Security gateway access strategy optimization method and system based on zero-trust architecture
By constructing a security gateway access policy based on a zero-trust architecture, the problems of resource sensitivity quantification and abnormal behavior identification in dynamic access scenarios in traditional network security protection models are solved, achieving a balance between security and system complexity, and enhancing the security and unpredictability of the system.
Patent Information
- Application Number
- CN202511332502.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-18
- Publication Date
- 2025-12-09
AI Technical Summary
Traditional boundary-based network security protection models are ill-suited to cope with dynamic and ever-changing access scenarios, cannot quantify the sensitivity of resources, rely too heavily on empirical rules for anomaly identification, and are too effective for policy optimization. Existing policy optimization methods are ineffective, cannot balance security and system complexity, and are easily circumvented by attackers.
We construct a security gateway access policy based on a zero-trust architecture. By collecting access behavior information, we establish a spatiotemporal correlation graph, quantify resource sensitivity, use a Brownian motion model to identify abnormal behavior, and model access control as an attack-defense game. We optimize the policy combination through the principle of minimum entropy increase and use quantum effects to increase unpredictability.
The system employs technical means to address existing technical issues through security and system technology applications based on a zero-trust architecture. This approach achieves the desired technical effects, including dynamic optimization of access policies, quantification of resource sensitivity, identification of abnormal behavior, a balance between security and system complexity, and enhanced system security.
Smart Images
Figure CN121098592A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of network security technology, specifically relating to a method and system for optimizing security gateway access policies based on a zero-trust architecture. Background Technology
[0002] Traditional boundary-based network security protection models face severe challenges, mainly due to the following issues: static access control policies struggle to cope with dynamic and ever-changing access scenarios and cannot be flexibly adjusted according to the spatiotemporal characteristics of access behavior; there is a lack of quantitative assessment methods for resource sensitivity, making it difficult to achieve risk-based, granular access control; abnormal behavior identification methods rely too heavily on empirical rules and cannot effectively capture the evolution of behavioral patterns; existing policy optimization methods often overemphasize security, neglecting the balance between system complexity and operational costs; and deterministic access control policies are easily predicted and circumvented by attackers, posing a risk of being bypassed.
[0003] Zero Trust architecture, as a new generation of network security framework, emphasizes the concept of "never trust, always verify". However, it still lacks a systematic solution for the dynamic optimization of access policies. Especially in complex and ever-changing business environments, how to build accurate behavioral models based on the spatiotemporal characteristics of access behavior, achieve quantitative assessment of resource sensitivity, and balance system complexity while ensuring security are all key issues that urgently need to be addressed. Summary of the Invention
[0004] To address the aforementioned issues, this invention proposes a method and system for optimizing security gateway access policies based on a zero-trust architecture. This method dynamically optimizes access policies according to the spatiotemporal characteristics of access behavior, effectively controlling complexity while ensuring system security. The specific technical solution is as follows:
[0005] In a first aspect, the present invention provides a method for optimizing security gateway access policies based on a zero-trust architecture, the method comprising the following steps:
[0006] Collect access behavior information of the accessing entities, which includes at least: entity identification information, timestamp, geographic location coordinates and target resources; treat each access behavior as a vertex of a graph, establish directed edges based on the association relationship of the access sequence, calculate edge weights through access frequency and spatiotemporal distance, and construct a spatiotemporal association graph based on access behavior;
[0007] Based on the spatiotemporal correlation graph, the probability distribution of resource access is calculated to obtain the information entropy of the resource access link and the conditional entropy under known resource access conditions. The change in conditional entropy reflects the degree of impact of the target resource being accessed on the overall uncertainty of the system, thereby quantifying the sensitivity of the resource.
[0008] The access behavior is treated as a continuous time series, and the Brownian motion model is used to calculate the drift coefficient of the access behavior to build a baseline for abnormal behavior identification.
[0009] The access control process is modeled as a zero-sum game between attackers and defenders. The defender chooses an access control strategy at each decision stage, while the attacker chooses a breach strategy. By balancing security, overhead, and complexity through the game payoff function, and based on the principle of minimum entropy increase, the combination of access strategies that minimizes the increase in system complexity is selected to optimize the security gateway access strategy.
[0010] Furthermore, the spatiotemporal relationship graph of access behavior is represented as follows: ,in: For a set of vertices, each vertex A visit event represents an event and includes the following attributes: a unique identifier of the visitor. Identifier of the accessed resource timestamp of the access The geographical coordinates of the location where the visit occurred E is a set of directed edges, where the direction of the edges indicates the order of visits. Represents edge weight, vertex weight To the top Edge weights between The calculation method is as follows: ,in, As vertex arrive The access transfer frequency, i.e., the frequency of access transfer per unit time. arrive Number of visits; For the normalized time interval, , for, As vertex arrive The maximum time interval within the observation period, Indicates an access event The timestamp of the occurrence Indicates the timestamp of the access event j; For normalized spatial distance, , Indicates an access event The distance from the geographical location where the event occurred to the data center. Indicates an access event The distance from the geographical location where the event occurred to the data center. This represents the maximum spatial distance allowed by the system.
[0011] Furthermore, the method for calculating the information entropy of the resource access link is as follows:
[0012] For resources Its access probability ;in, Representation and Resources The sum of the weights of all relevant access paths. This represents the sum of the weights of all access paths in the entire system; Indicates that the target of the access is a resource. The set of vertices, Spatiotemporal correlation diagram The set of vertices in; Indicates resources For a specific access event vertex of the target, Representing the spatiotemporal relationship graph Any vertex in the array represents any access event; Indicates from vertex To the top Edge weights; and Represent any two vertices in the spatiotemporal relation graph G. This represents the edge weight between two vertices;
[0013] Information entropy of resource access links Represented as: ;
[0014] Calculate the known access resource as Conditional entropy under the given conditions: .
[0015] Then resources sensitivity The quantification formula is: ,in, This represents the maximum access probability among all resources in the system.
[0016] Furthermore, in the Brownian motion model, the identification information for each accessing entity... Its access behavior sequence is modeled as follows: ,in, express The access behavior feature vector at each time step, including normalized spatiotemporal distance. and access frequency , The drift coefficient represents the trend of behavior. Volatility represents the uncertainty of behavior; For standard Wiener process;
[0017] Drift coefficient The calculation method is as follows: ;
[0018] Volatility The calculation method is as follows: .
[0019] Furthermore, the method for constructing the abnormal behavior identification baseline includes: for the access subject The resource access sequence, combined with resources Access probability Then the confidence interval for normal behavior is expressed as:
[0020] ;
[0021] in, For confidence level parameters;
[0022] The quantitative indicators for the degree of abnormality are: .
[0023] Furthermore, by balancing security, overhead, and complexity through a game theory payoff function, and based on the principle of minimum entropy increase, the combination of access strategies that minimizes the increase in system complexity is selected. This optimization of the security gateway access strategy is achieved using a multi-stage game theory optimization model. In this model, the payoff function for stage t is defined as:
[0024] ;
[0025] in, For resources The strategy combination provides safe returns. For the overhead of defense strategies, For system complexity;
[0026] The method for calculating the safe return of a strategy portfolio is as follows: ,in, and These represent the probabilities of the attacker's and defender's strategy choices, respectively.
[0027] Furthermore, based on the principle of minimum entropy increase, the optimal defense strategy is selected at each decision stage t by solving the following optimization problem:
[0028] ;
[0029] Among them, system complexity Defined as:
[0030] .
[0031] Furthermore, the optimization method also includes: using quantum effects to generate a true random number sequence, adding random perturbations to the deterministic strategy, improving the unpredictability of access control, and enhancing system security.
[0032] Furthermore, a method to add random perturbations to deterministic strategies by using quantum effects to generate truly random number sequences is as follows:
[0033] Control strategy disturbance amplitude: ,in, and To generate random numbers between 0 and 1 based on quantum effects, the sampling rate and bit depth of the quantum random number generator are set, the original quantum sequence is homogenized, a normal distribution perturbation is generated using Box-Muller transformation, the perturbation intensity is adjusted according to the threat level, the perturbation is verified to meet the constraints, and the effective perturbation is superimposed on the baseline strategy.
[0034] The constraints are as follows: , ,in, The perturbation threshold, This indicates the probability that the disturbance amplitude is greater than the disturbance threshold.
[0035] Based on the same inventive concept, the present invention also provides a security gateway access policy optimization system based on zero-trust architecture, the system comprising a computer executable program for executing the security gateway access policy method based on zero-trust architecture described in the first aspect.
[0036] Compared with the prior art, the beneficial effects of this invention are:
[0037] By constructing a spatiotemporal correlation graph based on access behavior, the temporal continuity and spatial correlation of access behavior can be comprehensively characterized, providing more accurate behavioral characteristics for strategy optimization. A quantitative assessment method for resource sensitivity is proposed based on changes in information entropy and conditional entropy, achieving an objective measurement of the importance of various system resources. A Brownian motion model is used to describe the evolutionary characteristics of access behavior, and a more adaptive baseline for identifying abnormal behavior is constructed by combining drift coefficients and volatility. Access control is modeled as a zero-sum game between attackers and defenders, achieving a multi-dimensional balance between security, overhead, and complexity through the game payoff function. The optimal strategy combination is selected based on the principle of minimum entropy increase, effectively controlling the growth of system complexity. This invention can dynamically optimize access strategies according to the spatiotemporal characteristics of access behavior, effectively controlling complexity while ensuring system security, and has significant theoretical and practical value. Attached Figure Description
[0038] Figure 1 This is a flowchart of the security gateway access policy optimization method based on zero-trust architecture of the present invention. Detailed Implementation
[0039] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention are described clearly and completely below. Obviously, the described embodiments are only some embodiments of this invention, not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.
[0040] Example 1: As Figure 1 As shown, this invention presents a method for optimizing security gateway access policies based on a zero-trust architecture. The method first collects user access behavior information, including user identity, access time, geographical location, and accessed resources. Then, it transforms this information into a graph structure for subsequent analysis. The method includes the following steps:
[0041] Step S1: Collect access behavior information of the accessing entities. The access behavior information includes at least: entity identification information, timestamp, geographic location coordinates, and target resource. Treat each access behavior as a vertex of the graph, establish directed edges based on the association relationship of the access sequence, calculate edge weights through access frequency and spatiotemporal distance, and construct a spatiotemporal association graph based on access behavior.
[0042] This method treats each visit as a vertex in a graph and establishes directed edges based on the order of visits, effectively capturing the temporal and spatial distribution characteristics of visit behaviors. Furthermore, by calculating edge weights, the degree of correlation between different visit behaviors can be assessed more accurately.
[0043] The spatiotemporal relationship diagram of access behavior is represented as follows: ,in: For a set of vertices, each vertex A visit event represents an event and includes the following attributes: a unique identifier of the visitor. Identifier of the accessed resource timestamp of the access The geographical coordinates of the location where the visit occurred E is a set of directed edges, where the direction of the edges indicates the order of visits. Represents edge weight, vertex weight To the top Edge weights between The calculation method is as follows: ,in, As vertex arrive The access transfer frequency, i.e., the frequency of access transfer per unit time. arrive Number of visits; For the normalized time interval, , for, As vertex arrive The maximum time interval within the observation period, Indicates an access event The timestamp of the occurrence Indicates the timestamp of the access event j; For normalized spatial distance, , Indicates an access event The distance from the geographical location where the event occurred to the data center. Indicates an access event The distance from the geographical location where the event occurred to the data center. This represents the maximum spatial distance allowed by the system.
[0044] Suppose we have the following access records: User A accessed the company's financial system from AAA at 09:00 on January 1, 2024; the same user attempted to access the same system from BBB 5 minutes later, AAA and BBB being 100 kilometers apart; User B accessed the email system from their normal office location at the same time; these access behaviors are converted into vertices in a graph, where each vertex contains information: {User ID, Resource ID, Timestamp, Location Coordinates}; the edge weights are calculated based on access frequency and spatiotemporal distance; for example, the edge weight between User A's two accesses will be very low because although the time interval is short, the geographical distance is unusual.
[0045] Weight calculation in the spatiotemporal graph G=(V,E,W): If the time interval between two visits by user A is 5 minutes and the spatial distance is 1200 kilometers, let T_max = 24 hours and D_max = 5000 kilometers; then: ∆t_ij = 5 / (24*60) ≈0.003472; ∆d_ij = 1200 / 5000 = 0.24; if the access frequency f_ij = 1, then the edge weight W_ij ≈ 4.15.
[0046] Step S2: Calculate the probability distribution of resource access based on the spatiotemporal correlation graph to obtain the information entropy of the resource access link and the conditional entropy under known resource access conditions. The change in conditional entropy reflects the degree of impact of the target resource being accessed on the overall uncertainty of the system, thereby quantifying the sensitivity of the resource.
[0047] By calculating the information entropy and conditional entropy of resource access links, the sensitivity of different resources can be effectively quantified. The introduction of information entropy allows us to understand the uncertainty and risk in the system from a probabilistic perspective, while changes in conditional entropy help us understand the impact of accessing a specific resource on the overall security of the system. The method for calculating the information entropy of a resource access link is as follows:
[0048] For resources Its access probability ;in, Representation and Resources The sum of the weights of all relevant access paths. This represents the sum of the weights of all access paths in the entire system; Indicates that the target of the access is a resource. The set of vertices, Spatiotemporal correlation diagram The set of vertices in; Indicates resources For a specific access event vertex of the target, Representing the spatiotemporal relationship graph Any vertex in the array represents any access event; Indicates from vertex To the top Edge weights; and Represent any two vertices in the spatiotemporal relation graph G. This represents the edge weight between two vertices;
[0049] Information entropy of resource access links Represented as: ;
[0050] Calculate the known access resource as Conditional entropy under the given conditions: .
[0051] Then resources sensitivity The quantification formula is: ,in, This represents the maximum access probability among all resources in the system.
[0052] Step S3: Treat the access behavior as a continuous time series, use the Brownian motion model to calculate the drift coefficient of the access behavior, and construct an abnormal behavior identification baseline.
[0053] By treating access behavior as a continuous time series and modeling it using a Brownian motion model, this approach effectively captures the trends and randomness within the access behavior. The calculation methods for drift coefficients and volatility enable us to more accurately identify anomalous behavior and construct an anomalous behavior identification baseline. The Brownian motion model includes identification information for each accessing entity. Its access behavior sequence is modeled as follows: ,in, express The access behavior feature vector at each time step, including normalized spatiotemporal distance. and access frequency , The drift coefficient represents the trend of behavior. Volatility represents the uncertainty of behavior; For standard Wiener process;
[0054] Drift coefficient The calculation method is as follows: ;
[0055] Volatility The calculation method is as follows: .
[0056] The method for constructing the abnormal behavior identification baseline includes: for the access subject The resource access sequence, combined with resources Access probability Then the confidence interval for normal behavior is expressed as:
[0057] ;
[0058] in, For confidence level parameters;
[0059] The quantitative indicators for the degree of abnormality are: .
[0060] Step S4: The access control process is modeled as a zero-sum game between the attacker and the defender. The defender selects an access control strategy at each decision stage, and the attacker selects a breakthrough strategy. The security, overhead and complexity are balanced through the game payoff function. Based on the principle of minimum entropy increase, the combination of access strategies that minimizes the increase in system complexity is selected to optimize the security gateway access strategy.
[0061] By modeling the access control process as a zero-sum game, we can balance the system's security, overhead, and complexity from a game theory perspective. The application of the minimum entropy increase principle allows us to minimize the increase in system complexity while ensuring system security, thereby optimizing the access strategy. By balancing security, overhead, and complexity through the game payoff function, and selecting the access strategy combination that minimizes the increase in system complexity based on the minimum entropy increase principle, the optimization of the security gateway access strategy is achieved based on a multi-stage game optimization model. In this model, the payoff function for stage t is defined as:
[0062] ;
[0063] in, For resources The strategy combination provides safe returns. For the overhead of defense strategies, For system complexity;
[0064] The method for calculating the safe return of a strategy portfolio is as follows: ,in, and These represent the probabilities of the attacker's and defender's strategy choices, respectively.
[0065] Based on the principle of minimum entropy increase, the optimal defense strategy is selected at each decision stage t by solving the following optimization problem:
[0066] ;
[0067] Among them, system complexity Defined as:
[0068] .
[0069] The optimization method further includes: using quantum effects to generate true random number sequences, adding random perturbations to deterministic strategies, improving the unpredictability of access control, and enhancing system security.
[0070] The method of using quantum effects to generate truly random number sequences and adding random perturbations to deterministic strategies is as follows:
[0071] Control strategy disturbance amplitude: ,in, and To generate random numbers between 0 and 1 based on quantum effects, the sampling rate and bit depth of the quantum random number generator are set, the original quantum sequence is homogenized, a normal distribution perturbation is generated using Box-Muller transformation, the perturbation intensity is adjusted according to the threat level, the perturbation is verified to meet the constraints, and the effective perturbation is superimposed on the baseline strategy.
[0072] The constraints are as follows: , ,in, The perturbation threshold, This indicates the probability that the disturbance amplitude is greater than the disturbance threshold.
[0073] Example 2: A security gateway access policy optimization system based on zero-trust architecture, the system comprising a computer executable program for executing a security gateway access policy method based on zero-trust architecture according to Example 1.
[0074] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.
Claims
1. A method for optimizing security gateway access policies based on a zero-trust architecture, characterized in that, The method includes the following steps: Collect access behavior information of the accessing entities, which includes at least: entity identification information, timestamp, geographic location coordinates and target resources; treat each access behavior as a vertex of a graph, establish directed edges based on the association relationship of the access sequence, calculate edge weights through access frequency and spatiotemporal distance, and construct a spatiotemporal association graph based on access behavior; Based on the spatiotemporal correlation graph, the probability distribution of resource access is calculated to obtain the information entropy of the resource access link and the conditional entropy under known resource access conditions. The change in conditional entropy reflects the degree of impact of the target resource being accessed on the overall uncertainty of the system, thereby quantifying the sensitivity of the resource. The access behavior is treated as a continuous time series, and the Brownian motion model is used to calculate the drift coefficient of the access behavior to build a baseline for abnormal behavior identification. The access control process is modeled as a zero-sum game between attackers and defenders. The defender chooses an access control strategy at each decision stage, while the attacker chooses a breach strategy. By balancing security, overhead, and complexity through the game payoff function, and based on the principle of minimum entropy increase, the combination of access strategies that minimizes the increase in system complexity is selected to optimize the security gateway access strategy.
2. The method for optimizing security gateway access policies based on zero-trust architecture according to claim 1, characterized in that, The spatiotemporal relationship diagram of access behavior is represented as follows: ,in: For a set of vertices, each vertex A visit event represents an event and includes the following attributes: a unique identifier of the visitor. Identifier of the accessed resource timestamp of the access The geographical coordinates of the location where the visit occurred E is a set of directed edges, where the direction of the edges indicates the order of visits. Represents edge weight, vertex weight To the top Edge weights between The calculation method is as follows: ,in, As vertex arrive The access transfer frequency, i.e., the frequency of access transfer per unit time. arrive Number of visits; For the normalized time interval, , for, As vertex arrive The maximum time interval within the observation period, Indicates an access event The timestamp of the occurrence Indicates the timestamp of the access event j; For normalized spatial distance, , Indicates an access event The distance from the geographical location where the event occurred to the data center. Indicates an access event The distance from the geographical location where the event occurred to the data center. This represents the maximum spatial distance allowed by the system.
3. The method for optimizing security gateway access policies based on zero-trust architecture according to claim 2, characterized in that, The method for calculating the information entropy of a resource access link is as follows: For resources Its access probability ;in, Representation and Resources The sum of the weights of all relevant access paths. This represents the sum of the weights of all access paths in the entire system; Indicates that the target of the access is a resource. The set of vertices, Spatiotemporal correlation diagram The set of vertices in; Indicates resources For a specific access event vertex of the target, Representing the spatiotemporal relationship graph Any vertex in the array represents any access event; Indicates from vertex To the top Edge weights; and Represent any two vertices in the spatiotemporal relation graph G. This represents the edge weight between two vertices; Information entropy of resource access links Represented as: ; Calculate the known access resource as Conditional entropy under the given conditions: ; Then resources sensitivity The quantification formula is: ,in, This represents the maximum access probability among all resources in the system.
4. The method for optimizing security gateway access policies based on zero-trust architecture according to claim 1, characterized in that, In the Brownian motion model, the identification information for each accessing entity... Its access behavior sequence is modeled as follows: ,in, express The access behavior feature vector at each time step, including normalized spatiotemporal distance. and access frequency , The drift coefficient represents the trend of behavior. Volatility represents the uncertainty of behavior; For standard Wiener process; Drift coefficient The calculation method is as follows: ; Volatility The calculation method is as follows: .
5. The method for optimizing security gateway access policies based on zero-trust architecture according to claim 4, characterized in that, The method for constructing the abnormal behavior identification baseline includes: for the access subject The resource access sequence, combined with resources Access probability Then the confidence interval for normal behavior is expressed as: ； in, For confidence level parameters; The quantitative indicators for the degree of abnormality are: .
6. The method for optimizing security gateway access policies based on zero-trust architecture according to claim 5, characterized in that, By balancing security, overhead, and complexity through a game theory payoff function, and based on the principle of minimum entropy increase, the combination of access strategies that minimizes the increase in system complexity is selected. This optimization of the security gateway access strategy is achieved using a multi-stage game theory optimization model. In this model, the payoff function for stage t is defined as follows: ； in, For resources The strategy combination provides safe returns. For the overhead of defense strategies, For system complexity; The method for calculating the safe return of a strategy portfolio is as follows: ,in, and These represent the probabilities of the attacker's and defender's strategy choices, respectively.
7. The method for optimizing security gateway access policies based on zero-trust architecture according to claim 6, characterized in that, Based on the principle of minimum entropy increase, the optimal defense strategy is selected at each decision stage t by solving the following optimization problem: ； Among them, system complexity Defined as: 。 8. The method for optimizing security gateway access policies based on zero-trust architecture according to claim 7, characterized in that, The optimization method further includes: using quantum effects to generate true random number sequences, adding random perturbations to deterministic strategies, improving the unpredictability of access control, and enhancing system security.
9. The method for optimizing security gateway access policies based on zero-trust architecture according to claim 8, characterized in that, The method of using quantum effects to generate truly random number sequences and adding random perturbations to deterministic strategies is as follows: Control strategy disturbance amplitude: ,in, and To generate random numbers between 0 and 1 based on quantum effects, the sampling rate and bit depth of the quantum random number generator are set, the original quantum sequence is homogenized, a normal distribution perturbation is generated using Box-Muller transformation, the perturbation intensity is adjusted according to the threat level, the perturbation is verified to meet the constraints, and the effective perturbation is superimposed on the baseline strategy. The constraints are as follows: , ,in, The perturbation threshold, This indicates the probability that the disturbance amplitude is greater than the disturbance threshold.
10. A security gateway access policy optimization system based on zero-trust architecture, the system comprising a computer-executable program for executing a security gateway access policy method based on zero-trust architecture as described in any one of claims 1-9.