A cloud office access control system based on a zero trust architecture

Abstract

This invention discloses a cloud office access control system based on a zero-trust architecture, belonging to the field of cloud office security technology. It includes a zero-trust architecture module for monitoring and acquiring relevant data information during user access; a risk monitoring module for determining whether the zero-trust architecture module has security vulnerabilities; a risk assessment module for assessing the security risks of this login; a user behavior analysis module for determining whether the logged-in user poses any abnormal risks based on the acquired data information; and a decision-making module for executing corresponding decisions based on the assessment results. This invention can monitor user behavior after normal login through the user behavior analysis module, analyze the relevant data information generated by the login behavior to determine whether the accessing user poses any abnormal risks. This allows for timely handling of abnormal risks, preventing the continuous theft of resources within the cloud office system, and effectively protecting the security of information resources.

Description

Technical Field

[0001] This invention belongs to the field of cloud office security technology, specifically relating to a cloud office access control system based on a zero-trust architecture. Background Technology

[0002] With the widespread adoption of remote work, BYOD (Bring Your Own Device), and cloud computing, traditional perimeter-based security measures are no longer sufficient to address complex cyber threats. Zero Trust architecture, a new cybersecurity strategy and model, requires strict authentication, authorization, and continuous monitoring of users, devices, and applications regardless of their location on the network before granting them access to relevant resources. The advantage of Zero Trust architecture lies in its flexibility and adaptability, providing consistent security policies across different environments. Only rigorously authenticated users and devices can access protected resources, significantly improving an enterprise's ability to defend against advanced persistent threats.

[0003] While a zero-trust architecture can protect cloud data security to some extent, it may also harbor inherent security vulnerabilities. If the core components or authentication mechanisms of a zero-trust system are compromised, attackers could bypass access controls, obtain sensitive information, or control cloud office resources, resulting in data loss. Furthermore, when attackers compromise a user's login system and access cloud office resources under that user's name, the system cannot determine that it has been compromised, potentially leading to the loss of sensitive information or control over cloud office resources. Summary of the Invention

[0004] The purpose of this invention is to provide a cloud office access control system based on a zero-trust architecture to solve the problems encountered in the background art.

[0005] The objective of this invention can be achieved through the following technical solutions:

[0006] A cloud-based office access control system based on a zero-trust architecture, the control system comprising:

[0007] A zero-trust architecture module, which is used to monitor and obtain relevant data information when users access the cloud office system;

[0008] The risk monitoring module is used to perform security monitoring on the zero-trust architecture module in order to determine whether there are any security vulnerabilities in the zero-trust architecture module.

[0009] The risk assessment module is used to assess the security risks of this login.

[0010] The user behavior analysis module is used to determine whether a logged-in user has any abnormal risks based on the relevant data information obtained.

[0011] The decision-making module executes corresponding decisions based on the judgment results.

[0012] Furthermore, the relevant data information includes user login information, system resource consumption information, log information, browsing information, and download information.

[0013] Furthermore, the risk monitoring module operates as follows:

[0014] Obtain the CPU utilization, memory usage, and system response time of the zero-trust architecture module over a certain period of time. Also, obtain the number of times the zero-trust architecture module was attacked during that period. and the number of exceptions generated in the logs ;

[0015] Through formula Determine the risk value ;

[0016] The obtained risk value Risk thresholds set within the risk monitoring module Compare:

[0017] when If so, it is determined that the zero-trust architecture module has potential security vulnerabilities;

[0018] in, This is the longest system response time within that period. The average system response time, The system response time comparison value is set. This represents the maximum CPU utilization during that period. Average CPU utilization The set CPU utilization comparison value, This represents the maximum memory usage during that period. This represents the average memory usage. The set memory usage comparison value.

[0019] Furthermore, the working method of the risk assessment module is as follows:

[0020] Get the number of times n a user attempts to log in within a set time period and the duration of each login attempt. The distance difference between the IP address and the frequently used IP address each time you log in. The number of times N can be used for multi-factor authentication within a set time period, and the number of times multi-factor authentication fails. ;

[0021] Through formula derive evaluation coefficient ;

[0022] when If this occurs, it is determined that there is a security risk in this login attempt;

[0023] That Medium risk additional factor, The preset evaluation coefficient threshold, as well as Each has its own preset coefficient, and .

[0024] Furthermore, the risk additional coefficient The method for obtaining it is as follows:

[0025] Record the number of different users logging into the system within a set time period. ;

[0026] when At that time, ;

[0027] when At that time, ;

[0028] when At that time, ;

[0029] in, as well as The preset number of logged-in users is used.

[0030] Furthermore, the user behavior analysis module operates as follows:

[0031] After a user logs in normally, the system retrieves the user's page views and downloads during the login process at regular intervals, and then calculates a curve function to show how page views change over time. and the download volume change over time curve function ;

[0032] Through formula Outliers were found;

[0033] The obtained outliers Compared with the preset abnormal threshold Compare:

[0034] when If so, it is determined that the logged-in user poses an abnormal risk;

[0035] in, This represents the number of times the user attempted to click on and browse unauthorized materials within the specified interval. The standard pageview volume over time curve function set for the system. The standard download volume over time curve function set for the system. for The maximum slope, for The minimum slope, For setting Slope comparison value, for The maximum slope, for The minimum slope, For setting Slope comparison value, This is the start time of the interval period. This is the end time of the interval period.

[0036] Furthermore, the decision-making module operates as follows:

[0037] When a zero-trust architecture module is identified as having a security vulnerability, the zero-trust architecture module is then updated.

[0038] If a security risk is detected during the login process, the login will be interrupted, and the zero-trust architecture module will be updated.

[0039] When a logged-in user is deemed to pose an abnormal risk, the user is immediately disabled and locked, and the device accessed by that user is disconnected from other networks, while an alarm is triggered.

[0040] The beneficial effects of this invention are:

[0041] This invention analyzes the number of attacks and anomalies recorded in the logs, along with CPU utilization, memory usage, and system response time, to determine whether there are security vulnerabilities in the zero-trust architecture module. This allows for timely updates to the zero-trust architecture module, thereby protecting its security.

[0042] This invention can assess login security risks based on user login information through a risk assessment module, thereby preventing users with security risks from logging in and ensuring information security.

[0043] This invention can monitor user behavior after normal login through a user behavior analysis module. By analyzing the relevant data information generated by the login behavior, it can determine whether there is any abnormal risk of the accessing user. This allows for timely handling of abnormal risks, preventing the continuous theft of resources within the cloud office system, and thus effectively protecting the security of information resources.

[0044] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0045] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 This is a system block diagram of the present invention. Detailed Implementation

[0047] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0048] In one embodiment, a cloud-based office access control system based on a zero-trust architecture is disclosed, such as... Figure 1 As shown, the control system mainly includes the following modules:

[0049] The Zero Trust Architecture Module is used to monitor and obtain relevant data information when users access the cloud office system. This data information includes user login information, system resource consumption information, log information, browsing information, and download information.

[0050] The risk monitoring module is used to perform security monitoring on the zero-trust architecture module in order to determine whether there are any security vulnerabilities or potential risks in the zero-trust architecture module.

[0051] The risk assessment module is used to assess the security risks of this login.

[0052] The user behavior analysis module is used to determine whether there are any abnormal risks among logged-in users based on the relevant data information obtained.

[0053] The decision-making module executes corresponding decisions based on the judgment results.

[0054] Through the above technical solutions, this application employs a risk detection module to further monitor the zero-trust architecture module, establishing a more comprehensive security vulnerability management mechanism to protect the zero-trust architecture module, prevent its breach, and ensure the security of information resources. Simultaneously, a risk assessment module can evaluate login security risks, thereby blocking login access and ensuring information security. Furthermore, a user behavior analysis module can monitor user behavior after normal login, analyzing relevant data generated by login behavior to determine if there are any abnormal risks associated with the accessing user. This allows for timely handling of abnormal risks, preventing the continuous theft of resources within the cloud office system and effectively protecting the security of information resources.

[0055] The risk monitoring module works as follows:

[0056] Obtain the CPU utilization, memory usage, and system response time of the zero-trust architecture module over a certain period of time. Also, obtain the number of times the zero-trust architecture module was attacked during that period. and the number of exceptions generated in the logs ;

[0057] Through formula Determine the risk value ;

[0058] The obtained risk value Risk thresholds set within the risk monitoring module Compare:

[0059] when If so, it is determined that the zero-trust architecture module has potential security vulnerabilities;

[0060] in, This is the longest system response time within that period. The average system response time, The system response time comparison value is set. This represents the maximum CPU utilization during that period. Average CPU utilization The set CPU utilization comparison value, This represents the maximum memory usage during that period. This represents the average memory usage. The set memory usage comparison value.

[0061] The above technical solution provides a specific method for the risk monitoring module to operate. Generally, when a zero-trust architecture module is attacked or compromised, its CPU utilization and memory usage will increase abnormally compared to normal conditions, and its normal system response time will also be greatly extended. Therefore, it is necessary to obtain the CPU utilization, memory usage, and system response time of the zero-trust architecture module over a period of time, and at the same time, obtain the number of times the zero-trust architecture module was attacked in the logs during that period. and the number of exceptions generated in the logs Through formula Determine the risk value It can be known that when The larger the value, the higher the CPU utilization, the higher the memory usage, and the longer the system response time during this period. Meanwhile, when the formula... The higher the risk value, the more times the zero-trust architecture module has been attacked during this period. The higher the value, the greater the likelihood that the zero-trust architecture module can be compromised, and therefore the higher the risk value obtained. Risk thresholds set within the risk monitoring module Compare: When If a vulnerability is detected, the zero-trust architecture module is identified as having a security flaw. In this case, the zero-trust architecture module is updated to protect its security and reduce the likelihood of it being compromised. This method involves comprehensively analyzing attack counts and anomalies from logs, along with CPU utilization, memory usage, and system response time, to determine if a security vulnerability exists in the zero-trust architecture module and promptly update it to protect its security.

[0062] Set system response time comparison value CPU utilization comparison value Memory usage ratio comparison value and risk threshold All of these can be determined based on the system's historical data and experience.

[0063] The risk assessment module works by obtaining the number of times (n) a user attempts to log in within a set time period and the duration of each login attempt. The distance difference between the IP address and the frequently used IP address each time you log in. The number of times N can be used for multi-factor authentication within a set time period, and the number of times multi-factor authentication fails. ;

[0064] Through formula derive evaluation coefficient ;

[0065] when If this occurs, it is determined that there is a security risk in this login attempt;

[0066] That Medium risk additional factor, The preset evaluation coefficient threshold, as well as Each has its own preset coefficient, and And risk factor The method for obtaining it is as follows:

[0067] Record the number of different users logging into the system within a set time period. ;

[0068] when At that time, ;

[0069] when At that time, ;

[0070] when At that time, ;

[0071] in, as well as The preset number of logged-in users is used.

[0072] The above technical solution provides a specific method for the risk assessment module to operate. First, it records the number of different users logging into the system within a set time period. According to the obtained Compared to the preset number of logged-in users as well as By making comparisons, the risk premium can be determined. Obviously, the more different users log into the system within a set time period, and the more than the normal range, the greater the risk. Therefore, the risk factor is increased. The larger the value, the more likely it is to be obtained; then, the number of times n, the same logged-in user attempts to log in within a set time, and the duration of each login attempt are obtained. The distance difference between the IP address and the frequently used IP address each time you log in. The number of times N can be used for multi-factor authentication within a set time period, and the number of times multi-factor authentication fails. Through formula A comprehensive analysis is conducted to determine the login risk of the same user. It is found that the higher the value, the higher the risk level. Finally, a risk premium coefficient is considered. Through formula The security risk assessment coefficient for this login phase was derived. Then compare it with the preset evaluation coefficient threshold. When a comparison is performed, If a security risk is detected during the login process, the login will be terminated, and the zero-trust architecture module will be updated to ensure the security of data information within the cloud office system.

[0073] In the above technical solution, the preset number of logged-in users is set to a value of... as well as Preset evaluation coefficient threshold Preset coefficients as well as All of these can be determined based on historical data and experience, and will not be elaborated on here.

[0074] The user behavior analysis module works as follows:

[0075] After a user logs in normally, the system retrieves the user's page views and downloads at regular intervals, and then calculates a curve function to show how page views change over time. and the download volume change over time curve function ;

[0076] Through formula Outliers were found;

[0077] The obtained outliers Compared with the preset abnormal threshold Compare:

[0078] when If so, it is determined that the logged-in user poses an abnormal risk;

[0079] in, This represents the number of times the user attempted to click on and browse unauthorized materials within the specified interval. The standard pageview volume over time curve function set for the system. The standard download volume over time curve function set for the system. for The maximum slope, for The minimum slope, For setting Slope comparison value, for The maximum slope, for The minimum slope, For setting Slope comparison value, This is the start time of the interval period. This is the end time of the interval period.

[0080] The above technical solution provides a specific method for the user behavior analysis module to operate. To prevent attackers from accessing cloud office resources under the user's name after breaching the user's login system, this embodiment, after a user logs in normally, periodically obtains the user's pageview and download information when logging into the cloud office system, and formulates a pageview change curve function over time. and the download volume change over time curve function ; and thus through the formula The formula identifies outliers. as well as These represent the changes in page views and downloads within the specified time interval, respectively. A larger value indicates a higher volume of page views and downloads within a short period, suggesting more likely abnormal behavior. The formula... as well as These represent the differences between the cumulative changes in page views and the standard cumulative changes in page views, and the differences between the cumulative changes in downloads and the standard cumulative changes in downloads, respectively, within the interval period. The larger the value, the more the downloads and page views exceed the normal downloads and page views within the interval period, and the higher the level of abnormal user behavior. This represents the number of times the user attempted to click on and browse unauthorized materials within a given time interval. A higher value indicates more abnormal user behavior. Therefore, when the value is abnormal... The larger the value, the more it indicates abnormal user behavior; therefore, the obtained abnormal value... Compared with the preset abnormal threshold When a comparison is performed, If the system detects an abnormal risk associated with the logged-in user, it immediately disables and locks the user, disconnects the device accessed by that user from other networks, and issues an alert to prevent further theft of resource information within the cloud office system, thereby reducing resource loss.

[0081] It should be noted that the standard pageview volume change curve function set in the above scheme is... The system's standard download volume as a function over time. Slope comparison value as well as Both can be determined based on historical data and experience, and the start time of the interval period... and end time It can then be determined manually based on the actual situation.

[0082] This invention analyzes attack counts and anomalies from logs, combined with CPU utilization, memory usage, and system response time, to determine if a zero-trust architecture module has security vulnerabilities. This allows for timely updates to the zero-trust architecture module, protecting its security. Furthermore, this invention uses a risk assessment module to evaluate login security risks based on user login information, preventing potentially vulnerable users from accessing the system and ensuring information security. Finally, this invention uses a user behavior analysis module to monitor user behavior after normal login, analyzing relevant data to determine if there are any abnormal risks associated with accessing the system. This allows for timely handling of these risks, preventing continuous theft of resources within the cloud office system and effectively protecting information security.

[0083] The above description is merely an example and illustration of the concept of the present invention. Those skilled in the art can make various modifications or additions to the specific embodiments described or use similar methods to replace them, as long as they do not deviate from the concept of the invention or exceed the scope defined in the claims, they should all fall within the protection scope of the present invention.

Claims

1. A cloud office access control system based on a zero trust architecture, characterized in that, The control system comprises: a zero-trust architecture module for monitoring and obtaining relevant data information when a user accesses a cloud office system; a risk monitoring module for monitoring the zero-trust architecture module to determine whether the zero-trust architecture module has a security loophole; a risk assessment module for assessing the security risk of the login; a user behavior analysis module for determining whether the login access user has an abnormal risk according to the obtained relevant data information; a decision module for executing a corresponding decision according to the determination result; the relevant data information comprises login information, system resource consumption information, log information, browsing information and download information when the user accesses; the working method of the risk monitoring module is: The CPU utilization, memory occupation and system response time of the zero trust architecture module in a period of time are acquired, and the number of times of log occurrence of being attacked in the period of time is acquired and the number of times of log occurrence of being attacked in the period of time is acquired ; The risk value is derived by the formula ;​ The obtained risk value with the risk threshold value set within the risk monitoring module The comparison is made: When a security vulnerability exists in the zero trust architecture module; wherein, is the longest system response time for the period of time, is the average system response time, is the set system response time comparison value, is the maximum CPU utilization for the period of time, is the average CPU utilization, is the set CPU utilization comparison value, is the maximum memory usage for the period of time, is the average memory usage, is the set memory usage comparison value; the working method of the user behavior analysis module is: After the user normally logs in, every interval period, the browsing volume information and the downloading volume information when the user logs in the cloud office system are acquired, and the browsing volume curve function with time and the downloading volume curve function with time are drafted and the downloading volume curve function with time are drafted ; Anomalies are derived by the formula = 1 - exp(-x) The obtained outliers with a preset outlier threshold are compared: When then it is determined that the logged-in access user is at an abnormal risk; wherein, is the number of times the user attempts to click through to browse non-privileged material during the interval period, is a standard browse volume over time curve function set by the system, is a standard download volume over time curve function set by the system, is the maximum slope of , is the minimum slope of , is the set slope ratio value, is the maximum slope of , is the minimum slope of , is the set slope ratio value, is the interval period start time, is the interval period end time.

2. The cloud office access control system based on the zero trust architecture according to claim 1, characterized in that, the working method of the risk assessment module is: Obtaining the number n of login attempts by the same login user within a set time, the length of time for each login , the distance difference between the IP address for each login and the commonly used IP address , the number N of times of enabling multi-factor authentication within the set time and the number of times of failure when enabling multi-factor authentication ; The evaluation coefficient is derived by the formula ;​ When a security risk exists for this login; its a medium risk additional coefficient, is a preset assessment coefficient threshold, and are each a preset coefficient, and .

3. The cloud office access control system based on a zero trust architecture according to claim 2, characterized in that, The risk factor The acquisition method is: record the number of different login users logging into the system within a set time ; When then ; When then ; When then ; wherein, and is a preset number of login users.

4. The cloud office access control system based on the zero trust architecture according to claim 1, characterized in that, the working method of the decision module is: when it is determined that the zero-trust architecture module has a security loophole, the zero-trust architecture module is updated; when it is determined that the login has a security risk, the login is interrupted, and the zero-trust architecture module is updated; when it is determined that the login access user has an abnormal risk, the current access user is immediately disabled and locked, the device accessed by the access user is disconnected from other networks, and an alarm is given.

Images