Access control method, system and equipment based on multi-dimensional trust and medium

Abstract

The invention relates to the technical field of aviation authentication, in particular to an access control method, system and device based on multi-dimensional trust and a medium. Relevant data information is collected from each link of the front-end software system; carrying out trust evaluation and score calculation on the user according to a preset multi-dimensional trust grade to obtain a score of each dimension; the multi-dimensional trust grading comprises account trust grading, equipment trust grading, network trust grading and user behavior trust grading; calculating a comprehensive trust score according to the weight of the score of each dimension; and according to data information acquired in real time, periodically calculating and updating a comprehensive trust score, and according to the comprehensive trust score, setting a corresponding authority and implementing a corresponding dynamic control strategy. According to the method and the device, trust evaluation is performed on access of the user by comprehensively considering information of multiple dimensions such as the account, the equipment, the network and the user behavior, and the dynamic control strategy is adopted according to the evaluation result, so that the security of front-end software is effectively improved.

Description

Technical Field

[0001] The present disclosure relates to the field of aviation authentication technology, and in particular to an access control method, system, device, and medium based on multi-dimensional trust. Background Art

[0002] In the existing technology, traditional front-end access control methods are often relatively simple and difficult to adapt to complex and changing network environments and diverse user behaviors.

[0003] In summary, there is an urgent need for a more intelligent, flexible and secure front-end access control strategy to ensure the security and stability of the front-end software system. Summary of the Invention

[0004] In response to the above problems, the present disclosure provides an access control method, system, device and medium based on multi-dimensional trust.

[0005] In a first aspect, a multi-dimensional trust-based access control method comprises: Collect data related to user accounts, devices, networks, and user behaviors from all aspects of the front-end software system; Based on the collected data and information, the user's trust is evaluated and scored according to the pre-set multi-dimensional trust grading system to obtain the score of each dimension. The multi-dimensional trust grading system includes: account trust grading, device trust grading, network trust grading, and user behavior trust grading. The scores of each dimension are calculated according to the weights to obtain a comprehensive trust score. Based on the data information collected in real time, the comprehensive trust score is calculated and updated periodically, and according to the comprehensive trust score, the corresponding permissions are set and the corresponding dynamic control strategy is implemented.

[0006] Furthermore, data information related to user accounts, devices, networks, and user behavior, including: Connect with the account management system to obtain account real-name authentication status and password setting details; Interact with the device management system to obtain the device's MAC address, security software installation status, and unbinding records; Collect access method and login IP address information from the network access layer; Collect user operation behavior data through monitoring code embedded in the front-end software.

[0007] Furthermore, account trust grading includes: Initial grading is performed based on the user's real-name authentication status; accounts that have completed real-name authentication and have accurate information are awarded a basic account trust score; The trust level is adjusted based on the strength and usage of the login password. If any of the following conditions are met, the corresponding trust score will be increased based on the account's basic trust score: An account that meets the front-end account and password standards; Accounts using multi-factor authentication.

[0008] Furthermore, accounts that meet the front-end account and password standards must also meet the following conditions: The password meets the minimum number of digits; The password contains letters, numbers, special characters and is different from the account name; The password is not the initial password; Passwords must be changed regularly and the most recent change must not exceed the time threshold.

[0009] Furthermore, accounts using multi-factor authentication include authentication using two or more of the following methods: Mobile phone verification code authentication; Email verification code authentication; Fingerprint recognition authentication; Face recognition authentication.

[0010] Furthermore, device trust grading includes: Manage and authenticate the MAC address of the device; devices that have been bound and logged in normally will receive a basic trust score; Adjustments are made based on the frequency of MAC address unbinding. If the number of times a non-local MAC address is unbinded exceeds the specified threshold, the corresponding score is reduced based on the basic trust score of the device. When the device has installed effective security protection software, the corresponding score will be increased based on the basic trust score of the device.

[0011] Furthermore, network trust grading includes: Evaluation is conducted based on the access method and location of the front-end software, including: For network connections accessed through a dedicated network and whose registered address is consistent with the fixed address of the connection channel identification number, the first network basic trust score is given; For public network access, when the login IP address is within the registered common address range and meets the upper limit of the number of accessible front-end software, a second network basic trust score will be given.

[0012] Furthermore, user behavior trust grading includes: Monitor user operations on the front-end software, including operation frequency, operation time, and operation path; set a basic trust score for user behavior based on historical operation behavior; When the statistical values of real-time operation behavior and historical operation behavior exceed the statistical threshold, the corresponding score is reduced based on the user behavior basic trust score.

[0013] Furthermore, the scores of multiple dimensions are weighted to calculate a comprehensive trust score, and ultimately determine the user's trust level, including: Set corresponding weights for each dimension; The comprehensive trust score is calculated by weighting and summing the scores of multiple dimensions.

[0014] Furthermore, according to the comprehensive trust score, corresponding permissions are set and corresponding dynamic control strategies are implemented, including: Several trust thresholds are set according to the comprehensive trust scores, several comprehensive trust score intervals are obtained through the trust thresholds, corresponding permissions are set based on the comprehensive trust score intervals, and corresponding dynamic control strategies are implemented.

[0015] Furthermore, according to the comprehensive trust score, corresponding permissions are set and corresponding dynamic control strategies are implemented, including: Setting a first trust threshold and a second trust threshold; the first trust threshold is greater than the second trust threshold; When the user's comprehensive trust score is higher than or equal to the first trust threshold, the user is assigned the highest access permission; When the user's comprehensive trust score is lower than the first trust threshold and higher than or equal to the second trust threshold, the user's sensitive operations are subject to secondary verification; When the user's comprehensive trust score is lower than the second trust threshold, the user's sensitive operations are secondary verified and access restriction measures are taken for the user.

[0016] In a second aspect, an access control system based on multi-dimensional trust hierarchy includes: Information collection module, trust classification module and access control module; The information collection module is used to collect data related to user accounts, devices, networks, and user behaviors from various aspects of the front-end software system; The trust grading module is used to evaluate the trust of users and calculate scores based on the pre-set multi-dimensional trust grading based on the collected data information, and obtain scores for each dimension. The multi-dimensional trust grading includes: account trust grading, device trust grading, network trust grading, and user behavior trust grading. The scores of each dimension are calculated according to the weights to obtain a comprehensive trust score. The access control module is used to periodically calculate and update the comprehensive trust score based on the data information collected in real time, and set corresponding permissions and implement corresponding dynamic control strategies based on the comprehensive trust score.

[0017] Furthermore, data information related to user accounts, devices, networks, and user behavior, including: Connect with the account management system to obtain account real-name authentication status and password setting details; Interact with the device management system to obtain the device's MAC address, security software installation status, and unbinding records; Collect access method and login IP address information from the network access layer; Collect user operation behavior data through monitoring code embedded in the front-end software.

[0018] Furthermore, account trust grading includes: Initial grading is performed based on the user's real-name authentication status; accounts that have completed real-name authentication and have accurate information are awarded a basic account trust score; The trust level is adjusted based on the strength and usage of the login password. If any of the following conditions are met, the corresponding trust score will be increased based on the account's basic trust score: An account that meets the front-end account and password standards; Accounts using multi-factor authentication.

[0019] Furthermore, accounts that meet the front-end account and password standards must also meet the following conditions: The password meets the minimum number of digits; The password contains letters, numbers, special characters and is different from the account name; The password is not the initial password; Passwords must be changed regularly and the most recent change must not exceed the time threshold.

[0020] Furthermore, accounts using multi-factor authentication include authentication using two or more of the following methods: Mobile phone verification code authentication; Email verification code authentication; Fingerprint recognition authentication; Face recognition authentication.

[0021] Furthermore, device trust grading includes: Manage and authenticate the MAC address of the device; devices that have been bound and logged in normally will receive a basic trust score; Adjustments are made based on the frequency of MAC address unbinding. If the number of times a non-local MAC address is unbinded exceeds the specified threshold, the corresponding score is reduced based on the basic trust score of the device. When the device has installed effective security protection software, the corresponding score will be increased based on the basic trust score of the device.

[0022] Furthermore, network trust grading includes: Evaluation is conducted based on the access method and location of the front-end software, including: For network connections accessed through a dedicated network and whose registered address is consistent with the fixed address of the connection channel identification number, the first network basic trust score is given; For public network access, when the login IP address is within the registered common address range and meets the upper limit of the number of accessible front-end software, a second network basic trust score will be given.

[0023] Furthermore, user behavior trust grading includes: Monitor user operations on the front-end software, including operation frequency, operation time, and operation path; set a basic trust score for user behavior based on historical operation behavior; When the statistical values of real-time operation behavior and historical operation behavior exceed the statistical threshold, the corresponding score is reduced based on the user behavior basic trust score.

[0024] Furthermore, the scores of multiple dimensions are weighted to calculate a comprehensive trust score, and ultimately determine the user's trust level, including: Set corresponding weights for each dimension; The comprehensive trust score is calculated by weighting and summing the scores of multiple dimensions.

[0025] Furthermore, according to the comprehensive trust score, corresponding permissions are set and corresponding dynamic control strategies are implemented, including: Several trust thresholds are set according to the comprehensive trust scores, several comprehensive trust score intervals are obtained through the trust thresholds, corresponding permissions are set based on the comprehensive trust score intervals, and corresponding dynamic control strategies are implemented.

[0026] Furthermore, according to the comprehensive trust score, corresponding permissions are set and corresponding dynamic control strategies are implemented, including: Setting a first trust threshold and a second trust threshold; the first trust threshold is greater than the second trust threshold; When the user's comprehensive trust score is higher than or equal to the first trust threshold, the user is assigned the highest access permission; When the user's comprehensive trust score is lower than the first trust threshold and higher than or equal to the second trust threshold, the user's sensitive operations are subject to secondary verification; When the user's comprehensive trust score is lower than the second trust threshold, the user's sensitive operations are secondary verified and access restriction measures are taken for the user.

[0027] According to a third aspect, an electronic device includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus; a memory storing a computer program; The processor is used to implement the above-mentioned access control method based on multi-dimensional trust when executing the computer program stored in the memory.

[0028] In a fourth aspect, a computer-readable storage medium stores a computer program, which, when executed by a processor, implements the above-mentioned access control method based on multi-dimensional trust.

[0029] The present disclosure includes at least the following beneficial effects: This disclosure conducts a trust assessment on user access by comprehensively considering information from multiple dimensions such as account, device, network, and user behavior, and adopts dynamic control strategies based on the assessment results, thereby effectively improving the security of front-end software.

[0030] This disclosure significantly improves security and achieves a balance between user experience and security. It is highly adaptable and can effectively prevent internal threats.

[0031] Other features and advantages of the present disclosure will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present disclosure. The purpose and other advantages of the present disclosure can be achieved and obtained through the structures indicated in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0033] Figure 1 This is a flow chart of the control method according to an embodiment of the present disclosure; Figure 2 A schematic diagram of a trust hierarchy system according to an embodiment of the present disclosure; Figure 3 A schematic diagram of trust evaluation and dynamic control according to an embodiment of the present disclosure; Figure 4 This is a flow chart of the dynamic control strategy of the embodiment of the present disclosure; Figure 5 This is a schematic diagram of the control system architecture of an embodiment of the present disclosure; Figure 6 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0034] To make the objectives, technical solutions, and advantages of the embodiments of the present disclosure more clear, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present disclosure without making any creative efforts shall fall within the scope of protection of the present disclosure.

[0035] The terms of this disclosure are explained as follows: A MAC address, short for Media Access Control Address, is a unique identifier used to identify network devices. In network communications, each network device (such as computers, mobile phones, routers, etc.) is assigned a globally unique MAC address, which is usually burned into the device's network interface card (NIC) by the device manufacturer. During network data transmission, the MAC address is used to uniquely identify the device sending and receiving data within a local area network (LAN) so that the data can reach the target device accurately. In this disclosure, the management and authentication of MAC addresses are used to achieve a hierarchical trust assessment of devices.

[0036] Multi-factor authentication is an identity verification method that combines two or more different authentication factors to confirm a user's identity, thereby improving authentication security. These authentication factors are generally categorized as something the user knows (such as a password, PIN code, etc.), something the user has (such as a mobile phone, email, hardware token, etc.), and the user's biometrics (such as fingerprint, face, iris, etc.). In this disclosure, multi-factor authentication methods include various combinations such as account password and mobile phone / email verification code authentication, and support at least one biometric authentication method. Users are required to perform biometric authentication regularly to enhance the security and trust level of their accounts.

[0037] The public network refers to network infrastructure built and operated by network service providers such as telecom operators and open to the public. Users can access various internet resources and services, such as websites, email servers, and online applications, through the public network. In the disclosed front-end access control method, users accessing front-end software through the public network must strictly manage and monitor their login IP addresses to prevent various security threats from the public network, such as hacker attacks and malware intrusions, and to ensure the security and stability of the front-end software system.

[0038] A private network, also known as a dedicated network, is a dedicated communication network built for a specific organization, institution, or user group. It is relatively isolated from the public network and offers enhanced security and confidentiality. It is typically used to transmit sensitive information and perform critical business operations, such as internal corporate office networks, financial institution transaction networks, and government administrative networks. In this disclosure, users accessing front-end software through a private network will be assigned a higher trust score during the network trust grading assessment based on the private network's access characteristics and security requirements, such as the registration of fixed IP addresses and the accuracy of connection channel identification numbers. This ensures the secure and stable operation of the front-end software within the private network environment.

[0039] In the disclosed front-end access control method, the trust threshold is a key indicator used to categorize user trust levels, including a high trust threshold and a low trust threshold. After the system calculates the user's comprehensive trust score based on a pre-set trust assessment algorithm, it compares this score with the trust threshold to determine the user's trust level and implements a corresponding dynamic control strategy accordingly. When the comprehensive trust score is higher than the high trust threshold, the user is granted more relaxed access rights. When the comprehensive trust score is lower than the low trust threshold, the system will implement access restriction measures to ensure the security of the front-end software system and prevent potential security threats and malicious behavior.

[0040] Secondary verification refers to the system requiring users to provide additional verification information for sensitive operations or at specific trust levels after completing initial login verification. This further confirms the user's identity and the legitimacy of the operation, thereby enhancing system security. In the dynamic control strategy disclosed herein, when a user's comprehensive trust score is in the medium range, users will be required to re-enter a verification code or undergo biometric authentication for sensitive operations such as modifying or deleting important data. This prevents illegal operations caused by account and password leaks, protecting the security of critical data and resources within the front-end software system.

[0041] like Figure 1 As shown, a multi-dimensional trust-based access control method includes: S101, collects data related to user accounts, devices, networks, and user behaviors from various aspects of the front-end software system; S102: Based on the collected data, the user is evaluated and scored according to a pre-defined multi-dimensional trust hierarchy to obtain a score for each dimension. The multi-dimensional trust hierarchy includes: account trust hierarchy, device trust hierarchy, network trust hierarchy, and user behavior trust hierarchy. The scores for each dimension are weighted to calculate a comprehensive trust score. S103, periodically calculating and updating the comprehensive trust score based on the data information collected in real time, setting corresponding permissions and implementing corresponding dynamic control strategies based on the comprehensive trust score.

[0042] The specific implementation is as follows: In the front-end software system, information on accounts, devices, networks, and user behaviors is collected and analyzed, and trust scores are calculated and graded according to preset rules and algorithms.

[0043] When a user logs into the front-end software, the trust grading module first verifies and evaluates the user's account, including checking the real-name authentication status, password strength, and multi-factor authentication status.

[0044] At the same time, the MAC address authentication and trust score adjustment of the device used by the user to log in are performed, and the security features and unbinding records of the device are checked.

[0045] For network access, verify whether the access method (public network / private network) and login IP address meet the filing requirements, and adjust the network trust score based on daily monitoring results.

[0046] While users are operating the front-end software, user behavior is continuously monitored and the user behavior trust score is updated in real time.

[0047] Based on the comprehensive trust score, the user's access rights and control policies are dynamically adjusted to ensure a balance between system security and user experience.

[0048] The security audit module records all events related to trust classification and access control in real time, and stores and manages them in accordance with regulations so that they can be traced and analyzed when security incidents occur.

[0049] like Figure 2 As shown, the account trust level is: Initial grading is performed based on the user's real-name authentication status. Accounts that have completed real-name authentication and have accurate information receive a basic trust score.

[0050] The trust level is further adjusted based on the strength and usage of the login password. Accounts that meet the front-end account password standards will have their trust score increased accordingly. For example, the minimum password is 8 characters, contains letters, numbers, and special characters, is different from the account name, is not the initial password, and is regularly changed for no more than 90 days.

[0051] For accounts that use multi-factor authentication, a higher level of trust is given, for example, two or more factors of authentication such as account password plus mobile phone / email verification code authentication, and support for either fingerprint recognition or face recognition biometric authentication methods to ensure that users perform biometric authentication at least once a year.

[0052] like Figure 2 As shown, the device trust level is: Manage and authenticate the MAC address of the device. Devices that have been bound and logged in normally will receive a certain trust score.

[0053] Adjustments are made based on the frequency of MAC address unbinding. Non-local MAC address unbinding is supported up to 3 times per day, and local MAC address unbinding is supported up to 99 times per day. The trust score of devices that exceed the specified number of times will be reduced.

[0054] The trust score is comprehensively evaluated by considering the security features of the device, such as whether effective security protection software is installed.

[0055] like Figure 2 As shown, network trust levels: The front-end software is evaluated based on its access method (public network / private network) and access location. A higher trust score (the first network basic trust score) is assigned to network connections that access via a private network and have an accurate fixed address for the registered connection channel identification number.

[0056] When accessing the public network, if the login IP address is within the registered commonly used address range and meets the upper limit on the number of front-end software that can be accessed by each non-fixed IP address or fixed IP address, a corresponding trust score (second network basic trust score) will be given. For example, for the public network: the upper limit for each non-fixed IP address is 9, and the upper limit for each fixed IP address is 99; for the private network: the upper limit for each fixed IP address is 999.

[0057] Daily monitoring of login IP addresses also affects the network trust level. If the registered address is inconsistent with the login IP address, the trust score will be adjusted based on the implementation of security measures such as warnings and access restrictions.

[0058] like Figure 2 As shown, user behavior trust level: Monitor user operations on the front-end software, such as operation frequency / number, operation time, operation path, etc. Abnormally frequent operations or behaviors that do not conform to normal usage patterns will reduce the trust score.

[0059] Behaviors involving important system operations, such as changes in permissions and abnormal use of system resources, are monitored and evaluated, and the trust level is adjusted based on their legality and rationality.

[0060] like Figure 3 As shown, the trust evaluation algorithm: Set corresponding weights for the trust level of each dimension, for example, the account trust weight is 0.4, the device trust weight is 0.2, the network trust weight is 0.2, and the user behavior trust weight is 0.2. The weights can be adjusted and optimized according to actual conditions.

[0061] Based on the user's performance in each dimension, a comprehensive trust score is calculated: Comprehensive Trust Score = Account Trust Score × 0.4 + Device Trust Score × 0.2 + Network Trust Score × 0.2 + User Behavior Trust Score × 0.2.

[0062] like Figure 4 As shown, when the comprehensive trust score is higher than the set high trust threshold (first trust threshold), the user can obtain more relaxed access rights, such as allowing access to more functional modules, increasing data transmission rate, etc.

[0063] If the comprehensive trust score is in the medium range (between the first trust threshold and the second trust threshold), while maintaining basic access rights, some sensitive operations will be subject to secondary verification. For example, operations such as modification and deletion of important data require re-entry of the verification code or biometric authentication.

[0064] When the comprehensive trust score is lower than the low trust threshold (the second trust threshold), access restriction measures are taken, such as temporarily freezing the account, restricting the login IP address, reducing the data transmission rate, etc., and a security reminder is issued to the user, requiring the user to take corresponding measures to improve the trust level, such as changing the password, re-authenticating the device, etc.

[0065] This disclosure significantly enhances security by comprehensively and accurately identifying potential security risks through a multi-dimensional trust assessment (account, device, network, and user behavior). Compared to traditional single-dimensional access control methods, this solution provides a more detailed analysis of user trustworthiness, effectively preventing security vulnerabilities caused by a single compromise. For example, when relying solely on an account and password for login, a compromised password could lead to malicious intrusion. However, by integrating multiple factors, including device, network, and user behavior, even if a password is compromised, access will be promptly restricted if the login device is abnormal, originates from an unfamiliar network, or the user's behavior is inconsistent with established practices. This significantly enhances the security of the front-end software system. Dynamic control strategies flexibly adjust access rights based on the comprehensive trust score. For users with low trust levels, timely restrictive measures, such as account freezing and IP address restriction, can be implemented to quickly respond to security threats, prevent unauthorized access and malicious activity, and reduce the likelihood and potential losses of security incidents.

[0066] The present disclosure achieves a balance between user experience and security, and does not simply emphasize security while excessively restricting users' normal use. When the trust score is high, users are provided with relaxed access rights, such as access rights to more functional modules and higher data transmission rates, ensuring that users can use the front-end software efficiently and conveniently, thereby improving user experience. Even at a medium trust score, the setting of the secondary verification is relatively reasonable, and only additional verification is performed for sensitive operations, which not only ensures the security of important data and operations, but also does not bring too many cumbersome verification processes to users, avoiding affecting the user's normal operating process and usage experience, and achieving a good balance between security and ease of use.

[0067] The present disclosure is highly flexible and adaptable, and the weights in the trust assessment algorithm can be adjusted and optimized according to actual conditions, and can adapt to the security requirements and usage scenarios of different front-end software systems. For example, for some financial front-end software that has extremely high requirements for account security, the account trust weight can be appropriately increased; and for some internal enterprise-specific front-end software that is more sensitive to device security, the device trust weight can be increased, so that the system can be flexibly configured according to specific circumstances and better respond to diverse security challenges. The multi-dimensional trust grading system covers a variety of factors that may affect the security of front-end access, and the grading rules of each dimension have certain scalability and adaptability. With the development of network technology and changes in user behavior patterns, such as the emergence of new network access methods or changes in user operating habits, the grading rules of the corresponding dimensions can be easily updated and supplemented to ensure that the front-end access control method always remains effective and adaptable without the need for large-scale changes to the entire system architecture.

[0068] This disclosure effectively prevents internal threats. User behavior trust grading not only focuses on external malicious attacks, but also monitors and evaluates abnormal operations by internal users. Within an enterprise or organization, employees may perform abnormal system operations due to errors or malicious intent. By evaluating user behavior trust, these abnormal behaviors can be discovered and restricted in a timely manner, preventing security risks that may be posed by internal personnel and providing comprehensive protection for the enterprise's information assets.

[0069] like Figure 5 As shown, an access control system based on multi-dimensional trust hierarchy includes: Information collection module, trust classification module and access control module; The information collection module is used to collect data related to user accounts, devices, networks, and user behaviors from various aspects of the front-end software system; The trust grading module is used to evaluate the trust of users and calculate scores based on the pre-set multi-dimensional trust grading based on the collected data information, and obtain scores for each dimension. The multi-dimensional trust grading includes: account trust grading, device trust grading, network trust grading, and user behavior trust grading. The scores of each dimension are calculated according to the weights to obtain a comprehensive trust score. The access control module is used to periodically calculate and update the comprehensive trust score based on the data information collected in real time, and set corresponding permissions and implement corresponding dynamic control strategies based on the comprehensive trust score.

[0070] The specific implementation is as follows: The information collection module is responsible for collecting data related to user accounts, devices, networks, and user behavior from various aspects of the front-end software system. For example, it connects with the account management system to obtain account real-name authentication status and password setting details; interacts with the device management system to obtain the device's MAC address, security software installation status, and unbinding records; collects network information such as access method (public / private network) and login IP address from the network access layer; and collects user operation behavior data such as operation frequency, operation time, operation path, and behavior records involving important system operations through monitoring code embedded in the front-end software.

[0071] The Trust Grading Module assesses user trust and calculates scores based on the data collected by the Information Collection Module, according to a pre-defined multi-dimensional trust grading system. This module includes submodules for account trust grading, device trust grading, network trust grading, and user behavior trust grading. Each submodule implements the trust score determination rules for its own dimension, aggregates the scores for each dimension, and calculates a comprehensive trust score based on the weights to ultimately determine the user's trust level.

[0072] The access control module implements dynamic control strategies based on the user trust level determined by the trust grading module. When the user's comprehensive trust score is higher than the high trust threshold, the module assigns the user more relaxed access permissions, such as allowing access to more functional modules and increasing data transmission rates. If the comprehensive trust score is in the medium range, the module performs secondary verification on sensitive user operations, such as requiring the re-entry of a verification code or biometric authentication for operations such as modifying or deleting important data. When the comprehensive trust score is lower than the low trust threshold, access restriction measures are implemented, such as temporarily freezing the account, restricting login IP addresses, and reducing data transmission rates. The module also issues a security alert to the user, requiring the user to take appropriate measures to increase their trust level.

[0073] like Figure 6As shown, the present disclosure provides an electronic device, including a processor 601, a communication interface 602, a memory 603 and a communication bus 604, wherein the processor 601, the communication interface 602 and the memory 603 communicate with each other through the communication bus 604; Memory 603, storing computer programs; The processor 601 is configured to implement the above method when executing the computer program stored in the memory 603 .

[0074] The present disclosure provides a computer-readable storage medium storing a computer program, which implements the above method when executed by a processor.

[0075] The computer-readable storage medium may be included in the device / apparatus described in the above embodiments, or may exist independently without being incorporated into the device / apparatus. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of the present disclosure.

[0076] According to embodiments of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, such as, but not limited to, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0077] Although the present disclosure has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure.

Claims

1. An access control method based on multi-dimensional trust, characterized in that: The method comprises: Collect data related to user accounts, devices, networks, and user behaviors from all aspects of the front-end software system; Based on the collected data and information, the user's trust is evaluated and scored according to the pre-set multi-dimensional trust grading system to obtain the score of each dimension. The multi-dimensional trust grading system includes: account trust grading, device trust grading, network trust grading, and user behavior trust grading. The scores of each dimension are calculated according to the weights to obtain a comprehensive trust score. Based on the data information collected in real time, the comprehensive trust score is calculated and updated periodically, and according to the comprehensive trust score, the corresponding permissions are set and the corresponding dynamic control strategy is implemented.

2. The access control method based on multi-dimensional trust according to claim 1, characterized in that: Data related to user accounts, devices, networks, and user behavior, including: Connect with the account management system to obtain account real-name authentication status and password setting details; Interact with the device management system to obtain the device's MAC address, security software installation status, and unbinding records; Collect access method and login IP address information from the network access layer; Collect user operation behavior data through monitoring code embedded in the front-end software.

3. The access control method based on multi-dimensional trust according to claim 1, characterized in that: Account trust level, including: Initial grading is performed based on the user's real-name authentication status; accounts that have completed real-name authentication and have accurate information are awarded a basic account trust score; The trust level is adjusted based on the strength and usage of the login password. If any of the following conditions are met, the corresponding trust score will be increased based on the account's basic trust score: An account that meets the front-end account and password standards; Accounts using multi-factor authentication; Among them, accounts that meet the front-end account and password standards must also meet the following conditions: The password meets the minimum number of digits; The password contains letters, numbers, special characters and is different from the account name; The password is not the initial password; Passwords are changed regularly and the most recent change does not exceed the time threshold; Accounts using multi-factor authentication include those using two or more of the following authentication methods: Mobile phone verification code authentication; Email verification code authentication; Fingerprint recognition authentication; Face recognition authentication.

4. The access control method based on multi-dimensional trust according to claim 1, characterized in that: Device trust rating, including: Manage and authenticate the MAC address of the device; devices that have been bound and logged in normally will receive a basic trust score; Adjustments are made based on the frequency of MAC address unbinding. If the number of times a non-local MAC address is unbinded exceeds the specified threshold, the corresponding score is reduced based on the basic trust score of the device. When the device has installed effective security protection software, the corresponding score will be increased based on the basic trust score of the device.

5. The access control method based on multi-dimensional trust according to claim 1, characterized in that: Network trust levels, including: Evaluation is conducted based on the access method and location of the front-end software, including: For network connections accessed through a dedicated network and whose registered address is consistent with the fixed address of the connection channel identification number, the first network basic trust score is given; For public network access, when the login IP address is within the registered common address range and meets the upper limit of the number of accessible front-end software, a second network basic trust score will be given.

6. The access control method based on multi-dimensional trust according to claim 1, characterized in that: User behavior trust rating, including: Monitor user operations on the front-end software, including operation frequency, operation time, and operation path; set a basic trust score for user behavior based on historical operation behavior; When the statistical values of real-time operation behavior and historical operation behavior exceed the statistical threshold, the corresponding score is reduced based on the user behavior basic trust score.

7. The access control method based on multi-dimensional trust according to claim 1, characterized in that: The multi-dimensional scores are weighted to calculate a comprehensive trust score, ultimately determining the user's trust level, including: Set corresponding weights for each dimension; The comprehensive trust score is calculated by weighting and summing the scores of multiple dimensions.

8. The access control method based on multi-dimensional trust according to claim 1, characterized in that: According to the comprehensive trust score, set corresponding permissions and implement corresponding dynamic control strategies, including: Several trust thresholds are set according to the comprehensive trust scores, several comprehensive trust score intervals are obtained through the trust thresholds, corresponding permissions are set based on the comprehensive trust score intervals, and corresponding dynamic control strategies are implemented.

9. The access control method based on multi-dimensional trust according to claim 8, characterized in that: According to the comprehensive trust score, set corresponding permissions and implement corresponding dynamic control strategies, including: Setting a first trust threshold and a second trust threshold; the first trust threshold is greater than the second trust threshold; When the user's comprehensive trust score is higher than or equal to the first trust threshold, the user is assigned the highest access permission; When the user's comprehensive trust score is lower than the first trust threshold and higher than or equal to the second trust threshold, the user's sensitive operations are subject to secondary verification; When the user's comprehensive trust score is lower than the second trust threshold, the user's sensitive operations are secondary verified and access restriction measures are taken for the user.

10. An access control system based on multi-dimensional trust hierarchy, characterized in that: include: Information collection module, trust classification module and access control module; The information collection module is used to collect data related to user accounts, devices, networks, and user behaviors from various aspects of the front-end software system; The trust grading module is used to evaluate the trust of users and calculate scores according to the pre-set multi-dimensional trust grading based on the collected data information, and obtain the scores of each dimension; Multi-dimensional trust grading, including account trust grading, device trust grading, network trust grading, and user behavior trust grading; the scores of each dimension are calculated according to the weight to obtain a comprehensive trust score; The access control module is used to periodically calculate and update the comprehensive trust score based on the data information collected in real time, and set corresponding permissions and implement corresponding dynamic control strategies based on the comprehensive trust score.

11. An electronic device, characterized in that: The processor, the communication interface, the memory and the communication bus are connected to each other via the communication bus. a memory storing a computer program; A processor is configured to implement an access control method based on multi-dimensional trust according to any one of claims 1 to 9 when executing a computer program stored in a memory.

12. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the access control method based on multi-dimensional trust according to any one of claims 1 to 9 is implemented.

Images