Enterprise network security model based on zero-trust architecture

Abstract

The invention discloses an enterprise network security model based on a zero-trust architecture, and the model comprises a user management module which is used for carrying out the authority grade division of a user according to the function attribute of the user, obtaining the authority grade of the user, and dynamically generating access authorization information according to the function attribute of the user and the security strategy of an enterprise; the data protection and encryption module is used for encrypting the network data and classifying the network data according to the sensitivity of the network data to obtain a network resource sensitivity level; the identity authentication module is used for performing identity authentication on the access user by using a multi-factor identity authentication mechanism; the trust quantification module is used for obtaining a trust quantification value according to the credibility displayed by the user through the identity verification link; the access authorization decision-making module is used for obtaining an access authorization decision-making result according to the trust quantized value, the sensitivity level of the network resource to be accessed and the user authority level; according to the model, strict verification and authorization of the network access request are realized, and the network security protection level is improved.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to an enterprise network security model based on a zero-trust architecture. Background Art

[0002] Enterprise network security is not only a crucial safeguard for maintaining a company's image and reputation, but also a crucial component of national security and social stability. With the development of internet technology, online office work and online shopping have become integral parts of people's lives. Once a company's network system is attacked or compromised, it can severely damage its rights and interests. Therefore, enterprise network security is crucial for maintaining market order. However, the current network security model is relatively simplistic, requiring only identity verification for access to corporate networks, posing a significant threat to network security.

[0003] Zero Trust Architecture (ZTA) is a network security paradigm that "never assumes trust, but continuously and dynamically verifies." Its core assumption is that "nothing inside or outside the network can be trusted." It radically overturns the traditional perimeter-based "castle and moat" model (which relies on firewalls / VPNs to isolate the inside and outside), instead implementing fine-grained resource access control through real-time risk assessment of identity, device, and behavior. With this in mind, Zero Trust Architecture is being introduced into enterprise network security to rigorously verify and authorize access requests within the network, safeguarding enterprise information security. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide an enterprise network security model based on a zero-trust architecture to solve the technical problems raised by the background technology.

[0005] The purpose of the present invention is achieved through the following technical solutions:

[0006] An enterprise network security model based on a zero-trust architecture, which includes:

[0007] User management module: used to classify users into permission levels according to their functional attributes, and dynamically generate access authorization information based on the user's functional attributes and the company's security policy;

[0008] Data protection and encryption module: used to encrypt network data and classify network data according to its sensitivity to obtain the sensitivity level of network resources;

[0009] Authentication module: used to authenticate access users using a multi-factor authentication mechanism;

[0010] Trust quantification module: used to obtain a trust quantification value based on the trustworthiness demonstrated by the user through the identity verification process;

[0011] Access authorization decision module: used to obtain access authorization decision results based on the trust quantification value, the sensitivity level of the network resource to be accessed and the user authority level.

[0012] Furthermore, it also includes an access risk assessment module: used to perform risk assessment based on the risk of the request source, the risk of the behavior pattern exhibited by the user through the identity authentication link, and the risk of the security status of the requesting device to obtain an access risk assessment result, and dynamically adjust the access authorization information of the access user based on the access risk assessment result, and the access authorization decision result is combined with the access risk assessment result.

[0013] Furthermore, it also includes a network security risk assessment module: it is used to conduct real-time risk assessment in the network based on the characteristics of network attack behavior, asset importance and potential losses to obtain network security risk assessment values and classify network security risks into low risk, medium risk or high risk according to the network security risk assessment values, and adopt different network security emergency response strategies for different risks.

[0014] Furthermore, it also includes a network security emergency response module: including low-risk emergency strategies, medium-risk emergency strategies and high-risk emergency strategies; if the network security risk is low, the low-risk emergency strategy records the network attack behavior log and restricts the traffic of the attack source; if the network security risk is medium, the medium-risk emergency strategy will guide part of the network attack traffic to the honeypot system on the basis of the low-risk emergency strategy to protect the real business system; if the network security risk is high, the high-risk emergency strategy will immediately cut off the connection between the attack source and the network and start the data backup and recovery process.

[0015] Furthermore, it also includes a network segmentation module: used to segment the network and set up security devices between the network segments.

[0016] Furthermore, the trust quantification algorithm in the trust quantification module is:

[0017] T u =ω1×F1(a1,a2,…,a n )+ω2×F2(b1,b2,…,b m )

[0018] Where: F1(a1,a2,…,a n ) is the weighted sum of the scores of each identity verification factor;

[0019] F2(b1,b2,…,b m ) is obtained by statistical analysis of behavioral data in the identity verification process;

[0020] ω1 is the weight of the identity verification factor;

[0021] ω2 is the weight of the behavioral analysis factor in the identity verification phase;

[0022] ω1+ω2=1.

[0023] Furthermore, the access authorization decision algorithm of the access authorization decision module is:

[0024]

[0025] Where: Tu is the trust quantification value;

[0026] C u The user authority level, where the administrator user has the highest authority level of 3, and the ordinary user authority level is 1;

[0027] P r is the sensitivity level of network resources;

[0028] θ1 and θ2 are thresholds.

[0029] Furthermore, the access risk assessment algorithm in the access risk assessment module is:

[0030] R q =I s +B p +D v

[0031] Where: I s For the request source risk, if the request comes from a trusted network segment within the enterprise, I s The value is 1; if it comes from an external unknown network, I s The value is 5;

[0032] B p The risk of the behavior pattern shown by the user when passing the identity verification link. Under normal behavior mode, B p The value is 1, and in abnormal behavior mode, the value ranges from 2 to 4 depending on the degree of abnormality;

[0033] D v To request the device security status risk, if no malware is detected, D v The value is 1; if the device has an unpatched security vulnerability, D v The value is 3.

[0034] Furthermore, the network security risk assessment algorithm of the network security risk assessment module:

[0035] R t =α×A t +β×I a +γ×L p

[0036] Where: R t is the cybersecurity risk assessment value at time t, in [1,5], where 1 is low risk and 5 is high risk;

[0037] A t is the network attack behavior characteristic at time t, and its value range is [2, 4], where 4 represents the highest network attack intensity and 2 represents the lowest network attack intensity;

[0038] I a is the asset importance, with a value range of [1,3], where 3 is the most important asset and 1 is the least important asset;

[0039] L p is the potential loss, and its value range is [1,3], where 3 is the maximum potential damage and 1 is the minimum potential loss;

[0040] α, β, and γ are weight coefficients, and their sum is 1.

[0041] Furthermore, the flow rate limiting amount calculation formula for limiting the flow rate of the attack source is:

[0042]

[0043] Where: T limit is the flow after restriction;

[0044] T current is the traffic of the network attack source at time t;

[0045] R t is the network security risk assessment value at time t;

[0046] The calculation formula for the honeypot diversion ratio of directing part of the network attack traffic to the honeypot system is:

[0047]

[0048] Where: R t is the network security risk assessment value at time t;

[0049] The calculation formula for the data backup and recovery time of the startup data backup and recovery process is:

[0050]

[0051] Where: D size The key data volume;

[0052] B rate is the backup recovery rate;

[0053] R t is the network security risk assessment value at time t.

[0054] The beneficial effects of the present invention are:

[0055] The enterprise network security model based on zero-trust architecture of the present invention not only requires identity authentication but also user trust quantification before access authorization, so that the access authorization decision is combined with the trust quantification value, network resource sensitivity level and user authority level, and realizes strict verification and authorization of network access requests, thereby improving the level of network security protection and ensuring enterprise information security.

[0056] The present invention also includes an access risk assessment module, which is based on the risk of the request source, the risk of the behavior pattern exhibited by the user through the identity authentication link, and the risk of the security status of the requesting device. The access risk assessment results obtained by it can be used to dynamically adjust the access authorization information of the accessing user, and can also be used as a decision condition for the access authorization decision module to further improve the level of network security protection.

[0057] Furthermore, we conduct real-time cybersecurity risk assessments and categorize them into low, medium, and high risk. We employ different emergency response strategies for different cybersecurity risk levels, achieving a good balance between network security and accessibility.

[0058] Other advantages, objectives, and features of the present invention will be described in part in the following description and, in part, will be apparent to those skilled in the art upon examination of the following description or may be learned from practice of the present invention. The objectives and other advantages of the present invention may be realized and obtained through the following description and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be further described in detail below with reference to the accompanying drawings, in which:

[0060] Figure 1 This is a schematic diagram of the principle of the present invention. DETAILED DESCRIPTION

[0061] The preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the preferred embodiments are only for illustrating the present invention, and are not intended to limit the scope of protection of the present invention.

[0062] like Figure 1 As shown in Figure 1, the enterprise network security model based on the zero trust architecture includes:

[0063] User management module: used to classify users into permission levels according to their roles, permission levels, departments and other attributes to obtain user permission levels; this module is also used to dynamically generate access authorization information based on the user's roles, permission levels, departments and other attributes combined with the company's security policies. The access authorization information not only limits the network resources that users can access (such as specific servers, databases, applications), but also includes the access method (such as read-only, read-write, execute) and time limit. Updates and adjustments to the access authorization information are synchronized in real time to each access control point in the enterprise network.

[0064] Network segmentation module: Divides the enterprise network into multiple logical segments, categorizing them based on business functions, data sensitivity, security requirements, and other factors. For example, core business systems, financial systems, and R&D systems can be assigned to different segments. Logical isolation is achieved between segments through security devices such as firewalls and virtual private networks (VPNs), limiting unnecessary network traffic between segments.

[0065] Within each network segment, micro-segmentation is further implemented to divide devices and applications within the segment into smaller security zones. Software-defined networking (SDN) technology and access control lists (ACLs) are used to define detailed access rules for each security zone, ensuring that only authorized traffic can flow between zones, preventing lateral movement attacks from spreading within the network segment.

[0066] Data protection module: This module is used to classify and label network data in the enterprise network according to its sensitivity, thereby obtaining a network resource sensitivity level. This module categorizes network data into different levels (e.g., top secret, confidential, and secret) based on the importance, confidentiality, and integrity requirements of the data. The labeling information is embedded in the data itself or its metadata for easy identification and processing throughout the network. This module is also used to encrypt and protect network data using encryption technology. During the data storage phase, network data is encrypted using symmetric encryption algorithms (e.g., AES) or asymmetric encryption algorithms (e.g., RSA), and encryption keys are stored and distributed through a secure key management system. During the data transmission phase, network traffic is encrypted using encryption protocols such as SSL / TLS to ensure the confidentiality and integrity of data within the enterprise network and during interactions with external networks.

[0067] Authentication module: Utilizes a multi-factor authentication mechanism, requiring users to provide at least two different types of authentication factors, including but not limited to passwords, fingerprints, dynamic passwords, hardware tokens, and biometric features (such as facial recognition). Each authentication factor is verified through an independent verification process based on an encrypted communication protocol to prevent authentication information from being eavesdropped during transmission.

[0068] Trust Quantification Module: This module aims to comprehensively consider multiple factors and quantitatively evaluate the degree of trust in users or devices in the enterprise network environment to provide a basis for subsequent access control decisions. It is used to obtain a trust quantification value based on the trustworthiness demonstrated by users through identity authentication. It involves a trust quantification algorithm, and the formula is:

[0069] T u =ω1×F1(a1,a2,…,a n )+ω2×F2(b1,b2,…,b m )

[0070] Where: T u It is a trust quantification value between 0 and 1, where 0 means completely untrustworthy and 1 means highly trustworthy;

[0071] F1(a1,a2,…,a n ) is a function based on various authentication factors, which reflects the credibility of the user or device through the authentication process. n Represents different authentication factors. For example, a1 can be the password strength score. The stronger the password, the larger the value of a1. a2 is the number of multi-factor authentication passes. The more authentication factors passed, the higher the value of a2. n ) is the weighted sum of the scores of each authentication factor, for example

[0072]

[0073] where k i is the weight coefficient of the i-th authentication factor. These weight coefficients can be set according to the company's judgment on the importance of different authentication factors. For example, if the company believes that password strength is crucial, k1 can be set to a higher value.

[0074] F2(b1,b2,…,b m ) is a function based on the behavioral analysis factors of the authentication phase, which is used to evaluate whether the behavior of users or devices in the network conforms to normal patterns. For example, b1 is the abnormal value of recent login frequency. If the number of logins by a user in a short period of time far exceeds the historical average login frequency, the value of b1 will increase accordingly; b2 is the compliance score of the operation behavior. If the user's operation complies with the permissions and processes specified by the enterprise, the value of b2 is high. F2(b1, b2, ..., b m ) is obtained by statistical analysis of behavioral data in the identity authentication process. For example, a normal distribution is used to evaluate login frequency outliers:

[0075]

[0076] Where μ is the mean of normal login frequency, and σ is the standard deviation. When the login frequency deviates from the mean by more than a certain multiple of the standard deviation, it is considered abnormal. At this time, the value of F2(b1) will be less than 1, and the greater the deviation, the smaller the value.

[0077] ω1 and ω2 are the weights for identity verification and behavioral analysis, respectively, with their sum being 1. The weightings are determined by the enterprise's relative importance of identity verification and behavioral analysis in trust assessment. For example, an enterprise that prioritizes data security and a relatively stable network environment might set ω1 higher, placing greater emphasis on identity verification. Meanwhile, an enterprise focused on real-time threat detection and response might increase ω2 to strengthen the role of behavioral analysis in trust assessment.

[0078] Access risk assessment module: This module is used to quantitatively assess the risk of network access requests in order to promptly identify and address potential security threats. It considers factors such as the risk of the request source (i.e., whether the network environment of the request source is from a known secure network or a suspicious external network), the risk of the user's behavior pattern during authentication (e.g., access frequency, whether the operation sequence is abnormal), and the risk of the security status of the requesting device (e.g., whether the device has security vulnerabilities or is infected by malware). This module involves an access risk assessment algorithm, which is formulated as follows:

[0079] R q =I s +B p +D v

[0080] Where: R q Indicates the risk quantification value of the network access request. The larger the value, the higher the risk.

[0081] I s The score represents the risk of the request source, which is used to evaluate the security of the source where the access request is initiated. For example, if the request comes from a trusted network segment within the enterprise, I s The value is 1; if it comes from an external unknown network, the risk is high, I s The value is 5.

[0082] B p The risk score of the behavior pattern displayed by the user during the authentication process reflects whether there is any abnormal risk in the user or device behavior accompanying the request. For example, if the user's operation sequence is seriously inconsistent with the normal business process, or there are abnormal behaviors such as frequent attempts to access restricted resources, B p The value of will increase accordingly. Under normal behavior mode, B p The value is 1. In abnormal behavior mode, the value ranges from 2 to 4 depending on the degree of abnormality.

[0083] Dv Indicates the security status risk score of the requesting device, which reflects the security status of the device that initiated the access request. For example, if the device has the latest security patch installed and no malware is detected, D v The value is 1; if the device has unpatched security vulnerabilities, it may be exploited maliciously. v The value is 3.

[0084] This module determines the risk level of each access request.

[0085] Based on the risk assessment level, the trust level of users and devices is dynamically adjusted. The trust level is divided into multiple levels (such as high, medium, and low). Different trust levels correspond to different access control policies. When abnormal behavior or increased risk factors are detected, the trust level of the relevant users or devices is lowered, and adaptive access authorization information is generated, triggering stricter access restrictions and security checks.

[0086] Access authorization decision module: Determines whether to allow access to specific resources based on the trust value of the user or device, the sensitivity level of the network resource to be accessed, and the permission level of the user or device itself, thereby achieving refined access control. This module involves the access authorization decision algorithm, which is formulated as follows:

[0087]

[0088] Where: A r Indicates the access authorization result for resource r, and its value is allow or deny.

[0089] T u Quantify the value of trust.

[0090] P r The sensitivity level of the network resource being accessed measures the importance and confidentiality of the network resource. For example, a company might set core business secrets to the Confidential level, corresponding to a sensitivity level of 3, and general internal documents to the Normal level, corresponding to a sensitivity level of 1.

[0091] C u This is the user's permission level, reflecting the scope of operations a user or device has within the enterprise network. For example, an administrator user might have the highest permission level, 3, allowing them to access and operate most resources; a regular user might have permission level 1, limiting them to accessing specific, non-sensitive resources.

[0092] θ1 and θ2 are thresholds and are pre-set judgment criteria.

[0093] When T u When ≥θ1, it means that the trust level of the user or device has reached a certain level. At the same time, when C u ≥Pr -θ2 means the user or device's permission level is sufficient to access the resource. Access is granted only when both conditions are met.

[0094] For example, if θ1 is set to 0.6 and θ2 is set to 1, for a resource with a sensitivity level of 2, access to the resource is allowed only when the user or device's trust value is not less than 0.6 and the permission level is not less than 1 (i.e., ordinary user and above).

[0095] Network security risk assessment module: It is used to conduct real-time risk assessment in the network based on the characteristics of network attack behavior, asset importance and potential losses to obtain network security risk assessment values and classify network security risks into low risk, medium risk or high risk based on the network security risk assessment values. This module involves a network security risk assessment algorithm, the formula is:

[0096] R t =α×A t +β×I a +γ×L p

[0097] Where: R t is the risk level of the network security incident at time t, and the risk level is [1,5], where 1 represents low risk, which means that the security incident has little impact on the enterprise network and the system can cope with it to a certain extent; 5 represents high risk, indicating that the security incident has posed a serious threat to the enterprise network and may even cause significant losses such as business interruption and data leakage.

[0098] α, β, and γ are weight coefficients, the sum of which is 1. They need to be set according to the company's network security strategy and actual situation. For example, if the company attaches great importance to the direct impact of attacks on the network, α may be set to 0.4; if the company's core assets are extremely valuable and asset protection is particularly important, β can be set to 0.3; if the company is extremely sensitive to potential losses, γ can be set to 0.3.

[0099] A t This is a quantitative score for the behavioral characteristics of network attacks, comprehensively considering multiple dimensions such as attack type, attack intensity, and attack duration. Different attack types present significantly different threat levels. For example, a distributed denial of service (DDoS) attack, which exhausts network bandwidth or overloads server resources through a large number of traffic requests, rendering normal services inaccessible, would be assigned a score of 4 due to its high attack intensity. A standard port scan attack, on the other hand, primarily probes network ports in an attempt to identify vulnerable targets. Its attack intensity is relatively low, resulting in a score of 2. Furthermore, the longer the attack lasts, the greater the damage and potential risk to the network, and the higher the score.

[0100] I a This rating is used to assess the importance of assets affected by security incidents, with a range of [1, 3]. For enterprises, core business servers carry out critical business operations, such as transaction processing servers for e-commerce companies and accounting servers for financial institutions. Databases store core enterprise data, such as customer information and financial data. Damage to these assets would have a devastating impact on enterprise operations, so their importance is rated 3. Ordinary office terminals, primarily used for daily work, are relatively less important, receiving a rating of 1.

[0101] L p Potential losses are assessed by comprehensively considering factors such as business interruption losses, data leakage losses, and reputational damage. Business interruption losses can be assessed by estimating revenue losses and recovery costs during the interruption period. Data leakage losses require consideration of data sensitivity, recovery costs, and potential legal damages. Reputational damage is more difficult to quantify but can be estimated based on industry experience and the impact of similar incidents. This comprehensive assessment of these potential losses results in a score ranging from 1 to 3. For example, if a security incident could disrupt a company's core business for several hours, resulting in significant order loss and leaking a significant amount of sensitive customer information, potentially leading to high compensation costs and severe reputational damage, the potential loss score could be set to 3.

[0102] This module also divides cybersecurity risks into low risk (R t =1 or 2), medium risk (R t =3) or high risk (R t =4 or 5).

[0103] Network Security Emergency Response Module: When a security incident (such as an intrusion attack or data leak) is detected, the emergency response process is automatically initiated, including isolating the infected device or network segment, blocking malicious traffic, and notifying relevant personnel (such as security administrators and affected business departments). At the same time, according to the preset emergency plan, the security incident is thoroughly investigated and analyzed, measures are taken to restore the affected systems and data, and lessons are learned to improve the enterprise network security strategy. Specifically:

[0104] (1) Low risk situation (R t =1 or 2)

[0105] The low-risk emergency response strategy records the attack behavior log in detail to facilitate in-depth analysis of the attack, trace the attack source and attack methods, and provide a basis for strengthening network security protection. On the other hand, it limits the flow of the attack source to reduce its interference with the network. The flow limit formula is:

[0106]

[0107] Among them, T current is the traffic of the current attack source, T limit For example, the current attack source traffic is 100Mbps, and the risk level is R t =2, substituting into the formula we get

[0108]

[0109] That is, the attack source traffic is limited to half of the original, weakening the impact of the attack source without affecting normal business.

[0110] (2) Medium risk situation (R t =3)

[0111] On the basis of low-risk emergency measures, the honeypot system is activated. Honeypot is a security mechanism to trap attackers. It simulates the real business system, attracts the attention of attackers, and diverts the attack traffic from the real business system, thereby protecting the security of the real business system. honey Dynamic adjustment based on risk level, the calculation formula is:

[0112]

[0113] For example, when the risk level R t =3, substitute into the formula and we get:

[0114]

[0115] This means that 50% of the attack traffic will be directed to the honeypot. As the risk level increases, the diversion ratio will also increase accordingly, more effectively protecting the real business system.

[0116] (3) High risk situations (R t =4 or 5)

[0117] At this time, a high-risk emergency response strategy is implemented. Given that the security incident has posed a serious threat to the enterprise network, to prevent further losses, the connection between the attack source and the enterprise network is immediately cut off, quickly blocking the attack path. At the same time, the data backup and recovery process is initiated to ensure the security of critical data. Data backup and recovery time T restore According to the data volume and backup strategy, the calculation formula is:

[0118]

[0119] Among them, D size is the critical data volume, B rate For example, if the critical data volume is 100GB and the backup recovery rate is 10GB / h, the risk level Rt =5, substituting into the formula we get:

[0120]

[0121] That is, it is estimated that it will take 20 hours to complete the data backup and recovery work. By estimating the recovery time in advance, the enterprise can reasonably arrange the business recovery plan and reduce the losses caused by data loss.

[0122] Throughout the emergency response process, the network security status is continuously monitored in real time, and the risk level R is updated in a timely manner based on newly acquired information. t , and dynamically adjust emergency strategies to ensure that corporate network security is always under control and minimize the impact of security incidents on the company.

[0123] The network security risk assessment module works in conjunction with the network security emergency response module. When a network security incident occurs, it aims to quickly and accurately adopt appropriate emergency response strategies through scientific and dynamic risk assessment, quickly locate, isolate and deal with the source of the attack, and maximize the protection of enterprise network security and business stability.

[0124] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not limiting. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solutions, which should all be included in the scope of the claims of the present invention.

Claims

1. An enterprise network security model based on a zero-trust architecture, characterized by: It includes: User management module: used to classify users into permission levels according to their functional attributes, and dynamically generate access authorization information based on the user's functional attributes and the company's security policy; Data protection and encryption module: used to encrypt network data and classify network data according to its sensitivity to obtain the sensitivity level of network resources; Authentication module: used to authenticate access users using a multi-factor authentication mechanism; Trust quantification module: used to obtain a trust quantification value based on the trustworthiness demonstrated by the user through the identity verification process; Access authorization decision module: used to obtain access authorization decision results based on the trust quantification value, the sensitivity level of the network resource to be accessed and the user authority level.

2. The enterprise network security model based on zero trust architecture according to claim 1, characterized in that: It also includes an access risk assessment module: used to perform risk assessment based on the risk of the request source, the risk of the behavior pattern exhibited by the user through the identity authentication link, and the risk of the security status of the requesting device to obtain an access risk assessment result, and dynamically adjust the access authorization information of the access user based on the access risk assessment result. The access authorization decision result is combined with the access risk assessment result.

3. The enterprise network security model based on zero trust architecture according to claim 1 or 2, characterized in that: It also includes a network security risk assessment module: it is used to conduct real-time risk assessment in the network based on the characteristics of network attack behavior, asset importance and potential losses to obtain network security risk assessment values and classify network security risks into low risk, medium risk or high risk according to the network security risk assessment values, and adopt different network security emergency response strategies for different risks.

4. The enterprise network security model based on zero trust architecture according to claim 3, characterized in that: It also includes a cybersecurity emergency response module: including low-risk emergency strategies, medium-risk emergency strategies, and high-risk emergency strategies; If the network security risk is low, the low-risk emergency strategy records the network attack behavior log and restricts the traffic of the attack source; If the network security risk is medium, the medium-risk emergency strategy will guide part of the network attack traffic to the honeypot system on the basis of the low-risk emergency strategy to protect the real business system; If the network security risk is high, the high-risk emergency response strategy immediately cuts off the connection between the attack source and the network and initiates the data backup and recovery process.

5. The enterprise network security model based on zero trust architecture according to claim 1, characterized in that: It also includes a network segmentation module: used to segment the network and set up security devices between the segments.

6. The enterprise network security model based on zero trust architecture according to claim 1, characterized in that: The trust quantification algorithm in the trust quantification module is: T u =ω1×F1(a1,a2,…,a n )+ω2×F2(b1,b2,…,b m ) Where: T u It is a trust quantification value between 0 and 1, where 0 means completely untrustworthy and 1 means highly trustworthy; F1(a1,a2,…,a n ) is the weighted sum of the scores of each identity verification factor; F2(b1,b2,…,b m ) is obtained by statistical analysis of behavioral data in the identity verification process; ω1 is the weight of the identity verification factor; ω2 is the weight of the behavioral analysis factor in the identity verification phase; ω1+ω2=1.

7. The enterprise network security model based on zero trust architecture according to claim 6, characterized in that: The access authorization decision algorithm of the access authorization decision module is: Where: Tu is the trust quantification value; C u The user authority level, where the administrator user has the highest authority level of 3, and the ordinary user authority level is 1; P r The sensitivity level of the network resource to be accessed; θ1 and θ2 are thresholds.

8. The enterprise network security model based on zero trust architecture according to claim 1, characterized in that: The access risk assessment algorithm in the access risk assessment module is: R q =I s +B p +D v Where: I s For the request source risk, if the request comes from a trusted network segment within the enterprise, I s The value is 1; if it comes from an external unknown network, I s The value is 5; B p The risk of the behavior pattern shown by the user when passing the identity verification link. Under normal behavior mode, B p The value is 1, and in abnormal behavior mode, the value ranges from 2 to 4 depending on the degree of abnormality; D v To request the device security status risk, if no malware is detected, D v The value is 1; if the device has an unpatched security vulnerability, D v The value is 3.

9. The enterprise network security model based on zero trust architecture according to claim 3, characterized in that: The network security risk assessment algorithm of the network security risk assessment module: R t =α×A t +β×I a +γ×L p Where: R t is the cybersecurity risk assessment value at time t, in [1,5], where 1 is low risk and 5 is high risk; A t is the network attack behavior characteristic at time t, and its value range is [2, 4], where 4 represents the highest network attack intensity and 2 represents the lowest network attack intensity; I a is the asset importance, with a value range of [1,3], where 3 is the most important asset and 1 is the least important asset; L p is the potential loss, and its value range is [1,3], where 3 is the maximum potential damage and 1 is the minimum potential loss; α, β, and γ are weight coefficients, and their sum is 1.

10. The enterprise network security model based on zero trust architecture according to claim 4, characterized in that: The flow rate limiting amount calculation formula for limiting the flow rate of the attack source is: Where: T limit is the flow after restriction; T current is the traffic of the network attack source at time t; R t is the network security risk assessment value at time t; The calculation formula for the honeypot diversion ratio of directing part of the network attack traffic to the honeypot system is: Where: R t is the network security risk assessment value at time t; The calculation formula for the data backup and recovery time of the startup data backup and recovery process is: Where: D size The key data volume; B rate is the backup recovery rate; R t is the network security risk assessment value at time t.

Images