Access control method and device, storage medium and computer program product

Abstract

The invention discloses an access control method and device, a storage medium and a computer program product, and belongs to the field of data security. The method comprises the following steps: when a service access request initiated by a user through a user terminal is received, obtaining terminal data of the user terminal, user data of the user, and network data and access asset data corresponding to the service access request; determining a terminal score, a behavior score, a network score and an asset score according to the terminal data, the behavior data, the network data and the access asset data; based on a predetermined identity-dimension distribution weight strategy, determining a target dimension distribution weight according to the identity data; according to the terminal score, the behavior score, the network score, the asset score and the target dimension distribution weight, determining a credibility evaluation value corresponding to the service access request; and determining an access decision result corresponding to the service access request according to the credibility evaluation value. The possibility of risk missed judgment can be reduced.

Description

Technical Field

[0001] This invention relates to the field of data security, and more specifically to an access control method, device, storage medium, and computer program product. Background Technology

[0002] In the era of cloud computing and big data, network security boundaries are gradually crumbling, and internal and external threats are escalating, making traditional perimeter security architectures inadequate. In existing technologies, when implementing access control, taking zero-trust systems as an example, trust assessments are typically based on endpoint security status (such as patch installation and antivirus software operation) and / or user authentication results (such as account passwords and dynamic passwords). Access is granted only when user authentication is successful and / or endpoint security status meets the requirements. However, these existing technologies rely solely on endpoint security and / or user identity data for risk assessment, resulting in limited assessment dimensions, low accuracy, and a tendency to miss risks. Summary of the Invention

[0003] The purpose of this invention is to provide an access control method, device, storage medium, and computer program product to solve the problem of potential missed detection of risks in the prior art.

[0004] To achieve the above objectives, a first aspect of this application provides an access control method, comprising: Upon receiving a service access request initiated by a user through a user terminal, the system acquires the user terminal's terminal data, the user's user data, the network data corresponding to the service access request, and the access asset data. The user data includes identity data and behavioral data. The terminal score, behavior score, network score, and asset score are determined based on terminal data, behavior data, network data, and access asset data, respectively. Based on a pre-determined identity-dimension weighting strategy, the target dimension weights are determined according to the identity data. The trust assessment value corresponding to the business access request is determined by assigning weights based on the terminal score, behavior score, network score, asset score, and target dimension. The access decision result corresponding to the business access request is determined based on the trust level assessment value, and the access decision result is fed back to the user terminal so that the user terminal can execute the access decision result.

[0005] In this embodiment of the application, the terminal score, behavior score, network score, and asset score are determined based on terminal data, behavior data, network data, and access asset data, respectively. This includes: determining the basic terminal score, basic behavior score, basic network score, and basic asset score based on the terminal data, behavior data, network data, and access asset data, respectively, according to a pre-determined single-dimensional data-score allocation strategy, so as to obtain the terminal score, behavior score, network score, and asset score.

[0006] In this embodiment of the application, the terminal score, behavior score, network score, and asset score are determined based on terminal data, behavior data, network data, and access asset data, respectively. This includes: determining a basic terminal score, a basic behavior score, a basic network score, and a basic asset score based on a pre-determined single-dimensional data-score allocation strategy, respectively, based on terminal data, behavior data, network data, and access asset data; and modifying at least one of the basic terminal score, basic behavior score, basic network score, and basic asset score based on at least two of the terminal data, behavior data, network data, and access asset data, based on a pre-determined cross-dimensional data-score allocation strategy, to obtain the terminal score, behavior score, network score, and asset score.

[0007] In this embodiment, the target dimension allocation weights include target terminal allocation weights, target behavior allocation weights, target network allocation weights, and target asset allocation weights. Based on the terminal score, behavior score, network score, asset score, and target dimension allocation weights, the trust assessment value corresponding to the service access request is determined, including: determining the sum of the products of the terminal score, behavior score, network score, and asset score with the target terminal allocation weight, target behavior allocation weight, target network allocation weight, and target asset allocation weight, respectively, to obtain the trust assessment value corresponding to the service access request.

[0008] In this embodiment, the trust assessment value corresponding to a business access request is determined based on the terminal score, behavior score, network score, asset score, and target dimension weights. This includes: determining the basic trust assessment value corresponding to the business access request based on the terminal score, behavior score, network score, asset score, and target dimension weights; determining the risk scenario score corresponding to the business access request based on a pre-determined risk scenario-score allocation strategy, using terminal data, behavior data, network data, and access asset data; and determining the sum of the basic trust assessment value and the risk scenario score to obtain the trust assessment value corresponding to the business access request.

[0009] In this embodiment of the application, the target dimension allocation weight is determined based on the identity data according to a pre-determined identity-dimension allocation weight strategy. This includes: determining the initial dimension allocation weight based on the identity data according to the pre-determined identity-dimension allocation weight strategy; and correcting the initial dimension allocation weight based on the terminal data, behavior data, network data, and access asset data according to a pre-determined weight adjustment scenario-dimension allocation weight strategy to obtain the target dimension allocation weight.

[0010] In this embodiment of the application, the access decision result includes whether to grant read and write permissions; determining the access decision result corresponding to the business access request based on the trust assessment value includes: obtaining the target asset importance level corresponding to the access asset data; determining the target trust threshold corresponding to the target asset importance level based on the pre-determined asset importance level-trust threshold relationship; and determining whether to grant read and write permissions based on the trust assessment value and the target trust threshold to obtain the access decision result corresponding to the business access request.

[0011] In this embodiment, the access decision results include allowing access, blocking access, and secondary authentication. Allowing access includes granting read / write permissions and granting read-only permissions. The access decision result corresponding to the business access request is determined based on the trust assessment value, including: obtaining the target asset importance level corresponding to the access asset data; and determining the access decision result corresponding to the business access request based on the pre-determined asset importance level-trust threshold-fine-grained access permission policy, according to the target asset importance level and the trust assessment value.

[0012] In this embodiment of the application, the access control method further includes: when abnormal behavior is detected during the process of a user terminal accessing services based on access decision results, issuing an instruction to block access, and reducing the trust score based on the abnormal behavior.

[0013] A second aspect of this application provides a computer device, including: a memory configured to store instructions; and a processor configured to retrieve instructions from the memory and, when executing the instructions, to implement the access control method described above.

[0014] A third aspect of this application provides a machine-readable storage medium storing instructions that cause a machine to execute the access control method described above.

[0015] A fourth aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the access control method described above.

[0016] The above technical solution, upon receiving a service access request initiated by a user through a user terminal, determines terminal scores, behavioral scores, network scores, and asset scores based on the user terminal's data, the user's behavioral data, network data corresponding to the service access request, and access asset data, respectively. Then, based on a pre-determined identity-dimension weighting strategy, it determines the target dimension weighting based on identity data. Finally, based on the terminal score, behavioral score, network score, asset score, and target dimension weighting, it determines the trust assessment value corresponding to the service access request, and determines the access decision result based on the trust assessment value. This technical solution comprehensively assesses trust based on dimensional data such as user terminal data, user behavioral data, network data corresponding to the service access request, and access asset data, constructing a multi-dimensional trust fusion assessment model. This model can identify various complex access risks, has higher assessment accuracy, reduces the possibility of missed risk detection, and improves data security. Furthermore, by determining the weighting of different dimensions based on the user's identity data, different assessment dimension weights are configured for users with different identities, allowing for more flexible adaptation to access scenarios with different user identities. This achieves differentiated access control for users and improves operational efficiency.

[0017] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0018] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings: Figure 1 The illustration shows a flowchart of an access control method according to an embodiment of this application. Detailed Implementation

[0019] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustrative and explanatory purposes only and are not intended to limit the scope of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments in this application without inventive effort are within the scope of protection of this application.

[0020] It should be noted that the acquisition, transmission, storage, use, and processing of data in the technical solution of this application all comply with relevant laws and regulations. In the embodiments of this application, certain existing industry solutions such as software, components, and models may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0021] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0022] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0023] Figure 1 The illustration shows a flowchart of an access control method according to an embodiment of this application. Figure 1 As shown in the illustration, this application provides an access control method. Taking the application of this method to a processor as an example, the method may include the following steps: Step S102: Upon receiving a service access request initiated by a user through a user terminal, obtain the terminal data of the user terminal, the user's user data, the network data corresponding to the service access request, and the access asset data, wherein the user data includes identity data and behavioral data.

[0024] Step S104: Determine the terminal score, behavior score, network score, and asset score based on the terminal data, behavior data, network data, and access asset data, respectively.

[0025] Step S106: Based on the pre-determined identity-dimension weight allocation strategy, determine the target dimension weight allocation according to the identity data.

[0026] Step S108: Based on the terminal score, behavior score, network score, asset score, and target dimension, assign weights to determine the trust evaluation value corresponding to the business access request.

[0027] Step S110: Determine the access decision result corresponding to the service access request based on the trust assessment value, and feed back the access decision result to the user terminal so that the user terminal can execute the access decision result.

[0028] It is understood that a business access request is a request to access information such as data assets in the network environment. This can be initiated by a user through a user terminal. The purpose of a business access request can be asset access or asset manipulation. Terminal data refers to relevant data information about the user terminal, which may include, but is not limited to, the device's unique identifier, security patch installation status, antivirus software running status, firewall configuration, and process compliance (whether any unauthorized software exists). User data refers to user-related data, which may include user identity data and user behavior data. User identity data refers to user role information, which may include, but is not limited to, operations and maintenance personnel, security auditors, and ordinary employees. User behavior data refers to user operational behavior data, which may include, but is not limited to, operation instructions (such as database modification / query instructions) and historical behavior baselines (such as operation frequency / type in the past 30 days). Network data refers to network environment-related information corresponding to the business access request, which may include, but is not limited to, access location (such as company intranet / public Wi-Fi), link encryption status (whether SSL / TLS is enabled), and network protocol type. Access asset data refers to information related to the access assets corresponding to the business access request, which may include, but is not limited to, asset type (database / server / file cabinet), asset importance, historical access frequency, etc. Terminal score is a score related to the terminal determined based on the relevant characteristic attributes of terminal data; behavior score is a score related to behavior determined based on the relevant characteristic attributes of user behavior data; network score is a score related to the network determined based on the relevant characteristic attributes of network data; and asset score is a score related to the access assets determined based on the relevant characteristic attributes of access asset data. The specific determination of the scores for each of the above dimensions (terminal, behavior, network, and access assets) can be based on a pre-determined and stored correspondence between the characteristic attributes and scores of the corresponding dimensions. The pre-determined identity-dimension allocation weight strategy is the pre-determined allocation weight information for different dimensions corresponding to different user identities. The target dimension allocation weight is the allocation weight corresponding to different dimensions determined based on the current user's identity data and the identity-dimension allocation weight strategy. The trust assessment value is the score obtained by assessing the trust level of the business access request. The access decision result is the access control decision result corresponding to the business access request.

[0029] Specifically, when the processor receives a service access request initiated by a user through a user terminal, it can obtain the terminal data of the user terminal, the user's user data, the network data corresponding to the service access request, and the access asset data. The user data includes identity data and behavioral data. Then, based on the terminal data, behavioral data, network data, and access asset data, it determines the terminal score, behavioral score, network score, and asset score, respectively. Based on a pre-determined identity-dimension weight allocation strategy, it determines the target dimension weight allocation based on the identity data. Thus, based on the terminal score, behavioral score, network score, asset score, and target dimension weight allocation, it determines the trust evaluation value corresponding to the service access request. Based on the trust evaluation value, it determines the access decision result corresponding to the service access request. For example, the correspondence between trust values ​​and access strategies of service access requests can be pre-determined and stored. Based on the currently determined trust evaluation value, the corresponding access strategy, i.e., the access decision result, is determined and fed back to the user terminal so that the user terminal can execute the access decision result.

[0030] The above technical solution, upon receiving a service access request initiated by a user through a user terminal, determines terminal scores, behavioral scores, network scores, and asset scores based on the user terminal's data, the user's behavioral data, network data corresponding to the service access request, and access asset data, respectively. Then, based on a pre-determined identity-dimension weighting strategy, it determines the target dimension weighting based on identity data. Finally, based on the terminal score, behavioral score, network score, asset score, and target dimension weighting, it determines the trust assessment value corresponding to the service access request, and determines the access decision result based on the trust assessment value. This technical solution comprehensively assesses trust based on dimensional data such as user terminal data, user behavioral data, network data corresponding to the service access request, and access asset data, constructing a multi-dimensional trust fusion assessment model. This model can identify various complex access risks, has higher assessment accuracy, reduces the possibility of missed risk detection, and improves data security. Furthermore, by determining the weighting of different dimensions based on the user's identity data, different assessment dimension weights are configured for users with different identities, allowing for more flexible adaptation to access scenarios with different user identities. This achieves differentiated access control for users and improves operational efficiency.

[0031] In one embodiment, the terminal score, behavior score, network score, and asset score are determined based on terminal data, behavior data, network data, and access asset data, respectively. This includes: determining the basic terminal score, basic behavior score, basic network score, and basic asset score based on the terminal data, behavior data, network data, and access asset data, respectively, according to a pre-determined single-dimensional data-score allocation strategy, to obtain the terminal score, behavior score, network score, and asset score.

[0032] It can be understood that the pre-determined single-dimensional data-score allocation strategy consists of pre-determined and stored scores corresponding to different data scenarios for each dimension. The basic terminal score is the score for the terminal dimension determined based on the single-dimensional data-score allocation strategy corresponding to the terminal data and terminal dimension. The basic behavior score is the score for the behavior dimension determined based on the single-dimensional data-score allocation strategy corresponding to the behavior data and behavior dimension. The basic network score is the score for the network dimension determined based on the single-dimensional data-score allocation strategy corresponding to the network data and network dimension. The basic asset score is the score for the asset dimension determined based on the single-dimensional data-score allocation strategy corresponding to the access asset data and asset dimension.

[0033] In some embodiments, network data may include access location, link encryption status, and network stability. The single-dimensional data-score allocation strategy corresponding to the network dimension may specifically be: "Access location" is classified by security level (company intranet = 20 points, VPN access = 15 points, public WiFi = 5 points, unknown network = 0 points), "Link encryption status" (SSL / TLS enabled = 10 points, disabled = 0 points), and "Network stability" is quantified by packet loss rate (≤1% = 10 points, 1%-3% = 5 points, ≥3% = 0 points). In some embodiments, terminal data may include patch installation status, antivirus software running status, and process compliance. The single-dimensional data-score allocation strategy corresponding to the terminal dimension may specifically be: quantifying "patch installation status" (installed / not installed) as 10 points / 0 points, "antivirus software running status" (normal / abnormal / not installed) as 15 points / 5 points / 0 points, and "process compliance" as mapped by the number of non-compliant processes (0 = 10 points, 1-2 = 5 points, ≥3 = 0 points).

[0034] In some embodiments, behavioral data may include operation instructions, operation frequency, and operation time. The single-dimensional data-score allocation strategy corresponding to the behavioral dimension may specifically be: "Operation instructions" are marked according to risk level (query type = 10 points, modification type = 5 points, deletion / configuration type = 0 points), "Operation frequency" is compared with historical baseline (within ±20% = 10 points, ±20%-50% = 5 points, outside ±50% = 0 points), and "Operation time" is (working time = 10 points, non-working time with approval = 5 points, non-working time without approval = 0 points).

[0035] In some embodiments, accessing asset data may include asset importance level and historical access compliance rate. The single-dimensional data-score allocation strategy corresponding to the asset dimension may specifically be: "asset importance level" (core = 20 points, important = 15 points, ordinary = 10 points) and "historical access compliance rate" (≥95% = 10 points, 90%-94% = 5 points, <90% = 0 points).

[0036] Specifically, the processor can determine the basic terminal score, basic behavior score, basic network score, and basic asset score based on the pre-determined single-dimensional data-score allocation strategy corresponding to different dimensions, respectively, according to terminal data, behavior data, network data, and access asset data, and then define the basic terminal score, basic behavior score, basic network score, and basic asset score as terminal score, behavior score, network score, and asset score, respectively.

[0037] In this embodiment of the application, by pre-setting single-dimensional data-score allocation strategies for different dimensions, the scores of the corresponding dimensions can be directly determined according to the actual data situation of different dimensions, so that the trust evaluation value can be quickly and accurately determined based on the scores of each dimension.

[0038] In one embodiment, determining the terminal score, behavior score, network score, and asset score based on terminal data, behavior data, network data, and access asset data respectively includes: determining the basic terminal score, basic behavior score, basic network score, and basic asset score based on a pre-determined single-dimensional data-score allocation strategy, respectively, based on terminal data, behavior data, network data, and access asset data; and modifying at least one of the basic terminal score, basic behavior score, basic network score, and basic asset score based on at least two of the terminal data, behavior data, network data, and access asset data, based on a pre-determined cross-dimensional data-score allocation strategy, to obtain the terminal score, behavior score, network score, and asset score.

[0039] It is understandable that the pre-determined cross-dimensional data-score allocation strategy is the score corresponding to the dimensional data of the cross-dimensional data that is pre-determined and stored. The cross-dimensional data can be, for example, the cross-dimensional data of terminal and network, the cross-dimensional data of behavior and assets, or the cross-dimensional data of terminal, behavior and assets.

[0040] In some embodiments, when the cross dimension is the cross dimension of terminal and network, the cross dimension data-score allocation strategy may include, for example: compliant terminal × untrusted network (public WiFi / unknown network) → basic terminal score × 0.3 (weakening the terminal compliance advantage).

[0041] In some embodiments, when the cross dimension is the cross dimension of behavior and assets, the cross dimension data-score allocation strategy may include, for example, behavior-asset cross feature: sensitive operation (modification / deletion instruction) × core asset → basic behavior score × 0.1 (significantly reducing the weight of behavior compliance).

[0042] Specifically, the processor can determine the basic terminal score, basic behavior score, basic network score, and basic asset score based on the pre-determined single-dimensional data-score allocation strategy corresponding to different dimensions, respectively, according to terminal data, behavior data, network data, and access asset data. Based on the pre-determined cross-dimensional data-score allocation strategy, the processor can modify at least one of the basic terminal score, basic behavior score, basic network score, and basic asset score according to at least two of the terminal data, behavior data, network data, and access asset data to obtain the terminal score, behavior score, network score, and asset score.

[0043] In this embodiment, by pre-setting single-dimensional data-score allocation strategies for different dimensions, the base score of the corresponding dimension can be directly determined based on the actual data situation of different dimensions. Then, by setting cross-dimensional data-score allocation strategies, at least one of the base scores can be corrected based on the actual data situation of at least two dimensions. That is, the relationship between single dimension and score and the relationship between cross-dimensional and score are considered at the same time, thereby strengthening the ability to identify composite risks, realizing dynamic trust assessment and access control, and further improving the accuracy of composite risk identification.

[0044] In one embodiment, the target dimension allocation weights include target terminal allocation weights, target behavior allocation weights, target network allocation weights, and target asset allocation weights. Based on the terminal score, behavior score, network score, asset score, and target dimension allocation weights, the trust assessment value corresponding to the service access request is determined, including: determining the sum of the products of the terminal score, behavior score, network score, and asset score with the target terminal allocation weight, target behavior allocation weight, target network allocation weight, and target asset allocation weight, respectively, to obtain the trust assessment value corresponding to the service access request.

[0045] It can be understood that the weight assigned to the target terminal is the proportion of the trust assessment weight corresponding to the terminal score, the weight assigned to the target behavior is the proportion of the trust assessment weight corresponding to the behavior score, the weight assigned to the target network is the proportion of the trust assessment weight corresponding to the network score, and the weight assigned to the target asset is the proportion of the trust assessment weight corresponding to the asset score.

[0046] Specifically, the processor can determine the sum of the products of the terminal score, behavior score, network score, and asset score with the corresponding target terminal allocation weight, target behavior allocation weight, target network allocation weight, and target asset allocation weight, respectively, thereby obtaining the trust evaluation value corresponding to the business access request.

[0047] In this embodiment of the application, the trust level assessment value corresponding to the business access request is comprehensively evaluated by assigning weights and scores to different dimensions of the target, which can obtain an accurate trust level assessment value and improve the accuracy of risk assessment.

[0048] In one embodiment, the trust assessment value corresponding to a business access request is determined by assigning weights based on terminal score, behavior score, network score, asset score, and target dimension. This includes: determining the basic trust assessment value corresponding to the business access request by assigning weights based on terminal score, behavior score, network score, asset score, and target dimension; determining the risk scenario score corresponding to the business access request based on a pre-determined risk scenario-score allocation strategy, according to terminal data, behavior data, network data, and access asset data; and determining the sum of the basic trust assessment value and the risk scenario score to obtain the trust assessment value corresponding to the business access request.

[0049] It can be understood that the basic trust assessment value is determined based on the terminal score, behavior score, network score, asset score, and the weights allocated to the target dimensions. The pre-determined risk scenario-score allocation strategy refers to the pre-determined and stored score information corresponding to different levels of risk scenarios. The risk scenario score is a score for the risk scenario determined based on the risk scenario-score allocation strategy and dimensional data from multiple dimensions; its value can be positive or negative.

[0050] In some embodiments, the risk scenario-score allocation strategy may include: "emergency operation and maintenance scenario flag" (approved = 1, no approval = 0), "remote login flag" (consistent with common IP = 1, inconsistent = 0), "multiple devices logging in simultaneously flag" (≤1 device = 1, >1 device = 0).

[0051] In some embodiments, the risk scenario-score allocation strategy may include: High-risk association rules: Compliant terminal (≥30 points) + non-working hours (0 points) + core assets (20 points) + sensitive operations (0 points) → additional deduction of 30 points; Medium-risk association rules: Compliant terminal (≥30 points) + Public Wi-Fi (5 points) + Important assets (15 points) + Batch operation (0 points) → Deduct an additional 15 points; Low-risk association rules: Compliant terminal (≥30 points) + company intranet (20 points) + ordinary assets (10 points) + query operation (10 points) → add 10 points; Emergency Exemption Rules: Emergency maintenance scenario (with approval) + terminal compliance (≥30 points) → Temporarily increase trust level by 10 points, valid for 1 hour.

[0052] Specifically, the processor can determine the basic trust assessment value corresponding to the business access request based on the terminal score, behavior score, network score, asset score, and target dimension weights. Specifically, it is the sum of the products of the terminal score, behavior score, network score, and asset score and the corresponding target dimension weights. Further, based on a pre-determined risk scenario-score allocation strategy, the processor determines the risk scenario score corresponding to the business access request based on terminal data, behavior data, network data, and access asset data, and determines the sum of the basic trust assessment value and the risk scenario score to obtain the trust assessment value corresponding to the business access request.

[0053] In this embodiment, by setting a risk scenario-score allocation strategy and combining the risk scenario score to correct the basic trust assessment value, a more accurate trust assessment value is obtained, which improves the adaptability to different risk scenarios, realizes dynamic trust assessment and access control, and can further improve the accuracy of risk assessment.

[0054] In one embodiment, based on a predetermined identity-dimension allocation weight strategy, the target dimension allocation weight is determined according to identity data, including: based on the predetermined identity-dimension allocation weight strategy, the initial dimension allocation weight is determined according to identity data; based on a predetermined weight adjustment scenario-dimension allocation weight strategy, the initial dimension allocation weight is corrected according to terminal data, behavioral data, network data, and access asset data to obtain the target dimension allocation weight.

[0055] It can be understood that the initial dimension allocation weights are determined based on identity data and the identity-dimension allocation weight strategy. The pre-determined weight adjustment scenario-dimension allocation weight strategy refers to the pre-determined and stored weight adjustment details corresponding to scenarios requiring weight allocation adjustments. For example, if the weight adjustment scenario is the "core asset access" scenario, the corresponding weight adjustment details could be: increasing the weight of the network score to 30%, increasing the weight of the behavior score to 50%, and assigning 10% weight each to the terminal score and asset score. The target dimension allocation weights are the dimension allocation weights obtained after adjusting the initial dimension allocation weights based on the weight adjustment scenario-dimension allocation weight strategy.

[0056] In some embodiments, the identity-dimension weighting strategy may include: For operations and maintenance personnel: "Operational behavior (i.e., behavior dimension)" weighting 40%, "Terminal compliance (i.e., terminal dimension)" weighting 20%, "Network environment (i.e., network dimension)" weighting 20%, and "Asset importance (i.e., asset dimension)" weighting 20%. Security auditors: "Operational behavior" weighted at 30%, "Endpoint compliance" weighted at 10%, "Network environment" weighted at 10%, and "Asset importance" weighted at 50%. For ordinary employees: "Terminal compliance" weighted at 50%, "Network environment" weighted at 30%, "Operational behavior" weighted at 15%, and "Asset importance" weighted at 5%.

[0057] Specifically, the processor can determine the initial dimension allocation weights based on the identity data according to a pre-determined identity-dimension allocation weight strategy, and adjust the scenario-dimension allocation weight strategy based on the pre-determined weights. The initial dimension allocation weights can be corrected according to terminal data, behavior data, network data, and access asset data to obtain the target dimension allocation weights.

[0058] In this embodiment of the application, by setting an identity-dimension allocation weight strategy, different evaluation weights for different identities can be configured for users. By setting a weight adjustment scenario-dimension allocation weight strategy, the weights allocated to dimensions determined based on user identity can be adjusted according to the actual scenario, thereby realizing dynamic adjustment of evaluation weights for different dimensions and achieving dynamic trust assessment and access control.

[0059] In existing technologies, access control lacks differentiation and has poor adaptability. All assets adopt a uniform access policy (only distinguishing between read-only and read-write), which cannot meet the differentiated management needs of "high protection for core assets and high efficiency for ordinary assets". Either the permissions of core assets are too open, or the access process for ordinary assets is cumbersome, resulting in an imbalance between security and efficiency.

[0060] To address the aforementioned issues, in one embodiment, the access decision result includes whether to grant read and write permissions; determining the access decision result corresponding to the business access request based on the trust assessment value includes: obtaining the target asset importance level corresponding to the access asset data; determining the target trust threshold corresponding to the target asset importance level based on a pre-determined asset importance level-trust threshold relationship; and determining whether to grant read and write permissions based on the trust assessment value and the target trust threshold to obtain the access decision result corresponding to the business access request.

[0061] It can be understood that the target asset importance level is the asset importance level corresponding to the accessed asset data. The pre-determined asset importance level-trust threshold relationship is the pre-determined correspondence between the asset importance level and the trust threshold. The target trust threshold is a trust threshold determined based on the target asset importance level and the asset importance level-trust threshold relationship. For example, the trust threshold for core assets (such as production databases and core business servers) is ≥80 points, the trust threshold for important assets (such as office business systems and test servers) is ≥60 points, and the trust threshold for ordinary assets (such as shared file cabinets and non-sensitive office documents) is ≥40 points.

[0062] Specifically, the processor can obtain the target asset importance level corresponding to the access asset data, and determine the target trust threshold corresponding to the target asset importance level based on the pre-determined asset importance level-trust threshold relationship. Based on the trust assessment value and the target trust threshold, it can determine whether to grant read and write permissions to obtain the access decision result corresponding to the business access request. If the trust assessment value is greater than or equal to the target trust threshold, then read and write permissions are granted; otherwise, read and write permissions are not granted.

[0063] In this embodiment, access to asset data is classified according to its importance, and an asset importance level-trust threshold relationship is set. Different trust thresholds are configured for assets of different importance levels. This can solve the problems of uniform permission policy for all assets, lack of asset classification, and coarse permissions in the prior art. It realizes the differentiated management and control requirements of high protection for core assets and high efficiency for ordinary assets, and improves asset operation and maintenance efficiency.

[0064] In one embodiment, the access decision result includes allowing access, blocking access, and secondary authentication. Allowing access includes granting read-write permissions and granting read-only permissions. The access decision result corresponding to the business access request is determined based on the trust assessment value, including: obtaining the target asset importance level corresponding to the access asset data; and determining the access decision result corresponding to the business access request based on the pre-determined asset importance level-trust threshold-fine-grained access permission policy, according to the target asset importance level and the trust assessment value.

[0065] It is understandable that the pre-determined asset importance level-trust threshold-fine-grained access permission policy is a pre-determined and stored correspondence between asset importance level, trust threshold, and fine-grained access permission. For example, for core assets: trust threshold ≥80 points grants read and write permissions, 60-79 points grants read-only permissions, and <60 points block access and trigger an administrator alert; for important assets: trust threshold ≥60 points grants read and write permissions, 40-59 points grants read-only permissions, and <40 points triggers two-factor authentication (such as face recognition + dynamic password); for ordinary assets: trust threshold ≥40 points grants read and write permissions, and <40 points prompts terminal compliance repair (such as installing antivirus software) and then prompts for retry.

[0066] Specifically, the processor can obtain the target asset importance level corresponding to the access asset data, and based on the pre-determined asset importance level-trust threshold-fine-grained access permission policy, it can achieve more refined dynamic access permission control, and determine the access decision result corresponding to the business access request according to the target asset importance level and trust assessment value.

[0067] In this embodiment, a fine-grained permission policy is generated based on the three conditions of "trust level - asset classification - user role". This solves the problems of generalized permission control and the imbalance between security and efficiency in existing technologies, and further realizes the differentiated management and control requirements of high protection for core assets and high efficiency for ordinary assets, thereby further improving asset operation and maintenance efficiency.

[0068] In one embodiment, the access control method may further include: when abnormal behavior is detected during the process of a user terminal accessing services based on access decision results, issuing an instruction to block access, and reducing the trust score based on the abnormal behavior.

[0069] Specifically, during the process of a user terminal accessing services based on access decision results, if abnormal behavior is detected, such as a user attempting to execute a database table structure modification command (sensitive operation), or the terminal antivirus software suddenly malfunctioning (abrupt change in terminal compliance status), the processor can issue an instruction to block access and, based on the abnormal behavior, reduce the trust score.

[0070] In this embodiment, real-time abnormal behavior detection enables rapid real-time response during the abnormal risk response phase, and emergency maintenance does not require manual approval, thus balancing safety and efficiency.

[0071] In a specific embodiment, taking a bastion host scenario as an example, existing bastion hosts have the following shortcomings: 1) Lack of dynamic trust assessment: Traditional bastion hosts mainly focus on static access control and lack dynamic access control capabilities based on continuous trust assessment. 2) Insufficient adaptability to new IT environments: With the development of emerging IT technologies such as cloud computing, big data, the Internet of Things, and mobile internet, traditional bastion hosts are inadequate in dealing with security threats in these new IT environments.

[0072] This application embodiment uses a bastion host as the core hub to construct an access control system that combines "multi-dimensional risk association assessment + two-way closed-loop linkage of modules + differentiated control of assets and roles." The specific scheme is as follows: The architecture comprises five core modules, which achieve collaborative decision-making through bidirectional data synchronization: 1. Bastion Host (Multi-Source Data Hub and Access Control Entry Point): 1) Multi-dimensional Data Acquisition: Real-time acquisition of four types of core data to form a unified data mart: Terminal data: unique device identifier, security patch installation status, firewall configuration, and process compliance (e.g., whether there is any unauthorized software).

[0073] User data includes operation commands (such as database modification / query commands), historical behavior baseline (operation frequency / type in the past 30 days), and role information (operation / audit / general employee).

[0074] Network data: access location (e.g., company intranet / public Wi-Fi), link encryption status (whether SSL / TLS is enabled), and network protocol type.

[0075] Asset data: asset type (database / server / file cabinet), importance level, and historical access frequency.

[0076] 2) User-Device-Asset Tripartite Binding: Upon initial user access, the bastion host automatically generates a unique device identifier, completing the binding of "User ID-Device-Accessible Asset," establishing an initial trust baseline (compliance terminal + user with no abnormal behavior initial trust score set at 80 points), avoiding the risk of unauthorized access due to account and device unbinding. 3) Permission Execution and Feedback: Receives permission instructions from the dynamic access decision engine and synchronizes them to the security gateway. Simultaneously, it collects the execution results (allow / block / secondary authentication) from the security gateway in real time and pushes them back to the trust evaluator, providing data support for the optimization of the evaluation model and forming the foundation of the "execution-feedback" link. 2. Security Management Center (Differentiated Policy Configuration Engine): 1) Asset Hierarchical Management: Divides assets managed by the bastion host into three levels according to importance, configures differentiated trust thresholds, and solves the problems of "no asset hierarchy" and "coarse permissions" in the comparison documents. Core assets (such as production databases and core business servers): Trust threshold ≥ 80 points; Important assets (such as office business systems, test servers): Trust threshold ≥ 60 points; Ordinary assets (such as shared file cabinets, non-sensitive office documents): Trust threshold ≥ 40 points.

[0077] 2) Role Weight Configuration: Configure evaluation dimension weights for the three core role types to adapt to multi-role operation and maintenance scenarios of the bastion host: For operations and maintenance personnel: "Operational behavior" weighted at 40%, "Terminal compliance" weighted at 20%, "Network environment" weighted at 20%, and "Asset importance" weighted at 20%. Security auditors: "Operational behavior" weighted at 30%, "Endpoint compliance" weighted at 10%, "Network environment" weighted at 10%, and "Asset importance" weighted at 50%. For ordinary employees: "Terminal compliance" weighted at 50%, "Network environment" weighted at 30%, "Operational behavior" weighted at 15%, and "Asset importance" weighted at 5%.

[0078] 3. Trust evaluator (multi-dimensional correlation evaluation model) 1) Data Preprocessing Module: Cleans and standardizes the four types of raw data collected by the bastion host, resolving issues such as inconsistent data formats and outlier interference. a. Terminal data: "Patch installation status" (installed / not installed) is quantified as 10 points / 0 points, "antivirus software running status" (normal / abnormal / not installed) is quantified as 15 points / 5 points / 0 points, and "process compliance" is mapped by the number of non-compliant processes (0 = 10 points, 1-2 = 5 points, ≥3 = 0 points).

[0079] b. Network data: "Access location" is classified by security level (company intranet = 20 points, VPN access = 15 points, public WiFi = 5 points, unknown network = 0 points), "link encryption status" (SSL / TLS enabled = 10 points, disabled = 0 points), and "network stability" is quantified by packet loss rate (≤1% = 10 points, 1%-3% = 5 points, ≥3% = 0 points). c. Behavioral data: "Operation instructions" are marked by risk level (query = 10 points, modification = 5 points, deletion / configuration = 0 points), "Operation frequency" is compared with historical baseline (within ±20% = 10 points, ±20%-50% = 5 points, outside ±50% = 0 points), "Operation time" (working time = 10 points, non-working time but with approval = 5 points, non-working time without approval = 0 points); d. Asset data: "Asset importance level" (core = 20 points, important = 15 points, ordinary = 10 points), "historical access compliance rate" (≥95% = 10 points, 90%-94% = 5 points, <90% = 0 points).

[0080] 2) Feature Engineering Module: Constructs a three-layer feature system of "basic features + cross features + scenario features" to enhance the ability to identify complex risks. a. Basic features: Directly map preprocessed quantitative data (such as terminal compliance score, network security score, behavioral compliance score, and asset adaptation score).

[0081] b. Cross-features: Capture cross-dimensional related risks through feature combinations, for example: i. Terminal-network cross-features: Compliant terminal (score ≥ 30 points) × Untrusted network (public WiFi / unknown network) → Feature value = terminal score × 0.3 (weakening the terminal compliance advantage); ii. Behavior-asset cross-feature: Sensitive operation (modification / deletion command) × core asset → feature value = behavior score × 0.1 (significantly reduces the weight of behavior compliance); iii. Identity-time cross-feature: Ordinary employee × non-working hours → feature value = identity base score × 0.5; c. Scenario characteristics: Design exclusive characteristics for high-frequency risk scenarios of bastion hosts, such as "emergency operation and maintenance scenario marker" (approval = 1, no approval = 0), "remote login marker" (consistent with common IP = 1, inconsistent = 0), "multiple devices logging in simultaneously marker" (≤1 device = 1, >1 device = 0).

[0082] 3) Model Training and Inference Module: Employs a composite model of "random forest + rule engine" to balance evaluation accuracy and interpretability. a. Random Forest Model: i. Model Structure: 100 decision trees are set up, each with a maximum depth of 8. The Gini coefficient is used as the feature importance evaluation index, and a basic trust score (0-80 points) is output. ii. Training Data: Bastion host operation and maintenance logs (including 50,000 normal operation data and 20,000 abnormal operation data) are used. The training set and test set are divided in a 7:3 ratio. The positive and negative samples in the training set are balanced using the SMOTE algorithm. Training stops when the accuracy of the test set is ≥92%. iii. Feature Importance Configuration: The basic dimension weights are dynamically allocated based on the training results. The default weights are 25% for terminal compliance, 20% for network security, 30% for operation behavior, and 25% for asset adaptability. Dynamic adjustment according to scenarios is supported. b. Rule Engine: Overlay bastion host scenario-specific association rules to correct the model output (total score after correction is 0-100 points): i. High-risk association rules: Compliant terminal (≥30 points) + Non-working hours (0 points) + Core assets (20 points) + Sensitive operations (0 points) → Deduct an additional 30 points; ii. Medium-risk association rules: Compliant terminal (≥30 points) + Public Wi-Fi (5 points) + Important assets (15 points) + Batch operations (0 points) → Deduct an additional 15 points; iii. Low-risk association rules: Compliant terminal (≥30 points) + Company intranet (20 points) + Ordinary assets (10 points) + Query operations (10 points) → Add an additional 10 points; iv. Emergency Exemption Rules: Emergency maintenance scenario (with approval) + terminal compliance (≥30 points) → Temporarily increase trust level by 10 points, valid for 1 hour.

[0083] 4) Dynamic optimization module: Based on a closed-loop feedback data-driven continuous iterative model, avoiding rigid evaluation logic. a. Real-time feedback iteration: Receive permission execution results (allow / block) and manual review labels (false positive / false negative) pushed by the bastion host. If the manual review after blocking is "positive" (real risk), the weight of the corresponding cross-feature is strengthened (e.g., the weight of the "sensitive operation × core asset" feature is increased by 5%). If it is "false positive" (false positive), the deduction intensity of the rule for that scenario is reduced (e.g., from deducting 30 points to deducting 20 points). b. Regular offline updates: Collect new operation and maintenance log data (≥1000 records) weekly, incrementally train the random forest model, update the feature importance weights, and ensure that the model adapts to newly emerging risk types (such as new types of illegal processes and unknown risk networks). 5) Trust Level Output: Combining the model's base score and rule-corrected score, output a trust value of 0-100, divided into risk levels: 0-30 for high risk, 31-70 for medium risk, and 71-100 for low risk; at the same time, output a "risk contribution factor" (e.g., "sensitive operation × core assets" contributes 40% of the risk) to provide an explanation basis for permission decisions and administrator alerts; if the trust level fluctuates by ≥15 points in a single instance, an emergency permission adjustment process is automatically triggered, and the reason for the fluctuation is pushed to the security management center simultaneously.

[0084] 4. Dynamic Access Decision Engine (Adaptive Permission Allocation Core) 1) Triple Matching Permission Decision: Based on the three conditions of "trust level - asset classification - user role", it generates fine-grained permission policies, solving the problems of "generalized permission control" in comparison files and "security and efficiency imbalance" in bastion hosts. a. Core assets: Trust level ≥80 points grant read and write permissions, 60-79 points grant read-only permissions, <60 points block access and trigger administrator alerts; b. Important assets: Trust level ≥ 60 points grants read and write permissions; 40-59 points grant read-only permissions; < 40 points triggers two-factor authentication (e.g., face recognition + dynamic password); c. Ordinary assets: Trust level ≥ 40 points grants read and write permissions; < 40 points prompts for terminal compliance repair (e.g., installing antivirus software) and prompts for retry. 2) Permission command synchronization: Permission policies are synchronized to the bastion host and security gateway in real time via a dedicated interface, ensuring that permission adjustments take effect within milliseconds, overcoming the limitation of "permission adjustment lag (3-10 seconds)" and meeting the emergency operation and maintenance needs of the bastion host.

[0085] 5. Security Gateway (Trusted Execution and Log Feedback Node) 1) Access Request Interception and Execution: Intercepts all business access requests from user terminals and executes precise control based on the instructions of the dynamic access decision engine: a. Allow access: Only forward operation commands that meet the permissions (e.g., under read-only permissions for core assets, intercept modification / deletion commands); b. Blocking requests: Directly reject high-risk access and push the blocking reason to the user's terminal (such as "Insufficient trust level, the current terminal does not have antivirus software installed"). c. Guided secondary authentication: Redirect to the unified authentication page, complete face / dynamic password verification before granting permissions. 2) Real-time log feedback: Record all access behaviors (including user ID, access asset IP, operation instructions, execution results, and timestamps), synchronize them to the bastion host in real time, and store them in conjunction with the trust assessment results by the bastion host to achieve two-way traceability of "risk behavior - log source tracing" and solve the pain point of "disconnect between audit and risk warning" in the bastion host.

[0086] The key technical process is as follows: 1. Initialization configuration phase (one-time deployment) 1) The security management center completes asset classification (e.g., "production database → core assets" "office shared files → ordinary assets") and role weight configuration (e.g., "operation and maintenance personnel → operation behavior weight 40%)); 2) When a user first accesses the bastion host, the bastion host collects terminal hardware / system / security configuration information, generates a unique device identifier, and completes the binding of "user-device-accessible assets"; 3) The trust evaluator generates an initial trust level of 80 points based on the initial compliance data (e.g., complete terminal patches, no illegal processes), and synchronizes it to the dynamic access decision engine and the security management center. 2. Real-time Access Control Phase (Daily Operations and Maintenance Scenario) Step 1: A user (e.g., operations and maintenance personnel) initiates an access request to core assets (production database). The bastion host collects current data in real time: the endpoint has all security patches installed (endpoint compliance), it is connected to the company's intranet (network security), and it requests to execute a database query command (operation compliance). Step 2: The bastion host synchronizes the collected data to the trust evaluator. Based on the "core asset access" scenario, the evaluator increases the weight of "network link security" to 40% and the weight of "operation behavior" to 50%, calculating the trust level: endpoint compliance 10 points + network security 40 points + operation behavior. 20 points + 10 points for asset matching = 80 points; Step 3: The trust assessor pushes the 80-point trust level to the dynamic access decision engine. The decision engine matches the core asset threshold (≥80 points), generates an "open read and write permission" instruction, and synchronizes it to the bastion host and security gateway; Step 4: The security gateway executes access control, allowing users to perform database read and write operations, while recording operation logs (including instruction content / execution time), and feeding back the "execution successful" result to the bastion host; Step 5: The bastion host pushes the execution result to the trust assessor (for model optimization), and associates it with the user ID and operation log storage for easy auditing and traceability later.3. Abnormal Risk Response Phase (Risk Outbreak Scenario) Triggering Conditions: During access to core assets, a user (operation and maintenance personnel) attempts to execute a database table structure modification command (sensitive operation), or the terminal antivirus software suddenly malfunctions (abrupt change in terminal compliance status); Step 1: The security gateway detects the abnormal behavior in real time, immediately blocks the operation, and pushes a "Operation blocked, there is a risk of sensitive operation" prompt to the user terminal; Step 2: The security gateway synchronizes the "blocking result + abnormal behavior details" to the bastion host, which pushes it to the trust evaluator; Step 3: Based on the abnormal behavior, the trust evaluator lowers the user's trust level from 80 points to 50 points (fluctuation ≥ 15 points), triggering the emergency adjustment process and synchronizing the new trust level to the dynamic access decision engine; Step 4: The decision engine matches the core asset threshold (< 60 points), generates an "access blocked" command, and the security gateway immediately disconnects the network connection with the core asset; Step 5: The security management center pushes alarm information to the administrator (including user ID, operation time, abnormal behavior, and current trust level). The administrator can trace the abnormal details through the bastion host logs to complete subsequent risk investigation.

[0087] This application also provides a specific application example: A company's production database experienced a data anomaly, requiring emergency remote repair by operations and maintenance personnel (access to core assets). The personnel accessed a bastion host via a laptop. The bastion host collected the following data: the terminal had antivirus software / all patches installed (terminal compliance), was connected to the company VPN (network security), and requested the execution of database repair commands (sensitive operation).

[0088] The trust assessor increases the weight of "operational behavior" to 50% based on the "core assets + sensitive operations" scenario, and calculates the trust level as follows: terminal compliance 15 points + network security 35 points + operation behavior 30 points = 80 points.

[0089] The dynamic access decision engine generates an "Open read / write permissions (limited to 1 hour)" command, which is executed by the security gateway, while simultaneously recording the repair operation log. After the repair is completed, the maintenance personnel voluntarily log out of access, the bastion host automatically restores the trust level to the baseline (80 points), and the security gateway clears temporary permissions. The entire process does not require manual approval and the response time is less than 100 milliseconds, which not only meets the needs of emergency maintenance but also ensures the security of core assets.

[0090] In summary, the bastion host scenario-specific four-dimensional correlation trust assessment utilizes a fusion model of "terminal + behavior + network + assets." Through cross-dimensional correlation analysis, it identifies compound risks (such as "compliant terminal + non-working hours + access to core assets" resulting in an additional 30-point deduction) and dynamically adjusts operational weights. With the bastion host as the central hub, a closed loop of "assessment → decision → execution → feedback" is constructed, and a "trust level fluctuation ≥ 15 points triggers millisecond-level adjustment" setting addresses the issues of "linear processes / lagged adjustments" in comparative documents and the "slow risk response" of bastion hosts.

[0091] Therefore, the embodiments of this application have the following advantages: 1) Improved Assessment Accuracy: By acquiring data across four dimensions—terminal, behavior, network, and assets—and determining the corresponding dimension score based on the data for each dimension, the system dynamically determines the dimension weight corresponding to each dimension score based on the relationship between identity and dimension weights. This allows for a more accurate and comprehensive trust assessment value based on the dimension scores and their corresponding weights. Furthermore, this embodiment can adjust the dimension weights of each dimension according to different weight adjustment scenarios, thereby determining a more accurate trust assessment value based on the dimension scores and adjusted dimension weights. This further realizes dynamic adjustment of dimension weights and reduces the risk of false positives / false negatives by the bastion host.

[0092] 2) Rapid Risk Response: Upon detecting abnormal behavior during access, the system immediately blocks the access operation and synchronizes the blocking result and abnormal behavior details to other modules or devices, triggering an emergency adjustment process for the abnormal behavior. This enables rapid risk response. Furthermore, access control adjustment policies can be synchronized to the bastion host and security gateway in real time via a dedicated interface, ensuring that permission adjustments take effect quickly. This meets the emergency maintenance needs of the bastion host, eliminating the need for manual approval during emergency maintenance and balancing security and efficiency.

[0093] 3) Improve operational efficiency: By setting different trust thresholds for assets of different importance, with higher trust thresholds for core assets and lower trust thresholds for ordinary assets, and different dimensional weights for user identities of different roles, asset access and role access are differentiated. This reduces the workload of manual permission approval operations, improves the access efficiency of ordinary assets, and enhances the protection strength of core assets.

[0094] 4) Enhanced audit and traceability capabilities: The abnormal risk behaviors of users during the access process are associated and stored with the corresponding bastion host logs and the trust assessment value after the score reduction, so that the administrator can quickly trace the details of abnormal operations, complete the subsequent risk investigation, and meet the compliance audit requirements of the bastion host.

[0095] This application also provides a computer device, including: a memory configured to store instructions; and a processor configured to retrieve instructions from the memory and, when executing the instructions, to implement the access control method according to the above embodiments.

[0096] This application also provides a machine-readable storage medium storing instructions that cause a machine to execute the access control method according to the above embodiments.

[0097] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the access control method according to the above embodiments.

[0098] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0099] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0100] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0101] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0102] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0103] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0104] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0105] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0106] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. An access control method, characterized in that, The access control method includes: Upon receiving a service access request initiated by a user through a user terminal, the system acquires the terminal data of the user terminal, the user data of the user, the network data corresponding to the service access request, and the access asset data, wherein the user data includes identity data and behavioral data. The terminal score, behavior score, network score, and asset score are determined based on the terminal data, behavior data, network data, and access asset data, respectively. Based on a pre-determined identity-dimension weight allocation strategy, the target dimension weight is determined according to the identity data; The trust assessment value corresponding to the service access request is determined by assigning weights based on the terminal score, the behavior score, the network score, the asset score, and the target dimension. The access decision result corresponding to the service access request is determined based on the trust assessment value, and the access decision result is fed back to the user terminal so that the user terminal executes the access decision result.

2. The access control method according to claim 1, characterized in that, The step of determining the terminal score, behavior score, network score, and asset score based on the terminal data, behavior data, network data, and access asset data respectively includes: Based on a predetermined single-dimensional data-score allocation strategy, basic terminal scores, basic behavior scores, basic network scores, and basic asset scores are determined according to the terminal data, the behavior data, the network data, and the access asset data, respectively, to obtain the terminal score, the behavior score, the network score, and the asset score.

3. The access control method according to claim 1, characterized in that, The step of determining the terminal score, behavior score, network score, and asset score based on the terminal data, behavior data, network data, and access asset data respectively includes: Based on a predetermined single-dimensional data-score allocation strategy, the basic terminal score, basic behavior score, basic network score, and basic asset score are determined according to the terminal data, the behavior data, the network data, and the access asset data, respectively. Based on a predetermined cross-dimensional data-score allocation strategy, at least one of the basic terminal score, basic behavior score, basic network score, and basic asset score is modified according to at least two of the terminal data, the behavior data, the network data, and the access asset data to obtain the terminal score, the behavior score, the network score, and the asset score.

4. The access control method according to claim 1, characterized in that, The target dimension allocation weights include target terminal allocation weights, target behavior allocation weights, target network allocation weights, and target asset allocation weights; determining the trust assessment value corresponding to the service access request based on the terminal score, the behavior score, the network score, the asset score, and the target dimension allocation weights includes: The trust evaluation value corresponding to the service access request is obtained by summing the products of the terminal score, the behavior score, the network score, and the asset score with the target terminal allocation weight, the target behavior allocation weight, the target network allocation weight, and the target asset allocation weight, respectively.

5. The access control method according to claim 1, characterized in that, The step of determining the trust assessment value corresponding to the service access request by allocating weights based on the terminal score, the behavior score, the network score, the asset score, and the target dimension includes: The basic trust assessment value corresponding to the service access request is determined by assigning weights based on the terminal score, behavior score, network score, asset score, and target dimension. Based on a pre-determined risk scenario-score allocation strategy, the risk scenario score corresponding to the business access request is determined according to the terminal data, the behavioral data, the network data, and the access asset data. The sum of the basic trust score and the risk scenario score is determined to obtain the trust score corresponding to the business access request.

6. The access control method according to claim 1, characterized in that, The pre-determined identity-dimension weight allocation strategy, based on the identity data, determines the target dimension weight allocation, including: Based on a pre-determined identity-dimension allocation weight strategy, the initial dimension allocation weights are determined according to the identity data; Based on a predetermined weight adjustment scenario—a dimension allocation weight strategy—the initial dimension allocation weights are corrected according to the terminal data, the behavioral data, the network data, and the access asset data to obtain the target dimension allocation weights.

7. The access control method according to claim 1, characterized in that, The access decision result includes whether to grant read and write permissions; determining the access decision result corresponding to the business access request based on the trust assessment value includes: Obtain the importance level of the target asset corresponding to the accessed asset data; Based on the predetermined relationship between asset importance level and trust threshold, the target trust threshold corresponding to the target asset importance level is determined; Based on the trust assessment value and the target trust threshold, it is determined whether to grant read and write permissions to obtain the access decision result corresponding to the business access request.

8. The access control method according to claim 1, characterized in that, The access decision results include allowing access, blocking access, and two-factor authentication. Allowing access includes granting read and write permissions and granting read-only permissions. The step of determining the access decision result corresponding to the service access request based on the trust assessment value includes: Obtain the importance level of the target asset corresponding to the accessed asset data; Based on a pre-determined asset importance level, trust threshold, and fine-grained access permission policy, the access decision result corresponding to the business access request is determined according to the target asset importance level and the trust assessment value.

9. The access control method according to claim 1, characterized in that, Also includes: If abnormal behavior is detected during the user terminal's access to services based on the access decision result, an instruction to block access is issued, and the trust score is reduced based on the abnormal behavior.

10. A computer device, characterized in that, include: The memory is configured to store instructions; A processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the access control method according to any one of claims 1 to 9.

11. A machine-readable storage medium, characterized in that, The machine-readable storage medium stores instructions that cause the machine to perform the access control method according to any one of claims 1 to 9.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the access control method according to any one of claims 1 to 9.

Images