Access control method, system, device and medium based on zero trust system

Abstract

The present application provides an access control method, system, device and medium based on a zero-trust system, which relates to the field of network information security technology. The method includes: receiving a user access request and obtaining the user access data of the current user; matching the user access data with the risk rule library and risk model library of the zero-trust system to obtain the risk rules and / or risk model outputs triggered by the user; converting the risk rules and / or risk model outputs triggered by the user into multi-granularity risk vectors according to a preset granularity mapping strategy; performing vector summation on the converted risk vectors to generate risk vector results, which include the user's scores at each granularity; and performing multi-level linkage access control on the user according to the risk vector results and the granularity access order. By calculating the scores of each granularity and combining the multi-level linkage access control with the granularity access order, accurate assessment of risk granularity and fine-grained access control are achieved.

Description

Technical Field

[0001] The present application relates to the field of network information security technology, and in particular to an access control method, system, device and medium based on a zero-trust system. Background Art

[0002] In the current cybersecurity landscape, Zero Trust, a key security architecture concept, aims to ensure security while minimizing disruption to user operations. However, existing Zero Trust products still have significant shortcomings in practical applications.

[0003] On the one hand, existing zero-trust systems typically employ a single-granularity approach, such as uniformly disconnecting the terminal when blocking. This single approach cannot precisely adapt to different risk scenarios and makes it difficult to minimize the impact on user access to business systems while ensuring security. On the other hand, when AI models are integrated, the risk scores they provide often blur the granularity of the risk, making it difficult to accurately identify the source of the risk and implement appropriate targeted measures. Therefore, developing a technical solution that can accurately assess risk granularity and effectively implement access control at that granularity has become a pressing technical challenge. Summary of the Invention

[0004] The present application provides an access control method, system, device and medium based on a zero-trust system to at least solve the above technical problems existing in the prior art.

[0005] According to a first aspect of the present application, a method for access control based on a zero-trust system is provided, the method comprising:

[0006] Receive user access requests and obtain user access data of the current user;

[0007] Match user access data with the risk rule library and risk model library of the zero trust system to obtain user-triggered risk rules and / or risk model outputs;

[0008] According to the preset granularity mapping strategy, the risk rules and / or risk model outputs triggered by the user are converted into multi-granularity risk vectors; vector summation is performed on the converted risk vectors to generate a risk vector result, which includes the user's score at each granularity;

[0009] Based on the risk vector results and the granular access order, multi-level linkage access control is performed on the user.

[0010] In one embodiment, the preset granularity mapping strategy includes:

[0011] Perform granular correlation analysis on risk rules to generate multi-granular risk vectors corresponding to the risk rules;

[0012] The output of the risk model is converted into a multi-granularity risk vector corresponding to the risk model.

[0013] In one possible implementation manner, performing vector summation on the risk vector obtained by conversion includes:

[0014] Perform preliminary vector summation on all multi-granularity risk vectors to obtain the initial risk vector result;

[0015] Weighting the initial risk vector result according to the granularity weighted vector to obtain a risk vector result;

[0016] The granularity weighted vector includes the weight of each granularity, and the weight is determined based on the granularity level of each granularity.

[0017] In one embodiment, the multiple granularities include account granularity, terminal granularity, application service granularity, URL granularity, and data field granularity.

[0018] In one possible implementation, the granularity access order is account granularity, terminal granularity, application service granularity, URL granularity and data field granularity; accordingly,

[0019] The multi-level linkage access control is performed on the user according to the risk vector result and the granular access order, including:

[0020] In the order of account granularity, terminal granularity, application service granularity, URL granularity, and data field granularity, the cumulative score of each granularity is compared with the first preset handling threshold and the second preset handling threshold according to the risk vector result to obtain the risk level of the corresponding granularity. At the corresponding granularity, corresponding access control is performed according to the risk level. The access control includes release, enhanced authentication, and blocking.

[0021] When blocking is triggered at any granularity, blocking of the granularity is executed and subsequent operations are stopped.

[0022] In one embodiment, the cumulative score of each granularity is compared with the first preset handling threshold and the second preset handling threshold step by step according to the risk vector result to obtain the risk level of the corresponding granularity, including:

[0023] When the cumulative score of each granularity is less than the first preset handling threshold, the risk level of the user at the current granularity is determined to be low risk;

[0024] If the cumulative score of each granularity is greater than the first preset handling threshold and less than the second preset handling threshold, the risk level of the user at the current granularity is determined to be medium risk;

[0025] When the accumulated scores of each granularity are greater than the second handling threshold, the risk level of the user at the current granularity is judged to be high risk;

[0026] The cumulative score of each granularity is used to show the sum of the scores of the current granularity and all its predecessor granularities.

[0027] In one embodiment, corresponding access control is performed at corresponding granularity according to risk level, including:

[0028] If the risk level of the corresponding granularity is low, the release operation is performed;

[0029] When the risk level of the corresponding granularity is medium risk, perform enhanced authentication operations;

[0030] When the risk level of the corresponding granularity is high, a blocking operation is performed;

[0031] Among them, blocking operations at the account granularity include restricting login through the current account;

[0032] Blocking operations at the terminal granularity include restricting logins through the current terminal;

[0033] Blocking operations at the application service level include restricting access through specific Internet Protocol addresses or ports;

[0034] Blocking operations at the URL granularity include restricting access to URL resources;

[0035] Blocking operations at the data field granularity include desensitizing the data and displaying only the desensitized data.

[0036] According to a second aspect of the present application, there is provided an access control system based on a zero-trust system, the system comprising:

[0037] The controller component is connected to the zero-trust client to receive user access requests and obtain user access data of the current user;

[0038] The risk assessment module is used to match user access data with the risk rule library and risk model library of the zero-trust system to obtain the risk rules and / or risk model outputs triggered by the user; according to the preset granularity mapping strategy, the risk rules and / or risk model outputs triggered by the user are converted into multi-granularity risk vectors; vector summation is performed on the converted risk vectors to generate a risk vector result, which includes the user's score at each granularity;

[0039] The controller component is further configured to perform multi-level linkage access control on the user based on the risk vector results and the granular access order.

[0040] According to a third aspect of the present application, an electronic device is provided, including:

[0041] at least one processor; and

[0042] a memory communicatively connected to the at least one processor; wherein,

[0043] The memory stores instructions that can be executed by the at least one processor. The instructions are executed by the at least one processor to enable the at least one processor to perform the method described in this application.

[0044] According to a fourth aspect of the present application, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method described in the present application.

[0045] The access control method, system, device and medium based on the zero-trust system of the present application analyzes the risk rules and / or risk model outputs triggered by user access data through the risk rule library and risk model library, and converts them into vectors into scores for each dimension. It then performs multi-level linkage access control in combination with the granular access sequence, thereby achieving accurate assessment of risk granularity and fine-grained access control.

[0046] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The above and other objects, features and advantages of the exemplary embodiments of the present application will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present application are shown in an illustrative and non-limiting manner, in which:

[0048] In the drawings, the same or corresponding reference numerals denote the same or corresponding parts.

[0049] Figure 1 The following is a schematic diagram of the implementation process of the access control method based on the zero-trust system provided in an embodiment of the present application;

[0050] Figure 2 A schematic diagram of the implementation flow of the vector summation operation of the access control method based on the zero trust system provided in an embodiment of the present application is shown;

[0051] Figure 3 A schematic diagram of the structure of an access control system based on a zero-trust system provided in an embodiment of the present application is shown;

[0052] Figure 4A schematic diagram of the structure of an electronic device according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0053] In order to make the purpose, features, and advantages of this application more obvious and easy to understand, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts shall fall within the scope of protection of this application.

[0054] Figure 1 A schematic diagram of the implementation process of the access control method based on the zero-trust system provided in an embodiment of the present application is shown.

[0055] refer to Figure 1 , this application provides an access control method based on a zero-trust system, the method comprising:

[0056] Operation 101: Receive a user access request and obtain user access data of the current user.

[0057] The zero-trust system focuses on the relationship between clients and business systems, and is used to securely manage the process of users accessing business system data through clients to prevent potential security risks.

[0058] When a user initiates a login through the client, access control is enabled and user access data generated during the user access process is obtained in real time, including but not limited to login time, device information, network environment, operation behavior, etc.

[0059] Operation 102 matches the user access data with the risk rule library and risk model library of the zero trust system to obtain the risk rules and / or risk model output triggered by the user.

[0060] Based on the Zero Trust system's long-term accumulation of historical data and rich practical experience, a comprehensive risk rule library and risk model library have been pre-built. The risk rule library covers a variety of known and explicit risk rules, which represent assertions or propositions that assess whether user behavior is risky. For example, a risk rule might be based on a user's normal access hours; access outside of normal access hours triggers the risk rule. The risk model library deploys multiple advanced risk models, such as malicious traffic detection models and business behavior analysis models, primarily to identify unknown and potential risk factors.

[0061] Among them, the risk rules of the risk rule library include but are not limited to a user account logging in to multiple devices in a short period of time, a device logging in to multiple accounts in a short period of time, a business system logging in outside working hours, a user from the Internet accessing a certain port, etc.

[0062] For real-time user access data, necessary preprocessing is first performed to organize and adjust the valid information within the data to meet the input requirements of risk rules and risk models. Specifically, preprocessing aligns all valid data within the data with the input format, data type, and other requirements of the risk rules and risk models. Once aligned, the risk rules matching the user access data are retrieved from the risk rule library. Based on the input requirements of each model in the risk model library, the aligned data is input into the corresponding risk model to obtain the risk model's output. For example, the input requirement for a malicious traffic model is typically all traffic-related data. User access data that meets these requirements is then input into the malicious traffic model.

[0063] In one embodiment of the present application, the output of the risk model is a quantitative score of the potential risks at each granularity in the access process. The risk model is obtained based on conventional neural network architecture training, and can accurately identify and extract key risk factors in the access process, such as risky behaviors, malicious traffic attacks, malicious operations, etc., and output the score of the risk factors at each granularity based on the correlation analysis between the risk factors and the granularity of the access process. Among them, the granularity refers to the source of the risk, such as an account, terminal, port, address, etc. It should be noted that the risk model of the embodiment of the present application is only triggered to output when a risk factor is identified.

[0064] Operation 103 converts the risk rules and / or risk model outputs triggered by the user into multi-granularity risk vectors according to a preset granularity mapping strategy; performs vector summation on the converted risk vectors to generate a risk vector result, which includes the user's score at each granularity.

[0065] For the zero-trust system, a granular mapping strategy is preset in advance, which configures a method for converting risk rules and risk model outputs into multi-granularity risk vectors.

[0066] In one embodiment of the present application, the preset granularity mapping strategy includes: performing granularity correlation analysis on risk rules to generate multi-granularity risk vectors corresponding to the risk rules; and converting the output of the risk model into multi-granularity risk vectors corresponding to the risk model.

[0067] Specifically, for each triggered risk rule, granular correlation analysis is performed on it. Based on the correlation analysis results for each granularity, a risk score for that granularity is output. A risk vector is constructed based on the risk score for each granularity. Correlation analysis can be performed using methods such as rule semantic matching or feature importance analysis based on machine learning. The risk vector can be represented as R = {F1, F2, ..., Fn}, where F1-Fn represent the risk scores for granularities 1-n.

[0068] In one embodiment of the present application, correlation analysis between rules and granularities can be performed through explicit matching based on rule semantics or feature importance analysis based on machine learning. Specifically, correlation analysis based on explicit matching based on rule semantics includes: parsing the text description or structured conditions of the rule to directly match its correlation strength with each granularity (account level, terminal level, etc.); correlation analysis based on feature importance analysis based on machine learning includes: encoding the granularity as a model feature, triggering a prediction model (such as a classifier) ​​through rule training, and using feature importance to reversely deduce the correlation strength between the rule and each granularity. The correlation strength can be regarded as a score with each granularity.

[0069] Regarding the output of the risk model, since the risk model directly outputs the scores for each granularity, after obtaining the output of the risk model, the scores for each granularity output by the risk model can be directly converted into risk vectors. The expression form of the risk vector is the same as that shown in the above risk rules.

[0070] After vector conversion is performed on the output of each risk rule and each risk model, all risk vectors are summed to obtain the risk vector result, which includes the final score at each granularity.

[0071] Operation 104 : Perform multi-level linkage access control on the user based on the risk vector result and the granular access order.

[0072] The granular access order refers to the order in which a user accesses the system through various granularities. For example, if a user first logs in to a terminal using an account and then accesses a resource, the granular access order is account, terminal, then resource.

[0073] After determining the wind volume vector result, access control is performed on users according to the corresponding granularity scores, step by step, in the granularity access order. The score corresponding to each granularity includes the scores of all previous granularities within that granularity. For example, when the risk vector result is R = {F1, F2...Fn}, the score used for access control at the first granularity is F1, the score used for access control at the second granularity is F1 + F2, and so on. Multi-level linkage access control can be considered as executing access control at the current granularity only after all previous granularity access controls have been determined to be permitted.

[0074] In this way, the embodiment of the present application analyzes the risk rules and / or risk model outputs triggered by user access data through the risk rule library and the risk model library, and converts them into vectors of scores at each granularity. Then, multi-level linkage access control is performed in combination with the granular access order, thereby achieving accurate assessment of risk granularity and fine-grained access control.

[0075] Figure 2 A schematic diagram of the implementation flow of the vector summation operation of the access control method based on the zero trust system provided in an embodiment of the present application is shown.

[0076] refer to Figure 2 In one embodiment of the present application, performing vector summation on the risk vector obtained by conversion includes:

[0077] In operation 201 , all risk vectors of multiple granularities are subjected to preliminary vector summation to obtain an initial risk vector result.

[0078] Since risk rules and risk model outputs correspond to different risks, firstly, the vectorized results of all risk rules and / or the vectorized results of all risk model outputs are summed to determine the total risk score of each granularity.

[0079] Operation 202 : weighting the initial risk vector result according to the granularity weighting vector to obtain a risk vector result; wherein the granularity weighting vector includes the weight of each granularity, and the weight is determined based on the granularity level of each granularity.

[0080] Similar to the highest and lowest permissions, each granularity is typically differentiated by level. For example, at the account level, there are privileged accounts and ordinary accounts; at the terminal level, there are personal terminals and private terminals; and at the interface level, there are specific interfaces and ordinary interfaces. Therefore, to better implement corrective control at each granularity, before weighting the initial risk vector results, the granularity level of each granularity is determined based on the user, device, network, and other attribute data in the user access data during actual access. Special attributes are assigned a higher granularity level. Then, a corresponding weight is dynamically assigned to each granularity based on the granularity level, and the weights of multiple granularities are constructed into a granularity weight vector.

[0081] After the initial risk vector result is calculated, the initial risk vector result is multiplied by the granularity weighting vector to obtain the final risk vector result.

[0082] In one embodiment of the present application, the multiple granularities in the access process include at least account granularity, terminal granularity, application service granularity, URL (Uniform Resource Locator) granularity, and data field granularity.

[0083] Specifically, in order to achieve fine-grained access control, this application designs access control at five granularities: account granularity, terminal granularity, application service granularity, URL granularity, and data field granularity. Account granularity can be understood as targeting a specific account; terminal granularity can be understood as targeting a specific terminal; application service granularity can be understood as targeting a specific target business system, service, or host, which is a combination of IP (Internet Protocol) and port; URL granularity can be understood as targeting a business system based on HTTP (HyperText Transfer Protocol) or HTTPS (HyperText Transfer Protocol Secure), targeting a specific URL; and data field granularity can be understood as targeting specific fields or data displayed on a page, such as ID number, mobile phone number, bank card number, etc.

[0084] In one embodiment of the present application, based on the risk vector results and the granular access order, multi-level access control is implemented for users. This includes comparing the cumulative score of each granularity with a first preset handling threshold and a second preset handling threshold based on the risk vector results, in the order of account granularity, terminal granularity, application service granularity, URL granularity, and data field granularity, to determine the risk level of the corresponding granularity. At the corresponding granularity, appropriate access control is implemented based on the risk level. Access control includes release, enhanced authentication, and blocking. When blocking is triggered at any granularity, the blocking action at that granularity is executed, and subsequent operations are stopped.

[0085] Based on the analysis of the user access process, the user access process goes through account granularity, terminal granularity, application service granularity, URL granularity and data field granularity. Therefore, the configuration granularity access order is account granularity, terminal granularity, application service granularity, URL granularity and data field granularity.

[0086] To prevent blocking at a single granularity, access control thresholds are configured for the entire access process. These thresholds include a first and second preset thresholds for determining risk levels. At each granularity, the risk level for the current granularity is determined by cumulatively adding the scores of previous granularities and comparing the accumulated scores with the thresholds.

[0087] In one embodiment of the present application, when the cumulative score of each granularity is less than the first preset disposal threshold, the risk level of the user at the current granularity is determined to be low risk; when the cumulative score of each granularity is greater than the first preset disposal threshold and less than the second preset disposal threshold, the risk level of the user at the current granularity is determined to be medium risk; when the cumulative score of each granularity is greater than the second disposal threshold, the risk level of the user at the current granularity is determined to be high risk; wherein the cumulative score of each granularity is used to show the sum of the scores of the current granularity and all its predecessor granularities.

[0088] The first preset handling threshold is used to determine whether enhanced authentication is required. If it is below the threshold, it indicates low risk and no enhanced authentication is required. If it is above the threshold, it is considered medium risk and requires enhanced authentication. To enhance security, a second preset handling threshold is configured in addition to the first preset handling threshold. The second preset handling threshold is used to determine whether blocking is required. If it exceeds the second preset handling threshold, it indicates high risk and is directly blocked without enhanced authentication.

[0089] According to the granular access order, release, enhanced authentication and blocking are performed accordingly at each granularity based on the comparison between the corresponding cumulative score and the two disposal thresholds.

[0090] Among them, in order to avoid wasting computing resources and improve security precautions, the score comparison and access control of the current granularity are only performed when all the previous granularities of the current granularity are not blocked. If the previous granularity is blocked, the access control operations of all subsequent granularities will be stopped by default.

[0091] In addition to stopping subsequent operations in the event of blocking, subsequent access control operations are also stopped when enhanced authentication occurs at a certain granularity until the granularity at which enhanced authentication occurs is determined to have passed the enhanced authentication and is released.

[0092] In one embodiment of the present application, when the risk level at the corresponding granularity is low risk, a release operation is performed; when the risk level at the corresponding granularity is medium risk, an enhanced authentication operation is performed; and when the risk level at the corresponding granularity is high risk, a blocking operation is performed. Blocking operations at the account granularity include restricting logins through the current account; blocking operations at the terminal granularity include restricting logins through the current terminal; blocking operations at the application service granularity include restricting access through specific Internet Protocol addresses or ports; blocking operations at the URL granularity include restricting access to URL resources; and blocking operations at the data field granularity include desensitizing the data and displaying only the desensitized data.

[0093] Low-risk situations can be directly released, medium-risk situations require enhanced authentication, and high-risk situations are directly blocked. Account-level blocking restricts the current account from logging in through any terminal, terminal-level blocking prevents any account from logging in through the current terminal, application-level blocking restricts access to business systems with specific IP addresses (Internet Protocol addresses) and ports, URL-level blocking restricts access to specific URL resources, and data-field-level blocking displays only desensitized data, excluding important data such as ID numbers and mobile phone numbers.

[0094] In one embodiment of the present application, a blacklist mechanism is also configured for account granularity and terminal granularity, that is, once an account and terminal are determined to be at a medium or high risk level, the corresponding account and terminal will be added to the disposal list cache. For accounts on the disposal list, any login through any terminal will be subject to enhanced authentication or blocking; for terminals on the disposal list, any login through any account will be subject to enhanced authentication or blocking. Among them, accounts can be cached in the disposal list based on account numbers, and terminals can be cached in the disposal list based on their device unique identifiers. The terminal's device unique identifier can be a device fingerprint.

[0095] In one embodiment of the present application, when implementing access control at each granularity, the risk level of each granularity is continuously determined in real time based on user access data. If the risk level of a granularity is determined to be medium or high during access, the operation is immediately stopped and timely blocking or enhanced authentication is performed at the corresponding granularity. For example, if a user accesses a URL resource and the current user's account or terminal is determined to be medium or high risk, the user is immediately blocked from accessing the URL resource, and enhanced authentication or blocking is implemented at the account or terminal granularity.

[0096] In one embodiment of the present application, in order to remind the user in time, when blocking or strengthening authentication is performed at each granularity, a reminder of blocking or strengthening authentication is also sent to the client to which the user belongs.

[0097] Figure 3 A schematic diagram of the composition structure of an access control system based on a zero-trust system provided in an embodiment of the present application is shown.

[0098] refer to Figure 3 In order to implement the access control method based on the zero trust system of this application, this application has designed a set of access control systems based on the zero trust system, also known as the zero trust system. The system can be connected with the zero trust client and business system to realize access control of users. The system includes a controller component, a forward proxy component, a reverse proxy component, an account credential management and authentication service component, a risk assessment module and an access control decision component.

[0099] The controller component connects to the zero-trust client to receive user access requests and obtain the current user's user access data. Specifically, when a user needs to access the business system, the controller component receives the user access request, performs identity authentication and binding / login, and reports the user access data to the risk assessment module based on the account credential management and authentication service components.

[0100] In addition to uploading user access data to the risk assessment module, the account credential management and authentication service component also receives attribute data such as users, devices, networks, etc. in the current access process, and determines the attribute weighting vector based on these special attributes, namely the granularity weighting vector, and then uploads the granularity weighting vector synchronously to the risk assessment module.

[0101] The risk assessment module is used to match user access data with the risk rule library and risk model library of the zero trust system to obtain the risk rules and / or risk model outputs triggered by the user; according to the preset granularity mapping strategy, the risk rules and / or risk model outputs triggered by the user are converted into multi-granularity risk vectors; the converted risk vectors are vector summed to generate risk vector results, which include the user's score at each granularity.

[0102] The risk assessment module includes an intelligent measurement engine and a rule measurement engine. The intelligent measurement engine is used to obtain the risk model output triggered by user access data, and the rule measurement engine is used to obtain the triggered risk rules.

[0103] After the risk assessment module obtains the risk vector results, it passes them to the access control decision component, which determines the access control decision for each granularity and returns the access control decision to the controller component. The controller component then implements multi-level access control for the user based on the granular access order and the corresponding access control decision. Access control decisions include executing access control functions such as release, authentication, or blocking.

[0104] In one embodiment of the present application, the controller component may perform multi-level linkage access control on the user based on the granular access order and the corresponding access control decision, which may include:

[0105] 1) If the decision includes blocking at the account level, access is denied based on the logged-in account name. If the decision includes enhanced authentication at the account level, the controller component notifies the Zero Trust client via a pop-up window, such as a text message, to request enhanced authentication. Once an account-level risk is triggered, the user is blocked or authenticated regardless of the device they are using.

[0106] 2) If the decision includes enhanced authentication or blocking at the terminal granularity, the controller component determines the device based on the device fingerprint of the terminal device, and denies access to users bound / logged in to the device, or triggers enhanced authentication.

[0107] 3) If the controller component determines that the user can access the network, the zero-trust client establishes a four-layer network tunnel with the forward proxy component to control user access. If, during the user's access to the business system, account-level or device-level blocking or enhanced authentication is triggered, the controller component notifies the forward proxy component to block the user, and the controller component notifies the zero-trust client to display a pop-up window to inform the client of the block or enhanced authentication. If, after the user accesses the forward proxy component and application-level blocking or enhanced authentication is triggered, the controller component notifies the forward proxy component to stop forwarding data to a certain IP address and port, and the controller component notifies the client to display a pop-up window to inform the user of the block or require enhanced authentication.

[0108] 4) If the user accesses the forward proxy component normally, the access request will be forwarded to the reverse proxy component, which will forward the request to the business system. If the user request triggers URL-level blocking or enhanced authentication, the reverse proxy component will insert a blocking notification or enhanced authentication interface into the page returned to the user.

[0109] 5) If enhanced authentication or blocking at the data field granularity is triggered when a user accesses a URL resource, the reverse proxy component will match and desensitize the data when forwarding the http protocol data. If enhanced authentication is required, the reverse proxy component will insert an enhanced authentication page. After authentication, the complete information can be seen. If blocking is triggered or enhanced authentication fails, the desensitized data will be directly returned.

[0110] In this way, the system of the embodiment of the present application realizes the effective implementation of the method of the present application through the combination of the controller component, account credential management and authentication service component, risk assessment module, access control decision component and forward / reverse proxy component, thereby improving the system's risk granularity assessment accuracy and fine-grained access control capabilities.

[0111] It should be noted that the description of the system in the embodiment of the present application is similar to the description of the method embodiment above, and has similar beneficial effects as the method embodiment, so it will not be repeated here. Figures 1 to 2 The present invention shall be understood by reference to the description of any of the accompanying drawings.

[0112] According to an embodiment of the present application, the present application also provides an electronic device and a readable storage medium.

[0113] Figure 4A schematic block diagram of an example electronic device 400 that can be used to implement an embodiment of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or claimed herein.

[0114] like Figure 4 As shown, device 400 includes a computing unit 401, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 402 or a computer program loaded from a storage unit 408 into a random access memory (RAM) 403. RAM 403 may also store various programs and data required for the operation of device 400. Computing unit 401, ROM 402, and RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to bus 404.

[0115] Various components in device 400 are connected to I / O interface 405, including an input unit 406, such as a keyboard, mouse, etc.; an output unit 407, such as various types of displays, speakers, etc.; a storage unit 408, such as a magnetic disk, optical disk, etc.; and a communication unit 409, such as a network card, modem, wireless communication transceiver, etc. Communication unit 409 allows device 400 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0116] Computing unit 401 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Computing unit 401 performs the various methods and processes described above, such as the zero-trust access control method. For example, in some embodiments, the zero-trust access control method can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as storage unit 408. In some embodiments, part or all of the computer program can be loaded and / or installed onto device 400 via ROM 402 and / or communication unit 409. When the computer program is loaded into RAM 403 and executed by computing unit 401, one or more steps of the zero-trust access control method described above can be performed. Alternatively, in other embodiments, the computing unit 401 may be configured to execute an access control method based on a zero-trust architecture in any other appropriate manner (for example, by means of firmware).

[0117] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on a chip (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0118] The program code for implementing the methods of the present application can be written in any combination of one or more programming languages. Such program code can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the program code is executed by the processor or controller, the functions / operations specified in the flow charts and / or block diagrams are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0119] In the context of this application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or apparatus. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of machine-readable storage media may include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fibers, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0120] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0121] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0122] A computer system may include a client and a server. The client and server are generally remote from each other and typically interact through a communication network. The client-server relationship arises through computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, a server in a distributed system, or a server integrated with a blockchain.

[0123] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this application can be achieved. This is not a limitation herein.

[0124] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. Throughout the description of this application, "plurality" means two or more, unless otherwise specifically defined.

[0125] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. An access control method based on a zero-trust system, characterized in that: The method comprises: Receive user access requests and obtain user access data of the current user; Match user access data with the risk rule library and risk model library of the zero trust system to obtain user-triggered risk rules and / or risk model outputs; According to the preset granularity mapping strategy, the risk rules and / or risk model outputs triggered by the user are converted into multi-granularity risk vectors; vector summation is performed on the converted risk vectors to generate a risk vector result, which includes the user's score at each granularity; Perform multi-level linkage access control on users based on the risk vector results and granular access order; The preset granularity mapping strategy includes: performing granularity correlation analysis on risk rules to generate multi-granularity risk vectors corresponding to the risk rules; converting the output of the risk model into multi-granularity risk vectors corresponding to the risk model; Multiple granularities include account granularity, terminal granularity, application service granularity, URL granularity and data field granularity; the granularity access order is account granularity, terminal granularity, application service granularity, URL granularity and data field granularity; accordingly, according to the risk vector results and the granularity access order, multi-level linkage access control is performed on the user, including: in the order of account granularity, terminal granularity, application service granularity, URL granularity and data field granularity, according to the risk vector results, the cumulative score of each granularity is compared with the first preset disposal threshold and the second preset disposal threshold step by step to obtain the risk level of the corresponding granularity, and corresponding access control is performed at the corresponding granularity according to the risk level, and the access control includes release, enhanced authentication and blocking; wherein, when blocking is triggered at any granularity, the blocking of the granularity is executed and subsequent operations are stopped.

2. The method according to claim 1, characterized in that The performing vector summation on the risk vector obtained by the conversion includes: Perform preliminary vector summation on all multi-granularity risk vectors to obtain the initial risk vector result; Weighting the initial risk vector result according to the granularity weighted vector to obtain a risk vector result; The granularity weighted vector includes the weight of each granularity, and the weight is determined based on the granularity level of each granularity.

3. The method according to claim 1, characterized in that According to the risk vector results, the cumulative score of each granularity is compared with the first preset treatment threshold and the second preset treatment threshold step by step to obtain the risk level of the corresponding granularity, including: When the cumulative score of each granularity is less than the first preset handling threshold, the risk level of the user at the current granularity is determined to be low risk; If the cumulative score of each granularity is greater than the first preset handling threshold and less than the second preset handling threshold, the risk level of the user at the current granularity is determined to be medium risk; When the accumulated scores of each granularity are greater than the second handling threshold, the risk level of the user at the current granularity is judged to be high risk; The cumulative score of each granularity is used to show the sum of the scores of the current granularity and all its predecessor granularities.

4. The method according to claim 3, characterized in that Implement access control based on risk level at the corresponding granularity, including: If the risk level of the corresponding granularity is low, the release operation is performed; When the risk level of the corresponding granularity is medium risk, perform enhanced authentication operations; When the risk level of the corresponding granularity is high, a blocking operation is performed; Among them, blocking operations at the account granularity include restricting login through the current account; Blocking operations at the terminal granularity include restricting logins through the current terminal; Blocking operations at the application service level include restricting access through specific Internet Protocol addresses or ports; Blocking operations at the URL granularity include restricting access to URL resources; Blocking operations at the data field granularity include desensitizing the data and displaying only the desensitized data.

5. An access control system based on a zero-trust system, characterized in that: The system comprises: The controller component is connected to the zero-trust client to receive user access requests and obtain user access data of the current user; The risk assessment module is used to match user access data with the risk rule library and risk model library of the zero-trust system to obtain the risk rules and / or risk model outputs triggered by the user; according to the preset granularity mapping strategy, the risk rules and / or risk model outputs triggered by the user are converted into multi-granularity risk vectors; vector summation is performed on the converted risk vectors to generate a risk vector result, which includes the user's score at each granularity; The controller component is further configured to perform multi-level linkage access control on the user based on the risk vector results and the granular access order; The preset granularity mapping strategy includes: performing granularity correlation analysis on risk rules to generate multi-granularity risk vectors corresponding to the risk rules; converting the output of the risk model into multi-granularity risk vectors corresponding to the risk model; Multiple granularities include account granularity, terminal granularity, application service granularity, URL granularity and data field granularity; the granularity access order is account granularity, terminal granularity, application service granularity, URL granularity and data field granularity; accordingly, the controller component performs multi-level linkage access control on the user according to the risk vector result and the granularity access order, including: the controller component compares the cumulative score of each granularity with the first preset disposal threshold and the second preset disposal threshold step by step according to the risk vector result in the order of account granularity, terminal granularity, application service granularity, URL granularity and data field granularity, obtains the risk level of the corresponding granularity, and performs corresponding access control at the corresponding granularity according to the risk level, and the access control includes release, enhanced authentication and blocking; wherein, when blocking is triggered at any granularity, blocking of the granularity is executed and subsequent operations are stopped.

6. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 4.

7. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 4.

Images