Network access control methods that combine traditional admission and zero-trust architectures

Abstract

This invention discloses a network access control method combining traditional admission and zero-trust architectures, relating to the field of network access control technology. The method includes the following steps: after identifying session re-authentication triggered by traditional admission, the connection identity fingerprint, device trust digest, and access behavior time series before and after authentication are collected. A fusion discrimination matrix is ​​constructed using a similarity convolution function to determine whether session interruption reconstruction behavior exists. After determining that session interruption reconstruction behavior exists, a fusion input set containing access context state and historical behavior label sequences is generated. A context update candidate set is constructed using an attention weighted model. This invention solves the problem of zero-trust permission continuation caused by traditional admission re-authentication, achieving accurate identification of session interruption reconstruction behavior and dynamic context update, ensuring a secure closed loop for access control.

Description

Technical Field

[0001] This invention relates to the field of network access control technology, and more specifically to a network access control method that combines traditional access control with a zero-trust architecture. Background Technology

[0002] Network access control combining traditional admission control and zero-trust architecture refers to introducing the zero-trust security concept into existing boundary-based traditional admission control to achieve a more dynamic, fine-grained, and context-aware access management mechanism. Traditional admission control typically relies on fixed network boundaries, determining access permissions through static parameters such as user authentication (username and password), device verification, or access location, assuming the internal network is trustworthy, and is suitable for closed management scenarios. Zero-trust architecture, on the other hand, completely abandons the assumption of "trustworthy internal network," emphasizing the principle of "never trust, continuous verification," performing real-time verification and least privilege authorization on all access requests. Current integration technologies mainly adopt a "dual-engine" or "overlay" converged architecture, that is, while retaining traditional admission processes (such as VPN access control, IP / MAC binding, role division, etc.), it integrates core elements of zero-trust architecture, such as context-based multi-factor authentication (MFA), continuous session behavior analysis (such as UEBA), fine-grained policy evaluation (such as ABAC), micro-segmentation isolation, and real-time policy delivery. Its typical implementation process usually includes the following core steps: First, the initial authentication stage, which combines traditional static access information with dynamic factors of zero trust (such as device health status, location information, etc.); second, the access request authorization stage, which uses a policy engine for real-time evaluation; third, the session maintenance stage, which dynamically adjusts the process by continuously monitoring behavioral changes and threat perception results; fourth, the resource access control stage, which uses micro-segmentation technology to control user accessibility at the resource level; and finally, the log auditing and response stage, which combines traditional auditing mechanisms with AI-powered intelligent threat analysis to block and track violations, thereby achieving a higher level of security and more compatible network access control mode.

[0003] The existing technology has the following shortcomings:

[0004] In implementing network access control by combining traditional admission and zero-trust architectures, when users complete access authentication through traditional admission mechanisms (such as VPN combined with dynamic passwords) and a periodic session re-authentication policy is set in the traditional admission system (e.g., triggering mandatory re-authentication every 8 hours), there may be situations where access control anomalies occur due to reconnection after session interruption. Specifically, after a user's VPN session expires and is forcibly disconnected by the system, immediately re-establishing the VPN connection, although considered a new session establishment process in the traditional admission system, the current zero-trust architecture typically relies on an independent policy engine for access control judgments. This policy engine cannot perceive the interruption and reconstruction of the underlying VPN connection state, causing the zero-trust architecture to continue using the access context before the disconnection (including user identity status, device trust information, behavioral models, etc.) to execute authorization policies. Due to the lack of a session state linkage mechanism, the zero-trust architecture does not re-perform trust assessment and permission verification for the re-established new session, resulting in an implicit continuation of access permissions. Therefore, existing network access control technologies that combine traditional admission and zero-trust architectures cannot update the access context and behavior judgment criteria on which the zero-trust architecture relies in a timely manner based on the session interruption and reconstruction behavior in the case of session re-authentication triggered by traditional admission. This will cause the system to skip the re-authorization process that should be executed, so that the previously invalidated permissions are incorrectly inherited in the new session, thereby causing serious security risks such as session hijacking, permission abuse, and unauthorized access to resources.

[0005] The information disclosed in the background section is only intended to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0006] The purpose of this invention is to provide a network access control method that combines traditional admission and zero-trust architecture to solve the problems mentioned in the background art.

[0007] To achieve the above objectives, the present invention provides the following technical solution: a network access control method combining traditional admission and zero-trust architectures, specifically including the following steps:

[0008] S1. Extract the authentication trajectory data generated during the user access process, and identify the session re-authentication situation triggered by traditional admission by constructing a data structure that includes authentication cycle timestamps, connection state transition sequences and breakpoint durations, based on dual time window sliding difference calculation.

[0009] S2. After identifying the session re-authentication situation triggered by traditional access control, collect the connection identity fingerprint, device trust digest and access behavior time series before and after authentication, and construct a fusion discrimination matrix through similarity convolution function to determine whether there is session interruption reconstruction behavior.

[0010] S3. After determining that there is a session interruption reconstruction behavior, generate a fused input set containing the access context state and historical behavior label sequence, construct a context update candidate set through an attention weighted model, perform mapping matching between the context update candidate set and the old context, and output the update path of access context and behavior judgment basis.

[0011] S4. Based on the update path of the access context and behavior judgment criteria, perform granular cascaded state replacement, map and transfer the identity status, device trust score and behavior pattern weight, and eliminate invalid behavior features through sequence adversarial testing mechanism to construct the updated access context and behavior judgment criteria.

[0012] S5. Collect state change factors before and after the update to construct a trust flow change trajectory map. Model the state jump intensity and behavior prediction offset based on graph convolutional neural network, generate a dynamic authorization control sequence, and perform differentiated permission adjustment according to the control sequence to complete access control.

[0013] Preferably, S1 is as follows:

[0014] Extract authentication trajectory data generated during user access, specifically including continuously collecting access time, authentication success time, connection disconnection time and reconnection time for each user network access, and construct an authentication trajectory data sequence in chronological order;

[0015] Based on the authentication trajectory data sequence, a data structure is constructed that includes authentication cycle timestamp, connection state transition sequence and breakpoint duration. The authentication cycle timestamp is calculated from the interval between adjacent successful authentication timestamps. The connection state transition sequence is generated by marking connection state switching behavior and encoding it sequentially. The breakpoint duration is formed by the time difference between connection disconnection and reconnection.

[0016] The method of identifying session re-authentication triggered by traditional admission based on dual-time-window sliding difference calculation includes calculating the change gradient of authentication cycle timestamp in a preset short time window and a preset long time window respectively, generating corresponding short-cycle difference values ​​and long-cycle difference values, and obtaining the re-authentication index by weighted superposition. When the re-authentication index exceeds the set dynamic offset threshold, it is identified as a session re-authentication triggered by traditional admission.

[0017] Preferably, S2 specifically includes the following steps:

[0018] S201. Collect connection identity fingerprints, device trust digests, and access behavior time series before and after authentication. Specifically, after identifying session re-authentication triggered by traditional access control, construct authentication boundaries based on two time points before and after the re-authentication event. Extract network connection source addresses, encryption algorithm identifiers, and communication protocol parameters before and after the boundary as connection identity fingerprints. Perform digest calculation on the terminal's hardware sequence, system security patch status, and trust assessment label to obtain device trust digests. Collect user access request times and operation command sequences before and after re-authentication to form access behavior time series.

[0019] S202. Based on the connection identity fingerprint, device trust digest and access behavior time series, construct a standard vector input. Perform local window sliding convolution operation between each input vector through the similarity convolution function to extract multi-dimensional similarity features. Generate a fusion discrimination matrix through channel cross convolution. This fusion discrimination matrix is ​​used to characterize the fine-grained differences between various types of information before and after authentication reconstruction.

[0020] S203. In the fusion discrimination matrix, determine whether the matching score of the connection identity fingerprint is greater than the preset identity trust threshold, and at the same time determine whether the offset distance of the device trust digest is less than the preset device stability threshold, and determine whether the time sequence overlap rate of the access behavior time series is higher than the preset behavior consistency threshold. When all three conditions are met, it is determined that there is a session interruption reconstruction behavior.

[0021] Preferably, S202 specifically refers to:

[0022] The connection identity fingerprint, device trust digest, and access behavior time series are converted into fixed-length standard vector inputs, and the three standard vector inputs are normalized respectively.

[0023] Based on standard vector input, the three standard vectors are subjected to equal-step local window sliding convolution operation through similarity convolution function. Local similarity features between continuous dimensions are extracted in each sliding window to form a corresponding set of local feature vectors. A channel mapping index structure is introduced between the standard vectors to perform channel cross convolution operation in a fixed pairing manner to extract the non-linear dependency between cross channels.

[0024] The local feature vector set is concatenated and concatenated with the channel cross-convolution result to generate a fusion discriminant matrix. Each column of the fusion discriminant matrix represents the interaction feature dimension between standard vector pairs within the local sliding window, and each row represents the degree of similarity difference between different information sources, which is used to characterize the fine-grained differences between various types of information before and after authentication reconstruction.

[0025] Preferably, S203 is as follows:

[0026] The connection identity fingerprint matching score item is extracted from the fusion discrimination matrix. The embedding values ​​of each field in the original connection identity fingerprint vector and the current connection identity fingerprint vector are compared. The cosine similarity is used to calculate the matching score value and determine whether the matching score value is greater than the preset identity trust threshold. This is used to determine the degree to which the connection identity information remains consistent before and after authentication.

[0027] The offset distance of the device trust digest is calculated. By constructing the Euclidean distance mapping between the device trust digest before and after authentication, the numerical difference of the device trust digest in the multidimensional security factor space is extracted as the offset distance value. It is then determined whether the offset distance value is less than the preset device stability threshold, which is used to reflect the degree of change of the device's trusted state during the session reconstruction process.

[0028] The temporal overlap rate of access behavior time series is evaluated by aligning the behavior tag sequences before and after authentication with time windows and calculating the synchronization ratio of matching tags in the time dimension as a temporal overlap rate indicator. It is then determined whether this indicator is higher than the preset behavior consistency threshold. When the connection identity fingerprint matching score is greater than the preset identity trust threshold, the device trust digest offset distance is less than the preset device stability threshold, and the temporal overlap rate is higher than the preset behavior consistency threshold, it is determined that there is a session interruption reconstruction behavior.

[0029] Preferably, S3 is as follows:

[0030] After confirming the existence of session interruption and reconstruction behavior, the authentication status, device trust parameters, and policy hit logs in the current access session are extracted and encoded to form an access context state vector. At the same time, historical behavior label sequences are extracted and time-series feature embedding is performed to construct a fusion input set containing access context state and historical behavior label sequences, which is used to express the access context evolution trend.

[0031] The fused input set is fed into the attention-weighted model. By constructing a bidirectional attention mapping structure between context state and behavior label, the dependence strength between highly correlated features is captured, and a context update candidate set with attention weights is generated, where each candidate corresponds to a state fragment with the possibility of context correction.

[0032] The context update candidate set is matched with the old context at the feature level. By establishing a vector alignment mechanism between identity status features, device trust factor and behavior discrimination label, the similarity gradient change between features of each dimension is calculated, and the matching matrix that identifies the mapping relationship between each candidate and the old context is output.

[0033] The optimal update path is extracted based on the feature mapping results in the matching matrix. A dimension-by-dimensional replacement operation is performed on the access context state and behavior judgment criteria, and the update path of the access context and behavior judgment criteria for subsequent trust assessment is output.

[0034] Preferably, S4 is as follows:

[0035] Based on the update path of the access context and behavior judgment criteria, the feature mapping pairs identified in the update path are parsed, and a granular cascaded mapping table is constructed based on the mapping index of the update path. Multi-level replacement channels are established according to the three dimensions of identity status, device trust score and behavior pattern weight, so as to realize the step-by-step mapping and positioning of status factors in the access context.

[0036] Based on the granular cascaded mapping table, the mapping and replacement of identity label weight values ​​are performed in the identity status dimension, the numerical transfer of various device trust rating factors is completed in the device trust rating dimension, and the weight coefficients between historical behavior patterns and reconstructed behavior patterns are continuously interpolated and mapped in the behavior pattern weight dimension to complete the cascaded replacement operation of the status.

[0037] A sequence adversarial testing mechanism is constructed. The replaced behavior pattern is input into the sequence discriminator network and the generator network to form an adversarial training. The generator network reconstructs the old behavior features, and the discriminator network identifies the feature differences between the reconstruction and the actual behavior. The segments with inconsistency or low confidence in continuous prediction are extracted and removed as invalid behavior features.

[0038] The identity status, device trust score, and behavior pattern weights processed by the granular cascaded state replacement and sequence adversarial testing mechanism are concatenated to construct the updated access context and behavior judgment criteria. A data structure for subsequent dynamic authorization reasoning is constructed through standardized coding.

[0039] Preferably, S5 is as follows:

[0040] Collect state change factors before and after the update, including the weight difference of identity status labels, the numerical offset of each security factor of device trust score, and the adjustment ratio of behavior pattern weight. Construct a factor change sequence according to the collection order, and use each type of state factor as a graph node and the dependency coupling relationship between factors as graph edges to establish a trust flow change trajectory graph containing time index and change weight, expressing the multi-dimensional evolution path between identity, device and behavior.

[0041] The trust flow change trajectory map is input into the graph convolutional neural network for modeling. The feature perturbation value of the node in the graph after multiple rounds of convolution is calculated as the state transition intensity. The error is fitted between the offset position of each label in the behavior pattern on the prediction time line and the original trajectory, and quantified as the behavior prediction offset. The two types of indicators are used to measure the degree of state change and the degree of deviation of behavior trajectory, respectively, and jointly generate a dynamic authorization control sequence.

[0042] Based on the state transition intensity and behavior prediction offset contained in the dynamic authorization control sequence, the permission adjustment policy rule set is matched to perform fine-grained differentiated adjustments on the access permissions, operation scope and policy restriction parameters of the access resources, thereby realizing dynamic access control.

[0043] The technical effects and advantages provided by the present invention in the above technical solution are as follows:

[0044] 1. This invention enables high-precision identification and deep context-linked updates of traditional session re-authentication behavior, enhancing the perception of underlying connection state changes in zero-trust architectures. By extracting dynamic features of the authentication trajectory through sliding differential extraction under dual time windows, it effectively captures the triggering events of periodic session re-authentication in traditional admission mechanisms. Furthermore, based on a fusion discrimination matrix constructed using a similarity convolution function, it accurately identifies the consistency of connection identity, device trust, and behavior sequences before and after authentication, determining whether session interruption and reconstruction behavior exists. This provides zero-trust systems with connection continuity perception capabilities at the behavioral semantic level, compensating for the structural defect of current zero-trust policy engines that cannot perceive underlying connection state changes.

[0045] 2. This invention also introduces an attention-weighted model and a granular cascaded state replacement mechanism to achieve dynamic evolution and fine-grained correction of access context and behavior judgment criteria. Furthermore, it combines a sequence adversarial testing mechanism to eliminate invalid behavior features, ensuring the accuracy and reliability of context updates. Based on this, a trust flow change trajectory graph is constructed and fused with a graph convolutional neural network for multi-dimensional state modeling. This quantifies the behavior prediction offset and state transition intensity, generating a dynamic authorization control sequence, ultimately achieving differentiated and evolutionarily adjustable access permissions. This scheme realizes state linkage, policy closure, and permission review between traditional access control and zero-trust architectures, improving the real-time performance, accuracy, and security protection capabilities of access control, and effectively preventing security risks such as session hijacking and permission abuse. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0047] Figure 1 This is a flowchart illustrating the network access control method of the present invention that combines traditional admission and zero-trust architecture. Detailed Implementation

[0048] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that the description of this disclosure will be more complete and fully convey the concept of the exemplary embodiments to those skilled in the art.

[0049] This invention provides, for example Figure 1 The network access control method shown combines traditional admission and zero-trust architectures, specifically including the following steps:

[0050] S1. Extract the authentication trajectory data generated during the user access process, and identify the session re-authentication situation triggered by traditional admission by constructing a data structure that includes authentication cycle timestamps, connection state transition sequences and breakpoint durations, based on dual time window sliding difference calculation.

[0051] In this embodiment, S1 specifically refers to:

[0052] Extract authentication trajectory data generated during user access, specifically including continuously collecting access time, authentication success time, connection disconnection time and reconnection time for each user network access, and construct an authentication trajectory data sequence in chronological order;

[0053] Extracting authentication trajectory data generated during user access refers to continuously capturing key time events related to access behavior throughout the entire process of a user accessing the network through traditional access mechanisms, and organizing these events into a structured data sequence according to their chronological order. Authentication trajectory data mainly includes four core time points: access time, authentication success time, connection disconnection time, and reconnection time. Access time represents the time when the user initiates a connection request; authentication success time represents the time when the authentication service confirms the user's identity and allows the connection; connection disconnection time records the time when the connection is interrupted due to session timeout or active exit; and reconnection time identifies the time when the user re-establishes a new connection after a disconnection. In practical implementation, components such as access control proxy nodes, VPN gateways, AAA servers, and authentication log systems can be used to monitor user-initiated network connection requests in real time and record the timestamps of each request and response event. For example, during VPN connection establishment, an event listening mechanism can record the handshake initiation and success times; during connection disconnection, the disconnection time can be recorded through heartbeat timeout, link loss, or a host issuing a close request signal; and during reconnection, a new authentication process is triggered, and the reconnection time is recorded. Organizing these time points chronologically to construct an authentication behavior sequence helps in identifying periodic changes in user connection patterns and determining whether re-authentication behavior occurs within a short period. This approach meticulously reconstructs the user session lifecycle using time-series data, laying a data foundation for identifying re-authentication situations triggered by traditional admission criteria. It features non-intrusiveness, low coupling, and high real-time performance, making it suitable for complex, multi-source access scenarios.

[0054] Based on the authentication trajectory data sequence, a data structure is constructed that includes authentication cycle timestamp, connection state transition sequence and breakpoint duration. The authentication cycle timestamp is calculated from the interval between adjacent successful authentication timestamps. The connection state transition sequence is generated by marking connection state switching behavior and encoding it sequentially. The breakpoint duration is formed by the time difference between connection disconnection and reconnection.

[0055] Constructing a data structure that includes authentication cycle timestamps, connection state transition sequences, and breakpoint durations refers to further processing and organizing the raw time event data into a structured representation that can be used for behavior recognition and pattern analysis after the authentication trajectory data extraction is completed. The authentication cycle timestamp represents the time interval between two consecutive successful authentication events. In practice, it can iterate through the time series formed by successful authentication timestamps, perform difference calculations on adjacent time points, and record each difference as the time span of an authentication cycle to reflect the strength of the periodicity of the user session. The connection state transition sequence is used to characterize the connection state changes of the user throughout the entire session lifecycle. Typically, each state, such as "connection established," "connection interrupted," and "reconnection successful," is assigned a unique discrete label code. Then, state identifiers are generated sequentially according to the time order of different events in the authentication trajectory data, thus forming a connection state code string. For example, "1-2-3-1" represents a process from access to disconnection and reconnection. The breakpoint duration is used to measure the length of time it takes to re-establish a connection after a connection interruption. It can be calculated by taking the difference between the connection disconnection time and the reconnection time, aligning this value with the position of the state transition sequence, and storing it to form a complete connection interruption analysis index. Taking a real-world scenario as an example, if a user successfully authenticates at 9:00 AM, disconnects at 12:00 PM, and reconnects and successfully authenticates at 12:05 PM, the authentication cycle timestamp is 3 hours, the connection state transition sequence is "access-disconnect-reconnect," and the breakpoint duration is 5 minutes. This data structure, as an intermediate carrier, not only efficiently expresses user access behavior but also provides highly reliable basic feature input for subsequent judgments regarding whether traditional access control-triggered session re-authentication exists.

[0056] The authentication cycle timestamp is a temporal difference metric reflecting user access frequency and connection stability, capturing the temporal evolution characteristics between authentication events through differential calculation. The connection state transition sequence reflects behavioral patterns throughout the user connection lifecycle, serving as a key method for converting discrete events into sequence encoding, thus providing conditions for sequence pattern learning and state machine modeling. Breakpoint duration, as an important dimension for discriminating session interruptions, reveals the differences between short-term and long-term interruptions, and is particularly valuable in identifying the presence of re-authentication intent. These three elements are logically independent and functionally complementary, collectively forming a temporal structure expression model for authentication behavior analysis. This model possesses good computability, scalability, and portability, facilitating high-precision modeling and dynamic identification of network access behavior in complex environments.

[0057] The method of identifying session re-authentication triggered by traditional admission based on dual-time-window sliding difference calculation includes calculating the change gradient of authentication cycle timestamp in a preset short time window and a preset long time window respectively, generating corresponding short-cycle difference values ​​and long-cycle difference values, and obtaining the re-authentication index by weighted superposition. When the re-authentication index exceeds the set dynamic offset threshold, it is identified as a session re-authentication triggered by traditional admission.

[0058] The process of identifying session re-authentication triggered by traditional admission is based on a dual-time-window sliding difference calculation method. Specifically, a shorter time span sliding window and a longer time span sliding window are first set, each extracting a corresponding subset of data from the authentication cycle timestamp sequence. Within each sliding window, the difference between adjacent authentication cycle timestamps is calculated sequentially to reflect the fluctuation of authentication behavior within a local time period. The shorter time window is used to capture abrupt changes in recent authentication activity, such as repeated authentication within a short period; the longer time window is used to statistically analyze the long-term average authentication rhythm, forming a stable baseline. The difference values ​​from the two windows are aggregated to generate short-cycle difference values ​​and long-cycle difference values, respectively. These are then superimposed using a preset weighting strategy to generate a re-authentication index representing the current session's trend. If this re-authentication index exceeds a preset dynamic offset threshold, it indicates a significant shift in the current session cycle, and the system thus determines it as a session re-authentication triggered by traditional admission. To illustrate with a practical example, if a user normally authenticates every 4 hours within an 8-hour period, but suddenly initiates another authentication operation within 1 hour, the short-cycle difference value fluctuates drastically. The resulting re-authentication index will significantly exceed the threshold, thus being identified by the system as a session re-authentication behavior.

[0059] Dual-time-window sliding difference is a time-series analysis method that combines local sensitivity with overall trend awareness. It can simultaneously perceive the differences between short-term mutations and long-term stability, achieving more robust behavior recognition. A preset short-time window enhances the response capability to transient abnormal authentication frequencies, while a preset long-time window provides a dynamic background benchmark, reducing the false recognition rate of occasional behaviors. A set dynamic offset threshold serves as the criterion for determining whether behavioral fluctuations constitute anomalies. This threshold is typically generated based on historical data analysis and adaptive parameter tuning mechanisms, flexibly adapting to the access behavior patterns of different users and business environments. This combined structure possesses high sensitivity and a low error rate, effectively identifying potential connection behavior mutations caused by traditional access re-authentication mechanisms, providing a reliable basis for subsequent zero-trust architecture context updates and permission adjustments.

[0060] S2. After identifying the session re-authentication situation triggered by traditional access control, collect the connection identity fingerprint, device trust digest and access behavior time series before and after authentication, and construct a fusion discrimination matrix through similarity convolution function to determine whether there is session interruption reconstruction behavior.

[0061] In this embodiment, S2 specifically includes the following steps:

[0062] S201. Collect connection identity fingerprints, device trust digests, and access behavior time series before and after authentication. Specifically, after identifying session re-authentication triggered by traditional access control, construct authentication boundaries based on two time points before and after the re-authentication event. Extract network connection source addresses, encryption algorithm identifiers, and communication protocol parameters before and after the boundary as connection identity fingerprints. Perform digest calculation on the terminal's hardware sequence, system security patch status, and trust assessment label to obtain device trust digests. Collect user access request times and operation command sequences before and after re-authentication to form access behavior time series.

[0063] After identifying session re-authentication triggered by traditional access control, an authentication boundary can be constructed using two time points before and after re-authentication. The authentication boundary is used to delineate the preceding and following stages of session behavior. Before the authentication boundary, the source address, encryption algorithm identifier, and communication protocol parameters of the user's network connection are extracted. This dimensional information is encapsulated into a connection identity fingerprint, representing the connection environment characteristics of a single network access. To obtain device trust information, a digest calculation needs to be performed on the terminal device's hardware serial number, operating system patch status, security configuration file, and trust assessment label. This calculation can be completed based on a hash mapping combined with a classification vector transformation model, thus forming a stable device trust digest. The construction of access behavior relies on continuous collection of user access request logs, including the access request initiation time, request target identifier, request type, and the control command code corresponding to each operation. These are combined chronologically to form an access behavior time series, used to characterize the user's behavioral path during the session. For example, if a user frequently accesses an internal API interface within 30 seconds before re-authentication, and continues to access the same interface within 1 minute after re-authentication, using the same protocol parameters and encryption method, the three types of data constructed will be highly continuous, providing a basis for subsequent judgment on whether session interruption and reconstruction behavior has occurred.

[0064] The connection identity fingerprint, device trust digest, and access behavior time series each serve different tasks in representing the access context. The connection identity fingerprint describes the session's access path through network source attributes, including the source address, transport protocol, and encryption negotiation parameters, used to identify whether the user has changed their network environment or connection method. The device trust digest, calculated by combining static hardware identifiers and dynamic security state parameters, reflects the volatility of device trustworthiness and is a core indicator for judging device security stability. The access behavior time series provides continuity clues at the user behavior level, reflecting the temporal continuity and consistency of their operations. All three types of data are collected through targeted acquisition and standardized normalization to ensure a unified conversion into a feature vector input structure. The selection of each feature considers the dimensions most likely to change when traditional access control mechanisms trigger session re-authentication, using temporal differences and state shifts as metrics to ensure the data accurately reconstructs the differences before and after authentication, thus providing a reliable input basis for subsequent similarity analysis and difference judgment.

[0065] S202. Based on the connection identity fingerprint, device trust digest and access behavior time series, construct a standard vector input. Perform local window sliding convolution operation between each input vector through the similarity convolution function to extract multi-dimensional similarity features. Generate a fusion discrimination matrix through channel cross convolution. This fusion discrimination matrix is ​​used to characterize the fine-grained differences between various types of information before and after authentication reconstruction.

[0066] S203. In the fusion discrimination matrix, determine whether the matching score of the connection identity fingerprint is greater than the preset identity trust threshold, and at the same time determine whether the offset distance of the device trust digest is less than the preset device stability threshold, and determine whether the time sequence overlap rate of the access behavior time series is higher than the preset behavior consistency threshold. When all three conditions are met, it is determined that there is a session interruption reconstruction behavior.

[0067] The fusion discrimination matrix separately judges whether the matching score of the connection identity fingerprint is greater than a preset identity trust threshold, whether the offset distance of the device trust digest is less than a preset device stability threshold, and whether the time-series overlap rate of the access behavior time series is higher than a preset behavior consistency threshold. These three indicators are used together to determine whether session interruption and reconstruction behavior exists. This is to establish a more rigorous multi-factor cross-validation mechanism in network access control that integrates traditional admission and zero-trust architectures. Relying on a single information source for judgment is prone to misjudgment. For example, identity fingerprints may change slightly due to address switching, device digests may shift due to minor updates, and behavior sequences may be out of sync due to operation delays. Therefore, it is necessary to integrate multi-dimensional features and introduce trust judgment boundaries in a threshold manner. This approach can more accurately identify whether a user reconnects with the same identity environment after a forced VPN disconnection, based on excluding occasional or non-malicious disturbances. It can achieve accurate identification of implicit session continuation behavior in traditional admission re-authentication events, prevent abnormal permission inheritance, and improve the fine-grained dynamic response capability of the zero-trust architecture at the session control level.

[0068] In this embodiment, S202 specifically refers to:

[0069] The connection identity fingerprint, device trust digest, and access behavior time series are converted into fixed-length standard vector inputs, and the three standard vector inputs are normalized respectively.

[0070] To achieve unified modeling and processing of connection identity fingerprints, device trust digests, and access behavior time series, the three types of data must first be converted into fixed-length standard vector inputs. For connection identity fingerprints, source IP addresses, transport protocol types, and encryption algorithm identifiers can be mapped to numerical vectors using field-level encoding. For example, the IP address can be decomposed into four segments and normalized, and the protocol type can be converted into a vector through one-hot encoding, merging them into a set of structured representations with unified dimensions. Device trust digests consist of multiple security factors, such as hardware serial number hash values, operating system patch version hierarchical encoding, and security policy scores. Each factor is mapped to a fixed-length vector according to preset rules and then concatenated to form the overall device feature vector. Access behavior time series are constructed by mapping behavior instruction labels and normalizing access timestamps to build a time-behavior nested structure, and then segmented into nested behavior fragments through time windows, which are then converted into standardized behavior vectors. To ensure the comparability of the three vectors in subsequent calculations, normalization processing needs to be performed separately to scale the data of each dimension to a uniform range, such as through min-max scaling or Z-score normalization, to eliminate interference from different units. This standard vector construction and normalization process ensures a more balanced weight distribution of different information sources in similarity calculations when multimodal features are input. For example, if the change in identity fingerprint is small while the behavioral pattern changes significantly, the differences between standard vectors will be more concentrated in the shift of behavioral features, thereby improving the sensitivity of the discriminant matrix to continuous changes in conversation behavior. The standard vector structure established in this way not only supports subsequent sliding convolution operations but also has strong scalability, facilitating the extraction of multiple rounds of fused features and decision modeling.

[0071] Based on standard vector input, the three standard vectors are subjected to equal-step local window sliding convolution operation through similarity convolution function. Local similarity features between continuous dimensions are extracted in each sliding window to form a corresponding set of local feature vectors. A channel mapping index structure is introduced between the standard vectors to perform channel cross convolution operation in a fixed pairing manner to extract the non-linear dependency between cross channels.

[0072] To extract deep similarity features between different information sources based on standard vector inputs, a similarity convolution function framework needs to be constructed. This framework performs equal-step local window sliding convolution operations on the connection between the identity fingerprint vector, the device trust digest vector, and the access behavior time series vector. First, each standard vector is treated as a one-dimensional feature channel. During convolution, a fixed sliding step and window width are set, allowing the convolution kernel to slide segment by segment across each standard vector, extracting local similarity features between adjacent dimensions. Examples include extracting IP address change trends, subtle changes in device metrics, or repetitive segments in behavioral sequences. Each sliding computation generates a local feature segment, and all segments are combined to form a set of local feature vectors, structurally representing the similarity responses of each standard vector in different local regions. To further integrate deep nonlinear interaction features from different information sources, a channel mapping index structure is constructed between the three standard vector channels. Connections between the identity fingerprint and device trust digest, device trust digest and access behavior time series, and connection between the identity fingerprint and access behavior time series are combined in fixed pairs and cross-channel convolutions are performed. The core of cross-convolution lies in leveraging the nonlinear transformation capability of two different information vector pairs under the same convolution kernel to extract the coupling relationships hidden behind information heterogeneity. Examples include abrupt changes in the behavioral sequence of the same device when its network identity features remain unchanged, or jumps in the connection identity of different devices when their behaviors are consistent. This channel cross-processing can establish higher-dimensional dependency features, constructing more detailed discriminative representations between data before and after authentication reconstruction, significantly enhancing the expressive power and discrimination accuracy of subsequent discriminative matrices.

[0073] The local feature vector set is concatenated and concatenated with the channel cross-convolution result to generate a fusion discriminant matrix. Each column of the fusion discriminant matrix represents the interaction feature dimension between standard vector pairs within the local sliding window, and each row represents the degree of similarity difference between different information sources, which is used to characterize the fine-grained differences between various types of information before and after authentication reconstruction.

[0074] In the process of concatenating local feature vector sets with channel cross-convolution results, it is first necessary to ensure that the two feature sets have aligned dimensional indices and length matching relationships in terms of structure. The local feature vector sets are derived from the local similarity response features extracted by sliding convolution within local windows of the connection between identity fingerprints, device trust summaries, and access behavior time series within their respective standard vectors. The channel cross-convolution results contain feature representations of nonlinear interaction relationships between different information sources. Specifically, each local feature vector is first numbered according to window order to form a feature channel matrix. Then, the channel cross-convolution outputs are arranged according to the paired channel order, so that the corresponding convolution outputs can establish a one-to-one mapping with the local feature channels in terms of structure. Subsequently, a feature concatenation operation is used to concatenate the two along the channel dimension to generate a structured fusion discriminant matrix. In this fusion discriminant matrix, each column corresponds to the composite feature dimension of the standard vector pair within a certain sliding window region, reflecting its interaction response strength; each row represents the degree of similarity difference between different information source pairs under the same dimension, such as the correspondence between changes in network connection parameters and device status within a specific window. This structure allows for fine-grained judgments on identity continuity and behavioral consistency, effectively capturing the slight shifts in the authentication information structure in the time and feature domains before and after traditional access-triggered session re-authentication, thus providing discriminative quantitative evidence.

[0075] In this embodiment, S203 specifically refers to:

[0076] The connection identity fingerprint matching score item is extracted from the fusion discrimination matrix. The embedding values ​​of each field in the original connection identity fingerprint vector and the current connection identity fingerprint vector are compared. The cosine similarity is used to calculate the matching score value and determine whether the matching score value is greater than the preset identity trust threshold. This is used to determine the degree to which the connection identity information remains consistent before and after authentication.

[0077] In the process of extracting the connection identity fingerprint matching score, two complete connection identity fingerprint vectors need to be constructed first. One represents the original connection identity information before the authentication event, and the other represents the current connection identity information after the authentication event. The original connection identity fingerprint vector is generated by embedding and encoding fields such as the network connection source address, encryption algorithm identifier, and communication protocol parameters used when the user accesses the network in a preset order. Each field is converted into a vector representation through an independent embedding layer, and then concatenated along the channel dimension to form a complete vector. The current connection identity fingerprint vector is constructed in the same way and is used for comparison with the original vector. The two vectors are input into the similarity calculation unit, and the cosine similarity method is used to compare them. That is, the cosine value of the angle between the two vectors in high-dimensional space is calculated. The closer the value is to 1, the more consistent the two identity features are. This matching score reflects the degree of similarity between the current connection identity and the original identity and is a key indicator for judging identity continuity. In order to filter out minor differences under normal changes, a preset identity trust threshold needs to be set. This threshold is usually dynamically generated through historical identity continuity analysis or set manually. If the matching score is greater than this threshold, the connection identity fingerprint information before and after authentication is considered to be consistent; otherwise, there may be a risk of identity switching or forgery. This matching mechanism can accurately identify whether a user accesses the system using their original identity after re-authentication, preventing access control bypass caused by implicit identity changes.

[0078] The offset distance of the device trust digest is calculated. By constructing the Euclidean distance mapping between the device trust digest before and after authentication, the numerical difference of the device trust digest in the multidimensional security factor space is extracted as the offset distance value. It is then determined whether the offset distance value is less than the preset device stability threshold, which is used to reflect the degree of change of the device's trusted state during the session reconstruction process.

[0079] When calculating the offset distance of the device trust digest, it is first necessary to construct the device trust digest vectors before and after authentication. The device trust digest is generated based on a series of key security factors collected by the terminal before and after authentication, including multi-dimensional security parameters such as hardware serial number, operating system version number, security patch level, trusted platform module status, device boot integrity identifier, and malware scan results. Each security parameter is mapped to a dimension of the vector through numerical normalization or classification embedding, and the vectors are combined to form a high-dimensional device trust digest vector. To measure the degree of change in the trusted state of the device before and after authentication, Euclidean distance is used to perform spatial mapping calculation on the two digest vectors to obtain the numerical deviation between the two vectors in the multi-dimensional security factor space. The smaller the offset distance value, the more stable the device state. To determine whether this offset is within an acceptable range, a preset device stability threshold is introduced. This threshold is used to define the boundary between normal fluctuations and abnormal changes in the device state. It is usually obtained by statistically analyzing a large number of historical device behavior samples, or it can be adaptively set according to the device type. When the offset distance is less than the threshold, the device is considered to be stable before and after session reconstruction, with high trust continuity; otherwise, it indicates that the device may have experienced risky behaviors such as restarting, configuration changes, or tampering. This process can effectively screen for highly covert threats such as spoofed access and device cloning, and make more refined security judgments on re-authentication behavior under a zero-trust architecture.

[0080] The temporal overlap rate of access behavior time series is evaluated by aligning the behavior tag sequences before and after authentication with time windows and calculating the synchronization ratio of matching tags in the time dimension as a temporal overlap rate indicator. It is then determined whether this indicator is higher than the preset behavior consistency threshold. When the connection identity fingerprint matching score is greater than the preset identity trust threshold, the device trust digest offset distance is less than the preset device stability threshold, and the temporal overlap rate is higher than the preset behavior consistency threshold, it is determined that there is a session interruption reconstruction behavior.

[0081] When evaluating the temporal overlap rate of access behavior time series, it is first necessary to extract the user behavior label sequence before and after authentication. Each label represents a specific operation of the user in the network, such as accessing a specific system resource, executing a specific command, or initiating a data upload request. These behaviors constitute a time series in chronological order. To determine whether the same user is continuously operating before and after authentication, time window alignment processing is required for the two time series. A fixed-length sliding time window is selected, and within each window, it is compared whether there are semantically consistent label pairs in the two sequences. The number of matching labels divided by the total number of labels within the time window yields the synchronization ratio, which is the temporal overlap rate. To further improve robustness, behavior labels can be mapped to semantic vectors through a behavior embedding model during matching, and a similarity function is used to assist in determining semantic consistency. The temporal overlap rate reflects the continuity of user operation patterns in the time dimension. A high overlap rate usually means that the same user is continuously working in a similar environment before and after authentication, while a low overlap rate may represent a behavior interruption or identity switching. A preset behavioral consistency threshold is used to define the boundary for judging operational consistency. Its setting can be determined based on the behavioral characteristic distribution of different types of users or business scenarios, and is usually generated through statistical analysis of historical user behavior samples. When making a comprehensive judgment by combining connection identity fingerprint matching score and device trust digest offset distance, only when the time sequence overlap rate is higher than the preset behavioral consistency threshold can it be identified as a session interruption reconstruction behavior, thereby avoiding misjudgment of user identity continuity due to occasional connection fluctuations.

[0082] S3. After determining that there is a session interruption reconstruction behavior, generate a fused input set containing the access context state and historical behavior label sequence, construct a context update candidate set through an attention weighted model, perform mapping matching between the context update candidate set and the old context, and output the update path of access context and behavior judgment basis.

[0083] In this embodiment, S3 specifically refers to:

[0084] After confirming the existence of session interruption and reconstruction behavior, the authentication status, device trust parameters, and policy hit logs in the current access session are extracted and encoded to form an access context state vector. At the same time, historical behavior label sequences are extracted and time-series feature embedding is performed to construct a fusion input set containing access context state and historical behavior label sequences, which is used to express the access context evolution trend.

[0085] After the session interruption reconstruction is confirmed, the set of input information for subsequent access authorization judgments needs to be reconstructed promptly. This can be achieved by continuously collecting authentication status, device trust parameters, and policy hit logs generated during the current access session through the access control gateway. Authentication status includes user identity, credential usage frequency, and trust factor changes; device trust parameters cover terminal hardware sequence, vulnerability patch version, and running process trust score; and policy hit logs record the matching status of policy conditions and access requests. After collection, the above content is encoded into a unified-dimensional access context state vector. Simultaneously, user behavior tag sequences over a past period are extracted from the behavior monitoring module, such as access frequency tags, resource call paths, and operation habit patterns. These are then combined with temporal factors such as location and timestamps for feature embedding, forming a behavior sequence vector. Finally, the access context state vector and behavior sequence vector are merged through feature concatenation to form a fused input set, which expresses the state evolution trend of the access context in dynamic interaction scenarios, thus providing a reliable foundation for subsequent context updates.

[0086] Identity authentication status is a fundamental dimension reflecting whether a user's identity attributes are abnormal during the current access process, with particular attention paid to the frequency of identity credential changes, authentication strength, and whether a high-risk identity profile is matched. Device trust parameters are used to quantify static and dynamic indicators of terminal security, expressed as multi-dimensional security factor embeddings when constructing vectors. Policy hit logs provide the matching status between access requests and established access policies, and can be used to construct a sparse feature matrix as part of the context representation. The introduction of historical behavior tag sequences can reveal user behavior patterns in previous sessions. Timestamps are used to align behavior segments, and time information is embedded through temporal convolution or positional encoding to achieve structured modeling of user behavior change trends. The fusion input set is a joint expression of the current access context and historical behavior evolution, possessing learnability and updability, and is a necessary input for achieving accurate subsequent context replacement and behavior judgment correction.

[0087] The fused input set is fed into the attention-weighted model. By constructing a bidirectional attention mapping structure between context state and behavior label, the dependence strength between highly correlated features is captured, and a context update candidate set with attention weights is generated, where each candidate corresponds to a state fragment with the possibility of context correction.

[0088] To extract the most representative state fragments from the fused input set for updating the access context, the fused input set needs to be fed into an attention-weighted model with bidirectional dependency awareness. When constructing this model, a bidirectional attention mapping structure is first established between the access context state vector and the historical behavior label vector. By performing weighted queries and key-value cross-matching operations on the two vector sequences respectively, high-order correlations between context state fields and historical behavior features are captured. Driven by the attention mechanism, the model automatically identifies which context fields are more significantly affected by changes in historical behavior and assigns them higher attention weights accordingly. Finally, a candidate set for context updates is output. Each candidate contains a context state fragment and its associated behavior label weight, representing the position and direction in the current context that may require correction, thus providing clear guidance for subsequent accurate replacement of the access context.

[0089] Attention-weighted models are crucial for achieving dynamic filtering of fused information. The bidirectional attention mapping structure within this model can model the interdependence between two input sequences. On one hand, it uses context state vectors to weight and focus on historical behavior label sequences, identifying which behavioral factors significantly impact the current identity status, device trustworthiness, or policy feedback. On the other hand, it also uses behavior label vectors to monitor abnormal trends in the context state, enhancing behavior-driven state selection capabilities. Attention weights reflect the necessity of correction for each context segment under a specific behavioral pattern; higher values ​​indicate greater potential bias in access decisions. The context update candidate set is a structured collection of state segments, including field names, current values, target behavior labels, and corresponding attention values. This set offers good interpretability and traceability, facilitating targeted context update operations by downstream execution modules.

[0090] The context update candidate set is matched with the old context at the feature level. By establishing a vector alignment mechanism between identity status features, device trust factor and behavior discrimination label, the similarity gradient change between features of each dimension is calculated, and the matching matrix that identifies the mapping relationship between each candidate and the old context is output.

[0091] To achieve accurate association between the candidate context update set and the old context, feature-level mapping and matching operations need to be performed across three information dimensions: identity status features, device trust factors, and behavior discrimination labels. Specifically, each item in the candidate context update set is first categorized according to its field type, and the corresponding feature vectors are standardized. Then, these vectors are paired one-to-one with similar fields in the old context. Next, based on a vector alignment mechanism, the Euclidean distance difference, cosine similarity gradient, and offset directionality index are calculated between each pair of field vectors, forming a three-dimensional matching scoring matrix composed of feature dimensions. This scoring matrix can be used to measure the degree of structural matching between the candidate and the old context at different levels, such as identity, device, and behavior, thereby identifying the most consistent update segment and providing a basis for subsequent context replacement. For example, when the identity status features of a candidate maintain high consistency with the old context, but the device trust factor shows a drastic shift, the matching matrix will reflect this inconsistency through gradient scoring, thus avoiding erroneous updates.

[0092] The context update candidate set contains multiple state fragments that can be used to correct the current access context. Each fragment consists of identity state features, device trust factors, and behavior discrimination labels. Identity state features typically refer to embedded representations of user authentication, such as dynamic token patterns and biometric mapping values. Device trust factors include high-dimensional feature vectors such as device hardware features and system integrity check codes. Behavior discrimination labels reflect the probability or weight of historical behavior classification in the model. Vector alignment is a method that maps elements in two vector spaces one-to-one and calculates similarity, often supported by embedding comparison and distance analysis. Similarity gradient change refers to the trend of the difference rate change between two sets of vectors during the matching process; the smaller the gradient, the more consistent the two sets of features are. The matching matrix is ​​the final generated multidimensional array, where each cell corresponds to a matching score between feature pairs. It possesses both structured expressive capabilities and supports dynamic visual analysis, serving as the intermediate decision-making basis for accurate access context updates.

[0093] The optimal update path is extracted based on the feature mapping results in the matching matrix. A dimension-by-dimensional replacement operation is performed on the access context state and behavior judgment criteria, and the update path of the access context and behavior judgment criteria for subsequent trust assessment is output.

[0094] To update the access context and behavior judgment criteria, the optimal feature mapping path needs to be identified in the matching matrix first. This process can be implemented by constructing a path optimization algorithm, such as a dynamic programming path extraction model, which selects the path with the highest cumulative similarity across the three dimensions of identity status features, device trust factor, and behavior judgment label based on feature similarity scores. This optimal update path represents the state combination in the candidate set that is closest to the old context. After extracting this path, the feature dimensions that need to be updated are located sequentially in the access context state and behavior judgment criteria, and a dimension-by-dimensional replacement operation is performed according to the corresponding feature vectors in the path. Regularization transformation and residual weighting mechanisms can be introduced during the replacement process to ensure that abrupt feature changes do not disrupt the continuity and stability of the context structure. The final updated path will form a new set of access context and behavior judgment criteria, providing basic input for the subsequent trust assessment stage. This approach ensures that the reconstructed context information is both continuous and reflects current behavior changes, achieving dynamic adjustment based on context awareness.

[0095] The feature mapping results in the matching matrix refer to the correspondence and matching scores between each candidate and the old context across different feature dimensions. Its core objective is to reveal which set of new features is most structurally and semantically similar to the old features. The optimal update path refers to the path with the highest score and most complete matching logic selected from all possible candidate mappings, typically spanning multiple feature dimensions. The access context state encompasses structured representations such as the user's trust level, session history authentication behavior, and policy interaction feedback. Behavior judgment criteria include probability outputs from behavior classification models and behavior pattern recognition labels. Dimensional replacement requires the system to perform selective coverage in each dimension, that is, replacing credible items in the feature representation while preserving the overall outline of the old information. This replacement method balances information fidelity and context adaptability, ensuring that the update path not only reflects the credibility of the current access situation but also avoids the risk of misjudgment caused by full coverage. The output of the update path ultimately manifests as a set of structured input vectors with complete semantic and state carrying capabilities.

[0096] S4. Based on the update path of the access context and behavior judgment criteria, perform granular cascaded state replacement, map and transfer the identity status, device trust score and behavior pattern weight, and eliminate invalid behavior features through sequence adversarial testing mechanism to construct the updated access context and behavior judgment criteria.

[0097] In this embodiment, S4 specifically refers to:

[0098] Based on the update path of the access context and behavior judgment criteria, the feature mapping pairs identified in the update path are parsed, and a granular cascaded mapping table is constructed based on the mapping index of the update path. Multi-level replacement channels are established according to the three dimensions of identity status, device trust score and behavior pattern weight, so as to realize the step-by-step mapping and positioning of status factors in the access context.

[0099] After determining the update path for the access context and behavior judgment criteria, the first step is to extract each feature mapping pair that identifies the correspondence between the old and new states from the update path, and then classify and organize these mapping pairs according to their index numbers. Each mapping pair identifies an update requirement between an old state feature and a new state feature, including the identity status field, device trust score item, and behavior pattern weight factor. The process of constructing the granular cascaded mapping table includes: setting multi-level granularity labels within each feature dimension, dividing from coarse to fine. For example, identity status can be divided into three sub-items: authentication method, authentication frequency, and authentication strength; device trust score can be divided into patch status score, system integrity score, access control score, etc. By comparing the mapping indexes level by level, the old and new state fields are mapped and matched layer by layer, realizing the construction of a state factor mapping channel from high granularity to low granularity. After completing this structure, a precise replacement operation can be performed in the access context according to the mapping path.

[0100] The update path for access context and behavior judgment includes multiple feature mapping pairs composed of state variables and indices. The granular cascaded mapping table is a structured three-dimensional mapping set, divided into identity state dimension, device trust score dimension, and behavior pattern weight dimension. Each dimension is further subdivided into multiple replaceable fields, supporting multi-level updates. The multi-level replacement channel is a set of matching logical paths formed on the mapping table, used to dynamically locate the position of the state factor that needs to be replaced, and to complete the value replacement operation of the corresponding field according to the replacement pair content provided in the update path. This approach avoids full state refresh, reduces resource consumption, and ensures the controllability and accuracy of state updates.

[0101] Based on the granular cascaded mapping table, the mapping and replacement of identity label weight values ​​are performed in the identity status dimension, the numerical transfer of various device trust rating factors is completed in the device trust rating dimension, and the weight coefficients between historical behavior patterns and reconstructed behavior patterns are continuously interpolated and mapped in the behavior pattern weight dimension to complete the cascaded replacement operation of the status.

[0102] After constructing the granular cascaded mapping table, state updates need to be performed in different dimensions according to the corresponding mapping rules. In the identity state dimension, by extracting the identity label index identified in the granular cascaded mapping table, the weight value corresponding to the original identity label is found and mapped to the corresponding new label weight value in the update path, thus achieving a precise reset of identity recognition credibility. In the device trust scoring dimension, according to the classification of each device security factor, the difference between the old score value and the updated score value is calculated item by item, and numerical transfer is performed to correct the trust bias caused by changes in device state. In the behavior pattern weight dimension, for the difference in behavioral instructions between historical behavior patterns and the current reconstructed behavior patterns, a linear interpolation algorithm is used to continuously interpolate in the weight space, thereby smoothly introducing new behavior pattern features while preserving historical behavior features, and finally completing the cascaded replacement operation of the three-dimensional state parameters.

[0103] The identity label weight value mapping under the identity status dimension uses index mapping to migrate the level, frequency, or method of identity authentication in the weight space. The device trust score dimension involves the numerical migration of device trust factors, including operating system security level, vulnerability patching status, and hardware integrity score, with their weight changes determined by the relative differences between the old and new states. The behavior pattern weight dimension uses an interpolation mechanism to connect historical behavior label weights with reconstructed behavior label weights, ensuring the continuity and stability of behavior trend prediction during session migration. This multi-dimensional linkage mapping mechanism can achieve high-precision synchronous replacement of multiple state factors in the access context, providing structured update support for dynamic trust assessment and policy adjustment under a zero-trust architecture.

[0104] A sequence adversarial testing mechanism is constructed. The replaced behavior pattern is input into the sequence discriminator network and the generator network to form an adversarial training. The generator network reconstructs the old behavior features, and the discriminator network identifies the feature differences between the reconstruction and the actual behavior. The segments with inconsistency or low confidence in continuous prediction are extracted and removed as invalid behavior features.

[0105] To improve the accuracy and reliability of behavioral patterns in the access context, a sequence adversarial testing mechanism can be constructed to deeply validate the replaced behavioral patterns. In the specific implementation, the updated behavioral pattern is used as input, fed into both a sequence generation network and a sequence discriminator network. The generation network predicts and reconstructs possible historical behavioral sequences based on the current behavioral pattern, simulating its performance in the original context. The discriminator network compares the current behavioral sequence with the output of the generation network, identifying the consistency and differences in behavior between the two through feature matching and error measurement. During the adversarial training of the generation and discriminator networks, the system can automatically learn to identify which behavioral segments exhibit significant deviations or decreased confidence in continuous prediction. Once segments with high feature drift or unable to form stable behavioral trajectories are identified, they can be judged as invalid behavioral features and removed, thereby preventing these segments from affecting subsequent behavior judgments and access strategy execution.

[0106] The sequence generation network, built on a recurrent neural network or Transformer architecture, is responsible for reconstructing historical behavior trajectories and extending trends. The sequence discrimination network compares the similarity between the input and generated behavior sequences through feature embedding, identifies their matching confidence and prediction bias, and then extracts difference indicators. The behavior consistency judgment process relies on the change curve of segment features within a time window during continuous prediction, identifying feature failure by recognizing abrupt changes in behavior state or low-confidence fluctuation intervals. Finally, this sequence adversarial testing mechanism achieves structural cleaning and precise screening of replacement behavior features through bidirectional dynamic adjustment of generation and discrimination, ensuring that the updated behavior judgment criteria have logical continuity and decision reliability.

[0107] The identity status, device trust score, and behavior pattern weights processed by the granular cascaded state replacement and sequence adversarial testing mechanism are concatenated to construct the updated access context and behavior judgment criteria. A data structure for subsequent dynamic authorization reasoning is constructed through standardized coding.

[0108] To construct a highly consistent access context and behavioral judgment basis for subsequent dynamic authorization reasoning, a unified feature concatenation operation should be performed on the processing results of the three core dimensions: identity state, device trust score, and behavioral pattern weight. In implementation, the identity state vector obtained through granular cascaded state replacement, the device trust score vector updated through continuous interpolation and score mapping, and the behavioral pattern weight vector retained after removing invalid segments through sequence adversarial testing are first subjected to dimensional expansion and type alignment. Then, a linear connection method is used to concatenate the three types of vectors into a structured joint feature vector set, ensuring that all state factors can participate in the subsequent reasoning process in a unified format. To improve system compatibility and model generality, this joint feature vector set needs to undergo standardized encoding processing, normalizing the numerical features to a uniform distribution range and mapping them to index fields according to a specific label structure, thereby constructing a context input data structure that can be recognized and invoked by the policy engine.

[0109] The identity state vector, containing identity tag weights, authentication history status, and trust level fields, is encoded into a continuous numerical sequence through multi-level embedding mapping. The device trust score vector consists of multiple device factor dimensions, such as hardware uniqueness indicators, security patch completeness, and recent security incident response scores, which require unit standardization and numerical constraint processing before concatenation. The behavior pattern weight vector reflects the distribution of user behavior preferences over time, and is aggregated using a time-weighted averaging strategy to form a behavior tendency vector. The three types of features are finally concatenated into a vector set with a unified numerical range through standardization. A tag index table and field mapping model are introduced during the structured encoding process to ensure the data structure has scalability and model adaptability in dynamic authorization reasoning. This approach can map the entire security state after session reconstruction onto a unified reasoning dimension, providing highly consistent contextual support for policy execution.

[0110] S5. Collect state change factors before and after the update to construct a trust flow change trajectory map. Model the state jump intensity and behavior prediction offset based on graph convolutional neural network, generate a dynamic authorization control sequence, and perform differentiated permission adjustment according to the control sequence to complete access control.

[0111] In this embodiment, S5 specifically refers to:

[0112] Collect state change factors before and after the update, including the weight difference of identity status labels, the numerical offset of each security factor of device trust score, and the adjustment ratio of behavior pattern weight. Construct a factor change sequence according to the collection order, and use each type of state factor as a graph node and the dependency coupling relationship between factors as graph edges to establish a trust flow change trajectory graph containing time index and change weight, expressing the multi-dimensional evolution path between identity, device and behavior.

[0113] After determining that the access context and behavior judgment criteria have been updated, it is necessary to systematically collect the state change factors before and after the update, and construct a trust flow change trajectory diagram in chronological order. The specific implementation is as follows: First, extract the identity state labels before and after the update, and calculate their weight differences to quantify the degree of change in identity state; then, for each security factor dimension in the device trust score, such as hardware sequence consistency, system patch level, and security assessment results, extract the numerical offsets before and after the update to form a multi-dimensional device trust change vector; simultaneously, analyze the weight adjustment ratio between historical behavior patterns and current behavior patterns to obtain the evolutionary magnitude of behavioral tendencies. Arrange these state change factors in a time series to form a factor change sequence, then map each type of factor to a node in the graph, constructing edges in the graph using their interdependencies and influence paths, and using weight differences, offsets, or weight adjustment ratios as the weights of the graph edges. Simultaneously, attach time index information to each graph node, ultimately constructing a trust flow change trajectory diagram containing multiple elements of identity, device, and behavior and their temporal evolution relationships, providing a structured foundation for subsequent dynamic modeling.

[0114] The trust flow trajectory graph is structurally represented as a multidimensional heterogeneous graph, where each node corresponds to a type of state factor, and the edges between nodes reflect the causal, cooperative, or inhibitory relationships they exhibit during access. For example, drastic fluctuations in identity state labels typically cause significant adjustments to behavioral pattern weights, thus resulting in higher edge weights between them. A time index is used to mark the evolution time point of each state change factor, facilitating the incorporation of a time factor into the graph convolutional neural network's adjacency aggregation, thereby identifying key transition points and shift trends in state evolution. In this way, changes in state factors not only form a computable graph structurally but also reflect dynamic correlations at the numerical level, providing a high-quality input graph structure for subsequent transition modeling and behavioral shift evaluation.

[0115] The trust flow change trajectory map is input into the graph convolutional neural network for modeling. The feature perturbation value of the node in the graph after multiple rounds of convolution is calculated as the state transition intensity. The error is fitted between the offset position of each label in the behavior pattern on the prediction time line and the original trajectory, and quantified as the behavior prediction offset. The two types of indicators are used to measure the degree of state change and the degree of deviation of behavior trajectory, respectively, and jointly generate a dynamic authorization control sequence.

[0116] When modeling the trust flow change trajectory graph using a graph convolutional neural network, each node in the graph is first initialized as a feature vector corresponding to a state change factor, including the weight difference of the identity state label, the numerical offset of the device trust score factor, and the adjustment ratio of the behavior pattern weights. In each layer, the graph convolutional neural network aggregates node information with its neighboring nodes through an adjacency matrix and continuously propagates the influence of upstream and downstream state factors after multiple rounds of convolution, thereby capturing potential change propagation paths between nodes. After multiple rounds of convolution, the change magnitude between the initial and final features of each node is extracted as the feature perturbation value of that node, used to measure the intensity of state transitions. For example, when the perturbation value of a device trust factor is significantly higher than other factors, it indicates that its trust status has changed drastically during the access process, i.e., the intensity of the state transition is high. Simultaneously, the predicted time points of each behavior label in the behavior pattern are aligned with their actual occurrence times in the original behavior trajectory. The time offset is calculated and error fitting is performed to quantify the behavior prediction offset of each behavior label, used to measure the degree of deviation of the behavior logic in the current access. By combining the state transition intensity and behavior prediction offset as feature inputs, a dynamic authorization adjustment sequence is generated to guide the real-time adjustment of access control policies.

[0117] State transition strength is a measure of change based on structural propagation. Its calculation relies on the ability of graph convolutional neural networks to model the coupling relationships between multiple nodes in the trust flow trajectory graph. During convolutional aggregation, time indices and change weights are retained. Dynamic perception of transitions is achieved by updating node states layer by layer, ensuring that feature perturbation values ​​accurately reflect the abrupt changes of key nodes in the global structure. Behavior prediction offset uses the label time of the behavior pattern as the core metric. By establishing a one-to-one mapping between actual and predicted behaviors in the time dimension and comparing their temporal position deviations, the degree of deviation is captured. If a behavior label is triggered significantly earlier or later in the current access, the fitted offset will increase significantly, reflecting an anomaly in the access behavior path. These two metrics cover two key aspects: state evolution and behavioral logic. When generating dynamic authorization control sequences, decision logic triggers strategies for situations with high state transition strength and large behavior prediction offsets, thereby achieving more refined and responsive access control policy output.

[0118] Based on the state transition intensity and behavior prediction offset contained in the dynamic authorization control sequence, the permission adjustment policy rule set is matched to perform fine-grained differentiated adjustments on the access permissions, operation scope and policy restriction parameters of the access resources, thereby realizing dynamic access control.

[0119] The process of implementing dynamic access control involves analyzing the state transition strength and behavior prediction offset contained in the dynamic authorization control sequence as core input features. First, these two types of indicators are input into the policy matching engine and matched item by item with a preset set of permission adjustment policy rules. The policy rule set is divided into multiple permission control policy fragments according to different combinations of state transition strength and behavior prediction offset intervals. For example, when the state transition strength exceeds a specified upper limit threshold and the behavior prediction offset deviates significantly, access permission downgrades, operation function freezes, or mandatory verification process injections can be triggered; conversely, when the indicators are in a stable range, access capabilities can be restored or policy restrictions can be relaxed. After matching, the set of differentiated adjustment parameters is located based on the matching results, and then fine-grained adjustments are made to multi-dimensional access control elements such as access permissions, operation scope, and policy restriction parameters. Through this indicator-driven dynamic policy matching mechanism, access control decisions are ensured to adapt to changes in identity status and behavior offsets, achieving precise dynamic authorization responses.

[0120] State transition intensity and behavior prediction deviation are key indicators in the dynamic authorization control sequence. The former reflects the severity of structural changes in the access context, such as identity status and device trustworthiness, while the latter measures the deviation between the user's behavior path and the expected behavior model during access. These two indicators play different roles in permission adjustment. State transition intensity primarily drives policy changes related to identity trustworthiness levels, such as restricting access to sensitive data or triggering secondary authentication; while behavior prediction deviation focuses on behavioral consistency, such as reducing the function call rate or temporarily freezing specific operation interfaces. The permission adjustment policy rule set is typically constructed in the form of a rule tree or policy graph. Each policy node sets the conditional boundaries of the state indicators and binds them to corresponding access control behaviors. In practical applications, different resource types, operation actions, and user roles will have different policy templates, thereby achieving multi-dimensional joint authorization control oriented towards identity, behavior, and resources. This method possesses strong adaptability and high scalability, enabling dynamic responses to changes in security posture and ensuring the trustworthiness and controllability of system access behavior.

[0121] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions according to the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means (e.g., infrared, wireless, microwave, etc.). A computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. Available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media. Semiconductor media can be solid-state drives.

[0122] It should be understood that, in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0123] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0124] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0125] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0126] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0127] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A network access control method combining traditional admission and zero-trust architectures, characterized in that: Specifically, the following steps are included: S1. Extract the authentication trajectory data generated during user access. Construct a data structure that includes authentication cycle timestamps, connection state transition sequences, and breakpoint durations. Identify session re-authentication triggered by traditional admission based on dual-time-window sliding difference calculation. Specifically, calculate the change gradient of authentication cycle timestamps in preset short-time windows and preset long-time windows respectively, generate corresponding short-cycle difference values ​​and long-cycle difference values, and obtain the re-authentication index through weighted superposition. When the re-authentication index exceeds the set dynamic offset threshold, it is identified as a session re-authentication triggered by traditional admission. S2. After identifying the session re-authentication situation triggered by traditional access control, collect the connection identity fingerprint, device trust digest and access behavior time series before and after authentication, and construct a fusion discrimination matrix through similarity convolution function to determine whether there is session interruption reconstruction behavior. S3. After determining that there is a session interruption reconstruction behavior, generate a fused input set containing the access context state and historical behavior label sequence, construct a context update candidate set through an attention weighted model, perform mapping matching between the context update candidate set and the old context, and output the update path of access context and behavior judgment basis. S4. Based on the update path of the access context and behavior judgment criteria, perform granular cascaded state replacement, map and transfer the identity status, device trust score and behavior pattern weight, and eliminate invalid behavior features through sequence adversarial testing mechanism to construct the updated access context and behavior judgment criteria. S4 specifically refers to: Based on the update path of the access context and behavior judgment criteria, the feature mapping pairs identified in the update path are parsed, and a granular cascaded mapping table is constructed based on the mapping index of the update path. Multi-level replacement channels are established according to the three dimensions of identity status, device trust score and behavior pattern weight, so as to realize the step-by-step mapping and positioning of status factors in the access context. Based on the granular cascaded mapping table, the mapping and replacement of identity label weight values ​​are performed in the identity status dimension, the numerical transfer of various device trust rating factors is completed in the device trust rating dimension, and the weight coefficients between historical behavior patterns and reconstructed behavior patterns are continuously interpolated and mapped in the behavior pattern weight dimension to complete the cascaded replacement operation of the status. A sequence adversarial testing mechanism is constructed. The replaced behavior pattern is input into the sequence discriminator network and the generator network to form an adversarial training. The generator network reconstructs the old behavior features, and the discriminator network identifies the feature differences between the reconstruction and the actual behavior. The segments with inconsistency or low confidence in continuous prediction are extracted and removed as invalid behavior features. The identity status, device trust score and behavior pattern weight after being processed by granular cascaded state replacement and sequence adversarial testing mechanism are concatenated to construct the updated access context and behavior judgment basis, and a data structure for subsequent dynamic authorization reasoning is constructed through standardized coding. S5. Collect state change factors before and after the update to construct a trust flow change trajectory map. Model the state jump intensity and behavior prediction offset based on graph convolutional neural network, generate a dynamic authorization control sequence, and perform differentiated permission adjustment according to the control sequence to complete access control.

2. The network access control method combining traditional admission and zero-trust architecture according to claim 1, characterized in that, S1 specifically refers to: Extract authentication trajectory data generated during user access, specifically including continuously collecting access time, authentication success time, connection disconnection time and reconnection time for each user network access, and construct an authentication trajectory data sequence in chronological order; Based on the authentication trajectory data sequence, a data structure is constructed that includes authentication cycle timestamp, connection state transition sequence and breakpoint duration. The authentication cycle timestamp is calculated from the interval between adjacent successful authentication timestamps. The connection state transition sequence is generated by marking connection state switching behavior and encoding it sequentially. The breakpoint duration is formed by the time difference between connection disconnection and reconnection. Identify session re-authentication scenarios triggered by traditional admission based on dual-time-window sliding difference calculation.

3. The network access control method combining traditional admission and zero-trust architecture as described in claim 1, characterized in that, S2 specifically includes the following steps: S201. Collect connection identity fingerprints, device trust digests, and access behavior time series before and after authentication. Specifically, after identifying session re-authentication triggered by traditional access control, construct authentication boundaries based on two time points before and after the re-authentication event. Extract network connection source addresses, encryption algorithm identifiers, and communication protocol parameters before and after the boundary as connection identity fingerprints. Perform digest calculation on the terminal's hardware sequence, system security patch status, and trust assessment label to obtain device trust digests. Collect user access request times and operation command sequences before and after re-authentication to form access behavior time series. S202. Based on the connection identity fingerprint, device trust digest and access behavior time series, construct a standard vector input. Perform local window sliding convolution operation between each input vector through the similarity convolution function to extract multi-dimensional similarity features. Generate a fusion discrimination matrix through channel cross convolution. This fusion discrimination matrix is ​​used to characterize the fine-grained differences between various types of information before and after authentication reconstruction. S203. In the fusion discrimination matrix, determine whether the matching score of the connection identity fingerprint is greater than the preset identity trust threshold, and at the same time determine whether the offset distance of the device trust digest is less than the preset device stability threshold, and determine whether the time sequence overlap rate of the access behavior time series is higher than the preset behavior consistency threshold. When all three conditions are met, it is determined that there is a session interruption reconstruction behavior.

4. The network access control method combining traditional admission and zero-trust architecture according to claim 3, characterized in that, S202 specifically refers to: The connection identity fingerprint, device trust digest, and access behavior time series are converted into fixed-length standard vector inputs, and the three standard vector inputs are normalized respectively. Based on standard vector input, the three standard vectors are subjected to equal-step local window sliding convolution operation through similarity convolution function. Local similarity features between continuous dimensions are extracted in each sliding window to form a corresponding set of local feature vectors. A channel mapping index structure is introduced between the standard vectors to perform channel cross convolution operation in a fixed pairing manner to extract the non-linear dependency between cross channels. The local feature vector set is concatenated and concatenated with the channel cross-convolution result to generate a fusion discriminant matrix. Each column of the fusion discriminant matrix represents the interaction feature dimension between standard vector pairs within the local sliding window, and each row represents the degree of similarity difference between different information sources, which is used to characterize the fine-grained differences between various types of information before and after authentication reconstruction.

5. The network access control method combining traditional admission and zero-trust architecture according to claim 3, characterized in that, S203 specifically refers to: The connection identity fingerprint matching score item is extracted from the fusion discrimination matrix. The embedding values ​​of each field in the original connection identity fingerprint vector and the current connection identity fingerprint vector are compared. The cosine similarity is used to calculate the matching score value and determine whether the matching score value is greater than the preset identity trust threshold. This is used to determine the degree to which the connection identity information remains consistent before and after authentication. The offset distance of the device trust digest is calculated. By constructing the Euclidean distance mapping between the device trust digest before and after authentication, the numerical difference of the device trust digest in the multidimensional security factor space is extracted as the offset distance value. It is then determined whether the offset distance value is less than the preset device stability threshold, which is used to reflect the degree of change of the device's trusted state during the session reconstruction process. The temporal overlap rate of access behavior time series is evaluated by aligning the behavior tag sequences before and after authentication with time windows and calculating the synchronization ratio of matching tags in the time dimension as a temporal overlap rate indicator. It is then determined whether this indicator is higher than the preset behavior consistency threshold. When the connection identity fingerprint matching score is greater than the preset identity trust threshold, the device trust digest offset distance is less than the preset device stability threshold, and the temporal overlap rate is higher than the preset behavior consistency threshold, it is determined that there is a session interruption reconstruction behavior.

6. The network access control method combining traditional admission and zero-trust architecture according to claim 1, characterized in that, S3 specifically refers to: After confirming the existence of session interruption and reconstruction behavior, the authentication status, device trust parameters, and policy hit logs in the current access session are extracted and encoded to form an access context state vector. At the same time, historical behavior label sequences are extracted and time-series feature embedding is performed to construct a fusion input set containing access context state and historical behavior label sequences, which is used to express the access context evolution trend. The fused input set is fed into the attention-weighted model. By constructing a bidirectional attention mapping structure between context state and behavior label, the dependence strength between highly correlated features is captured, and a context update candidate set with attention weights is generated, where each candidate corresponds to a state fragment with the possibility of context correction. The context update candidate set is matched with the old context at the feature level. By establishing a vector alignment mechanism between identity status features, device trust factor and behavior discrimination label, the similarity gradient change between features of each dimension is calculated, and the matching matrix that identifies the mapping relationship between each candidate and the old context is output. The optimal update path is extracted based on the feature mapping results in the matching matrix. A dimension-by-dimensional replacement operation is performed on the access context state and behavior judgment criteria, and the update path of the access context and behavior judgment criteria for subsequent trust assessment is output.

7. The network access control method combining traditional admission and zero-trust architecture according to claim 1, characterized in that, S5 specifically refers to: Collect state change factors before and after the update, including the weight difference of identity status labels, the numerical offset of each security factor of device trust score, and the adjustment ratio of behavior pattern weight. Construct a factor change sequence according to the collection order, and use each type of state factor as a graph node and the dependency coupling relationship between factors as graph edges to establish a trust flow change trajectory graph containing time index and change weight, expressing the multi-dimensional evolution path between identity, device and behavior. The trust flow change trajectory map is input into the graph convolutional neural network for modeling. The feature perturbation value of the node in the graph after multiple rounds of convolution is calculated as the state transition intensity. The error is fitted between the offset position of each label in the behavior pattern on the prediction time line and the original trajectory, and quantified as the behavior prediction offset. The two types of indicators are used to measure the degree of state change and the degree of deviation of behavior trajectory, respectively, and jointly generate a dynamic authorization control sequence. Based on the state transition intensity and behavior prediction offset contained in the dynamic authorization control sequence, the permission adjustment policy rule set is matched to perform fine-grained differentiated adjustments on the access permissions, operation scope and policy restriction parameters of the access resources, thereby realizing dynamic access control.

Images