Distributed identity authentication and access control system based on zero trust

Abstract

The present invention discloses a distributed identity authentication and access control system based on zero trust, and specifically relates to the field of access control technology. The present invention authenticates the user's identity information when logging into a service Internet platform and when accessing projects corresponding to the advanced permissions of the role user, thereby reducing the possibility of data leakage. A comprehensive access credibility analysis mechanism is introduced into the access process. When applying basic data access permissions, if the comprehensive access credibility does not meet expectations, the interface where the project to be accessed is located is directly exited and returned to the upper-level interface of the project to be accessed. If the comprehensive access credibility on the main interface does not meet expectations, the service Internet platform is directly exited. When applying for advanced data access permissions, the user is issued with the advanced data access permission for the project to be accessed only when the comprehensive access credibility meets expectations and the access identity authentication is passed. This can effectively reduce the risk of data exposure during access to the service Internet platform.

Description

Technical Field

[0001] The present invention relates to the field of access control technology, and more specifically, to a distributed identity authentication and access control system based on zero trust. Background Art

[0002] With the rapid development of internet technology, a growing number of services are being aggregated through the internet, forming the Internet of Services. In recent years, the microservices architecture (MSA), based on SOA concepts, has gained widespread adoption due to its ease of scalability and maintenance. It has been widely adopted within the Internet of Services platform and has become the preferred choice for enterprises to provide services to users and operate within their organizations. However, due to the cross-network and cross-domain nature of the Internet of Services, remote service invocation and service access scenarios are increasing, and access control scenarios are becoming increasingly complex, leading to a growing demand for access control.

[0003] The existing identity authentication and access control system associates the user's login identity authentication results with the access control policy. When the user successfully logs into the service Internet platform, all access and operation permissions are opened to the user. The user can directly and quickly access the data he needs, which greatly facilitates data query and effectively improves service quality.

[0004] However, the existing system still has some problems: the existing system only performs identity authentication when the user logs in to the service Internet platform and releases all access operation permissions after the user logs in to the service Internet platform. The one-time verification mechanism is difficult to completely eliminate the security risks of access or operation behaviors. Unauthorized access or data leakage may occur. A new access control mechanism needs to be introduced to further reduce the risk of data leakage. Summary of the Invention

[0005] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides a distributed identity authentication and access control system based on zero trust to solve the problems raised in the above-mentioned background technology.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a distributed identity authentication and access control system based on zero trust, comprising:

[0007] Access permission setting module: Build a role access control model to create users with different roles and assign different data access permissions to each role user;

[0008] Identity authentication module: includes two modes: login identity authentication and access identity authentication. Login identity authentication is used to authenticate the user's identity information when logging into the service Internet platform, and access identity authentication is used to authenticate the user's identity information when accessing projects corresponding to the role user's advanced permissions;

[0009] Access monitoring module: monitors users' access behavior on the service Internet platform in real time and generates access logs for backup, extracts real-time access operation data, real-time access network environment data, and real-time access device data and sends them to the access monitoring data analysis module;

[0010] Access monitoring data analysis module: processes the extracted real-time access operation data, real-time access network environment data, and real-time access device data to calculate the operation credibility coefficient, network credibility coefficient, and device credibility coefficient respectively;

[0011] Comprehensive access credibility analysis module: calculates the comprehensive access credibility index based on the operation credibility coefficient, network credibility coefficient and device credibility coefficient, determines whether the comprehensive access credibility index meets expectations, and sends the judgment result to the access control module;

[0012] Access control module: Receives comprehensive access credibility judgment results and identity authentication results and generates access control policies based on them. After daily access logs are generated, user access rights are updated in combination with historical user access logs.

[0013] Database: used to store data information of all modules in the system.

[0014] Preferably, the identity authentication module includes an account registration unit, a login identity authentication unit, an access identity authentication unit and an identity authentication result output unit. The account registration unit generates a login account after the user enters the real name, ID number, email account, strong login password, real-name registered mobile phone number, expected authentication questions and answers, and fingerprint information; the login identity authentication unit is used to perform multi-factor identity authentication on the user and enter the main interface of the service Internet platform after the authentication is passed; the access identity authentication unit authenticates the user's identity information when the user accesses the project corresponding to the advanced permissions of his or her role; the identity authentication result output unit sends the login identity authentication result and the access identity authentication result to the access control module.

[0015] Preferably, the real-time access operation data extracted by the access monitoring module are the number of repeated access applications mfcij for the j-th item at the i-th moment and the duration Tfcij of the no-operation access for the j-th item at the i-th moment; the real-time access network environment data extracted by the access monitoring module include the user's network connection speed vai, network bandwidth vbi and delay Tai at the i-th moment; the real-time access device data extracted by the access monitoring module include the firewall false alarm rate αwi at the i-th moment, the number of update differences mai between the operating system version at the i-th moment and the latest operating system version, and the browser encryption strength coefficient εmi at the i-th moment.

[0016] Preferably, the access monitoring data analysis module includes a data receiving unit, an operation credibility analysis unit, a network credibility analysis unit, a device credibility analysis unit, and a data output unit. The data receiving unit is used to receive the extracted real-time access operation data, real-time access network environment data, and real-time access device data; the operation credibility analysis unit is used to calculate the operation credibility coefficient Xrci at the i-th moment. The specific formula is: βmij and βTij are the access application excess coefficient and the no-operation stay excess coefficient of the j-th project at the i-th moment, respectively. The specific calculation formula is as follows: , , mfr and Tfr are the maximum number of repeated visits allowed for the project and the maximum non-operation stay time allowed for the project respectively, and na is the number of projects; the network credibility analysis unit is used to calculate the network credibility coefficient Xrwi at the i-th moment, and the specific formula is: , vae, vbe, and Tae are the minimum network connection speed, minimum network bandwidth, and maximum latency allowed for access, respectively; the device credibility analysis unit is used to calculate the device credibility coefficient Xrsi at the i-th moment. The specific formula is: ; The data output unit is used to transmit the calculated operation credibility coefficient, network credibility coefficient and device credibility coefficient to the comprehensive access credibility analysis module.

[0017] Preferably, the comprehensive access credibility analysis module includes a data receiving unit, a comprehensive access credibility analysis unit, a comprehensive access credibility judgment unit, and a judgment result output unit. The data receiving unit is used to receive the calculated operation credibility coefficient, network credibility coefficient, and device credibility coefficient at the i-th moment; the comprehensive access credibility analysis unit is used to calculate the comprehensive access credibility index YFi at the i-th moment. The specific formula is: ; The comprehensive access credibility judgment unit compares the calculated comprehensive access credibility index with the comprehensive access credibility expected value. If the calculated value is greater than or equal to the comprehensive access credibility expected value, it meets expectations; if the calculated value is less than the comprehensive access credibility expected value, it does not meet expectations; the judgment result output unit is used to send the comprehensive access credibility judgment result to the access control module.

[0018] Preferably, the access control module includes an information receiving unit and an access control policy generating unit, and the information receiving unit is used to receive the comprehensive access credibility judgment result and the identity authentication result; the access control policy generating unit automatically issues the role basic data access rights to the user when the login identity authentication is passed and sends an instruction to the access monitoring module to start access monitoring. When applying the basic data access rights, if the comprehensive access credibility does not meet expectations, the user will be directly exited from the interface where the project to be accessed is located and return to the previous level interface of the project to be accessed. If the comprehensive access credibility does not meet expectations on the main interface, the user will be directly exited from the service Internet platform. When applying for advanced data access rights, if the comprehensive access credibility meets expectations and the access identity authentication is passed, the user will be issued with the advanced data access rights for the project to be accessed. If the comprehensive access credibility meets expectations but the access identity authentication fails, the user will be directly exited from the service Internet platform.

[0019] Preferably, the access control module further includes a historical access log retrieval unit, a comprehensive access average credibility calculation unit, a user access permission adjustment judgment unit, and a user access permission update unit. The historical access log retrieval unit is used to retrieve the user's historical access log; the comprehensive access average credibility calculation unit aggregates the comprehensive access credibility index that can be calculated from the current day's access log and the historical access log and calculates the comprehensive access average credibility index YFe. The specific formula is: , nb is the data volume of the comprehensive access credibility index; the user access permission adjustment judgment unit compares the comprehensive access average credibility index with the expected value of the comprehensive access credibility. If the calculated value is greater than or equal to the expected value, the user access permission is not adjusted. Otherwise, some of the user's advanced data access permissions are frozen until the next access log is generated; the user access permission update unit evaluates the importance of existing advanced data access permissions and sorts them from high to low according to importance, and calculates the proportion fi of the i-th advanced data access permission. The specific formula is: , nc is the total number of advanced data access permissions, and the difference coefficient θa between the comprehensive access average credibility index YFe and the comprehensive access credibility expected value YFu is calculated. The specific formula is: ,when When the priority order is 1, the access permission of the advanced data is frozen. When , freeze the access rights of the first and second high-level data in importance, ..., when All advanced data access permissions are frozen.

[0020] Technical effects and advantages of the present invention:

[0021] 1. The present invention sets an identity authentication module to authenticate the user's identity information when logging into the service Internet platform on the one hand, and to authenticate the user's identity information when accessing projects corresponding to the role user's advanced permissions on the other hand, changing the one-time identity authentication to continuous identity authentication, reducing the possibility of data leakage.

[0022] 2. The present invention sets an access monitoring module to monitor the user's access behavior on the service Internet platform in real time and extract real-time access operation data, real-time access network environment data and real-time access device data. The access monitoring data analysis module is set to process the extracted real-time access operation data, real-time access network environment data and real-time access device data to calculate the operation credibility coefficient, network credibility coefficient and device credibility coefficient respectively. The comprehensive access credibility analysis module is set to calculate the comprehensive access credibility index based on the operation credibility coefficient, network credibility coefficient and device credibility coefficient and judge whether the comprehensive access credibility index meets expectations. The comprehensive access credibility is evaluated at the time of application of basic data access rights. When the comprehensive access credibility does not meet expectations, the user will be directly exited from the interface of the project to be accessed and return to the upper-level interface of the project to be accessed if the comprehensive access credibility does not meet expectations on the main interface. The user will be directly exited from the service Internet platform. When applying for advanced data access rights, the user will be issued with advanced data access rights for the project to be accessed if the comprehensive access credibility meets expectations and the access identity authentication is passed. When the comprehensive access credibility meets expectations but the access identity authentication fails, the user will be directly exited from the service Internet platform. This can effectively reduce the risk of data exposure during access to the service Internet platform and improve the flexibility and accuracy of security protection.

[0023] 3. The present invention sets an access control module to summarize the comprehensive access credibility index that can be calculated in the access log of the current day and the historical access log and calculate the comprehensive access average credibility index, and compare the comprehensive access average credibility index with the expected value of the comprehensive access credibility. If the calculated value is greater than or equal to the expected value, the user access rights will not be adjusted. Otherwise, some of the user's advanced data access rights will be frozen until the next access log is generated, reducing the losses caused by the theft of important data access rights, and providing a method for freezing advanced data access rights. The lower the credibility, the lower the user's rights, which can effectively protect data security and Internet service quality. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 This is a system structure diagram of the present invention.

[0025] Figure 2 A diagram showing the steps of the method of the present invention. DETAILED DESCRIPTION

[0026] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0027] like Figure 1 The distributed identity authentication and access control system based on zero trust provided by the present embodiment shown includes an access permission setting module, an identity authentication module, an access monitoring module, an access monitoring data analysis module, a comprehensive access credibility analysis module, an access control module and a database. The permission setting module, the identity authentication module, and the comprehensive access credibility analysis module are connected to the access control module, and the access monitoring module, the access monitoring data analysis module, and the comprehensive access credibility analysis module are connected in sequence. All modules in the system are connected to the database.

[0028] The access permission setting module constructs a role access control model to create users with different roles and assigns different data access permissions to each role user;

[0029] It should be specifically noted in this embodiment that the process of building a role-based access control model is an existing technology, so the model building process will not be specifically described here.

[0030] What needs to be specifically explained in this embodiment is that the data access rights assigned by the access permission setting module to each role user are divided into basic data access rights and advanced data access rights. Each role user can directly apply the basic data access rights when passing the login identity authentication, and can apply the corresponding advanced data access rights when the comprehensive access credibility assessment meets expectations and the access identity authentication is passed.

[0031] The identity authentication module includes two modes: login identity authentication and access identity authentication. Login identity authentication is used to authenticate the user's identity information when logging into the service Internet platform, and access identity authentication is used to authenticate the user's identity information when accessing projects corresponding to the role user's advanced permissions;

[0032] Furthermore, the identity authentication module includes an account registration unit, a login identity authentication unit, an access identity authentication unit and an identity authentication result output unit. The account registration unit generates a login account after the user enters the real name, ID number, email account, strong login password, real-name registered mobile phone number, expected authentication questions and answers, and fingerprint information; the login identity authentication unit is used to perform multi-factor identity authentication on the user and enter the main interface of the service Internet platform after the authentication is passed; the access identity authentication unit authenticates the user's identity information when the user accesses the project corresponding to the advanced permissions of his or her role; the identity authentication result output unit sends the login identity authentication result and the access identity authentication result to the access control module.

[0033] Specifically, in this embodiment, the specific steps of the login identity authentication unit performing multi-factor authentication on the user are as follows:

[0034] A1. Authenticate the user's login account and password. If the user enters the correct login account and strong password, the authentication is passed and the user enters the knowledge-based authentication process.

[0035] A2. Perform knowledge factor authentication on the user. A randomly generated authentication question, similar to the one the user entered when registering their account, is randomly generated. If the user enters the correct answer, the knowledge factor authentication is passed and the user proceeds to ownership factor authentication.

[0036] A3. Authenticate the user's ownership factor. A dynamic verification password is randomly sent to the user's email account or mobile phone number. If the user enters the password correctly within the validity period, the ownership factor authentication is passed and the biometric factor authentication begins.

[0037] A4. Perform biometric authentication on the accessing user. If the fingerprint information input by the accessing user is detected to be consistent with the fingerprint information entered when registering the account, the biometric authentication is passed, and the identity authentication is passed.

[0038] It should be specifically explained in this embodiment that the access authentication unit randomly applies one of the authentication methods of knowledge factor authentication, ownership factor authentication, and biometric factor authentication when authenticating the user.

[0039] The access monitoring module monitors the user's access behavior on the service Internet platform in real time and generates access logs for backup, extracts real-time access operation data, real-time access network environment data and real-time access device data and sends them to the access monitoring data analysis module;

[0040] Furthermore, the real-time access operation data extracted by the access monitoring module are the number of repeated access applications mfcij for the j-th item at the i-th moment and the duration Tfcij of the no-operation access for the j-th item at the i-th moment; the real-time access network environment data extracted by the access monitoring module include the user's network connection speed vai, network bandwidth vbi and delay Tai at the i-th moment; the real-time access device data extracted by the access monitoring module include the firewall false alarm rate αwi at the i-th moment, the number of update differences mai between the operating system version at the i-th moment and the latest operating system version, and the browser encryption strength coefficient εmi at the i-th moment.

[0041] Specifically, in this embodiment, a method for calculating the browser encryption strength coefficient εmi is provided. The specific formula is: , εai is the key length generated by the encryption algorithm used by the browser at the i-th moment.

[0042] The access monitoring data analysis module processes the extracted real-time access operation data, real-time access network environment data and real-time access device data to calculate the operation credibility coefficient, network credibility coefficient and device credibility coefficient respectively;

[0043] Furthermore, the access monitoring data analysis module includes a data receiving unit, an operation credibility analysis unit, a network credibility analysis unit, a device credibility analysis unit, and a data output unit. The data receiving unit is used to receive the extracted real-time access operation data, real-time access network environment data, and real-time access device data; the operation credibility analysis unit is used to calculate the operation credibility coefficient Xrci at the i-th moment. The specific formula is: βmij and βTij are the access application excess coefficient and the no-operation stay excess coefficient of the j-th project at the i-th moment, respectively. The specific calculation formula is as follows: , , mfr and Tfr are the maximum number of repeated visits allowed for the project and the maximum non-operation stay time allowed for the project respectively, and na is the number of projects; the network credibility analysis unit is used to calculate the network credibility coefficient Xrwi at the i-th moment, and the specific formula is: , vae, vbe, and Tae are the minimum network connection speed, minimum network bandwidth, and maximum latency allowed for access, respectively; the device credibility analysis unit is used to calculate the device credibility coefficient Xrsi at the i-th moment. The specific formula is: ; The data output unit is used to transmit the calculated operation credibility coefficient, network credibility coefficient and device credibility coefficient to the comprehensive access credibility analysis module.

[0044] The comprehensive access credibility analysis module calculates a comprehensive access credibility index based on the operation credibility coefficient, the network credibility coefficient and the device credibility coefficient, determines whether the comprehensive access credibility index meets expectations, and sends the judgment result to the access control module;

[0045] Furthermore, the comprehensive access credibility analysis module includes a data receiving unit, a comprehensive access credibility analysis unit, a comprehensive access credibility judgment unit, and a judgment result output unit. The data receiving unit is used to receive the calculated operation credibility coefficient, network credibility coefficient, and device credibility coefficient at the i-th moment; the comprehensive access credibility analysis unit is used to calculate the comprehensive access credibility index YFi at the i-th moment. The specific formula is: ; The comprehensive access credibility judgment unit compares the calculated comprehensive access credibility index with the comprehensive access credibility expected value. If the calculated value is greater than or equal to the comprehensive access credibility expected value, it meets expectations; if the calculated value is less than the comprehensive access credibility expected value, it does not meet expectations; the judgment result output unit is used to send the comprehensive access credibility judgment result to the access control module.

[0046] The access control module receives the comprehensive access credibility judgment result and the identity authentication result and generates an access control policy based on the result, and updates the user access rights in combination with the user's historical access log after the access log is generated every day;

[0047] Furthermore, the access control module includes an information receiving unit and an access control policy generating unit. The information receiving unit is used to receive the comprehensive access credibility judgment result and the identity authentication result; the access control policy generating unit automatically issues the role basic data access rights to the user when the login identity authentication is passed and sends an instruction to the access monitoring module to start access monitoring. When applying the basic data access rights, if the comprehensive access credibility does not meet expectations, the user will be directly exited from the interface where the project to be accessed is located and return to the previous level interface of the project to be accessed. If the comprehensive access credibility does not meet expectations on the main interface, the user will be directly exited from the service Internet platform. When applying for advanced data access rights, if the comprehensive access credibility meets expectations and the access identity authentication is passed, the user will be issued with the advanced data access rights for the project to be accessed. If the comprehensive access credibility meets expectations but the access identity authentication fails, the user will be directly exited from the service Internet platform.

[0048] Furthermore, the access control module also includes a historical access log retrieval unit, a comprehensive access average credibility calculation unit, a user access permission adjustment judgment unit, and a user access permission update unit. The historical access log retrieval unit is used to retrieve the user's historical access log; the comprehensive access average credibility calculation unit aggregates the comprehensive access credibility index that can be calculated from the current day's access log and the historical access log and calculates the comprehensive access average credibility index YFe. The specific formula is: , nb is the data volume of the comprehensive access credibility index; the user access permission adjustment judgment unit compares the comprehensive access average credibility index with the expected value of the comprehensive access credibility. If the calculated value is greater than or equal to the expected value, the user access permission is not adjusted. Otherwise, some of the user's advanced data access permissions are frozen until the next access log is generated; the user access permission update unit evaluates the importance of existing advanced data access permissions and sorts them from high to low according to importance, and calculates the proportion fi of the i-th advanced data access permission. The specific formula is: , nc is the total number of advanced data access permissions, and the difference coefficient θa between the comprehensive access average credibility index YFe and the comprehensive access credibility expected value YFu is calculated. The specific formula is: ,when When the priority order is 1, the access permission of the advanced data is frozen. When , freeze the access rights of the first and second high-level data in importance, ..., when All advanced data access permissions are frozen.

[0049] It should be specifically noted that in this embodiment, an access log refers to the result of integrating all access records within a full 24 hours from 0:00 to 24:00.

[0050] The database is used to store data information of all modules in the system.

[0051] It should be specifically noted in this embodiment that the expected values ​​and preset values ​​used are selected based on actual needs and are not limited to specific values ​​here.

[0052] like Figure 2 The distributed identity authentication and access control method based on zero trust provided in this embodiment includes the following steps:

[0053] S1: Build a role-based access control model to create users with different roles and assign different data access permissions to each role user;

[0054] S2: includes two modes: login identity authentication and access identity authentication. Login identity authentication is used to authenticate the user's identity information when logging into the service Internet platform, and access identity authentication is used to authenticate the user's identity information when accessing projects corresponding to the role user's advanced permissions;

[0055] S3: Monitors user access behavior on the service internet platform in real time and generates access logs for backup, extracting real-time access operation data, real-time access network environment data, and real-time access device data;

[0056] S4: Processing the extracted real-time access operation data, real-time access network environment data, and real-time access device data to calculate the operation credibility coefficient, network credibility coefficient, and device credibility coefficient respectively;

[0057] S5: Calculate a comprehensive access credibility index based on the operation credibility coefficient, the network credibility coefficient, and the device credibility coefficient, and determine whether the comprehensive access credibility index meets expectations;

[0058] S6: Receive the comprehensive access credibility judgment result and identity authentication result and generate an access control policy based on it. After the access log is generated every day, the user's access rights are updated in combination with the user's historical access log.

[0059] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A distributed identity authentication and access control system based on zero trust, characterized by: include: Access permission setting module: Build a role access control model to create users with different roles and assign different data access permissions to each role user; Identity authentication module: includes two modes: login identity authentication and access identity authentication. Login identity authentication is used to authenticate the user's identity information when logging into the service Internet platform, and access identity authentication is used to authenticate the user's identity information when accessing projects corresponding to the role user's advanced permissions; Access monitoring module: monitors users' access behavior on the service Internet platform in real time and generates access logs for backup, extracts real-time access operation data, real-time access network environment data, and real-time access device data and sends them to the access monitoring data analysis module; Access monitoring data analysis module: processes the extracted real-time access operation data, real-time access network environment data, and real-time access device data to calculate the operation credibility coefficient, network credibility coefficient, and device credibility coefficient respectively; Comprehensive access credibility analysis module: calculates the comprehensive access credibility index based on the operation credibility coefficient, network credibility coefficient and device credibility coefficient, determines whether the comprehensive access credibility index meets expectations, and sends the judgment result to the access control module; Access control module: Receives comprehensive access credibility judgment results and identity authentication results and generates access control policies based on them. After daily access logs are generated, user access rights are updated in combination with historical user access logs. The access control strategy is generated as follows: during the user's access process, the comprehensive access credibility is evaluated in real time. When applying basic data access permissions, if the comprehensive access credibility does not meet expectations, the user will be directly exited from the interface of the project to be accessed and returned to the interface of the previous level of the project to be accessed. If the comprehensive access credibility does not meet expectations on the main interface, the user will be directly exited from the service Internet platform. When applying for advanced data access permissions, if the comprehensive access credibility meets expectations and the access identity authentication is passed, the user will be granted the advanced data access permissions for the project to be accessed. If the comprehensive access credibility meets expectations but the access identity authentication is failed, the user will be directly exited from the service Internet platform. The updating of user access rights is as follows: first, the comprehensive access credibility indexes that can be calculated from the current day's access log and historical access logs are summarized and the comprehensive access average credibility index is calculated. The comprehensive access average credibility index is compared with the expected value of the comprehensive access credibility. If the calculated value is greater than or equal to the expected value, the user's access rights will not be adjusted. Otherwise, some of the user's advanced data access rights will be frozen until the next access log is generated. Then, the importance of the existing advanced data access rights is evaluated and sorted from high to low according to importance. The difference coefficient θa between the comprehensive access average credibility index YFe and the expected value of the comprehensive access credibility YFu is calculated. When When the priority order is 1, the access permission of the advanced data is frozen. When , freeze the access rights of the first and second high-level data in importance, ..., when All advanced data access permissions are frozen.

2. The zero-trust distributed identity authentication and access control system according to claim 1, characterized in that: The identity authentication module includes an account registration unit, a login identity authentication unit, an access identity authentication unit, and an identity authentication result output unit. The account registration unit generates a login account after the user enters the real name, ID number, email account, login strong password, real-name registered mobile phone number, expected authentication questions and answers, and fingerprint information; the login identity authentication unit is used to perform multi-factor identity authentication on the user and enter the main interface of the service Internet platform after the authentication is passed; the access identity authentication unit authenticates the user's identity information when the user accesses the project corresponding to the advanced permissions of the role to which he belongs; The identity authentication result output unit sends the login identity authentication result and the access identity authentication result to the access control module.

3. The zero-trust-based distributed identity authentication and access control system according to claim 1, characterized in that: The real-time access operation data extracted by the access monitoring module includes the number of repeated access applications mfcij for the j-th item at the i-th moment and the duration of no-operation access Tfcij for the j-th item at the i-th moment; the real-time access network environment data extracted by the access monitoring module includes the network connection speed vai, network bandwidth vbi and delay Tai of the user at the i-th moment; The real-time access device data extracted by the access monitoring module includes the firewall false alarm rate αwi at the i-th moment, the update difference number mai between the operating system version at the i-th moment and the latest operating system version, and the browser encryption strength coefficient εmi at the i-th moment.

4. The zero-trust-based distributed identity authentication and access control system according to claim 3, characterized in that: The access monitoring data analysis module includes a data receiving unit, an operation credibility analysis unit, a network credibility analysis unit, a device credibility analysis unit, and a data output unit. The data receiving unit is used to receive the extracted real-time access operation data, real-time access network environment data, and real-time access device data; the operation credibility analysis unit is used to calculate the operation credibility coefficient Xrci at the i-th moment. The specific formula is: βmij and βTij are the access application excess coefficient and the no-operation stay excess coefficient of the j-th project at the i-th moment, respectively. The specific calculation formula is as follows: mfr and Tfr are the maximum number of repeated visits allowed for the project and the maximum non-operation stay time allowed for the project, respectively. na is the number of projects. The network credibility analysis unit is used to calculate the network credibility coefficient Xrwi at the i-th moment. The specific formula is: vae, vbe, and Tae are the minimum network connection speed, minimum network bandwidth, and maximum latency allowed for access, respectively. The device credibility analysis unit is used to calculate the device credibility coefficient Xrsi at the i-th moment. The specific formula is: The data output unit is used to transmit the calculated operation credibility coefficient, network credibility coefficient and device credibility coefficient to the comprehensive access credibility analysis module.

5. The zero-trust-based distributed identity authentication and access control system according to claim 1, characterized in that: The comprehensive access credibility analysis module includes a data receiving unit, a comprehensive access credibility analysis unit, a comprehensive access credibility judgment unit, and a judgment result output unit. The data receiving unit is used to receive the calculated operation credibility coefficient, network credibility coefficient, and device credibility coefficient at the i-th moment; the comprehensive access credibility analysis unit is used to calculate the comprehensive access credibility index YFi at the i-th moment. The specific formula is: The comprehensive access credibility judgment unit compares the calculated comprehensive access credibility index with the expected comprehensive access credibility value. If the calculated value is greater than or equal to the expected comprehensive access credibility value, it meets expectations; if the calculated value is less than the expected comprehensive access credibility value, it does not meet expectations; the judgment result output unit is used to send the comprehensive access credibility judgment result to the access control module.

6. The zero-trust-based distributed identity authentication and access control system according to claim 1, characterized in that: The access control module includes an information receiving unit and an access control policy generating unit. The information receiving unit is used to receive the comprehensive access credibility judgment result and the identity authentication result. The access control policy generating unit automatically issues the role basic data access right to the user when the login identity authentication is passed and sends an instruction to the access monitoring module to start access monitoring. When applying the basic data access right, if the comprehensive access credibility does not meet the expectations, the user will be directly exited from the interface where the project to be accessed is located and return to the upper-level interface of the project to be accessed. If the comprehensive access credibility does not meet the expectations on the main interface, the user will be directly exited from the service Internet platform. When applying for advanced data access right, if the comprehensive access credibility meets the expectations and the access identity authentication is passed, the user will be issued the advanced data access right of the project to be accessed. If the comprehensive access credibility meets the expectations but the access identity authentication fails, the user will be directly exited from the service Internet platform.

7. The zero-trust-based distributed identity authentication and access control system according to claim 1, characterized in that: The access control module also includes a historical access log retrieval unit, a comprehensive access average credibility calculation unit, a user access permission adjustment judgment unit, and a user access permission update unit. The historical access log retrieval unit is used to retrieve the user's historical access log; the comprehensive access average credibility calculation unit aggregates the comprehensive access credibility index that can be calculated from the current access log and the historical access log and calculates the comprehensive access average credibility index YFe. The specific formula is: nb is the data volume of the comprehensive access credibility index; the user access permission adjustment judgment unit compares the comprehensive access average credibility index with the expected value of the comprehensive access credibility. If the calculated value is greater than or equal to the expected value, the user's access permission is not adjusted; otherwise, some of the user's advanced data access permissions are frozen until the next access log is generated; The user access permission update unit evaluates the importance of existing advanced data access permissions and sorts them from high to low in order of importance, and calculates the proportion fi of the i-th advanced data access permission. The specific formula is: nc is the total number of advanced data access permissions.

Images