Dynamic network access control method and system based on zero-trust architecture

Abstract

The invention discloses a dynamic network access control method and system based on a zero-trust architecture, and the method comprises the steps: integrating equipment health degree evaluation through the triple dynamic binding of biological feature dynamic binding, equipment fingerprint salt value hash verification and environmental state perception, and constructing a real-time trust basis; dynamic risk quantification is realized based on a multi-source heterogeneous data fusion machine learning model, real-time upgrading and degrading self-adaptive adjustment of authority is realized through an AI driving strategy generation module according to a real-time risk score, a zero-trust sandbox limitation sensitive operation is triggered for high-risk access, and a minimum authority channel is started for low-risk access; performing fine-grained access control and intercepting an unauthorized request in real time by adopting an agent-free API gateway technology, and monitoring an operation behavior in combination with a block chain non-tampering storage access log and an anomaly detection algorithm; finally, a continuous self-adaptive evolutionary cycle is formed through a risk assessment-policy execution-abnormal feedback closed loop mechanism, and the static lag problem of traditional network access control is systematically solved.

Description

Technical Field

[0001] This invention relates to the field of network access control technology, and in particular to a dynamic network access control method and system based on a zero-trust architecture. Background Technology

[0002] With the deepening of enterprise digital transformation and the widespread adoption of remote work, multi-cloud architecture, and IoT devices, network access control has become a core line of defense for ensuring data security and system integrity. In sensitive industries such as finance, healthcare, and government, ensuring that legitimate users can only access specific resources in authorized scenarios, while resisting internal threats and external attacks, is the cornerstone of security architecture in the digital age.

[0003] However, traditional network access control methods suffer from significant static lag, relying on pre-set static rule bases and manual policy adjustments, making it difficult to respond to dynamic security threats in real time. For example, a financial institution once used a static IP blacklist to defend against DDoS attacks, but attackers bypassed the restrictions through dynamic IP pools and VPN tunnels, launching continuous attacks that caused the core business system to crash. At the same time, employees within the institution, who were granted fixed administrator privileges, were still able to access sensitive customer databases after leaving the company, ultimately leading to a large-scale data breach and causing serious losses. Therefore, a dynamic network access control method and system based on a zero-trust architecture is proposed. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing a dynamic network access control method and system based on a zero-trust architecture.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: A dynamic network access control method based on a zero-trust architecture includes: Step 1 (Multi-factor Continuous Identity Authentication): Through dynamic binding of biometric features (such as microsecond-level fingerprint / voiceprint comparison), device fingerprint salt value hash verification, and environmental status awareness, a triple dynamic binding of user-device-environment is performed. At the same time, device health assessment (such as system patch version and firewall status) is integrated to ensure the unity of the authenticity of the access subject's identity, device compliance, and environmental security in continuous authentication. Step 2 (Real-time Risk Quantification Assessment): Based on multi-source heterogeneous data such as user behavior (access frequency / operation path), device status (security configuration / vulnerability score), and network environment (geographical location / IP reputation), a machine learning model is used to calculate risk scores in real time, achieving millisecond-level dynamic risk quantification and breaking through the single-dimensional assessment limitations of traditional static rule bases. Step 3 (Dynamic Policy Generation Engine): Based on real-time risk scores, the AI-driven policy generation module automatically constructs the least privilege access policy and combines it with a dynamic permission sandbox mechanism to automatically trigger the "zero trust sandbox" environment to restrict sensitive operations for high-risk access and enable the "least privilege channel" for low-risk access, thereby realizing real-time upgrade and downgrade and adaptive adjustment of permissions. Step 4 (Policy Execution and Monitoring): Employ agentless API gateway technology to achieve fine-grained access control and intercept unauthorized requests in real time; use blockchain to immutably store access logs and combine them with anomaly detection algorithms to monitor operational behavior, ensuring the transparency and auditability of policy execution while avoiding the performance loss caused by traditional proxy models; Step 5 (Feedback Loop and Adaptive Iteration): Construct a closed-loop mechanism of risk assessment, strategy execution, and anomaly feedback. Monitored and identified abnormal behaviors automatically feed back into the risk model to optimize feature weights. The effect of strategy execution (such as the frequency of permission adjustment / interception rate) back-drives the iteration of the strategy generation algorithm, forming a continuous adaptive evolutionary cycle of "assessment-generation-execution-feedback", breaking through the static mode of existing patents that lack feedback optimization.

[0006] The above technical solution further includes: Furthermore, the process of dynamically binding users, devices, and environments through biometrics, device fingerprint salt value hashing verification, and environmental status awareness, while also integrating device health assessment, includes the following steps: During each visit, the user's real-time biometric data is acquired through the biometric acquisition module and dynamically compared with the pre-stored biometric templates. A dynamic similarity threshold algorithm is used to dynamically adjust the comparison threshold according to environmental noise and device performance to ensure accurate identification of the user even in complex environments. The system collects unique hardware identifiers of the devices, such as CPU serial number, hard disk ID, and MAC address, and combines them with the device's operating status to generate a device fingerprint. A dynamic salt value generation algorithm is used to concatenate the device fingerprint with a real-time timestamp and a random salt value, and then generate an encrypted hash value using the SHA-256 hash function. The salt value is randomly generated by the system. Real-time collection of network environment data, physical environment data, and system environment data; based on the collected environmental data, a weighted risk scoring model is used to calculate the environmental risk value. in, Let be the weight of the j-th environmental indicator. The degree of abnormality of the indicator (0-1 standardized value); For example, abnormal geographical locations (unusual access locations) are given high weight, excessive network latency is given medium weight, and abnormal system processes are given high weight. Check device security configuration items (such as whether system patches are updated to the latest version, whether the firewall is enabled, whether antivirus software is running, and whether user privileges are minimized). Based on the results of the security configuration item check, calculate the device health score using a linear weighted scoring model. Among them, The deduction coefficient for the k-th security configuration. Configure an exception indicator variable (1 indicates an exception, 0 indicates normal); For example, 10 points are deducted for not updating system patches, 20 points are deducted for not enabling the firewall, and 15 points are deducted for not running antivirus software. The final score is mapped to a range of 0-100 points.

[0007] Furthermore, the process of dynamically quantifying risk by using a machine learning model to fuse and calculate risk scores in real time based on multi-source heterogeneous data includes the following steps: By integrating heterogeneous data from three dimensions—user behavior, device status, and network environment—a machine learning model is used for dynamic risk scoring. User behavior data includes access frequency, operation path, login time distribution, and abnormal operation frequency. Device status data includes system patch versions and vulnerability scores, firewall / antivirus software running status, and hardware fingerprint consistency (such as the matching degree between CPU serial number and registration information). Network environment data includes IP address geolocation mapping, IP reputation database scores, network latency and jitter values, and VPN usage status. Missing values ​​are filled with the mean or deleted, numerical features are standardized using Z-score, and categorical features are one-hot encoded, enabling the fusion of multi-source data under a unified scale. Sliding window features (such as access frequency in the last 5 minutes and operation path entropy value) are constructed based on user behavior sequences to capture short-term behavioral anomalies; device-network cross features (such as the combination of "high-risk IP + unpatched system") and user-device cross features (such as the combination of "unusual time period + unusual device login") are generated to enhance the expression of risk correlation; the entropy weight method or attention mechanism is used to dynamically adjust the feature weights of each dimension. For example, the weight of network environment features is automatically increased in high-risk scenarios, while the weight of user behavior features is dominant in low-risk scenarios. XGBoost and LightGBM gradient boosting tree models were selected due to their efficient processing capabilities for heterogeneous data and their real-time prediction performance. Historical datasets containing normal access samples and attack samples were used during model training, and hyperparameters were optimized through five-fold cross-validation. A risk assessment model is constructed through data preprocessing, feature engineering, and dynamic weight adjustment; risk levels are then determined based on a real-time risk scoring formula. in, The final risk score is calculated (0-1 range, with higher values ​​indicating greater risk). This is the Sigmoid activation function (which maps the linear output to the probability space). Let i be the weight of the i-th feature. Features The nonlinear transformation function, where b is the bias term; The model absorbs newly collected access data in real time through online learning or incremental training, dynamically adjusting feature weights and model parameters to ensure that the risk score always reflects the latest risk situation. The risk score is divided into three levels: low (0-0.3), medium (0.3-0.7), and high (0.7-1.0), corresponding to different access control strategies. High-risk scores directly trigger the zero-trust sandbox restriction in step three, medium-risk scores enable the least privilege channel, and low-risk scores maintain regular access permissions, realizing real-time linkage between risk quantification and access control.

[0008] Furthermore, the real-time adaptive adjustment of permissions includes the following steps: Based on the risk assessment results from step two, the risk levels are divided into three levels: Low risk (0 ≤ <0.3): Enable "least privilege channel", granting only the minimum resource access permissions (such as read-only permission, specific API call permission) required to complete the current task. Medium risk (0.3 ≤ <0.7): Enable "Restricted Permission Channel" to add necessary operation permissions (such as editing permissions) on the basis of minimum permissions, and monitor sensitive operations through dynamic sandbox; High risk (0.7 ≤ ≤ 1.0): Triggers a "zero-trust sandbox environment", completely restricting sensitive operations, allowing only basic access, and triggering a two-factor authentication process (such as SMS verification code, biometric verification). When a risk score crosses a tiered threshold, the system automatically triggers permission adjustments. For example, if a user suddenly jumps from a low-risk status to a high-risk status (e.g., multiple failed login attempts within a short period), the system immediately downgrades their permissions from the "least privilege channel" to the "zero-trust sandbox environment" and suspends all sensitive operation permissions. Thresholds are dynamically optimized through the closed-loop feedback mechanism in step five. For instance, if historical data shows that a certain type of operation (e.g., large-amount transfers) frequently triggers anomalies at a risk score of 0.6, the system can automatically adjust the trigger threshold for that operation to 0.5, increasing defense sensitivity. The magnitude ΔP depends on the change in the risk score ΔR. For example, when ΔR > 0.2 (sudden increase in risk), the permission is directly downgraded to the next level or lower; when ΔR < 0.1 (small fluctuation in risk), the permission is only slightly adjusted within the original level (e.g., downgraded from "edit permission" to "read-only permission"). After the permission is adjusted, the system continuously monitors whether the access behavior meets expectations. If the risk score continues to decline after the adjustment, the system can gradually restore some permissions (e.g., upgraded from "zero-trust sandbox" back to "restricted permission channel"); if the risk score does not improve or continues to rise, the permission is further tightened.

[0009] Furthermore, the use of agentless API gateway technology for fine-grained access control and real-time interception of unauthorized requests includes the following steps: The API gateway is deployed directly at the network layer between the client and the server, forwarding requests via direct IP / port connection, avoiding the "request-proxy-forward" three-way handshake overhead of traditional proxy mode; based on real-time traffic monitoring data, a weighted round-robin algorithm is used to dynamically allocate the weight of server nodes, ensuring fast forwarding and load balancing of requests in high-concurrency scenarios, and avoiding interception delays caused by single-point overload; Perform dynamic validation using a 5-tuple for each API request: User Identity: Verify the validity of the JWT token or OAuth2.0 access token to ensure that the requester is an authenticated user; Device status: Check whether the device fingerprint hash value is consistent with the device information bound in step one to prevent the device from being tampered with or impersonated; Risk Score: The real-time risk score output from step two is used to automatically trigger stricter access restrictions for high-risk requests; Resource permissions: Based on the dynamic permission policy generated in step three, verify whether the request is within the user's current permission range (e.g., users with read-only permissions are prohibited from calling the "Delete" API); Timeliness: Check if the request timestamp is within the valid time window to prevent replay attacks; An attribute-based access control model is adopted, which dynamically combines user attributes, environment attributes, and operation attributes into access control rules to achieve fine-grained management and control in four dimensions: user, device, environment, and operation. The access control matrix is ​​analyzed in real time by a rules engine, and "allow / deny / secondary authentication" decisions are made for each request. For example, when a high-risk user calls a sensitive API, the system directly denies the request and returns a 403 status code; when a low-risk user calls a regular API, the request is allowed. All intercepted events are written to the blockchain distributed ledger in real time to ensure that the logs are immutable and traceable. The log content includes key information such as request time, user ID, device fingerprint, API path, and reason for interception.

[0010] Frequently accessed API paths and user permissions are cached locally to reduce the number of real-time queries to the policy generation module and improve decision-making speed. Combined with the anomaly detection algorithm in step four, abnormal traffic such as DDoS attacks and SQL injections can be identified and intercepted in real time to ensure the stable operation of the gateway.

[0011] Furthermore, the method of storing access logs immutably via blockchain includes the following steps: Each access log contains five core fields: user unique identifier, device fingerprint hash value, operation timestamp, operation type, operation resource path, and real-time risk score output from step two. Intercepting decision-making results; using hash encryption or salting to process sensitive user information to ensure that user identity cannot be directly deduced when logs are stored, in compliance with privacy protection regulations; Each block consists of two parts: a block header and a block body. Block header: Stores the hash value of the previous block. Merkle root hash of all logs in the current block Metadata such as timestamps and random numbers; Block body: Stores plaintext or encrypted data of multiple access logs (e.g., using AES-256 symmetric encryption, with the key managed by a distributed key management system). Blocks are linked together using the cryptographic hash function SHA-256; It adopts a practical Byzantine fault-tolerant or proof-of-authority consensus mechanism to quickly achieve data consistency among distributed nodes and avoid the risk of forks; it sets up full nodes and light nodes to achieve rapid synchronization and verification of log data through a P2P network between nodes. The auditors used the Merkel root hash in the block header. By combining the hash value of the log entry, it is possible to quickly verify whether a single log entry has been tampered with. For example, if a log entry is modified, its corresponding Merkel path hash value will not match the root hash, immediately exposing the tampering behavior. By adding a timestamp to each block through the trusted timestamp service, the log generation time cannot be forged, meeting the time sequence requirements in compliance auditing.

[0012] Furthermore, the formation of a continuous adaptive evolutionary cycle includes the following steps: Based on the blockchain logs and anomaly detection algorithm from step four, the system continuously monitors access behavior patterns. When abnormal behavior is detected, it is automatically marked as an "abnormal event" and a feedback process is triggered. The abnormal event is deconstructed to extract key abnormal dimensions (such as abnormal operation frequency values, resource path deviation, and equipment state change indicators) to form a structured abnormal feature vector. ,in To determine the intensity of abnormal features, the feature weights of the risk assessment model are dynamically adjusted using the gradient descent method. Let the original feature weight vector be... The abnormal feature vector is The weight update rule is as follows:

[0013] Where η is the learning rate and L is the model loss function. Let be the partial derivative of the loss function with respect to the i-th weight. The intensity of the anomalous feature; The effectiveness of each strategy is quantitatively scored to form a strategy effectiveness matrix E. Based on the effectiveness matrix E, a reinforcement learning algorithm is used to adjust the strategy generation parameters. For example, when the false alarm rate of a certain strategy exceeds a threshold, the system automatically reduces the trigger priority of the strategy or adjusts its associated threshold parameters to balance security and availability. When abnormal behavior accumulates to a preset threshold (such as detecting the same type of abnormality 10 times consecutively), or when the strategy execution effect is consistently lower than the target value, the system automatically starts a closed-loop iteration process. Through weight optimization and strategy iteration, the system gradually forms a positive cycle of "abnormal behavior → model optimization → strategy adjustment → effect improvement". For example, the system may have a low recognition rate for new attack patterns in the early stages, but after multiple rounds of closed-loop iteration, the model can automatically learn attack characteristics, improve detection accuracy and optimize interception strategies, and finally achieve continuous adaptive evolution "without human intervention".

[0014] A dynamic network access control system based on a zero-trust architecture includes: Dynamic Trust Engine Binding Layer: This layer integrates a triple mechanism of dynamic biometric binding, device fingerprint salt value hash verification, and environmental status awareness to complete the real-time binding of the user, device, and environment. It also integrates a device health assessment module, generating a health score based on indicators such as system patch status and security configuration compliance. This layer outputs the binding results and health score to the intelligent risk quantification layer, serving as initial feature inputs and dynamic weighting factors for the risk model. For example, a low device health score directly increases the access risk value.

[0015] Intelligent Risk Quantification Layer: Based on multi-source heterogeneous data such as user behavior, device status, and network environment, it uses the XGBoost model to calculate risk scores in real time and outputs dynamic risk values ​​in the 0-1 range through dynamic feature extraction and entropy weighting. This layer receives the binding results and health scores from the binding layer and simultaneously transmits real-time risk scores and abnormal feature vectors to the adaptive permission control layer, triggering decision logic for high-risk access to activate zero-trust sandbox restrictions and low-risk access to activate the least privilege channel.

[0016] Adaptive Access Control Layer: Based on real-time risk scoring, the AI ​​policy generation module automatically constructs a least-privilege access policy. High-risk access triggers a zero-trust sandbox environment to restrict sensitive operations, while low-risk access enables a least-privilege channel, achieving real-time adaptive adjustment of permissions. This layer outputs permission execution results and policy effectiveness metrics, such as interception success rate and false alarm rate, to the zero-trust adaptive evolution layer, driving the optimization of risk model feature weights and the iteration of policy generation algorithms.

[0017] Zero-Trust Adaptive Evolution Layer: Employing agentless API gateway technology for fine-grained access control, this layer intercepts unauthorized requests in real time. Access logs are stored using a blockchain distributed ledger and verified using a Merkle tree to ensure log immutability. This layer simultaneously constructs a closed-loop mechanism of risk assessment, policy execution, and anomaly feedback. It receives execution results and performance metrics from the control layer, feeding back into optimizing feature weights and policy rules. For example, after identifying "high-frequency nighttime access" as a new attack pattern, it dynamically adjusts the binding layer's health scoring rules and optimizes the quantification layer's feature weight allocation, forming a continuous adaptive evolutionary cycle of "binding layer providing a trust foundation → quantification layer calculating risk values ​​→ control layer executing policies → evolution layer providing feedback optimization."

[0018] The present invention has the following beneficial effects: In this invention, a real-time trust foundation is built by integrating device health assessment through a triple dynamic binding of user-device-environment. Dynamic risk quantification is achieved based on a multi-source heterogeneous data fusion machine learning model. Based on real-time risk scores, an AI-driven policy generation module enables real-time adaptive adjustment of permissions by upgrading and downgrading. Agentless API gateway technology is used for fine-grained access control and real-time interception of unauthorized requests. Blockchain-based immutable storage of access logs and anomaly detection algorithms monitor operational behavior. Finally, a continuous adaptive evolutionary cycle is formed through a closed-loop mechanism of risk assessment, policy execution, and anomaly feedback. This effectively solves the static lag problem of traditional network access control and forms a zero-trust dynamic defense system. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating the steps of a dynamic network access control method based on a zero-trust architecture proposed in this invention. Figure 2This is a system block diagram of a dynamic network access control system based on a zero-trust architecture proposed in this invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Please see Figures 1-2 As shown, this invention is a dynamic network access control method and system based on a zero-trust architecture, comprising: A dynamic network access control method based on zero-trust architecture: Step 1 (Multi-factor Continuous Identity Authentication): Through dynamic binding of biometric features (such as microsecond-level fingerprint / voiceprint comparison), device fingerprint salt value hash verification, and environmental status awareness, a triple dynamic binding of user-device-environment is performed. At the same time, device health assessment (such as system patch version and firewall status) is integrated to ensure the unity of the authenticity of the access subject's identity, device compliance, and environmental security in continuous authentication. Step 2 (Real-time Risk Quantification Assessment): Based on multi-source heterogeneous data such as user behavior (access frequency / operation path), device status (security configuration / vulnerability score), and network environment (geographical location / IP reputation), a machine learning model is used to calculate risk scores in real time, achieving millisecond-level dynamic risk quantification and breaking through the single-dimensional assessment limitations of traditional static rule bases. Step 3 (Dynamic Policy Generation Engine): Based on real-time risk scores, the AI-driven policy generation module automatically constructs the least privilege access policy and combines it with a dynamic permission sandbox mechanism to automatically trigger the "zero trust sandbox" environment to restrict sensitive operations for high-risk access and enable the "least privilege channel" for low-risk access, thereby realizing real-time upgrade and downgrade and adaptive adjustment of permissions. Step 4 (Policy Execution and Monitoring): Employ agentless API gateway technology to achieve fine-grained access control and intercept unauthorized requests in real time; use blockchain to immutably store access logs and combine them with anomaly detection algorithms to monitor operational behavior, ensuring the transparency and auditability of policy execution while avoiding the performance loss caused by traditional proxy models; Step 5 (Feedback Loop and Adaptive Iteration): Construct a closed-loop mechanism of risk assessment, strategy execution, and anomaly feedback. Monitored and identified abnormal behaviors automatically feed back into the risk model to optimize feature weights. The effect of strategy execution (such as the frequency of permission adjustment / interception rate) back-drives the iteration of the strategy generation algorithm, forming a continuous adaptive evolutionary cycle of "assessment-generation-execution-feedback", breaking through the static mode of existing patents that lack feedback optimization.

[0022] In one embodiment, the user-device-environment triple dynamic binding is achieved through biometric dynamic binding, device fingerprint salt value hash verification, and environmental status awareness, while integrating device health assessment, including the following steps: During each visit, the user's real-time biometric data is acquired through the biometric acquisition module and dynamically compared with the pre-stored biometric templates. A dynamic similarity threshold algorithm is used to dynamically adjust the comparison threshold according to environmental noise and device performance to ensure accurate identification of the user even in complex environments. The system collects unique hardware identifiers of the devices, such as CPU serial number, hard disk ID, and MAC address, and combines them with the device's operating status to generate a device fingerprint. A dynamic salt value generation algorithm is used to concatenate the device fingerprint with a real-time timestamp and a random salt value, and then generate an encrypted hash value using the SHA-256 hash function. The salt value is randomly generated by the system. Real-time collection of network environment data, physical environment data, and system environment data; based on the collected environmental data, a weighted risk scoring model is used to calculate the environmental risk value. in, Let be the weight of the j-th environmental indicator. The degree of abnormality of the indicator (0-1 standardized value); For example, abnormal geographical locations (unusual access locations) are given high weight, excessive network latency is given medium weight, and abnormal system processes are given high weight. Check device security configuration items (such as whether system patches are updated to the latest version, whether the firewall is enabled, whether antivirus software is running, and whether user privileges are minimized). Based on the results of the security configuration item check, calculate the device health score using a linear weighted scoring model. Among them, The deduction coefficient for the k-th security configuration. Configure an exception indicator variable (1 indicates an exception, 0 indicates normal); For example, 10 points are deducted for not updating system patches, 20 points are deducted for not enabling the firewall, and 15 points are deducted for not running antivirus software. The final score is mapped to a range of 0-100 points.

[0023] In one embodiment, the step of dynamically quantifying risk by real-time fusion calculation of risk scores based on multi-source heterogeneous data and employing a machine learning model includes the following steps: By integrating heterogeneous data from three dimensions—user behavior, device status, and network environment—a machine learning model is used for dynamic risk scoring. User behavior data includes access frequency, operation path, login time distribution, and abnormal operation frequency. Device status data includes system patch versions and vulnerability scores, firewall / antivirus software running status, and hardware fingerprint consistency (such as the matching degree between CPU serial number and registration information). Network environment data includes IP address geolocation mapping, IP reputation database scores, network latency and jitter values, and VPN usage status. Missing values ​​are filled with the mean or deleted, numerical features are standardized using Z-score, and categorical features are one-hot encoded, enabling the fusion of multi-source data under a unified scale. Sliding window features (such as access frequency in the last 5 minutes and operation path entropy value) are constructed based on user behavior sequences to capture short-term behavioral anomalies; device-network cross features (such as the combination of "high-risk IP + unpatched system") and user-device cross features (such as the combination of "unusual time period + unusual device login") are generated to enhance the expression of risk correlation; the entropy weight method or attention mechanism is used to dynamically adjust the feature weights of each dimension. For example, the weight of network environment features is automatically increased in high-risk scenarios, while the weight of user behavior features is dominant in low-risk scenarios. XGBoost and LightGBM gradient boosting tree models were selected due to their efficient processing capabilities for heterogeneous data and their real-time prediction performance. Historical datasets containing normal access samples and attack samples were used during model training, and hyperparameters were optimized through five-fold cross-validation. A risk assessment model is constructed through data preprocessing, feature engineering, and dynamic weight adjustment; risk levels are then determined based on a real-time risk scoring formula. in, The final risk score is calculated (0-1 range, with higher values ​​indicating greater risk). This is the Sigmoid activation function (which maps the linear output to the probability space). Let i be the weight of the i-th feature. Features The nonlinear transformation function, where b is the bias term; The model absorbs newly collected access data in real time through online learning or incremental training, dynamically adjusting feature weights and model parameters to ensure that the risk score always reflects the latest risk situation. The risk score is divided into three levels: low (0-0.3), medium (0.3-0.7), and high (0.7-1.0), corresponding to different access control strategies. High-risk scores directly trigger the zero-trust sandbox restriction in step three, medium-risk scores enable the least privilege channel, and low-risk scores maintain regular access permissions, realizing real-time linkage between risk quantification and access control.

[0024] In one embodiment, the real-time adaptive adjustment of permissions includes the following steps: Based on the risk assessment results from step two, the risk levels are divided into three levels: Low risk (0 ≤ <0.3): Enable "least privilege channel", granting only the minimum resource access permissions (such as read-only permission, specific API call permission) required to complete the current task. Medium risk (0.3 ≤ <0.7): Enable "Restricted Permission Channel" to add necessary operation permissions (such as editing permissions) on the basis of minimum permissions, and monitor sensitive operations through dynamic sandbox; High risk (0.7 ≤ ≤ 1.0): Triggers a "zero-trust sandbox environment", completely restricting sensitive operations, allowing only basic access, and triggering a two-factor authentication process (such as SMS verification code, biometric verification). When a risk score crosses a tiered threshold, the system automatically triggers permission adjustments. For example, if a user suddenly jumps from a low-risk status to a high-risk status (e.g., multiple failed login attempts within a short period), the system immediately downgrades their permissions from the "least privilege channel" to the "zero-trust sandbox environment" and suspends all sensitive operation permissions. Thresholds are dynamically optimized through the closed-loop feedback mechanism in step five. For instance, if historical data shows that a certain type of operation (e.g., large-amount transfers) frequently triggers anomalies at a risk score of 0.6, the system can automatically adjust the trigger threshold for that operation to 0.5, increasing defense sensitivity. The magnitude ΔP depends on the change in the risk score ΔR. For example, when ΔR > 0.2 (sudden increase in risk), the permission is directly downgraded to the next level or lower; when ΔR < 0.1 (small fluctuation in risk), the permission is only slightly adjusted within the original level (e.g., downgraded from "edit permission" to "read-only permission"). After the permission is adjusted, the system continuously monitors whether the access behavior meets expectations. If the risk score continues to decline after the adjustment, the system can gradually restore some permissions (e.g., upgraded from "zero-trust sandbox" back to "restricted permission channel"); if the risk score does not improve or continues to rise, the permission is further tightened.

[0025] In one embodiment, the use of agentless API gateway technology for fine-grained access control and real-time interception of unauthorized requests includes the following steps: The API gateway is deployed directly at the network layer between the client and the server, forwarding requests via direct IP / port connection, avoiding the "request-proxy-forward" three-way handshake overhead of traditional proxy mode; based on real-time traffic monitoring data, a weighted round-robin algorithm is used to dynamically allocate the weight of server nodes, ensuring fast forwarding and load balancing of requests in high-concurrency scenarios, and avoiding interception delays caused by single-point overload; Perform dynamic validation using a 5-tuple for each API request: User Identity: Verify the validity of the JWT token or OAuth2.0 access token to ensure that the requester is an authenticated user; Device status: Check whether the device fingerprint hash value is consistent with the device information bound in step one to prevent the device from being tampered with or impersonated; Risk Score: The real-time risk score output from step two is used to automatically trigger stricter access restrictions for high-risk requests; Resource permissions: Based on the dynamic permission policy generated in step three, verify whether the request is within the user's current permission range (e.g., users with read-only permissions are prohibited from calling the "Delete" API); Timeliness: Check if the request timestamp is within the valid time window to prevent replay attacks; An attribute-based access control model is adopted, which dynamically combines user attributes, environment attributes, and operation attributes into access control rules to achieve fine-grained management and control in four dimensions: user, device, environment, and operation. The access control matrix is ​​analyzed in real time by a rules engine, and "allow / deny / secondary authentication" decisions are made for each request. For example, when a high-risk user calls a sensitive API, the system directly denies the request and returns a 403 status code; when a low-risk user calls a regular API, the request is allowed. All intercepted events are written to the blockchain distributed ledger in real time to ensure that the logs are immutable and traceable. The log content includes key information such as request time, user ID, device fingerprint, API path, and reason for interception.

[0026] Frequently accessed API paths and user permissions are cached locally to reduce the number of real-time queries to the policy generation module and improve decision-making speed. Combined with the anomaly detection algorithm in step four, abnormal traffic such as DDoS attacks and SQL injections can be identified and intercepted in real time to ensure the stable operation of the gateway.

[0027] In one embodiment, the method of storing access logs immutably via blockchain includes the following steps: Each access log contains five core fields: user unique identifier, device fingerprint hash value, operation timestamp, operation type, operation resource path, and real-time risk score output from step two. Intercepting decision-making results; using hash encryption or salting to process sensitive user information to ensure that user identity cannot be directly deduced when logs are stored, in compliance with privacy protection regulations; Each block consists of two parts: a block header and a block body. Block header: Stores the hash value of the previous block. Merkle root hash of all logs in the current block Metadata such as timestamps and random numbers; Block body: Stores plaintext or encrypted data of multiple access logs (e.g., using AES-256 symmetric encryption, with the key managed by a distributed key management system). Blocks are linked together using the cryptographic hash function SHA-256; It adopts a practical Byzantine fault-tolerant or proof-of-authority consensus mechanism to quickly achieve data consistency among distributed nodes and avoid the risk of forks; it sets up full nodes and light nodes to achieve rapid synchronization and verification of log data through a P2P network between nodes. The auditors used the Merkel root hash in the block header. By combining the hash value of the log entry, it is possible to quickly verify whether a single log entry has been tampered with. For example, if a log entry is modified, its corresponding Merkel path hash value will not match the root hash, immediately exposing the tampering behavior. By adding a timestamp to each block through the trusted timestamp service, the log generation time cannot be forged, meeting the time sequence requirements in compliance auditing.

[0028] In one embodiment, forming a continuous adaptive evolutionary cycle includes the following steps: Based on the blockchain logs and anomaly detection algorithm from step four, the system continuously monitors access behavior patterns. When abnormal behavior is detected, it is automatically marked as an "abnormal event" and a feedback process is triggered. The abnormal event is deconstructed to extract key abnormal dimensions (such as abnormal operation frequency values, resource path deviation, and equipment state change indicators) to form a structured abnormal feature vector. ,in To determine the intensity of abnormal features, the feature weights of the risk assessment model are dynamically adjusted using the gradient descent method. Let the original feature weight vector be... The abnormal feature vector is The weight update rule is as follows:

[0029] Where η is the learning rate and L is the model loss function. Let be the partial derivative of the loss function with respect to the i-th weight. The intensity of the anomalous feature; The effectiveness of each strategy is quantitatively scored to form a strategy effectiveness matrix E. Based on the effectiveness matrix E, a reinforcement learning algorithm is used to adjust the strategy generation parameters. For example, when the false alarm rate of a strategy exceeds a threshold, the system automatically reduces the trigger priority of the strategy or adjusts its associated threshold parameters to balance security and availability. When abnormal behavior accumulates to a preset threshold (such as detecting the same type of abnormality 10 times consecutively), or when the strategy execution effect is consistently lower than the target value, the system automatically starts a closed-loop iteration process. Through weight optimization and strategy iteration, the system gradually forms a positive cycle of "abnormal behavior → model optimization → strategy adjustment → effect improvement". For example, the system may have a low recognition rate for new attack patterns in the early stages, but after multiple rounds of closed-loop iteration, the model can automatically learn attack characteristics, improve detection accuracy and optimize interception strategies, and finally achieve continuous adaptive evolution "without human intervention".

[0030] A dynamic network access control system based on a zero-trust architecture includes: Dynamic Trust Engine Binding Layer: This layer integrates a triple mechanism of dynamic biometric binding, device fingerprint salt value hash verification, and environmental status awareness to complete the real-time binding of the user, device, and environment. It also integrates a device health assessment module, generating a health score based on indicators such as system patch status and security configuration compliance. This layer outputs the binding results and health score to the intelligent risk quantification layer, serving as initial feature inputs and dynamic weighting factors for the risk model. For example, a low device health score directly increases the access risk value.

[0031] Intelligent Risk Quantification Layer: Based on multi-source heterogeneous data such as user behavior, device status, and network environment, it uses the XGBoost model to calculate risk scores in real time and outputs dynamic risk values ​​in the 0-1 range through dynamic feature extraction and entropy weighting. This layer receives the binding results and health scores from the binding layer and simultaneously transmits real-time risk scores and abnormal feature vectors to the adaptive permission control layer, triggering decision logic for high-risk access to activate zero-trust sandbox restrictions and low-risk access to activate the least privilege channel.

[0032] Adaptive Access Control Layer: Based on real-time risk scoring, the AI ​​policy generation module automatically constructs a least-privilege access policy. High-risk access triggers a zero-trust sandbox environment to restrict sensitive operations, while low-risk access enables a least-privilege channel, achieving real-time adaptive adjustment of permissions. This layer outputs permission execution results and policy effectiveness metrics, such as interception success rate and false alarm rate, to the zero-trust adaptive evolution layer, driving the optimization of risk model feature weights and the iteration of policy generation algorithms.

[0033] Zero-Trust Adaptive Evolution Layer: Employing agentless API gateway technology for fine-grained access control, this layer intercepts unauthorized requests in real time. Access logs are stored using a blockchain distributed ledger and verified using a Merkle tree to ensure log immutability. This layer simultaneously constructs a closed-loop mechanism of risk assessment, policy execution, and anomaly feedback. It receives execution results and performance metrics from the control layer, feeding back into optimizing feature weights and policy rules. For example, after identifying "high-frequency nighttime access" as a new attack pattern, it dynamically adjusts the binding layer's health scoring rules and optimizes the quantification layer's feature weight allocation, forming a continuous adaptive evolutionary cycle of "binding layer providing a trust foundation → quantification layer calculating risk values ​​→ control layer executing policies → evolution layer providing feedback optimization."

[0034] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A dynamic network access control method based on a zero-trust architecture, characterized in that, include: Step 1: Through dynamic binding of biometric features, device fingerprint salt value hash verification, and environmental status perception, a triple dynamic binding of user-device-environment is achieved, while integrating device health assessment. Step 2: Based on multi-source heterogeneous data, a machine learning model is used to fuse and calculate risk scores in real time to perform dynamic risk quantification; Step 3: Based on the real-time risk score, the AI-driven strategy generation module automatically constructs the least privilege access policy and combines it with the dynamic permission sandbox mechanism to automatically trigger the zero-trust sandbox environment to restrict sensitive operations for high-risk access, enable the least privilege channel for low-risk access, and adaptively adjust the permissions in real time. Step 4: Employ agentless API gateway technology for fine-grained access control, intercepting unauthorized requests in real time; store access logs immutably using blockchain, and monitor operational behavior using anomaly detection algorithms; Step 5: Construct a closed-loop mechanism of risk assessment, strategy execution, and anomaly feedback. Monitored and identified abnormal behaviors automatically feed back into the risk model to optimize feature weights, and the effect of strategy execution drives the iteration of the strategy generation algorithm, forming a continuous adaptive evolutionary cycle.

2. The dynamic network access control method based on zero-trust architecture according to claim 1, characterized in that, The process involves dynamic binding of user, device, and environment through biometrics, device fingerprint salt value hash verification, and environmental status awareness, while also integrating device health assessment. This includes the following steps: During each visit, the system acquires the user's real-time biometric data through the biometric acquisition module and dynamically compares it with pre-stored biometric templates. A dynamic similarity threshold algorithm is used to dynamically adjust the comparison threshold based on environmental noise and device performance. The system collects the device's unique hardware identifier and generates a device fingerprint by combining it with the device's operating status. A dynamic salt value generation algorithm is used to concatenate the device fingerprint with a real-time timestamp and a random salt value, and then generates an encrypted hash value using the SHA-256 hash function. The salt value is randomly generated by the system. Real-time collection of network environment data, physical environment data, and system environment data; based on the collected environmental data, a weighted risk scoring model is used to calculate the environmental risk value. in, Let j be the weight of the j-th environmental indicator. The degree of abnormality of the indicator; Check the equipment's safety configuration items. Based on the results of the safety configuration item check, calculate the equipment health score using a linear weighted scoring model. Among them, The deduction coefficient for the k-th security configuration. Configure exception indicator variables.

3. The dynamic network access control method based on zero-trust architecture according to claim 1, characterized in that, The method of dynamically quantifying risk by using a machine learning model to calculate risk scores in real time based on multi-source heterogeneous data includes the following steps: By integrating heterogeneous data from three dimensions—user behavior, device status, and network environment—a machine learning model is used for dynamic risk scoring. User behavior data includes access frequency, operation path, login time distribution, and abnormal operation frequency. Device status data includes system patch version and vulnerability score, firewall / antivirus software running status, and hardware fingerprint consistency. Network environment data includes IP address geolocation mapping, IP reputation database score, network latency and jitter values, and VPN usage status. Missing values ​​are filled with mean or deleted, numerical features are standardized using Z-score, and categorical features are one-hot encoded, fusing multi-source data under a unified scale. Sliding window features are constructed based on user behavior sequences to capture short-term behavioral anomalies; device-network cross features and user-device cross features are generated to enhance the expression of risk correlation; and the weights of each dimension of features are dynamically adjusted using entropy weighting or attention mechanisms. XGBoost and LightGBM gradient boosting tree models were selected. Historical datasets, including normal access samples and attack samples, were used during model training. Hyperparameters were optimized through five-fold cross-validation. A risk assessment model is constructed through data preprocessing, feature engineering, and dynamic weight adjustment; risk levels are then determined based on a real-time risk scoring formula. in, For the final risk score, For the Sigmoid activation function, Let i be the weight of the i-th feature. Features The nonlinear transformation function, where b is the bias term; The model absorbs newly collected access data in real time through online learning or incremental training, dynamically adjusts feature weights and model parameters, and reflects the latest risk situation. The risk score is divided into three levels: low, medium and high, corresponding to different access control strategies. The high-risk score directly triggers the zero-trust sandbox restriction in step three, the medium-risk score enables the least privilege channel, and the low-risk score maintains the regular access permission.

4. The dynamic network access control method based on zero-trust architecture according to claim 1, characterized in that, The real-time adaptive adjustment of permissions includes the following steps: Based on the risk assessment results from step two, the risk levels are divided into three levels: Low risk: Enable "least privilege channel", granting only the minimum resource access required to complete the current task; Medium risk: Enable "restricted access channel", add necessary operation permissions on the basis of minimum permissions, and monitor sensitive operations through dynamic sandbox; High risk: Triggers a "zero trust sandbox environment", completely restricting sensitive operations, allowing only basic access, and triggering a two-factor authentication process; When the risk score crosses the tiered threshold, the system automatically triggers permission adjustment; the threshold is dynamically optimized through the closed-loop feedback mechanism in step five; the permission adjustment magnitude ΔP depends on the change in the risk score ΔR; after the permission adjustment, the system continuously monitors whether the access behavior meets expectations; if the risk score continues to decline after the adjustment, the system can gradually restore some permissions; if the risk score does not improve or continues to rise, the permissions will be further tightened.

5. The dynamic network access control method based on zero-trust architecture according to claim 1, characterized in that, The use of agentless API gateway technology for fine-grained access control and real-time interception of unauthorized requests includes the following steps: The API gateway is deployed directly at the network layer between the client and the server, forwarding requests via direct IP / port connection. Based on real-time traffic monitoring data, it uses a weighted round-robin algorithm to dynamically allocate server node weights, improving the fast forwarding and load balancing of requests in high-concurrency scenarios and avoiding interception delays caused by single-point overload. Perform dynamic validation of each API request using a 5-tuple: User Identity: Verify the validity of the JWT token or OAuth2.0 access token and confirm that the requester is an authenticated user; Device status: Check whether the device fingerprint hash value is consistent with the device information bound in step one; Risk Score: Associated with the real-time risk score output in step two, access restrictions are automatically triggered for high-risk requests; Resource permissions: Based on the dynamic permission policy generated in step three, verify whether the request is within the user's current permission scope; Timeliness: Check if the request timestamp is within the valid time window to prevent replay attacks; An attribute-based access control model is adopted, which dynamically combines user attributes, environment attributes, and operation attributes into access control rules. The access control matrix is ​​parsed in real time by a rules engine, and "allow / deny / secondary authentication" decisions are made for each request; all interception events are written to the blockchain distributed ledger in real time, making the logs immutable and traceable; the log content includes information such as request time, user ID, device fingerprint, API path, and reason for interception. Frequently accessed API paths and user permissions are cached locally to reduce the number of real-time queries to the policy generation module and improve decision-making speed; combined with the anomaly detection algorithm in step four, abnormal traffic is identified and intercepted in real time.

6. The dynamic network access control method based on zero-trust architecture according to claim 1, characterized in that, The method of storing access logs immutably via blockchain includes the following steps: Each access log contains five core fields: user unique identifier, device fingerprint hash value, operation timestamp, operation type, operation resource path, and real-time risk score output from step two. Intercepting decision-making results; using hash encryption or salting to process sensitive user information so that user identity cannot be directly deduced when the log is stored, which complies with privacy protection regulations; Each block consists of two parts: a block header and a block body. Block header: Stores the hash value of the previous block. Merkle root hash of all logs in the current block timestamp, random number metadata; Block body: Stores plaintext or encrypted data for multiple access log entries; Blocks are linked together using the cryptographic hash function SHA-256; It adopts a practical Byzantine fault-tolerant or proof-of-authority consensus mechanism to achieve data consistency quickly among distributed nodes and avoid the risk of forks; it sets up full nodes and light nodes to quickly synchronize and verify log data through a P2P network between nodes. The auditors used the Merkel root hash in the block header. By combining the hash value of the log entry, we can quickly verify whether a single log entry has been tampered with; by adding a timestamp to each block through a trusted timestamp service, the generation time of the log cannot be forged.

7. The dynamic network access control method based on zero-trust architecture according to claim 1, characterized in that, The formation of a continuous adaptive evolutionary cycle includes the following steps: Based on the blockchain logs and anomaly detection algorithm from step four, the system continuously monitors access behavior patterns. When abnormal behavior is detected, it is automatically marked as an "abnormal event" and a feedback process is triggered. The abnormal event is then deconstructed to extract key abnormal dimensions, forming a structured abnormal feature vector. ,in To determine the intensity of abnormal features; the feature weights of the risk assessment model are dynamically adjusted using the gradient descent method; let the original feature weight vector be... The abnormal feature vector is The weight update rule is as follows: Where η is the learning rate and L is the model loss function. Let be the partial derivative of the loss function with respect to the i-th weight. The intensity of the anomalous feature; The effectiveness of each strategy is quantitatively scored to form a strategy effectiveness matrix E. Based on the effectiveness matrix E, a reinforcement learning algorithm is used to adjust the strategy generation parameters. When abnormal behavior accumulates to a preset threshold, or when the strategy execution effect continues to be lower than the target value, the system automatically starts a closed-loop iteration process. Through weight optimization and strategy iteration, the system gradually forms a positive cycle of "abnormal behavior → model optimization → strategy adjustment → effect improvement".

8. The dynamic network access control system based on zero-trust architecture used in the dynamic network access control method based on zero-trust architecture according to claim 1, characterized in that, include: Dynamic Trust Engine Binding Layer: Integrates a triple mechanism of dynamic biometric binding, device fingerprint salt value hash verification, and environmental status awareness to perform real-time binding of user-device-environment. It also integrates a device health assessment module to generate a health score based on system patch status and security configuration compliance indicators. The binding results and health score are output to the intelligent risk quantification layer as the initial feature input and dynamic weighting factor of the risk model. Intelligent Risk Quantification Layer: Based on multi-source heterogeneous data, it uses the XGBoost model to calculate risk scores in real time and outputs dynamic risk values ​​in the 0-1 range through dynamic feature extraction and entropy weighting. It receives the binding results and health scores output by the binding layer and transmits real-time risk scores and abnormal feature vectors to the adaptive permission control layer, triggering the decision logic of zero-trust sandbox restriction for high-risk access and minimum permission channel for low-risk access. Adaptive Access Control Layer: Based on real-time risk scores, the AI ​​policy generation module automatically constructs the least privilege access policy. High-risk access triggers a zero-trust sandbox environment to restrict sensitive operations, while low-risk access enables the least privilege channel. The layer outputs permission execution results and policy effectiveness metrics, such as interception success rate and false alarm rate, to the zero-trust adaptive evolution layer, driving the optimization of risk model feature weights and the iteration of policy generation algorithms. Zero-trust adaptive evolution layer: Employs agentless API gateway technology for fine-grained access control, intercepts unauthorized requests in real time, stores access logs through a blockchain distributed ledger and verifies them using Merkle trees to ensure log immutability; Simultaneously constructs a closed-loop mechanism of risk assessment, policy execution, and anomaly feedback, receives execution results and performance indicators from the control layer, and feeds back to optimize feature weights and policy rules.

Images