Cloud office access control system based on zero-trust architecture

Abstract

The invention discloses a cloud office access control system based on a zero-trust architecture, and belongs to the technical field of cloud office security, and the system comprises a zero-trust architecture module which is used for monitoring and obtaining related data information when a user accesses; the risk monitoring module is used for judging whether the zero-trust architecture module has a security vulnerability hidden danger or not; the risk assessment module is used for assessing the security risk of the login; the user behavior analysis module is used for judging whether the login access user has an abnormal risk or not according to the acquired related data information; and the decision module executes a corresponding decision according to the judgment result. According to the invention, the user behavior after normal login can be monitored through the user behavior analysis module, and analysis is carried out according to the related data information generated by the login behavior to judge whether the access user has an abnormal risk, so that the abnormal risk can be processed in time, resources in the cloud office system are prevented from being continuously stolen, and the user experience is improved. Therefore, the security of information resources is effectively protected.

Description

Technical Field

[0001] The present invention belongs to the field of cloud office security technology, and specifically relates to a cloud office access control system based on a zero-trust architecture. Background Art

[0002] With the popularity of remote work, BYOD (bring your own device) and cloud computing, traditional perimeter-based security measures are no longer sufficient to deal with complex network threats. Zero trust architecture is a new network security strategy and model. No matter where the user, device or application is located in the network, it must undergo strict authentication, authorization and continuous monitoring before accessing the corresponding resources. The advantage of zero trust architecture lies in its flexibility and adaptability, which can provide consistent security policies across different environments. Only strictly verified users and devices can access protected resources, which significantly improves the company's defense capabilities against advanced persistent threats.

[0003] Although the adoption of zero-trust architecture design can protect the security of cloud data to a certain extent, it may also have security vulnerabilities. Once the core components or authentication mechanisms of the zero-trust architecture system are compromised, attackers may bypass access control, obtain sensitive information or control cloud office resources, resulting in information loss. In addition, when attackers break into the system logged in by the user and access cloud office resources in the name of the user, the system cannot determine that the cloud office system has been invaded, which may also cause the loss of sensitive information or control of cloud office resources. Summary of the invention

[0004] The purpose of the present invention is to provide a cloud office access control system based on a zero-trust architecture to solve the problems faced in the above-mentioned background technology.

[0005] The purpose of the present invention can be achieved through the following technical solutions:

[0006] A cloud office access control system based on zero trust architecture, the control system comprising:

[0007] A zero-trust architecture module, which is used to monitor and obtain relevant data information when a user accesses a cloud office system;

[0008] A risk monitoring module, which is used to perform security monitoring on the zero-trust architecture module to determine whether there are security vulnerabilities in the zero-trust architecture module;

[0009] A risk assessment module, which is used to assess the security risk of this login;

[0010] A user behavior analysis module, which is used to determine whether the logged-in access user has abnormal risks based on the acquired relevant data information;

[0011] A decision-making module executes corresponding decisions according to the judgment results.

[0012] Furthermore, the relevant data information includes login information, system resource consumption information, log information, browsing information and download information when the user accesses.

[0013] Furthermore, the risk monitoring module works as follows:

[0014] Obtain the CPU utilization, memory usage, and system response time of the zero-trust architecture module over a period of time, and also obtain the number of attacks AT and the number of exceptions AB in the logs of the zero-trust architecture module during this period;

[0015] By formula Obtain the risk value Rv;

[0016] The obtained risk value Rv is compared with the risk threshold Rv set in the risk monitoring module th To compare:

[0017] When Rv>Rv th When the zero-trust architecture module is detected, it is judged that there are security vulnerabilities;

[0018] Among them, MAXU RT is the longest system response time during this period, is the average system response time, ΔRT is the set system response time comparison value, MAXU CPU is the maximum CPU utilization during this period. is the average CPU utilization, ΔCPU is the set CPU utilization comparison value, MAXU MO is the maximum memory usage during this period, is the average memory usage, and ΔMO is the set memory usage comparison value.

[0019] Furthermore, the risk assessment module works as follows:

[0020] Get the number of login attempts n and the duration t of each login attempt by the same login user within the set time i , the distance difference between the IP address and the commonly used IP address each time you log in, L i , the number of times multi-factor authentication is enabled within a set period of time N and the number of times multi-factor authentication fails when enabled N L ;

[0021] By formula The evaluation coefficient H is obtained;

[0022] When H>H th , it is judged that there is a security risk in this login;

[0023] The additional risk factor in ∈, H th is the preset evaluation coefficient threshold, α1 and α2 are respective preset coefficients, and i∈[1,n].

[0024] Furthermore, the risk additional coefficient ∈ is obtained by:

[0025] Record the number of different users logging into the system within the set time P U ;

[0026] when When , then ∈=1;

[0027] when When ∈=2;

[0028] when When ∈=3;

[0029] in, as well as The value for the preset number of logged-in users.

[0030] Furthermore, the user behavior analysis module works as follows:

[0031] After the user logs in normally, the browsing and downloading information of the user when logging into the cloud office system is obtained at intervals of one end, and a curve function G(t) of the browsing and downloading over time and a curve function Q(t) of the downloading and browsing over time are formulated;

[0032] By formula Get outliers;

[0033] The obtained abnormal value K is compared with the preset abnormal threshold K th To compare:

[0034] When K>K th , it is judged that the logged-in access user has abnormal risks;

[0035] Among them, τ is the number of times the user attempts to click to browse non-authorized materials during the interval period, G0(t) is the time-varying curve function of the standard browsing volume set by the system, Q0(t) is the time-varying curve function of the standard download volume set by the system, maxG′(t) is the maximum slope of G(t), minG′(t) is the minimum slope of G(t), γG is the set slope comparison value of G(t), maxQ′(t) is the maximum slope of Q(t), minQ′(t) is the minimum slope of Q(t), γQ is the set slope comparison value of Q(t), t1 is the start time of the interval period, and t2 is the end time of the interval period.

[0036] Furthermore, the working method of the decision module is:

[0037] When it is determined that the zero-trust architecture module has security vulnerabilities, the zero-trust architecture module is updated;

[0038] If it is determined that there is a security risk in this login, the login will be interrupted and the zero-trust architecture module will be updated at the same time;

[0039] When it is determined that the logged-in access user has abnormal risks, the current access user will be immediately disabled and locked, and the device accessed by the access user will be disconnected from other networks, and an alarm will be issued.

[0040] Beneficial effects of the present invention:

[0041] The present invention conducts a comprehensive analysis based on the number of attacks in the log, the anomalies generated, the CPU utilization, the memory occupancy rate, and the system response time to determine whether there are security risks in the zero-trust architecture module, so as to update the zero-trust architecture module in time to protect the security of the zero-trust architecture module.

[0042] The present invention can evaluate the login security risk according to the user's login information through the risk assessment module, thereby preventing users with security risks from logging in and accessing, thereby ensuring information security.

[0043] The present invention can monitor user behavior after normal login through a user behavior analysis module, and analyze the relevant data information generated by the login behavior to determine whether there is an abnormal risk for the accessing user. In this way, the abnormal risk can be handled in time to avoid the continuous theft of resources in the cloud office system, thereby effectively protecting the security of information resources.

[0044] Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for describing the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0046] Figure 1 It is a system block diagram of the present invention. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] In one embodiment, a cloud office access control system based on a zero-trust architecture is disclosed. Figure 1 As shown, the control system mainly includes the following modules:

[0049] Zero-trust architecture module: The zero-trust architecture module is used to monitor and obtain relevant data information when users access the cloud office system. The relevant data information includes login information, system resource consumption information, log information, browsing information, and download information when users access the system.

[0050] Risk monitoring module: The risk monitoring module is used to perform security monitoring on the zero-trust architecture module to determine whether there are security vulnerabilities in the zero-trust architecture module;

[0051] Risk assessment module: the risk assessment module is used to assess the security risk of this login;

[0052] User behavior analysis module: The user behavior analysis module is used to determine whether the logged-in access user has abnormal risks based on the relevant data information obtained;

[0053] Decision-making module, the decision-making module executes corresponding decisions based on the judgment results.

[0054] Through the above technical scheme, this application adopts a risk detection module to further monitor the zero-trust architecture module, and can establish a more complete security vulnerability management mechanism to provide security protection for the zero-trust architecture module, avoid the occurrence of zero-trust architecture module being breached, and ensure the security of information resources; at the same time, the risk assessment module can be used to assess login security risks, thereby blocking login access and ensuring information security; in addition, the user behavior after normal login can be monitored through the user behavior analysis module, and the relevant data information generated by the login behavior can be analyzed to determine whether there is an abnormal risk for the accessing user. In this way, the abnormal risk can be handled in time to avoid the continuous theft of resources in the cloud office system, thereby effectively protecting the security of information resources.

[0055] The working method of the risk monitoring module is:

[0056] Obtain the CPU utilization, memory usage, and system response time of the zero-trust architecture module over a period of time, and also obtain the number of attacks AT and the number of exceptions AB in the logs of the zero-trust architecture module during this period;

[0057] By formula Obtain the risk value Rv;

[0058] The obtained risk value Rv is compared with the risk threshold Rv set in the risk monitoring module th To compare:

[0059] When Rv>Rv th When the zero-trust architecture module is detected, it is judged that there are security vulnerabilities;

[0060] Among them, MAXU RT is the longest system response time during this period, is the average system response time, ΔRT is the set system response time comparison value, MAXU CPU is the maximum CPU utilization during this period. is the average CPU utilization, ΔCPU is the set CPU utilization comparison value, MAXU MO is the maximum memory usage during this period, is the average memory usage, and ΔMO is the set memory usage comparison value.

[0061] The above technical solution provides a specific method for the risk monitoring module to work. Generally speaking, when the zero-trust architecture module is attacked or breached, its CPU utilization and memory occupancy rate will be abnormally increased compared with normal conditions, and the normal response time of the system will also be greatly extended. Therefore, the CPU utilization rate, memory occupancy rate and system response time of the zero-trust architecture module within a period of time are obtained, and at the same time, the number of attacks AT and the number of abnormalities AB in the log of the zero-trust architecture module during this period of time are obtained. Through the formula The risk value Rv is obtained, and it can be known that when The larger the value, the higher the CPU utilization, memory usage and system response time during this period of time. At the same time, when formula e AT+AB The larger the value, the higher the number of times the zero trust architecture module has been attacked in large numbers during this period. Therefore, when the risk value Rv is larger, the greater the possibility that the zero trust architecture module is breached. Therefore, the obtained risk value Rv is compared with the risk threshold Rv set in the risk monitoring module. th Compare: When Rv>Rv th When the zero-trust architecture module is detected, it is determined that there are security vulnerabilities in the zero-trust architecture module. At this time, the zero-trust architecture module is updated to protect the security of the zero-trust architecture module and reduce the occurrence of its breach. In this way, the number of attacks in the log, the abnormalities generated, combined with the CPU utilization, memory occupancy, and system response time, can be used for comprehensive analysis to determine whether there are security risks in the zero-trust architecture module, so that the zero-trust architecture module can be updated in time to protect the security of the zero-trust architecture module.

[0062] Set the system response time comparison value ΔRT, CPU utilization comparison value ΔCPU, memory usage comparison value ΔMO, and risk threshold Rv th Both can be determined based on the system's historical data and experience.

[0063] The working method of the risk assessment module is: obtain the number of login attempts n by the same login user within a set time, the duration of each login t i , the distance difference between the IP address and the commonly used IP address each time you log in, L i , the number of times multi-factor authentication is enabled within a set period of time N and the number of times multi-factor authentication fails when enabled N L ;

[0064] By formula The evaluation coefficient H is obtained;

[0065] When H>H th , it is judged that there is a security risk in this login;

[0066] The additional risk factor in ∈, H th is the preset evaluation coefficient threshold, α1 and α2 are respective preset coefficients, and i∈[1,n], and the risk additional coefficient ∈ is obtained by:

[0067] Record the number of different users logging into the system within the set time P U ;

[0068] when When , then ∈=1;

[0069] when When ∈=2;

[0070] when When ∈=3;

[0071] in, as well as The value for the preset number of logged-in users.

[0072] The above technical solution provides a specific method for the risk assessment module to work. First, the number of different login users logging into the system within a set time is recorded. U , according to the obtained P U The value of the preset number of logged-in users as well as By comparing, we can get the risk additional coefficient ∈. Obviously, if the number of different login users logging into the system within the set time is more and obviously more than the normal range, the risk is greater, so the value of the risk additional coefficient ∈ is larger; then we get the number of login attempts n and the duration of each login t of the same login user within the set time. i , the distance difference between the IP address and the commonly used IP address each time you log in, L i , the number of times multi-factor authentication is enabled within a set period of time N and the number of times multi-factor authentication fails when enabled N L , through the formula A comprehensive analysis is performed to determine the login risk of the same login user. It can be seen that the larger the value, the higher the risk level. Finally, combined with the risk additional coefficient ∈, the formula is used Obtain the security risk assessment coefficient H for this login phase, and then compare it with the preset assessment coefficient threshold H th Compare, when H>H th , it is determined that there is a security risk in this login. At this time, the login is interrupted and the zero-trust architecture module is updated to ensure the security of data information in the cloud office system.

[0073] In the above technical solution, the preset number of logged-in users is as well as The preset evaluation coefficient threshold H th The preset coefficients α1 and α2 can be determined based on historical data and experience, so we will not elaborate on them here.

[0074] The user behavior analysis module works as follows:

[0075] After the user logs in normally, the browsing and downloading information of the user when logging into the cloud office system is obtained at intervals of one end, and a curve function G(t) of the browsing and downloading over time and a curve function Q(t) of the downloading and browsing over time are formulated;

[0076] By formula Get outliers;

[0077] The obtained abnormal value K is compared with the preset abnormal threshold K th To compare:

[0078] When K>K th , it is judged that the logged-in access user has abnormal risks;

[0079] Among them, τ is the number of times the user attempts to click to browse non-authorized materials during the interval period, G0(t) is the time-varying curve function of the standard browsing volume set by the system, Q0(t) is the time-varying curve function of the standard download volume set by the system, maxG′(t) is the maximum slope of G(t), minG′(t) is the minimum slope of G(t), γG is the set slope comparison value of G(t), maxQ′(t) is the maximum slope of Q(t), minQ′(t) is the minimum slope of Q(t), γQ is the set slope comparison value of Q(t), t1 is the start time of the interval period, and t2 is the end time of the interval period.

[0080] The above technical solution provides a specific method for the user behavior analysis module to work. In order to prevent attackers from accessing cloud office resources in the name of users after breaking into the system logged in by users, this embodiment obtains the browsing information and download information of the user when logging into the cloud office system at intervals after the user logs in normally, and formulates the browsing volume change curve function G(t) and the download volume change curve function Q(t) over time; thus, through the formula To get the outlier value, the formula as well as They respectively represent the changes in page views and downloads within the interval period. The larger the value, the greater the page views and downloads in a short period of time, and the higher the abnormal behavior. as well as It represents the difference between the cumulative change of page views and the standard cumulative change of page views, and the difference between the cumulative change of downloads and the standard cumulative change of downloads. The larger the value, the more the downloads and page views exceed the normal downloads and page views in the interval, and the higher the abnormal behavior of the user. τ represents the number of times the user attempts to click to browse non-authorized materials in the interval. The larger the value, the higher the abnormal behavior of the user. Therefore, the larger the value of the abnormal value K, the more it indicates that the user behavior is abnormal. The obtained abnormal value K is compared with the preset abnormal threshold K. th Compare, when K>K th When the system detects abnormality, it determines that the logged-in access user has an abnormal risk. At this time, the current access user is immediately disabled and locked, and the device accessed by the access user is disconnected from other networks. At the same time, an alarm is issued to prevent further theft of resource information in the cloud office system, thereby reducing resource losses.

[0082] It should be noted that in the above scheme, the standard browsing volume change curve function G0(t) set by the system, the standard download volume change curve function Q0(t) set by the system, and the slope comparison values ​​γG and γQ can all be determined based on historical data and experience, while the start time t1 and end time t2 of the interval period can be determined artificially based on actual conditions.

[0083] The present invention conducts a comprehensive analysis based on the number of attacks in the log, the anomalies generated, and the CPU utilization, memory occupancy, and system response time to determine whether the zero-trust architecture module has security risks, thereby timely updating the zero-trust architecture module to protect the security of the zero-trust architecture module. The present invention can evaluate the login security risk based on the user's login information through a risk assessment module, thereby preventing users with security risks from logging in and accessing, and ensuring information security. The present invention can monitor user behavior after normal login through a user behavior analysis module, and analyze the relevant data information generated by the login behavior to determine whether the accessing user has abnormal risks. In this way, abnormal risks can be handled in a timely manner to prevent the continuous theft of resources in the cloud office system, thereby effectively protecting the security of information resources.

[0084] The above contents are merely examples and explanations of the concept of the present invention. The technicians in this technical field may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the concept of the invention or exceed the scope defined by the claims, they should all fall within the protection scope of the present invention.

Claims

1. A cloud office access control system based on zero trust architecture, characterized in that: The control system comprises: A zero-trust architecture module, which is used to monitor and obtain relevant data information when a user accesses a cloud office system; A risk monitoring module, which is used to perform security monitoring on the zero-trust architecture module to determine whether there are security vulnerabilities in the zero-trust architecture module; A risk assessment module, which is used to assess the security risk of this login; A user behavior analysis module, which is used to determine whether the logged-in access user has abnormal risks based on the acquired relevant data information; A decision-making module executes corresponding decisions according to the judgment results.

2. According to claim 1, a cloud office access control system based on zero trust architecture is characterized in that: The relevant data information includes login information, system resource consumption information, log information, browsing information and download information when the user accesses.

3. A cloud office access control system based on zero trust architecture according to claim 2, characterized in that: The working method of the risk monitoring module is: Obtain the CPU utilization, memory usage, and system response time of the zero-trust architecture module over a period of time, and also obtain the number of attacks AT and the number of exceptions AB in the logs of the zero-trust architecture module during this period; By formula Obtain the risk value Rv; The obtained risk value Rv is compared with the risk threshold Rv set in the risk monitoring module th To compare: When Rv>Rv th When the zero-trust architecture module is detected, it is judged that there are security vulnerabilities; Among them, MAXU RT is the longest system response time during this period, is the average system response time, ΔRT is the set system response time comparison value, MAXU CPU is the maximum CPU utilization during this period. is the average CPU utilization, ΔCPU is the set CPU utilization comparison value, MAXU MO is the maximum memory usage during this period, is the average memory usage, and ΔMO is the set memory usage comparison value.

4. A cloud office access control system based on zero trust architecture according to claim 2, characterized in that: The risk assessment module works as follows: Get the number of login attempts n and the duration t of each login attempt by the same login user within the set time i , the distance difference between the IP address and the commonly used IP address each time you log in, L i , the number of times multi-factor authentication is enabled within a set period of time N and the number of times multi-factor authentication fails when enabled N L ; By formula The evaluation coefficient H is obtained; When H>H th , it is judged that there is a security risk in this login; The additional risk factor in ∈, H th is the preset evaluation coefficient threshold, α1 and α2 are respective preset coefficients, and i∈[1,n].

5. A cloud office access control system based on zero trust architecture according to claim 4, characterized in that: The method for obtaining the risk additional coefficient ∈ is: Record the number of different users logging into the system within the set time P U ; when When , then ∈=1; when When ∈=2; when When ∈=3; in, as well as The value for the preset number of logged-in users.

6. A cloud office access control system based on zero trust architecture according to claim 2, characterized in that: The user behavior analysis module works as follows: After the user logs in normally, the browsing and downloading information of the user when logging into the cloud office system is obtained at intervals of one end, and a curve function G(t) of the browsing and downloading over time and a curve function Q(t) of the downloading and browsing over time are formulated; By formula Outliers are obtained; The obtained abnormal value K is compared with the preset abnormal threshold K th To compare: When K>K th , it is judged that the logged-in access user has abnormal risks; Wherein, T is the number of times the user attempts to click to browse non-authorized materials during the interval period, G0(t) is the time-varying curve function of the standard browsing volume set by the system, Q0(t) is the time-varying curve function of the standard download volume set by the system, maxG′(t) is the maximum slope of G(t), minG′(t) is the minimum slope of G(t), γG is the set slope comparison value of G(t), maxQ′(t) is the maximum slope of Q(t), minQ′(t) is the minimum slope of Q(t), γQ is the set slope comparison value of Q(t), t1 is the start time of the interval period, and t2 is the end time of the interval period.

7. A cloud office access control system based on zero trust architecture according to claim 2, characterized in that: The working method of the decision module is: When it is determined that the zero-trust architecture module has security vulnerabilities, the zero-trust architecture module is updated; If it is determined that there is a security risk in this login, the login will be interrupted and the zero-trust architecture module will be updated at the same time; When it is determined that the logged-in access user has abnormal risks, the current access user will be immediately disabled and locked, and the device accessed by the access user will be disconnected from other networks, and an alarm will be issued.

Images