed trust transfer graph, and calculates the trust attenuation coefficient of each trust transfer edge based on the historical security event data to quantify the degree of trust attenuation during the transfer process.

[0089] Specifically, the system first obtains security event data from each trust node within a first preset time window, such as abnormal access and data leakage. The system then identifies the abnormal behavior type of each trust node based on this security event data and constructs a security risk scoring matrix based on the abnormal behavior type. Finally, based on the security risk scores of adjacent trust nodes, the system calculates the trust decay coefficient of the trust transfer edge between them.

[0090] When calculating the trust decay coefficient, the system can use a variety of decay functions, such as exponential decay and linear decay, and select the appropriate decay function based on the actual scenario. In addition, the system can also introduce a time decay factor to consider the impact of the time when the security incident occurred on trust decay. The earlier the security incident occurs, the smaller the impact on the current trust decay.

[0091] During this step, the system may encounter issues such as incomplete data and high noise when acquiring security incident data, which can affect the accuracy of the trust decay coefficient calculation. To address this issue, the system can use data cleaning and data completion techniques to filter out noisy data, complete missing data, and improve data quality.

[0092] S104: Using the user trust index as the initial trust value of the starting trust node, and calculating the node trust value of each trust node along the directed trust transfer graph according to the trust attenuation coefficient;

[0093] This step uses the user trust index calculated in step S101 as the initial trust value of the starting trust node in the directed trust transfer graph, and then performs trust transfer calculation along the directed trust transfer graph based on the trust attenuation coefficient calculated in step S103 to obtain the node trust value of each trust node in the graph, indicating the trustworthiness of the node.

[0094] When calculating trust transfer, the system can use a recursive or iterative algorithm, starting from the starting node and gradually transferring the trust value to adjacent nodes until the trust values ​​of all nodes converge or the preset number of iterations is reached. During the transfer process, the system calculates the decay of the transferred trust value based on the direction of the trust transfer edge and the trust decay coefficient to obtain the trust value of the next node.

[0095] To improve the efficiency of trust transfer calculations, the system can use parallel computing technology to divide the trust transfer graph into multiple subgraphs, perform calculations separately, and finally merge the calculation results. At the same time, the system can also introduce a random walk algorithm to simulate the random walk process of trust in the graph to approximate the trust value of the node and reduce the computational complexity.

[0096] S105: construct a relationship similarity matrix based on the connection relationship of each trust transfer edge, and cluster the trust nodes according to the relationship similarity matrix to obtain multiple trust groups;

[0097] This step constructs a relational similarity matrix based on the connections between the trust transfer edges in the directed trust transfer graph. This matrix is ​​used to measure the similarity between trust nodes. The system then clusters the trust nodes based on the relational similarity matrix, aggregating nodes with high similarity into the same trust group, resulting in multiple trust groups.

[0098] When constructing the relationship similarity matrix, the system can use various similarity metrics, such as the shared neighbor method and the Jaccard coefficient method, to calculate the similarity between nodes based on the connections between trust transitive edges. For clustering algorithms, the system can use density-based clustering algorithms (such as DBSCAN) and hierarchical clustering algorithms (such as AGNES) to cluster nodes based on their similarity.

[0099] To improve clustering effectiveness, the system can introduce multi-view clustering technology, comprehensively considering multiple similarity metrics between nodes, such as trust transfer similarity and attribute similarity, to achieve more accurate clustering results through multi-view fusion. Furthermore, the system can also use an incremental clustering algorithm. When the trust transfer graph changes, only the affected local areas are re-clustered, improving the real-time performance of clustering.

[0100] S106: Calculate the group trust threshold corresponding to each trust group based on the distribution characteristics of the node trust values ​​in each trust group;

[0101] This step analyzes the distribution characteristics of the trust values ​​of the nodes in each trust group obtained in step S105, such as the mean value, variance, etc., and then calculates the group trust threshold corresponding to the trust group based on the distribution characteristics, which serves as the basis for determining whether the nodes in the group are trustworthy.

[0102] When calculating group trust thresholds, the system can employ a variety of threshold calculation methods, such as those based on mean and standard deviation, and those based on quantiles, to adaptively determine thresholds based on the distribution characteristics of node trust values. Furthermore, the system can also introduce a dynamic threshold adjustment mechanism to dynamically adjust group trust thresholds based on the changing trends of node trust values ​​within the group, improving threshold adaptability.

[0103] S107: Determine whether the node trust value of each trust node in the trust group where the target resource is located is greater than the group trust threshold corresponding to the trust group where the target resource is located;

[0104] This step determines whether the node trust value of each trusted node in the trust group containing the target resource in the access request is greater than the group trust threshold corresponding to the trust group. Only when the trust values ​​of all nodes in the group exceed the threshold is the access request considered to have passed the trust verification; otherwise, it is considered to have failed the verification.

[0105] S108, updating transmission path information;

[0106] If the result of step S107 is negative, the transmission path information is updated and the process returns to step S102. This indicates that the target resource's trust group contains nodes with trust values ​​below the group trust threshold, indicating that the current transmission path is not secure and trustworthy. In this case, the system needs to update the transmission path information, reselect a more secure transmission path, and then return to step S102 to re-transmit and re-evaluate trust.

[0107] When updating transmission paths, the system can employ various path selection algorithms, such as Dijkstra and Floyd, to select the optimal transmission path based on factors such as the trust relationship between nodes and path length. Furthermore, the system can also incorporate a path diversity mechanism to select multiple alternative paths. If a path encounters a security issue, the system can quickly switch to an alternative path, improving transmission reliability.

[0108] To improve the security of the transmission path, the system can introduce path encryption technology to encrypt data along the transmission path to prevent data theft or tampering during transmission. In addition, the system can also adopt a dynamic path adjustment mechanism to dynamically adjust the transmission path based on changes in the network environment and node trust values ​​to ensure the real-time credibility of the transmission path.

[0109] S109: Determine whether the access request passes the security verification.

[0110] If the result of step S107 is yes, the system determines that the access request has passed security verification. This means that the trust values ​​of all nodes in the trust group containing the target resource are greater than the group trust threshold, indicating that the current transmission path is secure and trustworthy. At this point, the system determines that the access request has passed security verification and allows the target user to access the requested target resource.

[0111] During security verification, the system can use digital signature technology to sign the verification results, ensuring their authenticity and immutability. At the same time, the system can also generate a secure access token, authorizing the target user to access the target resource within a certain period of time, simplifying the subsequent access control process.

[0112] To enhance system security, after verifying that an access request has been authenticated, the system can continuously monitor the target user's access behavior, assessing their trust status in real time. Once any abnormal behavior is detected, appropriate security measures can be taken promptly, such as disconnecting the user or restricting access. Furthermore, the system can employ proactive defense technology to reinforce the security of authenticated access requests, enhancing the system's resilience.

[0113] In the above embodiment, the target user's access request is obtained and the user's trust index is extracted. A directed trust transfer graph is constructed based on the transmission path information, and the trust decay coefficient and node trust value are calculated. Trust nodes are then clustered based on the relationship similarity matrix and the group trust threshold is calculated to achieve secure verification of the access request. During the verification process, multi-dimensional information such as user trustworthiness, transmission path trustworthiness, and node group characteristics is considered, making security verification more comprehensive and accurate. The attenuation of trust values ​​is quantified using the trust decay coefficient of the trust transfer edge, accurately reflecting the impact of different transmission paths on system security. Clustering is used to group trust nodes and set differentiated group trust thresholds, ensuring unified management within similar node groups while enabling differentiated control between different groups. If verification fails, the system automatically updates the transmission path and re-verifies, improving the system's fault tolerance and availability. This improves both system security and flexibility, thereby enhancing network security.

[0114] In the above embodiment, the basic process of zero-trust architecture network security protection is described, including the calculation of user trust index and final security verification. However, in actual applications, there may be loop problems in the transmission path, which will affect the accuracy and efficiency of trust transfer. Therefore, before constructing a directed trust transfer graph, the transmission path needs to be preprocessed to ensure the rationality of its topology. Figure 2 , a transmission path preprocessing method in an embodiment of the present application is described:

[0115] See also Figure 2 , which is a flow chart of a transmission path preprocessing method in an embodiment of the present application.

[0116] S201, obtaining network topology information of each system node in the transmission path information;

[0117] This step obtains the network topology information of each system node involved in the transmission path information, including the connection relationship between nodes, node attribute information, etc. Network topology information reflects the organizational structure and mutual relationship of nodes in the transmission path and is the basis for constructing the path map.

[0118] To obtain network topology information, the system can employ various methods, such as active probing and passive monitoring. Active probing involves the system proactively sending probe packets to the network and inferring node connectivity based on the responses received. Passive monitoring involves analyzing network traffic, extracting inter-node communication information, and inferring node connectivity. Furthermore, the system can directly obtain node attribute information and connectivity by accessing network device configuration information or the network management system's database.

[0119] S202, constructing an initial path map based on network topology information;

[0120] This step constructs an initial path graph of the transmission path based on the network topology information obtained in step S201. The initial path graph is a directed graph, where nodes represent system nodes in the transmission path, edges represent the connection relationship between nodes, and the direction of the edge represents the direction of data transmission.

[0121] When constructing the initial path graph, the system can use data structures such as adjacency matrices or adjacency lists to represent the graph. An adjacency matrix is ​​a two-dimensional array, with rows and columns representing nodes in the graph, and each matrix element indicates whether a connection exists between nodes. An adjacency list is an array, with each element corresponding to a node and storing information about that node's neighbors. Based on the network topology, the system can generate the corresponding adjacency matrix or adjacency list to construct the initial path graph.

[0122] S203, determining whether there is a loop in the initial path graph;

[0123] The system determines whether there is a loop in the initial path graph. Specifically, it performs a depth-first traversal on the initial path graph and records the system nodes visited during the traversal.

[0124] Determine whether the currently accessed system node is among the recorded system nodes;

[0125] If so, it is determined that there is a loop in the initial path graph;

[0126] If not, then perform the step of depth-first traversal of the initial path graph;

[0127] When the depth-first traversal is completed, if the currently visited system node is not in the recorded system nodes, it is determined that there is no loop in the initial path graph.

[0128] This step determines whether there are loops in the initial path graph—that is, whether there is a path that starts at a certain node, passes through a series of nodes, and then returns to the same node. The existence of loops can lead to an infinite loop of trust transfer, affecting the accuracy and efficiency of trust assessment.

[0129] When determining loops, the system can employ a depth-first traversal algorithm. Specifically, the system begins at the starting node of the initial path graph and recursively traverses each node in the graph. During the traversal process, the system maintains a visit tag set to record the nodes that have been visited. When traversing to a node, the system first determines whether the node is in the visit tag set. If so, a loop exists. If not, the node is added to the visit tag set and traversal continues to its adjacent nodes. If, after traversing all nodes, no duplicate nodes exist in the visit tag set, then there is no loop in the initial path graph.

[0130] During this step, when determining loops, the system may face issues such as repeated node visits and excessive traversal times, impacting the efficiency and accuracy of the determination. To address this issue, the system can introduce pruning optimization technology. During the traversal process, by recording the access status of nodes, duplicate visits are avoided, reducing unnecessary traversal overhead. Furthermore, the system can employ parallel traversal technology, utilizing multithreading or distributed computing to simultaneously traverse multiple nodes, improving traversal parallelism and efficiency. Through efficient and accurate loop determination, the system can promptly identify loop problems in the transmission path, providing a basis for subsequent path optimization decisions.

[0131] S204: Adjust the transmission path information to remove loops.

[0132] If the determination result in step S203 is yes, the system adjusts the transmission path information to remove the loop. If the determination result in step S203 is no, the system re-executes step S102.

[0133] If the judgment result of step S203 is yes, that is, there is a loop in the initial path graph, the system needs to adjust the transmission path information to remove the loop and ensure the rationality of the path.

[0134] The system can employ various strategies when adjusting transmission path information. One strategy is loop breaking, which involves selecting an edge within a loop and removing it from the path, breaking the loop. Edge selection can be based on factors such as edge weight and the trust value of the nodes on the edge, prioritizing edges with the least impact on the path. Another strategy is loop merging, which involves merging nodes in a loop into a supernode and connecting edges entering and exiting the loop to the supernode, thus eliminating the loop. The system can flexibly select a loop removal strategy and adjust transmission path information based on actual conditions.

[0135] In the above-described embodiment, network topology information of system nodes is obtained to construct an initial path graph, which is then subjected to loop detection and processing, ensuring that the resulting directed trust transfer graph possesses a well-defined topological structure. The loop detection mechanism promptly identifies circular dependencies within the transmission path, while loop removal ensures the unidirectionality and terminability of the trust value transfer process, reducing the risk of circular calculations or dead loops during the trust transfer process and improving the efficiency and accuracy of subsequent trust value calculations. By optimizing the network topology, the authenticity of the trust transfer relationship between system nodes as reflected by the directed trust transfer graph is enhanced.

[0136] Furthermore, in another embodiment, after calculating the group trust threshold corresponding to each trust group according to the distribution characteristics of the node trust values ​​in each trust group, the method further includes:

[0137] Obtain node trust value change data and access records of each trust group within a second preset time window;

[0138] The group stability index of each trust group is calculated based on the node trust value change data. The group stability index is used to represent the degree of fluctuation of the trust value of nodes in the trust group.

[0139] The group trust threshold is weighted and modified based on the group stability index to obtain a dynamic trust threshold;

[0140] Correlate and analyze the dynamic trust threshold with the security event data in the access records to generate a threshold optimization strategy. Specifically, extract the occurrence time of various security events in the access records and the corresponding dynamic trust threshold;

[0141] Construct a time series correlation matrix and calculate the correlation coefficient between various security events and dynamic trust thresholds based on the time series correlation matrix;

[0142] Identify key security event types that affect dynamic trust thresholds based on correlation coefficients;

[0143] Construct a threshold adjustment function based on the historical distribution patterns of key security event types;

[0144] Generate a threshold optimization strategy based on the threshold adjustment function;

[0145] The dynamic trust threshold is calibrated according to the threshold optimization strategy to obtain the final group trust threshold.

[0146] In this embodiment, after calculating the group trust threshold corresponding to each trust group, the system further optimizes the group trust threshold so that it can dynamically adapt to changes in the network environment and improve the accuracy and reliability of trust evaluation.

[0147] First, the system obtains node trust value change data and access records for each trust group within a second preset time window. Node trust value change data reflects the stability of node trust values ​​within the trust group, while access records contain information about various security incidents that have occurred on the network. By analyzing these two types of data, the system can assess the rationality of the group's trust threshold and make appropriate optimization adjustments.

[0148] The system then calculates a group stability index for each trust group based on the node trust value change data. The group stability index characterizes the degree of fluctuation in the trust values ​​of nodes within a trust group and can be quantified by calculating statistics such as the standard deviation and coefficient of variation of the node trust values. A higher group stability index indicates greater fluctuation in the trust values ​​of nodes within the group and a lower reliability of the group trust threshold.

[0149] Next, the system applies a weighted correction to the group trust threshold based on the group stability index to obtain a dynamic trust threshold. The purpose of this weighted correction is to dynamically adjust the trust threshold based on the group's stability, appropriately lowering the trust threshold for groups with poor stability and raising it for groups with good stability. Weighted correction can be performed using linear or nonlinear weighting methods. Based on the group stability index, a weighting coefficient is calculated and multiplied by the original group trust threshold to obtain the dynamic trust threshold.

[0150] After obtaining the dynamic trust threshold, the system correlates it with the security event data in the access log to generate a threshold optimization strategy. Specifically, the system first extracts the occurrence time of each security event in the access log and the corresponding dynamic trust threshold to construct a temporal correlation matrix. The rows of the temporal correlation matrix represent different time windows, while the columns represent different types of security events and dynamic trust thresholds. The matrix elements represent the number of occurrences of the corresponding security event type or the value of the dynamic trust threshold within the corresponding time window.

[0151] The system then calculates the correlation coefficient between each security event and the dynamic trust threshold based on the time-series correlation matrix. The correlation coefficient measures the linear correlation between the security event and the dynamic trust threshold; a larger correlation coefficient indicates a stronger relationship. By analyzing the correlation coefficient, the system can identify key security event types that affect the dynamic trust threshold.

[0152] Next, the system constructs a threshold adjustment function based on the historical distribution patterns of key security event types. This function defines the mapping between the number or frequency of key security events and the dynamic trust threshold. It can take the form of a linear, logarithmic, or exponential function. By fitting the historical distribution data of key security events, the system derives the parameters of the threshold adjustment function and generates a threshold optimization strategy based on the function.

[0153] Finally, the system calibrates the dynamic trust threshold based on the threshold optimization strategy to obtain the final group trust threshold. The calibration process applies the threshold optimization strategy to the dynamic trust threshold and calculates the adjusted trust threshold based on the current security event status. This calibrated group trust threshold better adapts to the current network security situation and dynamically reflects the trustworthiness of the trust group.

[0154] In the above embodiment, a group stability index is introduced to characterize the degree of fluctuation of the trust value of the nodes in the trust group, and the group trust threshold is dynamically adjusted in combination with the historical change data of the node trust value. This threshold correction mechanism based on historical data can adapt to the dynamic change characteristics of the network environment, so that the setting of the trust threshold is more in line with the actual situation. By correlating and analyzing the dynamic trust threshold with the security event data in the access record, the system can identify the key factors that affect the threshold setting, and generate a scientific and reasonable threshold optimization strategy based on these factors. The optimized group trust threshold not only maintains the effective identification ability of abnormal access behavior, but also reduces the problem of normal access being misjudged due to overly strict threshold settings. This adaptive threshold adjustment mechanism improves the accuracy and reliability of the system, while reducing the workload of security management personnel, making the access control of the zero-trust architecture more accurate and efficient.

[0155] The following describes the system in the embodiment of the present invention from the perspective of hardware processing. Figure 3 , which is a schematic diagram of the physical device structure of a zero-trust architecture network security protection system provided in an embodiment of the present application.

[0156] It should be noted that Figure 3 The structure of the system shown is only an example and should not limit the functions and scope of use of the embodiments of the present invention.

[0157] like Figure 3 As shown, the system includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes, such as the methods described in the above embodiments, based on programs stored in a read-only memory (ROM) 302 or programs loaded from a storage unit 308 into a random access memory (RAM) 303. RAM 303 also stores various programs and data required for system operation. CPU 301, ROM 302, and RAM 303 are interconnected via a bus 304. An input / output (I / O) interface 305 is also connected to bus 304.

[0158] The following components are connected to the I / O interface 305: an input section 306 including a camera, infrared sensor, and the like; an output section 307 including a liquid crystal display (LCD) and speakers; a storage section 308 including a hard disk and the like; and a communication section 309 including a network interface card such as a LAN (Local Area Network) card or a modem. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as needed. Removable media 311, such as a magnetic disk, optical disk, magneto-optical disk, or semiconductor memory, is installed in the drive 310 as needed, so that computer programs read from the media can be installed in the storage section 308 as needed.

[0159] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program including a computer program for executing the methods illustrated in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via the communication section 309 and / or installed from removable media 311. When executed by the central processing unit (CPU) 301, the computer program performs the various functions defined in the present invention.

[0160] It should be noted that the computer-readable medium described in the embodiments of the present invention may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present invention, a computer-readable signal medium may include a data signal transmitted in baseband or as part of a carrier wave, which carries a computer-readable computer program. Such a propagated data signal may take any of a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof.

[0161] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. Each box in the flowchart or block diagram can represent a module, program segment, or part of the code, and the above-mentioned module, program segment, or part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the boxes can also occur in an order different from that marked in the accompanying drawings. For example, two boxes shown in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or can be implemented using a combination of dedicated hardware and computer instructions.

[0162] As another aspect, the present invention further provides a computer-readable storage medium, which may be included in the system described in the above embodiments, or may exist independently and not incorporated into the system. The storage medium carries one or more computer programs, and when executed by a processor of a system, the system implements the methods provided in the above embodiments.

[0163] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0164] As used in the above embodiments, the term “when” may be interpreted to mean “if” or “after” or “in response to determining that” or “in response to detecting that”, depending on the context. Similarly, the phrases “upon determining that” or “if (stated condition or event) is detected” may be interpreted to mean “if determining that” or “in response to determining that” or “upon detecting (stated condition or event)” or “in response to detecting (stated condition or event)”, depending on the context.

[0165] In the above embodiments, all or part of the embodiments can be implemented using software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, hard disk, tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive).

[0166] Those skilled in the art will appreciate that all or part of the process steps in the above-described method embodiments can be implemented by a computer program instructing the relevant hardware. The program can be stored in a computer-readable storage medium, and when executed, the program can include the process steps in the above-described method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A zero-trust architecture network security protection method, characterized in that: include: Obtaining an access request from a target user, the access request including identity information of the target user, target resource information, and transmission path information, the transmission path information including node identifiers of multiple system nodes; Extracting credit features from a preset user credit database based on the identity information, and calculating a user trust index based on the credit features; Constructing a directed trust transfer graph according to the transmission path information, mapping each node identifier to a trust node in the directed trust transfer graph, and establishing trust transfer edges between adjacent trust nodes; Obtaining historical security event data of each of the trust nodes, and calculating the trust attenuation coefficient of each of the trust transfer edges based on the historical security event data; Taking the user trust index as the initial trust value of the starting trust node, and calculating the node trust value of each trust node along the directed trust transfer graph according to the trust decay coefficient; Constructing a relationship similarity matrix based on the connection relationship of each of the trust transfer edges; Clustering the trust nodes according to the relationship similarity matrix to obtain multiple trust groups; Calculating the group trust threshold corresponding to each trust group according to the distribution characteristics of the trust values ​​of the nodes in each trust group; Determining whether the node trust value of each of the trust nodes in the trust group where the target resource is located is greater than the group trust threshold corresponding to the trust group where the target resource is located; If so, determining that the access request passes the security verification; If not, update the transmission path information and return to the step of constructing a directed trust transfer graph according to the transmission path information.

2. The method according to claim 1, characterized in that The calculating of the user trust index based on the credit characteristics specifically includes: Constructing an N-dimensional feature vector based on the credit feature, where N is a positive integer; Performing weighted calculation on each dimension of the N-dimensional feature vector based on a preset weight coefficient to obtain a weighted feature vector; Inputting the weighted feature vector into a preset trust evaluation model, wherein the preset trust evaluation model is trained based on historical user credit characteristics and security event data; The user trust index is determined according to the output result of the preset trust evaluation model.

3. The method according to claim 1, characterized in that Calculating the trust attenuation coefficient of each trust transfer edge according to the historical security event data specifically includes: Obtaining security event data of each of the trusted nodes within a first preset time window; Identifying the abnormal behavior type of each of the trust nodes according to the security event data; Constructing a security risk scoring matrix based on the abnormal behavior types; The trust attenuation coefficient of the trust transfer edge corresponding to the trust node is calculated according to the security risk score of the adjacent trust node.

4. The method according to claim 1, wherein Before constructing a directed trust transfer graph according to the transmission path information, the method further includes: Acquire network topology information of each of the system nodes in the transmission path information; constructing an initial path graph based on the network topology information; Determine whether there is a loop in the initial path graph; If so, adjusting the transmission path information to remove the loop; If not, execute the step of constructing a directed trust transfer graph according to the transmission path information.

5. The method according to claim 4, characterized in that Determining whether there is a loop in the initial path graph specifically includes: Performing a depth-first traversal on the initial path graph, and recording the system nodes visited during the traversal; Determining whether the currently accessed system node is among the recorded system nodes; If so, determining that a loop exists in the initial path graph; If not, executing the step of performing depth-first traversal on the initial path graph; When the depth-first traversal is completed, if the currently visited system node is not in the recorded system nodes, it is determined that the initial path graph does not have the loop.

6. The method according to claim 1, wherein After calculating the group trust threshold corresponding to each trust group based on the distribution characteristics of the trust values ​​of the nodes in each trust group, the method further includes: Obtaining node trust value change data and access records of each trust group within a second preset time window; Calculating a group stability index of each trust group based on the node trust value change data, wherein the group stability index is used to characterize the degree of fluctuation of the trust values ​​of nodes in the trust group; Performing weighted correction on the group trust threshold based on the group stability index to obtain a dynamic trust threshold; Correlate and analyze the dynamic trust threshold with the security event data in the access record to generate a threshold optimization strategy; The dynamic trust threshold is calibrated according to the threshold optimization strategy to obtain a final group trust threshold.

7. The method according to claim 6, characterized in that The correlating analysis of the dynamic trust threshold with the security event data in the access record to generate a threshold optimization strategy specifically includes: Extracting the occurrence time of various security events and the corresponding dynamic trust thresholds in the access records; Constructing a time series correlation matrix, and calculating the correlation coefficient between the various security events and the dynamic trust threshold based on the time series correlation matrix; Identifying a key security event type that affects the dynamic trust threshold according to the correlation coefficient; Constructing a threshold adjustment function based on the historical distribution pattern of the key security event types; A threshold optimization strategy is generated according to the threshold adjustment function.

8. A zero-trust architecture network security protection system, characterized in that: The system comprises: One or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to cause the system to execute the method according to any one of claims 1 to 7.

9. A computer-readable storage medium comprising instructions, characterized in that: When the instructions are executed on a system, the system is caused to perform the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that When the computer program product is run on a system, the system is caused to perform the method according to any one of claims 1 to 7.

Images