Marketing business system safety protection system based on zero trust and application

Abstract

The invention provides a marketing business system security protection system and application based on zero trust, and the security protection system employs a security protection framework with marketing system characteristics, collects environment attributes and business access logs, combines identity information, equipment information, strategy information, attribute information and other multi-dimensional data, and carries out correlation analysis. Roles, permissions and strategies are dynamically adjusted and optimized according to closed-loop management of trust and risks; a multi-dimensional composite terminal identification information technology based on automatic identification is adopted, equipment characteristics are analyzed, multi-dimensional composite information is used for generating an equipment identification ID for identification of terminal equipment, and multi-dimensional information is comprehensively obtained; according to the invention, the design of a safe system and a marketing service system is closely fused, a safe marketing service system safety protection system based on zero trust is constructed, dynamic access control based on identity is realized, and the safety of the marketing service system is protected.

Description

Technical Field

[0001] The present invention relates to the field of power marketing technology, and specifically to a zero-trust-based marketing business system security protection system and application. Background Art

[0002] With the construction of smart grids, power marketing-related business systems serve various power marketing businesses, including office, recharge payment, charging piles, etc. The rapid development of the business also brings many security challenges. At the same time, the power industry has long faced threats from hostile forces at home and abroad, and the safe and stable operation of information systems faces great threats. With the rapid advancement of the construction of the power Internet of Things, the complexity of the power system structure will increase significantly, the marketing business application will develop explosively, the coupling relationship between business systems will become increasingly complex, and the access terminals will increase exponentially, which makes the security protection of the power Internet of Things extremely complicated.

[0003] Existing terminals in the power marketing business face the risk of being counterfeited and attacked. The IoT terminal devices in the marketing business are characterized by "large quantity and diverse types". Due to the different degrees of tailoring of the embedded operating system and the uneven security self-protection capabilities of the terminals of various manufacturers, different terminals and even different models of the same type of terminals have different capabilities to resist attacks, which brings huge challenges to the security protection of power terminals.

[0004] At the same time, the access control under the existing technology has limitations in the power Internet of Things scenario. The interactivity and sharing of the energy Internet and its information have gradually broken the original network security protection zoning rules. The energy Internet transforms the traditional working mode from fixed to mobile, and needs to support data access anytime and anywhere. The access to business and data has far exceeded the boundaries. In addition, external high-intensity attacks and internal network security incidents are emerging in an endless stream, and the risk of business systems being attacked by network attacks is increasing. Traditional access control adopts a one-size-fits-all release / blocking strategy, which is difficult to cope with the above-mentioned business scenario risks with different changes. Summary of the invention

[0005] In view of the shortcomings of the existing technology, the purpose of the present invention is to provide a zero-trust-based marketing business system security protection system and application to solve the problems raised in the above-mentioned background technology. The present invention closely integrates the security system and marketing business system design, constructs an inherently secure zero-trust-based marketing business system security protection system, realizes identity-based dynamic access control, and protects the security of the marketing business system.

[0006] In order to achieve the above-mentioned purpose, the present invention is implemented through the following technical solutions: a zero-trust-based marketing business system security protection system, which adopts a security protection framework with the characteristics of a marketing system, collects environmental attributes and business access logs, combines identity information, device information, policy information, attribute information and other multi-dimensional data and performs correlation analysis, and dynamically adjusts and optimizes roles, permissions, and policies according to the closed-loop management of trust and risk; the protection system also adopts multi-dimensional composite terminal identification information technology based on automatic identification, analyzes device characteristics, uses multi-dimensional composite information to generate a device identification ID for terminal device identification, and comprehensively obtains multi-dimensional information; adopts a business edge-side object trust assessment method for a power marketing system based on a data mining model, which performs a comprehensive trust assessment from two aspects: baseline rules and assessment models.

[0007] Furthermore, the security protection level is dynamically adjusted through continuous trust evaluation, providing a security protection system that is adaptive to business scenarios and is used to comprehensively improve the security protection capabilities of the marketing system business.

[0008] Furthermore, the comprehensively acquired information includes the type of operating system, the real-time version of the operating system, the features of apps involving sensitive data, and the features of user behavior. The mixed information is used to generate the device identification features of the smart terminal. If there are any abnormalities, the device identification information is updated to ensure the legitimacy and validity of the terminal identity, and to achieve rapid and accurate identification and classification of the terminal.

[0009] Furthermore, the mechanism of the evaluation model can be expanded and adjusted according to the characteristics of actual business scenarios to meet the security requirements of multiple business scenarios in power marketing and provide a basis for the trusted identity of edge terminals and people.

[0010] Furthermore, it also includes a marketing zero-trust security protection system, which completes dynamic access control request judgment based on multi-dimensional factors such as roles, attributes, environment, and trust assessment. As a unified security policy decision point, it controls business access agents and provides dynamic access control services for east-west traffic flowing through business access agents, thereby achieving the ultimate business scenario adaptive dynamic access control capability.

[0011] Furthermore, it also includes marketing zero-trust security protection software, which provides one-stop publishing and proxying of B / S applications and C / S applications through security protection software. When users access the proxied applications, the zero-trust security protection system will take over the user access request. The system will first verify the user's identity. If the identity verification passes, the user's permissions will be further checked. Only user access requests that pass the identity verification and permission check can be forwarded through the zero-trust security protection system and complete subsequent access to business applications. Otherwise, according to the policy, the user access request will be blocked or require secondary authentication.

[0012] Furthermore, customized access control policies implement fine-grained access control on user access. Access control mainly conducts comprehensive measurement and evaluation from aspects such as the subject, object and environmental context of access, and implements corresponding access control based on the results. First, when the user access request reaches the zero-trust security protection system, the zero-trust security protection system will check the corresponding subject, object and environmental information in the access request according to the control policy. When the access subject, object and environmental information hit certain access control policies, the corresponding access control action is triggered. The access control actions mainly include secondary authentication, blocking access, etc. For each user access, the access control policy will be executed to dynamically intercept risks.

[0013] Furthermore, the zero-trust security protection system hides or opens business ports on the user side according to the system's policies, thereby ensuring business access security; when the zero-trust security protection system turns on port hiding, the user side cannot scan or PING related business ports, and cannot access business. At this time, the user terminal needs to install the corresponding client software and knock on the port through the client software to enable the zero-trust security protection system to open the port and establish a network access business connection to achieve business access.

[0014] An application of the protection system as described above, wherein the protection system is applied to the marketing business of the electric power Internet of Things. Through multiple authorization strategies such as static authorization and dynamic authorization, dynamic access control request judgment is completed based on multi-dimensional factors such as roles, attributes, environment, and trust evaluation. At the same time, it is also used to control business access agents, providing dynamic access control services for east-west traffic flowing through the business access agents, thereby realizing the ultimate business scenario adaptive dynamic access control capability.

[0015] Furthermore, the power marketing business scenario can be promoted and applied in different business scenarios to cope with power safety risks, improve the safety protection level of the State Grid, and be used to promote the application value of big data in the marketing system and improve the level of operation management.

[0016] Beneficial effects of the present invention:

[0017] 1. This invention has the ability to test and apply the marketing business system security protection system based on zero trust by constructing a marketing business system security protection system model that is "identity-centric, business security access, continuous trust assessment, and intelligent permission access control". It realizes mandatory access control and intelligent permission adjustment for marketing business applications. It completes the security protection system of the marketing business system, improves the level of operation and management, and also improves the level of user service and satisfaction.

[0018] 2. After effective practice, this invention will form the basic theory and key technology of intelligent permission access control for marketing business, which can effectively reduce the operational risks caused by the uncontrollable marketing business terminals. By refining the key points and key elements of security protection, conducting correlation analysis of key elements, forming a business scenario adaptive security framework design, providing a theoretical analysis basis for business scenarios, and providing security protection support for marketing business applications.

[0019] 3. The present invention takes the construction of intelligent permission access control as its core capability, connects back-end services such as device terminals and business systems, and continuously provides intelligent, secure, and reliable access control capabilities through security capabilities such as terminal security perception, trust assessment, and user behavior analysis. It ultimately completes the overall security capability closed loop and effectively improves the intelligent control security capabilities of marketing business entity access.

[0020] 4. Through continuous verification, observation, and adjustment of system security capabilities in typical scenarios, the practical implementation capabilities of the security system framework in scenarios can be comprehensively improved, and the embedded integration capabilities of the security system and business scenarios can be effectively improved, forming an important supplement and improvement to the overall security capabilities of all business scenarios. This can maximize the feasibility of project research results and provide valuable technical accumulation for subsequent formal product development. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 This is a schematic diagram of the correlation analysis process of key elements of security protection points in an embodiment of the present invention;

[0022] Figure 2 Schematic diagram of the network security risk analysis process of the business link in the embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the technical means, creative features, objectives and effects achieved by the present invention easy to understand, the present invention is further explained below in conjunction with specific implementation methods.

[0024] See also Figure 1 to Figure 2 , the present invention provides the following technical solutions: Marketing business system security protection system and application based on zero trust:

[0025] This embodiment provides a marketing system security protection framework based on business scenario adaptation:

[0026] This embodiment combines the security protection needs of typical business scenarios of the marketing system, and based on the concept of "continuous trust evaluation, dynamic access control", for the first time proposes a security protection framework with marketing system characteristics. By collecting environmental attributes and business access logs, combined with identity information, device information, policy information, attribute information and other multi-dimensional data and performing correlation analysis, it dynamically adjusts and optimizes roles, permissions, and policies according to the closed-loop management of trust and risk, changes the traditional network-centric access control model, and realizes the transition to identity-centric dynamic access control. Through continuous trust evaluation, the security protection level is dynamically adjusted, and a security protection system that is adaptive to business scenarios is provided, which comprehensively improves the security protection capabilities of the marketing system business.

[0027] This embodiment provides a multi-dimensional composite terminal identification information technology based on automatic recognition:

[0028] This embodiment adopts multi-dimensional composite terminal identification information technology for automatic device identification in a low-trust environment. By analyzing device features, multi-dimensional composite information is used to generate a device identification ID for terminal device identification. The comprehensively acquired information includes the type of operating system, the real-time version of the operating system, App features involving sensitive data, user behavior features, etc., and the mixed information is used to generate device identification features for smart terminals. If there is an abnormality, the device identification information is updated to ensure the legitimacy and validity of the terminal identity, so that the terminal can be quickly and accurately identified and classified. Traditional terminal equipment technology usually uses the device number of the terminal equipment installed at the factory as the device ID of the marking device. Compared with traditional terminal identification technology, this project breaks through the technical bottleneck that traditional terminal equipment identification technology cannot be applied to massive "ubiquitous" terminals. Through multi-dimensional composite terminal identification information technology, it effectively solves the access security problem of massive and heterogeneous IoT terminal devices.

[0029] This embodiment proposes a trust evaluation method for objects at the edge side of a power marketing system business based on a data mining model:

[0030] In this embodiment, based on the multi-dimensional data such as static attribute data, status data and business access records of the terminals and people on the business edge side of the company's power marketing system, a trust evaluation mechanism for the terminals and people on the business edge side of the power marketing system is established, and a trust evaluation method for the terminals and people on the business edge side of the power marketing system is proposed. This trust evaluation method conducts a comprehensive trust evaluation from two aspects: baseline rules and evaluation models, avoiding the limitations and one-sidedness of using a single trust evaluation method, reducing the misjudgment rate of trust evaluation, and improving the reliability and authenticity of trust evaluation; in addition, the mechanism of the evaluation model can also be expanded and adjusted according to the characteristics of the actual business scenario to meet the security requirements of multiple business scenarios of power marketing, which can provide a basis for the identity trustworthiness of the terminals and people on the edge side, and provide strong support for the implementation of precise access control.

[0031] In this embodiment, a precise authorization and dynamic access control security protection architecture for marketing business applications is proposed, and the specific contents include:

[0032] 1. Cybersecurity risk analysis of typical marketing business links

[0033] Typical network security risk analysis studies and analyzes network security risks in business environments. The specific process includes risk identification, determination of risk consequence attributes, risk probability analysis and consequence attribute calculation, risk index calculation and risk determination. Based on the determination results, the security risks that may exist in typical business scenarios are identified. Based on the results of network security risk analysis, the subsequent condensation of key security protection elements is also based on further correlation analysis of this analysis result.

[0034] 2. Analysis of the correlation between key elements of safety protection and safety attributes

[0035] Based on the network security analysis of business scenarios, based on the security protection system and protection technology, we study and refine the key factors that affect business security, and conduct correlation analysis from identity factors, access control baseline factors, behavioral factors, etc., so as to be able to associate the security status of these factors, and then dynamically control the access behavior of the terminal, changing the traditional network-centric access control model to achieve a transition to identity-centric dynamic access control.

[0036] 3. Precise authorization and dynamic access control security framework design

[0037] With the advancement of the construction of the power Internet of Things, security boundaries are gradually broken and blurred. The traditional isolation-based security framework is difficult to adapt to the rapid development and rapid changes of the business. The study designs an identity-centric "comprehensive identity management, business security access, continuous trust assessment, dynamic access control" power Internet of Things business scenario adaptive security framework, changes the traditional network-centric access control mode, and realizes the transition to identity-centric dynamic access control, which can provide flexible permission management for various typical business scenarios.

[0038] In this embodiment, a refined authorization mechanism and dynamic access control technology are proposed, which specifically include:

[0039] 1. Research on refined authorization technology and implementation methods

[0040] Discretionary access control (DAC), mandatory access control (MAC), and attribute-based authorization model (RBAC) are all commonly used authorization models. Among them, RBAC is widely used, and implements coarse-grained authorization based on roles, and establishes permission baselines to meet the principle of least privilege. However, these access control models are more suitable for authorization of people and applications. The attribute-based authorization (ABAC) model allows more information to be input into access control decisions, implements role mapping based on subject, object and environmental attributes, meets fine-grained authorization requirements, and is flexible to manage. In this project, an access control model based on multidimensional attributes is studied, which supports various access attributes: device ID, group, device type, authorization level; resource ID, classification, classification attributes; environmental attributes: time, source network, geographic location, publishing and subscription behavior, etc. Authorization fully considers the multidimensional attributes of the subject, object and environment for security assessment, and parses and perceives the operations at the protocol level, which can achieve fine-grained authorization for operations such as publishing and subscribing, and ensure that access rights are controllable. Authorization based on attributes rather than entities can well support various scenarios such as static and dynamic authorization.

[0041] 2. Research on various technologies and implementation methods of dynamic authorization control

[0042] Based on typical application scenarios of marketing business, an adaptive dynamic authorization model is established, integrating continuous trust assessment data such as device security assessment, user security assessment, and resource security assessment, and studying dynamic authorization policy adjustment and dynamic access control technology.

[0043] 2.1 Research on terminal behavior security model

[0044] Study the terminal behavior security model, conduct statistical analysis on the user's historical behavior data, establish a user behavior baseline, and form a user behavior baseline library. The dimensions of statistical analysis include user operation time, common geographical location, number of operations, and device usage distribution, which are used to evaluate the time period, frequency, frequently visited geographical location, and frequently used devices of users' daily access, as well as inferential analysis of user behavior.

[0045] When performing specific calculations, the user's abnormal risk probability is first evaluated by analyzing the degree of deviation between a certain operation of the user and the behavioral baseline. The calculation rules are configurable, such as the proportion of a certain operation and the same operation in historical behavior; second, the abnormal event is determined by comparing the abnormal risk probability with the abnormal event determination threshold, and the threshold can be adaptively adjusted according to the analysis results; third, the trust level is calculated based on the risk score configured for the abnormal event.

[0046] 2.2 Dynamic Authorization Risk Calculation

[0047] By effectively sensing the environmental risks of access terminals and discovering user behaviors that pose security threats, the system comprehensively evaluates access security based on a variety of security factors, and calculates quantifiable risk measurement factors and trust assessment factors, which are used as judgment conditions for security control strategies or provide security judgment basis for other external access control systems. When calculating risks, the system scores from multiple dimensions such as risk classification, risk hazard, and occurrence time, and performs weighted calculations based on the scores of each dimension, and finally calculates the risk score of the access user. For high-risk risk vulnerabilities, the system can increase their priority and issue a notification immediately.

[0048] 2.3 User Trust Level Assessment

[0049] Based on the time, location, device, frequency, results and other attributes of user behavior, we defined security judgment rules for various usage scenarios, created reasoning analysis models, multiple user behavior models, constructed a user trust level model, and conducted user trust level assessment research.

[0050] This embodiment also provides a marketing zero-trust security protection system prototype software and device, which are as follows:

[0051] (1) Design, develop and market zero-trust security protection system prototype software and devices, with multiple authorization strategies such as static authorization and dynamic authorization, which can complete dynamic access control request judgment based on multi-dimensional factors such as roles, attributes, environment, and trust assessment. As a unified security policy decision point, it controls the business access proxy and provides dynamic access control services for east-west traffic flowing through the business access proxy, thus achieving the ultimate business scenario adaptive dynamic access control capability.

[0052] (2) Application Verification Report

[0053] On the basis of complete prototype design and development, by building typical business scenarios of the marketing business system, covering two types of office networks and mobile operation terminals, the security capabilities of the prototype and core components are verified in business scenarios, and the scenario-based verification of the marketing zero-trust security protection system prototype is realized. Based on the feedback of the verification results, the prototype development is optimized, the key technologies are verified, and an application verification report is formed.

[0054] (3) Main functions of prototype software

[0055] 1) Application access identity verification

[0056] It can realize one-stop publishing and proxying of B / S applications and C / S applications. When a user accesses the proxied application, the zero-trust security protection system will take over the user's access request. The system will first verify the user's identity. If the identity verification passes, the user's permissions will be further checked. Only user access requests that pass the identity verification and permission check can be forwarded through the zero-trust security protection system and complete subsequent access to business applications. Otherwise, according to the policy, the user's access request will be blocked or require secondary authentication, etc.

[0057] 2) Dynamic access control

[0058] Customized access control policies implement fine-grained access control on user access. Access control mainly conducts comprehensive measurement and evaluation from aspects such as the subject, object and environmental context of access, and implements corresponding access control based on the results. First, when a user access request reaches the zero-trust security protection system, the zero-trust security protection system will check the corresponding subject, object and environmental information in the access request according to the control policy. When the access subject, object and environmental information hit certain access control policies, the corresponding access control action is triggered. Access control actions mainly include secondary authentication, blocking access, etc. For each user access, the access control policy will be executed to dynamically intercept risks.

[0059] 3) Encrypted transmission

[0060] It can support secure transmission between user access and the zero-trust security protection system, provide a secure channel for business access, and ensure access security. The zero-trust security protection system supports secure transmission protocols such as one-way TLS protocol, two-way TLS protocol, and national secret TLS protocol. By encrypting the full flow of proxy applications, the zero-trust security protection system can uniformly and quickly realize the secure transmission of application data, even if the application itself does not use a secure data transmission method.

[0061] 4) Traffic control strategy

[0062] The access requests and responses of all applications will be processed. To ensure the continuous and stable provision of business services by back-end business applications, the zero-trust security protection system can control the traffic of business access according to the policy to alleviate the risk of unavailability of business services due to traffic overload. The zero-trust security protection system supports traffic control based on the number of concurrent requests, request size, request speed, number of request connections, number of requests per unit time, etc. When the set condition threshold is exceeded, the zero-trust security protection system can automatically execute traffic control measures.

[0063] 5) Business Hiding

[0064] The zero-trust security protection system can hide or open business ports on the user side according to the system's policies, thereby ensuring business access security. When the zero-trust security protection system turns on port hiding, the user side cannot scan or ping related business ports and cannot access business. At this time, the user terminal needs to install the corresponding client software and knock on the port through the client software to enable the zero-trust security protection system to open the port and establish a network access business connection to achieve business access.

[0065] 6) Personal safety protection

[0066] Achieve security protection for your own devices to minimize the risk of the zero-trust security protection system itself being invaded and hacked by malicious attackers. The zero-trust security protection system can support security protection measures such as file protection, process protection, WEB protection, and RASP protection according to the strategy to improve the security of the zero-trust security protection system itself and mitigate the security risks of malicious invasion and malicious hacking.

[0067] 7) Single Sign-On

[0068] On the one hand, the zero-trust security protection system can support single sign-on for applications based on standard authentication protocols such as OIDC and CAS. On the other hand, it can also implement single sign-on for applications with non-standard authentication protocols through password generation. When the zero-trust security protection system implements single sign-on for applications based on standard authentication protocols, the application needs to complete the single sign-on connection with the authentication source in advance. When the zero-trust security protection system performs application proxy access, the application can achieve seamless connection without modification; when implementing single sign-on through password generation, the zero-trust security protection system can implement simple single sign-on with password generation of user name + password. For password generation applications with complex situations such as dynamic passwords and verification codes, simple password generation cannot be implemented directly, and it depends on the situation.

[0069] The zero-trust security protection system can implement single sign-out for all taken-over applications according to the configuration. When the user authentication expires or a single application session is terminated, all logged-in applications can be forced to exit to meet higher security requirements when application access ends.

[0070] 8) Log upload

[0071] The zero-trust security protection system supports the recording of application access, management logs, and device protection logs, and provides detailed log records for log auditing. The recorded log details include the user identity information, terminal information, access time, application status, traffic size, etc., so that the source of related events can be quickly checked or traced. At the same time, the zero-trust security protection system can send logs to external professional log analysis or audit systems in the form of syslog for further log analysis and auditing.

[0072] The basic principles and main features of the present invention and the advantages of the present invention are shown and described above. For those skilled in the art, it is obvious that the present invention is not limited to the details of the above exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or basic characteristics of the present invention.

[0073] In addition, it should be understood that although the present specification is described according to implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment may also be appropriately combined to form other implementation modes that can be understood by those skilled in the art.

Claims

1. A zero-trust-based marketing business system security protection system, characterized by: The security protection system adopts a security protection framework with the characteristics of a marketing system. By collecting environmental attributes and business access logs, combining multi-dimensional data such as identity information, device information, policy information, and attribute information and performing correlation analysis, it dynamically adjusts and optimizes roles, permissions, and policies based on the closed-loop management of trust and risk. The protection system also adopts multi-dimensional composite terminal identification information technology based on automatic identification. By analyzing device characteristics, it uses multi-dimensional composite information to generate a device identification ID for terminal device identification and comprehensively obtains multi-dimensional information. It adopts a trust assessment method for objects on the business edge side of the power marketing system based on a data mining model. This assessment method conducts a comprehensive trust assessment from two aspects: baseline rules and assessment models.

2. The zero-trust-based marketing business system security protection system according to claim 1 is characterized by: The security protection level is dynamically adjusted through continuous trust evaluation, providing a security protection system that is adaptive to business scenarios and is used to comprehensively improve the security protection capabilities of the marketing system business.

3. The zero-trust-based marketing business system security protection system according to claim 2 is characterized by: The comprehensive information obtained includes the type of operating system, the real-time version of the operating system, the characteristics of apps involving sensitive data, and the characteristics of user behavior; The mixed information is used to generate the device identification features of the smart terminal. If there is an abnormality, the device identification information is updated to ensure the legitimacy and validity of the terminal identity, and to achieve fast and accurate identification and classification of the terminal.

4. The zero-trust-based marketing business system security protection system according to claim 3 is characterized by: The mechanism of the evaluation model can be expanded and adjusted according to the characteristics of actual business scenarios to meet the security needs of multiple business scenarios in power marketing and provide a basis for the trusted identity of edge terminals and people.

5. The zero-trust-based marketing business system security protection system according to claim 1 is characterized by: It also includes a marketing zero-trust security protection system, which completes dynamic access control request judgment based on multi-dimensional factors such as roles, attributes, environment, and trust assessment. As a unified security policy decision point, it controls business access agents and provides dynamic access control services for east-west traffic flowing through business access agents, thereby achieving the ultimate business scenario adaptive dynamic access control capability.

6. The zero-trust-based marketing business system security protection system according to claim 5 is characterized by: It also includes marketing zero-trust security protection software, which provides one-stop publishing and proxying of B / S applications and C / S applications through security protection software. When users access the proxied applications, the zero-trust security protection system will take over the user access request. The system will first verify the user's identity. If the identity verification passes, the user's permissions will be further checked. Only user access requests that pass the identity verification and permission check can be forwarded through the zero-trust security protection system and complete subsequent access to business applications. Otherwise, according to the policy, the user access request will be blocked or require secondary authentication.

7. The zero-trust-based marketing business system security protection system according to claim 6 is characterized by: Customized access control policies implement fine-grained access control on user access. Access control mainly conducts comprehensive measurement and evaluation from aspects such as the subject, object and environmental context of access, and implements corresponding access control based on the results. First, when the user access request reaches the zero-trust security protection system, the zero-trust security protection system will check the corresponding subject, object and environmental information in the access request according to the control policy. When the access subject, object and environmental information hit certain access control policies, the corresponding access control action is triggered. The access control actions mainly include secondary authentication, blocking access, etc. For each user access, the access control policy will be executed to dynamically intercept risks.

8. The zero-trust-based marketing business system security protection system according to claim 5 is characterized by: The zero-trust security protection system hides or opens business ports on the user side according to the system's strategy to ensure business access security. When the zero-trust security protection system turns on port hiding, the user side cannot scan or PING related business ports and cannot access business. At this time, the user terminal needs to install the corresponding client software and knock on the port through the client software to enable the zero-trust security protection system to open the port and establish a network access business connection to achieve business access.

9. Use of the protective system according to claim 1, characterized in that: The protection system is applied to the marketing business of the electric power Internet of Things. Through various authorization strategies such as static authorization and dynamic authorization, it completes the request judgment of dynamic access control based on multi-dimensional factors such as roles, attributes, environment, and trust evaluation. It is also used to control business access agents and provide dynamic access control services for east-west traffic flowing through business access agents, thereby realizing the ultimate business scenario adaptive dynamic access control capability.

10. Use of the protective system according to claim 9, characterized in that: The power marketing business scenario, through promotion and application in different business scenarios, can cope with power safety risks, improve the safety protection level of the State Grid, and be used to promote the application value of big data in the marketing system and improve the level of operation management.

Images