Access control method and device, electronic equipment and computer readable storage medium

Abstract

The embodiment of the invention discloses an access control method and device, electronic equipment and a computer readable storage medium, and relates to the technical field of access control, and the method comprises the steps: obtaining current access evaluation information in response to a detected access request of a target user; and determining an access evaluation result corresponding to the current access evaluation information through an access evaluation model, and performing access control on the target user according to the access evaluation result. The access evaluation result is intelligently identified based on the access evaluation model, and compared with a scheme of performing access control based on a predefined access control strategy in a traditional scheme, the security threat identification is more comprehensive, the access control is more accurate, and the security is higher.

Description

Technical Field

[0001] This application relates to the field of access control technology, specifically to an access control method, apparatus, electronic device, and computer-readable storage medium. Background Technology

[0002] With the rapid development of information technology and the widespread adoption of network applications, the security of information systems is facing increasingly severe challenges. Access control, as a crucial component of information security, is directly related to the security of systems and data.

[0003] Currently, there are various types of access control systems on the market, including rule-based access control systems, role-based access control systems, and attribute-based access control systems. These systems typically rely on predefined access control policies, which are then matched to the current access scenario to control access permissions.

[0004] However, with the continuous development of the network, access scenarios are also constantly changing, making them vulnerable to evolving security threats. Due to the limited access control policies and the difficulty in configuration, predefined access control policies cannot respond to new security threats in a timely manner, thus posing security risks. Summary of the Invention

[0005] This application provides an access control method, apparatus, electronic device, and computer-readable storage medium, which can improve the accuracy of access control.

[0006] In a first aspect, embodiments of this application provide an access control method, the method comprising: In response to the detection of an access request from a target user, obtain current access assessment information; The access assessment result corresponding to the current access assessment information is determined by the access assessment model; Access control is applied to the target user based on the access assessment results.

[0007] Secondly, embodiments of this application also provide an access control device, the device comprising: The acquisition module is used to obtain current access evaluation information in response to the detection of an access request from a target user; The determination module is used to determine the access assessment result corresponding to the current access assessment information through the access assessment model; The control module is used to perform access control on the target user based on the access assessment results.

[0008] Optionally, in some embodiments of this application, determining the access assessment result corresponding to the current access assessment information through an access assessment model includes: Input the current access assessment information into the access assessment model to obtain the current risk assessment result; The access assessment result is determined based on the current risk assessment result and the target risk threshold.

[0009] Optionally, in some embodiments of this application, obtaining the target risk threshold includes: Acquire scene change information, which is determined based on the difference between historical access evaluation information and current access evaluation information; Determine the threshold adjustment value based on the scene change information; The target risk threshold is obtained by adjusting the historical risk threshold based on the threshold adjustment value.

[0010] Optionally, in some embodiments of this application, before determining the threshold adjustment value based on the scene change information, the method further includes: Obtain assessment result difference information, which is determined based on the difference between historical risk assessment results and the current risk assessment results; Determining the threshold adjustment value based on the scene change information includes: The threshold adjustment value is determined based on the difference information in the evaluation results and the scene change information.

[0011] Optionally, in some embodiments of this application, obtaining the target risk threshold includes: Retrieve historical access control results; Update the cumulative reward based on the historical access control results; The target risk threshold is determined using a reinforcement learning strategy based on the updated cumulative rewards.

[0012] Optionally, in some embodiments of this application, the current access assessment information includes current user behavior information, current device status information, and current network environment information; the access assessment model includes a first assessment module, a second assessment module, and a third assessment module; The step of inputting the current access assessment information into the access assessment model to obtain the current risk assessment result includes: The current user behavior information is input into the first evaluation module to obtain the behavior evaluation result; The current device status information is input into the second evaluation module to obtain the device evaluation result; The current network environment information is input into the third evaluation module to obtain the network evaluation result; The current risk assessment result is generated based on the behavior assessment result, the device assessment result, the network assessment result, and the preset weights.

[0013] Optionally, in some embodiments of this application, determining the access assessment result based on the current risk assessment result and the target risk threshold includes: Determine the triggering event corresponding to the access request; The access assessment result is determined based on the current risk assessment result, the target risk threshold, and the triggering event.

[0014] Thirdly, embodiments of this application also provide an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the steps in the access control method described above.

[0015] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in the access control method described above.

[0016] Fifthly, embodiments of this application also provide a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the various optional implementations described in embodiments of this application.

[0017] In this embodiment of the application, in response to the detection of an access request from a target user, current access assessment information is obtained; the access assessment result corresponding to the current access assessment information is determined through an access assessment model; and access control is performed on the target user based on the access assessment result.

[0018] In particular, by intelligently identifying access assessment results based on the access assessment model, compared with the traditional solution that uses predefined access control policies for access control, the security threat identification in this application embodiment is more comprehensive, the access control is more accurate, and the security is higher. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1This is a schematic diagram illustrating a scenario where a server executes the access control method according to an embodiment of this application; Figure 2 This is a flowchart illustrating the access control method provided in an embodiment of this application; Figure 3 This is a schematic diagram of the access control device provided in the embodiments of this application; Figure 4 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application.

[0021] Explanation of icon numbers: 10-Server; 201-Acquisition module; 202-Determination module; 203-Control module; 301-Processor; 302-Memory; 303-Power supply; 304-Input unit. Detailed Implementation

[0022] The technical solutions of this application will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] This application provides an access control method, apparatus, electronic device, and computer-readable storage medium. Specifically, this application provides an access control apparatus suitable for electronic devices to improve the accuracy and security of access control. Specifically, the electronic device includes a terminal device or a server. The terminal device includes, but is not limited to, desktop computers, laptops, mobile phones, etc. The server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. The server can be directly or indirectly connected via wired or wireless communication.

[0024] Please see Figure 1 , Figure 1 This is a schematic diagram illustrating a scenario where a server executes the access control method according to an embodiment of this application. The specific execution process of the access control method by the terminal device is as follows: In response to the detection of an access request from a target user, server 10 obtains current access assessment information; determines the access assessment result corresponding to the current access assessment information through the access assessment model; and performs access control on the target user based on the access assessment result.

[0025] For example, the server receives an access request initiated by a target user through a terminal device, obtains the current access assessment information used for access assessment, analyzes the current access assessment information using a trained access assessment model to obtain the access assessment result, and then controls the user's access based on the access request according to the access assessment result.

[0026] In summary, the embodiments of this application intelligently identify access assessment results based on an access assessment model. Compared with traditional solutions that rely on predefined access control policies, the embodiments of this application provide more comprehensive security threat identification, more accurate access control, and higher security.

[0027] The following sections provide detailed descriptions of each example. It should be noted that the order in which the embodiments are described is not intended to limit the priority of the embodiments. Please refer to [link / reference]. Figure 2 , Figure 2 This is a flowchart illustrating the access control method provided in an embodiment of this application. Although a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown in the flowchart. Specifically, the flow of this access control method includes: 101. In response to the detection of an access request from a target user, obtain the current access assessment information.

[0028] The access request is generated by the user through the terminal device. For example, the user will generate the access request when trying to log in to the system, access a specific resource, or perform a specific operation through the terminal device.

[0029] In this embodiment of the application, when an access request is detected from a target user, the acquisition of relevant evaluation information for assessing whether the user is suitable for access is triggered. For example, various types of information related to the current access are collected to form current access evaluation information. This information may include multi-dimensional data such as the user's identity information, behavioral characteristics, device information, and network environment information.

[0030] In this embodiment, to improve the accuracy of access assessment, the current access assessment information may further include access time, access location, access resource type, user's historical access records, network connection method, etc. The system acquires this information through various sensors, monitoring modules, and data acquisition interfaces, and integrates it into a structured set of assessment information. Furthermore, in this embodiment, the current access assessment information can also be collected using a proxy-based approach; for example, the collection task can be distributed among different proxy programs to alleviate the pressure on the collection task and improve collection efficiency.

[0031] In this embodiment, after obtaining the current access assessment information, the data is preprocessed before being input into the subsequent access assessment model. For example, redundant, abnormal, and invalid data are removed. During this stage, feature extraction can also be performed on the collected current access assessment information for application in subsequent model evaluation. For example, the number and frequency of consecutive login failures can be extracted or statistically analyzed.

[0032] In this embodiment of the application, in order to ensure the accuracy and effectiveness of the data subsequently input into the access evaluation model, an automated feature selection (e.g., data screening methods based on correlation, variance, etc.) and anomaly detection algorithms (e.g., outlier detection, specifically based on normal distribution, clustering, distance-based screening algorithms, etc.) can be used to select the feature subset that best represents the essence of the data from the original feature set, thereby improving the model's predictive ability and reducing the risk of overfitting.

[0033] 102. Determine the access assessment result corresponding to the current access assessment information through the access assessment model.

[0034] The access assessment model is an intelligent model capable of assessing the security of access. It can be built based on machine learning algorithms, such as Support Vector Machines (SVN), decision trees, neural networks, or ensemble learning methods. Taking Support Vector Machines (SVN) as an example, the kernel function can be a radial basis function, and the C parameter can be dynamically adjusted using regularization, for example, by obtaining the optimal C parameter through cross-validation.

[0035] In this embodiment, the access assessment result is a judgment obtained after performing a security assessment on the target user's access. The access assessment result includes allowing access, denying access, restricting access permissions, and requiring additional verification. Specifically, if the access assessment result is allowing access, the target user will be authorized to access the requested resource; if the access assessment result is denying access, the target user's access request will be blocked and related security events may be recorded; if the access assessment result is restricting access permissions, the target user's access scope will be restricted based on available permissions; if the access assessment result is requiring additional verification, the target user will be required to provide additional authentication information (such as SMS verification code, fingerprint recognition, etc.) before a decision is made on whether to allow access.

[0036] In this application, the embodiment judges the access assessment results based on a machine learning model. By utilizing the powerful learning and analysis capabilities of the machine learning model, it can respond in a timely manner to the ever-evolving new security threats arising from network development, resulting in higher accuracy of access control and improved security.

[0037] 103. Perform access control on the target user based on the access assessment results.

[0038] Specifically, access to the target user is controlled based on the access assessment results. For example, if the access assessment result is "allow access," the target user will be authorized to access the requested resource; if the access assessment result is "deny access," the target user's access request will be blocked and related security events may be logged.

[0039] In summary, the embodiments of this application intelligently identify access assessment results based on an access assessment model. Compared with traditional solutions that rely on predefined access control policies, the embodiments of this application provide more comprehensive security threat identification, more accurate access control, and higher security.

[0040] Optionally, in embodiments of this application, an access assessment model based on risk assessment can be constructed. This model is used to analyze the risk profile (such as risk level or risk score) of the target user's access, and the access assessment result is determined based on this risk profile. That is, optionally, in some embodiments of this application, the step "determining the access assessment result corresponding to the current access assessment information through the access assessment model" includes: Input the current access assessment information into the access assessment model to obtain the current risk assessment result; The access assessment result is determined based on the current risk assessment result and the target risk threshold.

[0041] The current risk assessment result is a result that represents the level of risk of the current access by assessing the risk of the access. For example, the current risk assessment result can be a risk level (such as high risk, medium risk, low risk, specifically, the level can be represented by a numerical value, such as from 1 to 10, with 10 being the highest risk) or a risk score (such as a score range of 0-100, with the higher the score, the greater the risk).

[0042] The target risk threshold is a set reference value used to determine the specific access assessment result to which the current risk assessment result belongs. For example, if the access assessment result includes allowed access and denied access, then if the risk level corresponding to the current risk assessment result is higher than the risk level corresponding to the target risk threshold, the access assessment result is determined to be denied access; conversely, if it is lower than the risk level corresponding to the target risk threshold, the access assessment result is determined to be allowed access.

[0043] It is understandable that access control requirements differ across different access scenarios. For example, a user's access permissions in an office environment should differ from those in a home environment. Therefore, the target risk threshold is not fixed. For instance, different scenario types may be matched with a corresponding risk threshold. That is, in this embodiment, the target risk threshold is determined by identifying the current access scenario and based on that scenario. The access scenario is determined comprehensively based on user behavior, device status, and network environment.

[0044] It should be noted that due to the continuous changes in network access scenarios, it is difficult to exhaustively list all access scenarios and accurately configure risk thresholds for each scenario. This results in access control failing to comprehensively and accurately cover all access scenarios, posing access security risks. Based on this situation, embodiments of this application consider dynamically updating risk thresholds based on changes in scenarios to adapt to the access control needs of different scenarios. Specifically, optionally, in some embodiments of this application, obtaining the target risk threshold includes: Acquire scene change information, which is determined based on the difference between historical access evaluation information and current access evaluation information; Determine the threshold adjustment value based on the scene change information; The target risk threshold is obtained by adjusting the historical risk threshold based on the threshold adjustment value.

[0045] For example, scenario change information, such as time differences, location differences, and device differences, is determined based on changes in device status and network environment. These differences are then quantified to form scenario change information. Subsequently, a threshold adjustment value is determined based on this scenario change information (such as the magnitude of change). The target risk threshold is obtained by updating the historical risk threshold based on this threshold adjustment value. The historical risk threshold is a risk threshold determined during historical access periods, and this historical risk threshold is used to control user access during those historical periods.

[0046] For example, if the risk level of the target user in a historical phase (e.g., the previous round) is 4, and the risk level corresponding to the historical risk threshold of that historical phase is 5, then it is determined that the user's access risk in the historical phase is low, and the target user's access is allowed in that historical phase. If the risk level of the target user in a historical phase (e.g., the previous round) is 6, and the risk level corresponding to the historical risk threshold of that historical phase is 5, then it is determined that the target user's access risk in that historical phase is high, and the target user's access is denied, or the target user's access permissions are restricted, or the identity verification of the target user is strengthened.

[0047] By updating historical risk thresholds based on scenario change information to obtain target risk thresholds, real-time dynamic access control for users is achieved, improving the accuracy of access control. For example, if a user chooses to access the site on a new device, resulting in changes to the device and network status, the historical risk thresholds are updated to obtain the target risk threshold based on the scheme of this application embodiment. For example, if the updated target risk threshold is 6, and the user's risk level is determined to be 5 based on the current access assessment information, then the user is allowed to access the site in this case, without the problem of inaccurate access control caused by comparing the current risk level with the risk level corresponding to the historical risk threshold in the previous stage.

[0048] For example, in this embodiment of the application, a mapping rule between scene change information and threshold adjustment value can be set, and the corresponding threshold adjustment value can be determined according to the mapping rule based on the currently determined scene change information.

[0049] In this embodiment, a Bayesian network can be introduced to model the relationship between scene change information and threshold adjustment values ​​or risk levels in greater detail, so as to further optimize the accuracy of the control strategy.

[0050] It is understood that, in the embodiments of this application, the risk threshold is updated in real time based on the scene change information, so that each access control can correspond to a clear and relatively accurate and effective target risk threshold determined based on the scene change, thereby achieving the effect of adaptive access control based on scene changes.

[0051] It is understandable that changes in risk levels alter user access permissions. Therefore, to improve the accuracy of updating the target risk threshold, in this embodiment, the historical risk threshold is also updated based on changes in risk levels to obtain the target risk threshold. That is, the threshold adjustment value is determined based on changes in risk levels. Optionally, in some embodiments of this application, before the step "determine the threshold adjustment value based on the scenario change information," the method further includes: Obtain assessment result difference information, which is determined based on the difference between historical risk assessment results and the current risk assessment results; Determining the threshold adjustment value based on the scene change information includes: The threshold adjustment value is determined based on the difference information in the evaluation results and the scene change information.

[0052] In this embodiment, the historical risk assessment result mainly refers to the average of multiple historical risk levels. Assuming that scenario change information is represented by Δ_env (e.g., changes in network traffic, device status, etc.), the historical risk assessment result is represented by μ, and the current user's risk level (i.e., the current risk assessment result) is represented by R, then the threshold adjustment value Δ_T is represented as: Δ_T = α * (R - μ) + β * Δ_env.

[0053] Wherein, the threshold adjustment value Δ_T represents the adjustment amount of the historical risk threshold of the access control rule, and α and β are the influence coefficients of the assessment result difference information (i.e., risk level change) and scenario change information on the historical risk threshold adjustment, respectively.

[0054] In this embodiment, whether to increase or decrease the historical risk threshold based on the threshold adjustment value can be determined by comparing the current risk level with the risk level of the previous round. For example, if the current risk level is higher than the risk level of the previous round, the target risk threshold is obtained by increasing the historical risk threshold through the threshold adjustment value; conversely, the target risk threshold is obtained by decreasing the historical risk threshold. For instance, if the historical risk threshold is 5, the current risk level is 6, the risk level of the previous round is 4, and the calculated threshold adjustment value is 0.5, then since the current risk level of 6 is greater than the risk level of 4 in the previous round, the target risk threshold of 5.5 is obtained by adding the historical risk threshold to the threshold adjustment value.

[0055] In some embodiments of this application, the target risk threshold can also be determined through reinforcement learning. Specifically, in some embodiments of this application, the acquisition of the target risk threshold includes: Retrieve historical access control results; Update the cumulative reward based on the historical access control results; The target risk threshold is determined using a reinforcement learning strategy based on the updated cumulative rewards.

[0056] The historical access control results include whether a security incident occurred after access was granted, and whether denying access caused normal business interruption. The cumulative reward value is updated based on these historical results; for example, correct access control decisions increase the reward, while incorrect decisions decrease it. Then, based on the updated cumulative reward, an optimal target risk threshold is determined using reinforcement learning algorithms (such as Q-learning, policy gradient, etc.) to achieve a balance between security and availability in the system.

[0057] It is understandable that more dimensions of information can improve the accuracy of risk assessment, and the information in each dimension can be assessed separately and weighted to obtain the final risk assessment result (i.e., the current risk assessment result in this application embodiment). Optionally, in some embodiments of this application, the current access assessment information includes current user behavior information, current device status information, and current network environment information; the access assessment model includes a first assessment module, a second assessment module, and a third assessment module, and the step "inputting the current access assessment information into the access assessment model to obtain the current risk assessment result" includes: The current user behavior information is input into the first evaluation module to obtain the behavior evaluation result; The current device status information is input into the second evaluation module to obtain the device evaluation result; The current network environment information is input into the third evaluation module to obtain the network evaluation result; The current risk assessment result is generated based on the behavior assessment result, the device assessment result, the network assessment result, and the preset weights.

[0058] The current user behavior information includes the current access time, access frequency, operation type, etc.; the current device status information includes the ID of the device that initiated the access request, device category, operating system, and security patch status of the device, etc.; and the current network environment information includes the current IP address, network type, and geographical location, etc.

[0059] The behavioral assessment result is a risk assessment result obtained by assessing the current user behavior information; the device assessment result is a risk assessment result obtained by assessing the current device status information; and the network assessment result is a risk assessment result obtained by assessing the current network environment. The behavioral assessment result, device assessment result, and network assessment result can be obtained by scoring the risks of user behavior, device status, and network environment, respectively.

[0060] The first, second, and third assessment models can be of the same or different types. They are jointly constructed to form the access assessment model. The preset weights, obtained during the training of the access assessment model, reflect the importance of information from each dimension in the risk assessment. For example, the weights of the assessment results from the first, second, and third assessment models are 0.5, 0.3, and 0.2, respectively. By weighting the information from different dimensions, the accuracy of the risk assessment is improved.

[0061] For example, the first, second, and third evaluation models are represented as f1(X, θ1), f2(Y, θ2), and f3(Z, θ3), respectively. Here, X, Y, and Z represent feature vectors of current user behavior information, current device status information, and current network environment information, respectively, while θ1, θ2, and θ3 represent specific parameters of these information. For instance, θ1 could include parameters such as the user's average daily login frequency, login time period, and frequency of accessing sensitive operations, with specific values ​​such as 5 logins per day, primarily concentrated during weekdays, and 2 sensitive operations per month. θ2 could include parameters covering the device's operating system version, last update time, and the existence of known vulnerabilities, with specific values ​​such as the latest version of Windows 10, the last update being 7 days ago, and the absence of known vulnerabilities. θ3 could include parameters covering network connection stability, IP address geolocation, and abnormal network traffic fluctuations, with specific values ​​such as a stable wired connection, a specific location, monthly changes, and peak weekday traffic between 10 AM and 2 PM.

[0062] In some embodiments of this application, the triggering event corresponding to the access request may also be considered, and access control may be accurately performed based on the triggering event. That is, optionally, in some embodiments of this application, the step "determine the access assessment result based on the current risk assessment result and the target risk threshold" includes: Determine the triggering event corresponding to the access request; The access assessment result is determined based on the current risk assessment result, the target risk threshold, and the triggering event.

[0063] For example, if the triggering event is "accessing highly sensitive data," the system may require additional verification even if the current risk assessment result is slightly below the target risk threshold; conversely, if the triggering event is "viewing publicly available information," the system may allow access even if the risk assessment result is slightly above the threshold. This trigger-based adjustment makes access control more flexible and precise.

[0064] In this embodiment, a data storage module is also included to store user behavior information, device status information, access permission adjustment records, and risk assessment results for subsequent analysis and auditing. This module ensures data integrity and security, and supports rapid retrieval and analysis. Simultaneously, the data storage module also provides data support for future model optimization and policy adjustments, ensuring that access control can be continuously improved and evolved.

[0065] In this embodiment of the application, for multi-user access, some risk assessment processes and responses can be deployed on the network edge device where the user is located to reduce the processing burden on the accessed system or device.

[0066] In summary, the embodiments of this application intelligently identify access assessment results based on an access assessment model. Compared with traditional solutions that rely on predefined access control policies, the embodiments of this application provide more comprehensive security threat identification, more accurate access control, and higher security.

[0067] Among these measures, the accuracy of access control is improved by dynamically updating risk thresholds based on changes in scenarios and risk levels.

[0068] To facilitate better implementation of the access control method of this application, this application also provides an access control device based on the above-described access control method. The meanings of the terms used are the same as in the access control method described above, and specific implementation details can be found in the descriptions of the method embodiments.

[0069] Please see Figure 3 , Figure 3 This is a schematic diagram of the access control device provided in an embodiment of this application. The access control device can be specifically as follows: The acquisition module 201 is used to acquire current access evaluation information in response to the detection of an access request from a target user; The determining module 202 is used to determine the access assessment result corresponding to the current access assessment information through the access assessment model; The control module 203 is used to perform access control on the target user based on the access assessment results.

[0070] Optionally, in some embodiments of this application, determining the access assessment result corresponding to the current access assessment information through an access assessment model includes: Input the current access assessment information into the access assessment model to obtain the current risk assessment result; The access assessment result is determined based on the current risk assessment result and the target risk threshold.

[0071] Optionally, in some embodiments of this application, obtaining the target risk threshold includes: Acquire scene change information, which is determined based on the difference between historical access evaluation information and current access evaluation information; Determine the threshold adjustment value based on the scene change information; The target risk threshold is obtained by adjusting the historical risk threshold based on the threshold adjustment value.

[0072] Optionally, in some embodiments of this application, before determining the threshold adjustment value based on the scene change information, the method further includes: Obtain assessment result difference information, which is determined based on the difference between historical risk assessment results and the current risk assessment results; Determining the threshold adjustment value based on the scene change information includes: The threshold adjustment value is determined based on the difference information in the evaluation results and the scene change information.

[0073] Optionally, in some embodiments of this application, obtaining the target risk threshold includes: Retrieve historical access control results; Update the cumulative reward based on the historical access control results; The target risk threshold is determined using a reinforcement learning strategy based on the updated cumulative rewards.

[0074] Optionally, in some embodiments of this application, the current access assessment information includes current user behavior information, current device status information, and current network environment information; the access assessment model includes a first assessment module, a second assessment module, and a third assessment module; The step of inputting the current access assessment information into the access assessment model to obtain the current risk assessment result includes: The current user behavior information is input into the first evaluation module to obtain the behavior evaluation result; The current device status information is input into the second evaluation module to obtain the device evaluation result; The current network environment information is input into the third evaluation module to obtain the network evaluation result; The current risk assessment result is generated based on the behavior assessment result, the device assessment result, the network assessment result, and the preset weights.

[0075] Optionally, in some embodiments of this application, determining the access assessment result based on the current risk assessment result and the target risk threshold includes: Determine the triggering event corresponding to the access request; The access assessment result is determined based on the current risk assessment result, the target risk threshold, and the triggering event.

[0076] In this embodiment, the acquisition module 201 acquires current access assessment information in response to detecting an access request from a target user, the determination module 202 determines the access assessment result corresponding to the current access assessment information through an access assessment model, and the control module 203 performs access control on the target user based on the access assessment result.

[0077] In this application embodiment, access assessment results are intelligently identified based on an access assessment model. Compared with traditional solutions that rely on predefined access control policies, this application embodiment offers more comprehensive security threat identification, more accurate access control, and higher security.

[0078] In addition, this application also provides an electronic device, such as Figure 4 As shown, it illustrates the structural diagram of the electronic device involved in this application, specifically: The electronic device may include components such as a processor 301 with one or more processing cores, a memory 302 with one or more computer-readable storage media, a power supply 303, and an input unit 304. Those skilled in the art will understand that... Figure 4 The electronic device structure shown does not constitute a limitation on the electronic device and may include more or fewer components than shown, or combine certain components, or have different component arrangements. Wherein: The processor 301 is the control center of the electronic device. It connects various parts of the electronic device via various interfaces and lines, and performs various functions and processes data by running or executing software programs and / or modules stored in the memory 302, and by calling data stored in the memory 302, thereby providing overall monitoring of the electronic device. Optionally, the processor 301 may include one or more processing cores; preferably, the processor 301 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 301.

[0079] The memory 302 can be used to store software programs and modules. The processor 301 executes various functional applications and data processing by running the software programs and modules stored in the memory 302. The memory 302 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 302 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 302 may also include a memory controller to provide the processor 301 with access to the memory 302.

[0080] The electronic device also includes a power supply 303 that supplies power to the various components. Preferably, the power supply 303 can be logically connected to the processor 301 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. The power supply 303 may also include one or more DC or AC power supplies, recharging systems, power equipment debugging circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0081] The electronic device may also include an input unit 304, which can be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control.

[0082] Although not shown, the electronic device may also include a display unit, etc., which will not be described in detail here. Specifically, in this embodiment, the processor 301 in the electronic device loads the executable files corresponding to the processes of one or more applications into the memory 302 according to the following instructions, and the processor 301 runs the applications stored in the memory 302, thereby implementing the steps in any of the access control methods provided in the embodiments of this application.

[0083] In this embodiment of the application, in response to the detection of an access request from a target user, current access assessment information is obtained; the access assessment result corresponding to the current access assessment information is determined through an access assessment model; and access control is performed on the target user based on the access assessment result.

[0084] In this application embodiment, access assessment results are intelligently identified based on an access assessment model. Compared with traditional solutions that rely on predefined access control policies, this application embodiment offers more comprehensive security threat identification, more accurate access control, and higher security.

[0085] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0086] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0087] Therefore, this application provides a computer-readable storage medium storing a computer program that can be loaded by a processor to execute the steps of any of the access control methods provided in this application.

[0088] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0089] The computer-readable storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0090] Since the instructions stored in the computer-readable storage medium can execute the steps of any of the access control methods provided in this application, the beneficial effects that any of the access control methods provided in this application can achieve can be realized, as detailed in the preceding embodiments, and will not be repeated here.

[0091] The above provides a detailed description of an access control method, apparatus, electronic device, and computer-readable storage medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, those skilled in the art will recognize that there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. An access control method, characterized in that, The method includes: In response to the detection of an access request from a target user, obtain current access assessment information; The access assessment result corresponding to the current access assessment information is determined by the access assessment model; Access control is applied to the target user based on the access assessment results.

2. The access control method according to claim 1, characterized in that, The step of determining the access assessment result corresponding to the current access assessment information through the access assessment model includes: Input the current access assessment information into the access assessment model to obtain the current risk assessment result; The access assessment result is determined based on the current risk assessment result and the target risk threshold.

3. The access control method according to claim 2, characterized in that, The acquisition of the target risk threshold includes: Acquire scene change information, which is determined based on the difference between historical access evaluation information and current access evaluation information; Determine the threshold adjustment value based on the scene change information; The target risk threshold is obtained by adjusting the historical risk threshold based on the threshold adjustment value.

4. The access control method according to claim 3, characterized in that, Before determining the threshold adjustment value based on the scene change information, the method further includes: Obtain assessment result difference information, which is determined based on the difference between historical risk assessment results and the current risk assessment results; Determining the threshold adjustment value based on the scene change information includes: The threshold adjustment value is determined based on the difference information in the evaluation results and the scene change information.

5. The access control method according to claim 2, characterized in that, The acquisition of the target risk threshold includes: Retrieve historical access control results; Update the cumulative reward based on the historical access control results; The target risk threshold is determined using a reinforcement learning strategy based on the updated cumulative rewards.

6. The access control method according to claim 2, characterized in that, The current access assessment information includes current user behavior information, current device status information, and current network environment information; the access assessment model includes a first assessment module, a second assessment module, and a third assessment module. The step of inputting the current access assessment information into the access assessment model to obtain the current risk assessment result includes: The current user behavior information is input into the first evaluation module to obtain the behavior evaluation result; The current device status information is input into the second evaluation module to obtain the device evaluation result; The current network environment information is input into the third evaluation module to obtain the network evaluation result; The current risk assessment result is generated based on the behavior assessment result, the device assessment result, the network assessment result, and the preset weights.

7. The access control method according to claim 2, characterized in that, The step of determining the access assessment result based on the current risk assessment result and the target risk threshold includes: Determine the triggering event corresponding to the access request; The access assessment result is determined based on the current risk assessment result, the target risk threshold, and the triggering event.

8. An access control device, characterized in that, The device includes: The acquisition module is used to obtain current access evaluation information in response to the detection of an access request from a target user; The determination module is used to determine the access assessment result corresponding to the current access assessment information through the access assessment model; The control module is used to perform access control on the target user based on the access assessment results.

9. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the steps of the access control method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the access control method as described in any one of claims 1-7.

Images