Information security protection method and system based on zero-trust architecture

Abstract

The invention relates to the technical field of information security, and discloses an information security protection method and system based on a zero-trust architecture, and the method comprises the steps: obtaining a user access request and an identity certificate, and obtaining a user identity trust value through employing a hierarchical verification and multi-factor weighted fusion method; obtaining a resource sensitivity level and a sensitive feature tag by adopting an intelligent content analysis and historical access mode mining method; a scene clustering and self-adaptive threshold adjustment method is adopted to obtain a dynamic trust threshold required by an access decision; obtaining an access authorization decision and an access control token by adopting a hierarchical decision and progressive verification method; a lightweight behavior monitoring and increment anomaly detection method is adopted to obtain a session monitoring result and an updated user trust score; and obtaining a globally optimized access control strategy parameter by adopting federated learning and reinforcement learning methods. According to the invention, a dynamic self-adaptive access control decision can be realized, and the accuracy and the intelligent level of information security protection are improved.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and more specifically, to an information security protection method and system based on a zero-trust architecture. Background Technology

[0002] As enterprises deepen their digital transformation, traditional perimeter-based network security architectures face severe challenges. Traditional security models assume internal trust and external untrustworthiness, isolating internal and external networks through firewalls and other perimeter devices, and defaulting to trusting access requests that pass perimeter authentication. However, with the widespread adoption of cloud computing, mobile work, and the Internet of Things (IoT), enterprise network boundaries are becoming increasingly blurred, and internal threats and advanced persistent threats are frequent. Traditional perimeter protection models can no longer meet the security needs of dynamic business environments.

[0003] Existing access control technologies suffer from the following main problems: First, the authentication mechanism is simplistic, relying solely on static credentials for one-time verification, which cannot address threats such as credential theft or session hijacking. Second, access control policies are statically fixed, using pre-configured permission rules for authorization decisions, making it impossible to dynamically adjust control strength based on real-time security posture and access context. Third, there is a lack of continuous monitoring mechanisms, as user behavior is no longer monitored after authorization, resulting in abnormal access behavior not being detected and blocked in a timely manner. Fourth, policy optimization relies on manual configuration, making it difficult to adapt to constantly changing business scenarios and security threats.

[0004] Zero Trust architecture, as a new generation of cybersecurity concept, proposes the core principles of never trusting and continuous verification, requiring dynamic evaluation and authorization for each access request. However, existing zero trust solutions still have shortcomings in the accuracy of trust assessment, the adaptability of decision thresholds, the real-time nature of behavior monitoring, and the intelligence of policy optimization, making it difficult to ensure both security and business convenience. Summary of the Invention

[0005] This invention provides an information security protection method and system based on a zero-trust architecture, which solves the technical problems of static and fixed access control policies, insufficient accuracy of trust assessment, and lack of continuous monitoring mechanisms in related technologies.

[0006] This invention provides an information security protection method based on a zero-trust architecture, comprising the following steps:

[0007] S1: Obtain user access request and identity credentials, and use a layered verification and multi-factor weighted fusion method to obtain user identity trust value;

[0008] S2 receives the user's identity trust value and uses intelligent content analysis and historical access pattern mining methods to obtain the resource sensitivity level and sensitive feature tags;

[0009] S3 receives resource sensitivity levels and user access requests, and uses scenario clustering and adaptive threshold adjustment methods to obtain the dynamic trust threshold required for access decisions.

[0010] S4 receives the user's identity trust value, dynamic trust threshold, and resource sensitivity level, and uses a hierarchical decision-making and progressive verification method to obtain access authorization decisions and access control tokens.

[0011] S5 receives the access control token, uses lightweight behavior monitoring and incremental anomaly detection methods to obtain session monitoring results and updated user trust scores;

[0012] S6 receives session monitoring results and access decision history data, and uses federated learning and reinforcement learning methods to obtain globally optimized access control policy parameters.

[0013] In a preferred embodiment, S1 includes:

[0014] Receive the identity credentials submitted by the user, and use the fast authentication protocol of the distributed identity authentication center to obtain the user's basic identity identifier and pre-calculated trust score;

[0015] Receive the user's basic identity identifier, collect the device's hardware and software features to construct a device fingerprint, match the device fingerprint vector with the device trust database to obtain the device trust level label and the corresponding trust value;

[0016] Receive the device trust level label and the access target resource identifier, and search in the verification strength decision matrix according to the device trust level and the initial sensitivity identifier of the resource to obtain the verification strength level;

[0017] Receive the verification strength level, use the corresponding strength of the authentication method combination to execute the verification process, and obtain the verification pass mark and verification success factor;

[0018] The system receives and verifies the identity through the identifier, verification success factor, pre-calculated trust score, and device trust value. It then calculates the time matching degree, location matching degree, and resource type matching degree to obtain the comprehensive behavior matching degree. Finally, it weights and sums the authentication contribution item, device contribution item, and behavior contribution item using preset weight coefficients and normalizes them to obtain the comprehensive identity trust value of the user's current session.

[0019] In a preferred embodiment, S2 includes:

[0020] Receive the identifier of the target resource and use resource metadata extraction technology to obtain the structured attribute information of the resource;

[0021] The system receives structured attribute information of resources, adopts a multimodal sensitivity prediction method based on a pre-trained language model, and fuses textual semantic features and visual features through a cross-modal attention fusion mechanism to obtain a preliminary sensitivity level of the resources.

[0022] The initial sensitivity level of the received resource is determined. When the resource is determined to be confidential or internal, a deep scan of the content is performed using named entity recognition algorithm and keyword matching combined with semantic similarity calculation to obtain sensitive data feature identifiers.

[0023] Receive sensitive data feature identifiers, accumulate weight coefficients according to the sensitive feature weight table to obtain a basic sensitivity score, and adjust it in combination with the resource's access breadth index, access frequency index and sensitive operation frequency to obtain the current sensitivity score of the resource;

[0024] Receive the current sensitivity score of the resource, map the score to public, internal and confidential levels according to the preset threshold, generate sensitive labels and store them in the resource profile library, and obtain the final sensitivity level and sensitive feature labels of the resource.

[0025] In a preferred embodiment, S3 includes:

[0026] Receive the final sensitivity level of the resource and the access request, collect time context, spatial context, network context and business context information, encode the features of each dimension and concatenate them into a multi-dimensional context feature vector;

[0027] Receive multi-dimensional context feature vectors, use scene clustering algorithm to cluster historical access records, calculate the similarity between the current access context feature vector and the scene cluster center vector to obtain scene category identifier and scene similarity;

[0028] Receive scene category identifier, scene similarity and final resource sensitivity level, and query the corresponding baseline trust threshold configuration from the scene threshold configuration library;

[0029] The system receives the baseline trust threshold configuration, obtains indicators from the security situation awareness platform in terms of threat intelligence, security incidents, and system health, and comprehensively evaluates them to obtain the situation adjustment factor.

[0030] The system receives a baseline trust threshold, scene similarity, and situation adjustment factor. It adjusts the baseline threshold based on scene similarity, multiplies it by the situation adjustment factor, and performs boundary checks to obtain the final dynamic trust threshold.

[0031] In a preferred embodiment, S4 includes:

[0032] Receive the user's comprehensive identity trust value and final dynamic trust threshold, calculate the difference between the trust value and the threshold as the trust margin, and classify access requests into high trust category, boundary trust category and low trust category based on the trust margin;

[0033] Receive the initial authorization decision category, analyze the reasons why the trust value does not meet the standard for the boundary trust category, and select the device security enhancement verification, identity reconfirmation verification or administrator approval verification method to obtain supplementary verification requirements;

[0034] Receive supplementary verification requests and verification result feedback, determine the trust increase amount based on the type and intensity of the supplementary verification, add the trust increase amount to the original trust value, and obtain the increased user trust value;

[0035] Receive the enhanced user trust value and the final sensitivity level of the resource, determine the data access scope and operation permission scope based on the margin between the trust value and the threshold, calculate the authorization validity period, and obtain the authorization scope parameters;

[0036] Receive the authorization scope parameters and authorization validity period, generate an access control token containing user identifier, resource identifier, authorization scope description, and authorization validity period, sign it using digital signature technology, and then send it to the resource access agent.

[0037] In a preferred embodiment, S5 includes:

[0038] Receive access control tokens, deploy lightweight behavior monitoring probes on resource access paths, collect operation behavior data in bypass listening mode, and obtain session monitoring instances and baseline behavior records;

[0039] Receive session monitoring instances, use sliding time window technology to aggregate and statistically analyze behavioral features, and obtain a sequence of real-time user operation behavior features.

[0040] The system receives real-time user operation behavior feature sequences, uses a temporal convolutional network combined with a multi-head self-attention mechanism to extract behavior pattern features, and calculates reconstruction error and Mahalanobis distance through a variational autoencoder to obtain a behavior anomaly score.

[0041] Receive behavior anomaly score, classify the anomaly into different risk levels according to preset multi-level response thresholds, and execute corresponding response actions such as recording alarms, restricting permissions, re-authenticating, or terminating the session.

[0042] Receive the response action execution result, adjust the user trust score according to the response level, synchronize the updated trust score to the distributed identity authentication center, and obtain the updated user trust score and session status.

[0043] In a preferred embodiment, S6 includes:

[0044] Receive session monitoring logs and response records, extract access decision records locally in each business system to build training samples, perform desensitization and balancing processing on the samples, and obtain a decision optimization training sample set;

[0045] Receive the decision optimization training sample set, construct an access control knowledge graph using a graph neural network for representation learning, introduce a meta-learning mechanism, and obtain locally optimized decision model parameters;

[0046] Receive local optimization decision model parameters from each business system, perform secure aggregation calculations using a federated learning aggregation protocol, and obtain global aggregation model parameters;

[0047] Receive globally aggregated model parameters, perform replay tests in a simulation environment, evaluate decision accuracy, false positive rate, and false negative rate, and obtain the evaluation results of policy optimization effect;

[0048] The system receives the evaluation results of the strategy optimization effect, applies the new model to the production environment using a canary release strategy, establishes a continuous monitoring mechanism for model performance and a feedback collection channel, and obtains the updated production environment decision model.

[0049] In a preferred embodiment, the verification strength levels are divided into basic verification, standard verification, and enhanced verification;

[0050] The standard verification requires a password plus a dynamic token or SMS verification code; the enhanced verification requires biometric authentication, including fingerprint recognition and facial recognition. Fingerprint recognition uses a minutiae matching algorithm, and facial recognition calculates similarity using liveness detection and facial key point feature vectors.

[0051] In a preferred embodiment, the high trust category is defined as a trust margin exceeding a preset boundary, in which the system adopts a fast passage strategy;

[0052] When the boundary trust category has a negative trust margin but does not exceed the compensation verification threshold, the system initiates a progressive supplementary verification process; when the low trust category has a significantly negative trust margin, the system adopts a direct rejection strategy.

[0053] In a preferred embodiment, an information security protection system based on a zero-trust architecture is used to perform the steps of the above-described information security protection method based on a zero-trust architecture, including:

[0054] The identity trust assessment module is used to obtain user access requests and identity credentials, and uses a layered verification and multi-factor weighted fusion method to obtain the user identity trust value.

[0055] The resource sensitivity identification module receives user identity trust values ​​and uses intelligent content analysis and historical access pattern mining methods to obtain resource sensitivity levels and sensitive feature tags.

[0056] The dynamic threshold calculation module receives resource sensitivity levels and user access requests, and uses scenario clustering and adaptive threshold adjustment methods to obtain the dynamic trust threshold required for access decisions.

[0057] The access authorization decision module receives user identity trust value, dynamic trust threshold and resource sensitivity level, and uses a hierarchical decision and progressive verification method to obtain access authorization decision and access control token.

[0058] The session monitoring module receives access control tokens and uses lightweight behavior monitoring and incremental anomaly detection methods to obtain session monitoring results and updated user trust scores.

[0059] The policy optimization module receives session monitoring results and access decision history data, and uses federated learning and reinforcement learning methods to obtain globally optimized access control policy parameters.

[0060] The beneficial effects of this invention are as follows:

[0061] By employing a layered verification and multi-factor weighted fusion method, the user identity trust value is calculated by integrating multiple dimensions of information such as user identity credentials, device trust level, and historical behavior matching degree. Combined with scenario clustering and adaptive threshold adjustment methods, the trust threshold is dynamically determined according to the access context and global security situation. This achieves dynamic adaptation of access control decisions, overcomes the limitations of traditional static policies in dealing with dynamic business environments, improves the accuracy and flexibility of access control, and takes into account business convenience while ensuring security.

[0062] By employing lightweight behavior monitoring and incremental anomaly detection methods to continuously monitor authorized sessions, and utilizing temporal convolutional networks and multi-head self-attention mechanisms to identify abnormal behaviors in real time and execute hierarchical responses, while employing federated learning and reinforcement learning methods to continuously optimize access control policy parameters, the system achieves full lifecycle security management from pre-verification to in-process monitoring and post-event optimization, thereby improving the system's ability to detect new threats and the adaptive evolution capability of policies. Attached Figure Description

[0063] Figure 1 This is a flowchart of an information security protection method based on a zero-trust architecture according to the present invention;

[0064] Figure 2 This is a flowchart of an information security protection method based on a zero-trust architecture according to the present invention. Detailed Implementation

[0065] The subject matter described herein will now be discussed with reference to exemplary embodiments. It should be understood that these embodiments are discussed only to enable those skilled in the art to better understand and implement the subject matter described herein, and changes may be made to the function and arrangement of the elements discussed without departing from the scope of this specification. Various processes or components may be omitted, substituted, or added as needed in the examples. Furthermore, some features described in the examples may be combined in other examples.

[0066] At least one embodiment of the present invention discloses an information security protection method based on a zero-trust architecture, such as Figures 1 to 2 As shown, it includes the following steps:

[0067] S1: Obtain user access request and identity credentials, and use a layered verification and multi-factor weighted fusion method to obtain user identity trust value;

[0068] This step aims to establish a fast and efficient identity trust assessment mechanism. By dividing the identity verification process into two layers—a basic verification layer and an enhanced verification layer—the verification strength is dynamically selected based on the security level of the access requirements, optimizing verification response speed while ensuring security. This step overcomes the performance bottleneck caused by traditional solutions using a uniform verification process for all access requests, achieving a precise match between verification strength and security requirements.

[0069] S11 receives the identity credentials submitted by the user, uses the fast authentication protocol of the distributed identity authentication center to obtain the user's basic identity identifier and pre-calculated trust score;

[0070] When a user initiates an access request, the system first receives the user's submitted identity credentials. These credentials include static identity elements such as username, password hash, or digital certificate. The system then sends the received credentials to a distributed identity authentication center via a secure channel.

[0071] This authentication center uses a lightweight authentication protocol based on elliptic curve cryptography for identity verification. This protocol confirms that the user possesses a valid private key or password through a challenge-response mechanism. After completing the identity verification, the authentication center not only returns a result of successful or failed verification, but also returns the user's pre-calculated basic trust score.

[0072] This pre-calculated trust score is calculated using an offline trust assessment model based on factors such as the user's historical behavior records, security event records, and role permissions during user registration or the last successful access, and is stored in the user profile database. By adopting a pre-calculation method, the latency caused by real-time calculation of complex trust models is avoided.

[0073] The basic identity identifier is returned as a unique identifier for the user, which is associated with the user's complete identity attributes and permission configuration information.

[0074] S12, receive the user's basic identity identifier, and use device fingerprint fast matching technology to obtain the device trust level label and the corresponding trust value;

[0075] After obtaining the user's basic identity identifier, the system immediately collects the characteristic information of the user's currently used device to construct a device fingerprint. Device fingerprint collection includes two dimensions: hardware layer characteristics and software layer characteristics. Hardware layer characteristics include unique device identifiers such as CPU model, memory capacity, storage device serial number, network interface physical address, and display device resolution. Software layer characteristics include environmental characteristics such as operating system type and version number, system patch installation list, browser type and plugin configuration, and security software running status.

[0076] The system maps the collected multi-dimensional device features into fixed-length device fingerprint vectors using a feature encoding algorithm. These fingerprint vectors are then matched for similarity with the fingerprint vectors of registered devices in a device trust database. The device trust database maintains fingerprint baselines and corresponding trust level labels for all authorized devices.

[0077] Device trust levels are divided into four categories: Trusted Devices, Known Devices, Unknown Devices, and Risky Devices. Each level corresponds to a different trust value. Trusted Devices correspond to the highest trust level, Known Devices to a medium-high trust level, Unknown Devices to a medium-low trust level, and Risky Devices to the lowest trust level.

[0078] The system calculates vector similarity. If the similarity exceeds a high threshold, the device is identified as a known or trusted device. If the similarity is within a medium range, the device configuration has changed and requires further verification. If no match is found, the device is identified as an unknown device. Based on the matching results, the system assigns a corresponding trust level label and its corresponding trust value to the currently accessing device.

[0079] S13, Receive the device trust level label and the access target resource identifier, and use a hierarchical verification strategy selection mechanism to obtain the appropriate verification strength level;

[0080] After obtaining the device trust level label, the system needs to determine the appropriate authentication strength for this access. The choice of authentication strength depends on two key factors: the device trust level and the sensitivity of the target resource. The system first queries the resource catalog service for a preliminary sensitivity identifier of the target resource by parsing the resource identifier in the access request.

[0081] The initial sensitivity identification of resources adopts a three-level classification: public-level resources require no special protection, internal-level resources are restricted to access by internal personnel, and confidential-level resources involve core trade secrets or personal privacy data. This initial sensitivity identification is a basic classification label pre-configured in the system for quickly determining the sensitivity level. Detailed sensitivity analysis of resources will be performed in step S2.

[0082] The system establishes a two-dimensional verification strength decision matrix. Rows represent device trust levels, columns represent resource sensitivity levels, and matrix elements represent the corresponding verification strength level. Verification strength levels are divided into three levels: basic verification, standard verification, and enhanced verification. Basic verification requires only username and password verification; standard verification requires a password plus a dynamic token or SMS verification code; enhanced verification requires biometric identification or a hardware token plus administrator approval.

[0083] For example, basic authentication is used when a trusted device accesses public-level resources, while enhanced authentication is used when an unknown device accesses confidential-level resources. The system searches for the corresponding authentication strength level in the decision matrix based on the current device trust level label and the initial sensitivity identifier of the resource as the output result.

[0084] S14, Receive the verification strength level, use the corresponding strength of the authentication method combination to execute the verification process, and obtain the verification pass mark and verification success factor;

[0085] After determining the verification strength level, the system invokes the corresponding combination of authentication methods based on the level. For the basic verification level, the system has already completed credential verification in step S11, so it directly marks the verification as passed and assigns the basic verification success factor as the baseline value.

[0086] For the standard verification level, the system triggers a secondary authentication process after the basic verification is successful. Secondary authentication can be performed using either a dynamic password or an SMS verification code. If a dynamic password is selected, the system sends a challenge code to the user's pre-bound token device or mobile application. The user then uses a token generator to generate a dynamic password based on the challenge code and device key using a time synchronization algorithm. The system receives the user's input dynamic password and verifies its correctness using the same algorithm.

[0087] If the SMS verification code method is selected, the system generates a 6-digit random numeric verification code and sends it to the user's registered mobile phone number via the SMS gateway. The user enters the verification code within a specified time, and the system verifies the correctness and timeliness of the verification code. Upon successful standard verification, a medium enhancement value is assigned to the standard verification success factor.

[0088] For enhanced verification levels, the system triggers a biometric authentication process. Biometrics supports both fingerprint and facial recognition. Fingerprint recognition requires the user to press their finger on the fingerprint acquisition device. The system acquires a fingerprint image and extracts fingerprint feature points, including the position and orientation information of ridge endpoints and bifurcation points. The system matches the extracted feature point set with the fingerprint template stored during user registration, using a minutiae-based matching algorithm to calculate a matching score.

[0089] Facial recognition requires the user to face the camera. The system captures facial images and performs liveness detection to prevent photo attacks. Liveness detection is achieved by requiring the user to perform actions such as blinking or turning their head. The system extracts facial key points from the facial image, including the coordinates of the corners of the eyes, the tip of the nose, and the corners of the mouth, constructs a facial feature vector, and calculates its similarity with a registered template. Upon successful enhancement verification, a high enhancement value is assigned to the verification success factor. The system outputs a verification success identifier and the corresponding verification success factor value.

[0090] S15: Receive the verification pass identifier, verification success factor, pre-calculated trust score and device trust value, and use a multi-factor weighted fusion algorithm combined with historical behavior matching degree to calculate the comprehensive identity trust value of the user's current session.

[0091] After obtaining the verification pass identifier and verification success factor, the system needs to calculate the final identity trust value by integrating multiple dimensions of trust elements. The system first obtains a summary of the user's historical behavioral characteristics from the user behavior analysis platform. This summary contains the user's typical access patterns over a past time window, extracted through offline analysis of the user's historical access logs. Behavioral pattern characteristics include the distribution of frequently accessed time periods, the set of frequently accessed geographical locations, the distribution of frequently accessed resource types, and typical operation sequence patterns.

[0092] The system extracts real-time behavioral features of the user's current access request, including the current access time, current geographical location, and type of requested resource. The system uses a feature similarity calculation method to evaluate the degree of matching between the current behavioral features and historical behavioral feature summaries.

[0093] Time-based matching score is calculated by determining whether the current access time falls within the user's frequently accessed time period. If it does, a high matching score is assigned; otherwise, a medium or low matching score is assigned based on the degree of deviation. Geographic location matching score is calculated by determining whether the current access location belongs to the user's frequently accessed location set. For mobile access scenarios, the system calculates the geographic distance between the current location and the nearest frequently accessed location; the closer the distance, the higher the matching score. Resource type matching score is calculated by comparing the currently requested resource type with the distribution of resource types accessed historically by the user. If the resource type is one that the user frequently accesses, the matching score is high.

[0094] The system calculates a weighted average of time matching, location matching, and resource type matching to obtain a comprehensive behavioral matching score. Next, the system performs a trust value fusion calculation. The inputs to this calculation include the user's pre-calculated basic trust score, the value corresponding to the device's trust level, the verification success factor, and the comprehensive behavioral matching score.

[0095] The system uses a multi-factor weighted fusion method for calculation. This method multiplies the basic trust score by the verification success factor as the authentication contribution item, uses the device trust level value as the device contribution item, and converts the behavior matching degree into a value as the behavior contribution item. The three contribution items are weighted and summed through preset weight coefficients to obtain the preliminary trust value.

[0096] To normalize the trust value to a standard range, the system applies a normalization mapping function to the initial trust value, mapping the value to a standard scoring range of zero to one hundred, thus obtaining the comprehensive identity trust value for the user's current session. This trust value is the output of this step and is also stored in association with the session identifier for use in subsequent steps.

[0097] S2 receives the user's identity trust value and uses intelligent content analysis and historical access pattern mining methods to obtain the resource sensitivity level and sensitive feature tags;

[0098] This step aims to accurately identify the sensitivity level of the target resource, providing crucial information for subsequent access control decisions. Traditional solutions rely on manual sensitivity labeling of resources, which is inefficient and struggles to handle dynamic changes in resource content. This step utilizes intelligent resource analysis technology to automatically identify and dynamically update sensitivity levels, ensuring that access control policies are always based on the actual security needs of the resource. It should be noted that the initial resource sensitivity label used in step S1 is a pre-configured tag for quickly determining verification strength, while the dynamic resource sensitivity level obtained through in-depth content analysis in this step is based on a precise assessment of the resource's actual content and access patterns, used for subsequent refined authorization decisions.

[0099] S21, Receive the identifier of the target resource and use resource metadata extraction technology to obtain the structured attribute information of the resource;

[0100] When a user initiates an access request for a specific resource, the system parses the unique identifier of the target resource from the request message. The resource identifier can be in various forms, such as a file path, a database table name, or an API address. The system then uses the resource identifier to query the resource management system for the resource's metadata information.

[0101] The resource management system maintains a metadata catalog of all information assets within the enterprise. Metadata information includes two categories: basic attributes and management attributes. Basic attributes include descriptive information such as resource name, resource type, file format, creation time, last modification time, resource size, and system to which it belongs. Management attributes include administrative information such as resource owner, department, business category tag, compliance tag, and access permission configuration.

[0102] For file-related resources, the system also extracts the file extension to determine the file format type. Common types include document, image, video, data, and code files. For database-related resources, the system extracts structural information such as the database name, table name, and list of field names. For interface-related resources, the system extracts information such as the service name to which the interface belongs, the interface function description, and the definitions of input and output parameters.

[0103] The system organizes the extracted multidimensional metadata information into a structured attribute vector, which serves as the basic input for subsequent sensitivity analysis.

[0104] S22, Receive structured attribute information of resources, and use a multimodal sensitivity prediction method based on a pre-trained language model to obtain the preliminary sensitivity level of resources;

[0105] After obtaining the structured attribute information of the resources, the system initiates the sensitivity prediction process. Considering the diverse resource types, highly specialized technical documents, and concealed expression of sensitive information in the manufacturing scenario, the system employs a deep semantic understanding method based on a pre-trained language model for sensitivity identification.

[0106] The system first inputs the structured attribute information and textual description information of the resources into a pre-trained BERT model for semantic encoding. The BERT model captures the deep semantic features of the text through a bidirectional Transformer architecture, enabling it to understand technical terms and contextual relationships.

[0107] The system builds a multi-task learning framework on top of the BERT encoding layer, simultaneously predicting the sensitivity level and sensitive data type of resources. Multi-task learning improves the model's generalization ability by sharing the underlying semantic representation.

[0108] For non-text resources commonly found in manufacturing technical documents, such as drawings and CAD files, the system introduces a visual Transformer model to extract visual features from thumbnails or homepage screenshots of these resources. The visual Transformer segments the image into multiple image blocks and learns the spatial relationships between these blocks through a self-attention mechanism, identifying sensitive visual elements such as technical annotations and dimensional parameters in the drawings.

[0109] The system employs a cross-modal attention fusion mechanism to deeply integrate textual semantic features and visual features. The fusion module dynamically adjusts the contribution of different modal features through attention weights, emphasizing textual features for pure text resources and considering both textual and visual features for drawing resources.

[0110] The fused multimodal feature vectors are input into a fully connected classification layer, which outputs the probability distribution of resources belonging to each sensitivity level. The system selects the level with the highest probability as the initial sensitivity level. To improve the model's understanding of manufacturing industry terminology, the system performs domain-adaptive fine-tuning using a corpus of manufacturing technical documents on top of a general pre-trained model, enabling the model to learn industry-specific semantic patterns.

[0111] S23, Receive the initial sensitivity level of the resource, and use content deep scanning technology to perform detailed analysis on the high-sensitivity candidate resources to obtain sensitive data feature identifiers;

[0112] When a resource's initial sensitivity level is determined to be confidential or internal, the system triggers a deep content scan to verify and refine the sensitivity assessment. The content scan analyzes the actual content of the resource to identify any sensitive data types it contains.

[0113] For text-based resources, the system employs natural language processing (NLP) techniques for content understanding. The system first segments and tags the text, then uses named entity recognition (NER) algorithms to identify entity information within the text. Named entities include types such as person names, organization names, location names, dates and times, and currency amounts.

[0114] The system focuses on identifying entities related to personal identity information, including names, ID card numbers, mobile phone numbers, bank card numbers, and email addresses. The identification method combines rule-based pattern matching and deep learning-based sequence labeling models. Pattern matching uses regular expressions to define the format characteristics of various sensitive information types, such as ID card numbers being 18 digits and conforming to specific verification rules.

[0115] Sequence labeling models identify sensitive entities without a fixed format through contextual semantic understanding. The system also identifies trade secret-related content, including product formulas, process parameters, customer lists, pricing information, and contract terms.

[0116] The identification method uses keyword matching combined with semantic similarity calculation. The system maintains a dictionary of commercial secret keywords, locates candidate sensitive paragraphs by matching the dictionary, and then calculates the similarity between the semantic vector of the paragraph and the semantic template of the sensitive content to confirm whether it is real sensitive content.

[0117] For structured data resources, the system employs data pattern analysis techniques. The system reads and analyzes the field names, data types, and data samples. Semantic analysis of field names determines whether a field contains sensitive attributes, such as field names containing semantics related to identity, contact information, or financial information.

[0118] The sensitivity of data content is determined by analyzing the format and distribution characteristics of data samples. For example, if the data values ​​of a certain field exhibit the format characteristics of a phone number or ID card number, the system will analyze them. For image resources, the system uses image recognition technology to detect whether the images contain sensitive visual content such as faces, ID documents, or confidential documents.

[0119] The system records all sensitive data types identified during scanning as sensitive feature identifiers. These identifiers are in the form of a set of tags, with each tag representing a sensitive data type.

[0120] S24, Receive sensitive data feature identifiers, and calculate the current sensitivity score of the resource by combining historical access behavior analysis with sensitive feature weights;

[0121] After obtaining the sensitive data characteristics, the system needs to quantify the sensitivity of the resources. The quantification calculation comprehensively considers the types of sensitive data contained in the resources and their importance, as well as the actual access and usage patterns of the resources.

[0122] The system first establishes a weight table for sensitive features based on the types of sensitive data. The weight table assigns a weight coefficient to each type of sensitive data, reflecting the potential harm of data leakage or misuse. For example, personally identifiable information is given a high weight due to privacy protection and legal compliance requirements, trade secrets are given a high weight because they involve the company's core competitiveness, while general business data is given a lower weight.

[0123] The system iterates through the set of sensitive feature identifiers for the current resource, queries the weight coefficient corresponding to each feature, and sums the weight coefficients of all features to obtain a basic sensitivity score. Next, the system queries the access log database for historical access records of the resource.

[0124] Historical access records contain information such as the list of users who accessed the resource, the number of accesses, the distribution of access times, and the types of operations performed. The system calculates the resource access breadth index, which is the proportion of different users who have accessed the resource to the total number of users. The greater the access breadth, the higher the degree of resource sharing.

[0125] The system calculates the access frequency metric for resources, which is the average number of times the resource is accessed per unit of time. Access frequency reflects the activity level of resource usage. The system also tracks the frequency of sensitive operations performed on the resource, including operations such as downloading, exporting, printing, and copying that may lead to data dissemination.

[0126] The system adjusts the base sensitivity score based on access behavior characteristics. The adjustment rule is that if a resource has limited access, meaning it is accessed only by a few specific users, the sensitivity score is increased, because highly restricted access patterns usually mean that the resource contains confidential information.

[0127] If a resource is frequently subjected to sensitive operations, its sensitivity score is increased, as this indicates a higher risk of data spread. If the resource contains cold data that has not been accessed for a long time, its real-time protection priority is appropriately reduced according to the cold data protection strategy, while its assigned sensitivity level remains unchanged.

[0128] The system will output the adjusted score as the current sensitivity score of the resource.

[0129] S25: Receive the current sensitivity score of the resource, use a level division and caching mechanism to obtain the final sensitivity level and sensitivity label of the resource and store them in the resource profile library;

[0130] After obtaining the current sensitivity score of a resource, the system maps continuous numerical scores to discrete sensitivity levels. The system predefines a sensitivity level system, adopting a three-level classification scheme, including public, internal, and confidential levels.

[0131] The system sets two score thresholds as boundaries for classifying sensitivity levels. Resources with a sensitivity score below the first threshold are classified as public; resources with a score between the first and second thresholds are classified as internal; and resources with a score above the second threshold are classified as confidential. These thresholds are set based on the enterprise's security policy and compliance requirements and can be configured and adjusted according to actual needs.

[0132] The system determines the final sensitivity level of a resource based on a comparison between its current sensitivity score and a threshold. The system constructs resource sensitivity tags, which include information such as the sensitivity level, a list of sensitive data types, and a sensitivity assessment timestamp. These tags are organized in a structured data format for easy subsequent querying and use.

[0133] The system associates the generated sensitive tags with resource identifiers and stores them in the resource profile library. The resource profile library adopts a key-value storage architecture, supporting fast queries based on resource identifiers.

[0134] To improve the response speed of access control decisions, the system builds a distributed caching layer on top of the resource profile database. The caching layer loads the sensitive tags of frequently accessed resources into memory. When the access control module needs to query resource sensitivity, it first reads from the cache. If the cache is not found, it then accesses the underlying profile database.

[0135] The cache employs a Least Recently Used (LRU) eviction policy to manage cache entries, ensuring that cache space is occupied by the most valuable data. The system also establishes a sensitivity change notification mechanism. When the sensitivity level of a resource changes, the system proactively invalidates the relevant cache entries and pushes a change notification to the access control module, ensuring that access control decisions are based on the latest sensitivity information.

[0136] S3 receives resource sensitivity levels and user access requests, and uses scenario clustering and adaptive threshold adjustment methods to obtain the dynamic trust threshold required for access decisions.

[0137] This step aims to dynamically determine the trust threshold for access decisions based on the specific access scenario and the current security posture, overcoming the limitations of traditional static threshold configurations that cannot adapt to dynamic business needs. Through scenario awareness and adaptive adjustment, the system can adopt different security control strengths under different business scenarios and security states, achieving a dynamic balance between security and availability.

[0138] S31, Receive the final sensitivity level of the resource and the access request, and use access context information collection technology to obtain a multi-dimensional context feature vector;

[0139] When a system needs to make authorization decisions on access requests, in addition to considering user identity trust and resource sensitivity, it also needs to be aware of the context in which the access occurs. Context information includes four dimensions: temporal context, spatial context, network context, and business context.

[0140] The time context includes time attributes such as the specific time the access occurred, the weekday or holiday, and the working or non-working hours. The system extracts time features such as hour, day of the week, and month from the timestamp of the access request and determines the time period type based on the company's working hour configuration.

[0141] Spatial context includes the user's geographic and physical location information. For mobile device access, the system obtains the geographic location through GPS coordinates or base station positioning information reported by the device. For fixed device access, the system obtains the network geographic location through reverse IP address lookup. The system matches the geographic location with the user's usual work location to determine whether the access is from a different location.

[0142] Network context includes information such as the type of network the user accesses, network affiliation, and network security status. Network types include categories such as corporate intranet, VPN connection, and public internet. The system determines network affiliation by analyzing the source IP address range of the access request. Corporate intranet IP ranges are marked as trusted networks, VPN gateway IP ranges are marked as controlled networks, and other IP ranges are marked as untrusted networks.

[0143] Network security status is obtained by querying a network threat intelligence database, which records threat network information such as known malicious IP addresses, botnet nodes, and anonymous proxy nodes. Business context includes information such as the user's currently executing business process, the urgency of the business, and the status of business approvals.

[0144] For scenarios integrated with business systems, the system can obtain the user's current business scenario identifier from the business systems, such as the work order number being processed, project name, and task type. The system will perform feature encoding on the collected multidimensional context information. The time feature adopts a periodic encoding method, encoding periodic variables such as hours and days of the week into sine and cosine function values ​​to retain periodic characteristics.

[0145] Geographic location features are encoded as latitude and longitude coordinates or location area identifiers. Network features are encoded as a one-hot vector of network type and a numerical value of network risk level. Business features are encoded as a one-hot vector of business scenario category. The system concatenates all encoded features into a unified multi-dimensional context feature vector.

[0146] S32, receive the multi-dimensional context feature vector, and use the scene clustering algorithm to obtain the category identifier and scene similarity of the current access scene;

[0147] After obtaining the multidimensional contextual feature vector, the system needs to identify which typical scenario the current access belongs to. During the offline phase, the system performs scenario clustering analysis on historical access logs, dividing the massive amount of historical accesses into several scenario clusters based on the similarity of contextual features.

[0148] The clustering algorithm employs a density-based spatial clustering method, which can discover clusters of arbitrary shapes and automatically determine the number of clusters. The input to the clustering is a set of context feature vectors of historical access records, and the output is several scene clusters and the center vector of each cluster.

[0149] Each scenario cluster represents a typical access scenario, such as daytime office intranet access on weekdays, nighttime remote VPN access on weekdays, mobile device access on holidays, and access during business trips. The system assigns a unique scenario category identifier to each scenario cluster and calculates the statistical characteristics of the scenario cluster, including the average security event occurrence rate and average resource sensitivity distribution of access records within the cluster.

[0150] During real-time access decision-making, the system calculates the similarity between the current access context feature vector and the center vectors of all scene clusters. The similarity calculation uses Euclidean distance or cosine similarity metrics. Considering the scale differences across different feature dimensions, the system standardizes the feature vectors before calculation.

[0151] The system selects the scene cluster with the highest similarity as the matching scene for the current visit, and outputs the scene category identifier of this cluster. The system also outputs a similarity value, which reflects the degree of matching between the current visit and typical scenes. High similarity indicates that the current visit belongs to a common scene, while low similarity indicates that the current visit belongs to an atypical scene that requires extra attention.

[0152] S33, receive scene category identifier, scene similarity and final resource sensitivity level, and use the threshold parameter query of scene association to obtain the baseline trust threshold configuration;

[0153] After identifying the currently accessed scenario category, the system queries the scenario threshold configuration library for the corresponding baseline trust threshold configuration. The scenario threshold configuration library maintains recommended threshold parameters for each scenario category under different resource sensitivity levels. The library is built based on historical security event analysis and expert experience.

[0154] For each scenario category, security managers set reasonable thresholds based on the historical security risk level and business convenience requirements of that scenario. For example, for the scenario of accessing the office intranet during weekdays, since the security risks in this scenario are relatively controllable, the trust threshold for internal resources can be set relatively leniently, allowing users to easily obtain access authorization.

[0155] For remote access scenarios during holidays and late at night, due to the risk of account theft or abnormal operations, the trust threshold for resources of the same sensitivity needs to be set more strictly, requiring users to have a higher trust value to obtain authorization.

[0156] The configuration database uses a two-dimensional table structure, with rows representing scenario categories and columns representing resource sensitivity levels. Each table element represents a corresponding baseline trust threshold value. The system locates the corresponding table element based on the current scenario category identifier and resource sensitivity level, and then reads the baseline trust threshold configuration.

[0157] For scenarios with low scene similarity, the system considers the current access to deviate from typical scenarios and requires a conservative adjustment based on the baseline threshold, i.e., appropriately increasing the threshold to enhance security control. The system outputs the baseline trust threshold configuration and scene similarity value together for subsequent adjustments.

[0158] S34, Receive the baseline trust threshold configuration, and use global security situation awareness data to obtain the situation adjustment factor;

[0159] The baseline trust threshold reflects the standard security requirements in a specific scenario, but the system needs to dynamically adjust the threshold based on the current overall security posture. The overall security posture reflects the overall security risk level faced by the entire enterprise information system at any given moment. The system obtains real-time posture assessment data from the security posture awareness platform.

[0160] The situation assessment data includes indicators across multiple dimensions. Threat intelligence indicators include external threat information such as the number of recently added high-risk vulnerabilities, intelligence on attack activities targeting the industry, and malware propagation trends. Security incident indicators include internal security status such as the number of recent security alerts within the system, the severity distribution of security incidents, and the status of incident response and handling.

[0161] System health metrics include the operational status of critical security devices, the coverage of security policy implementation, and the integrity of security logs—basic protection capabilities. The system comprehensively evaluates these metrics to calculate the overall security posture level.

[0162] The security situation is categorized into four levels: Normal, Attention, Alert, and Critical. The Normal level indicates no significant security risks have been detected, and the system is operating smoothly. The Attention level indicates some security vulnerabilities exist but have not yet posed an actual threat. The Alert level indicates that signs of targeted attacks have been detected or a security incident has occurred. The Critical level indicates that the system is under attack or a major security incident has occurred.

[0163] The system determines a situation adjustment factor based on the global security situation level. The situation adjustment factor is a numerical coefficient used to multiply and adjust the baseline threshold. When the situation level is normal, the adjustment factor is the baseline value, indicating that the baseline threshold is maintained.

[0164] When the situation level is "Concern," an adjustment factor slightly higher than the baseline value indicates a moderate increase in the threshold to enhance protection. When the situation level is "Alert" or "Severe," an adjustment factor significantly higher than the baseline value indicates a substantial increase in the threshold to activate a strict protection mode. The system outputs the current situation adjustment factor value.

[0165] S35: Receive the baseline trust threshold, scene similarity, and situation adjustment factor, and use an adaptive threshold calculation method to obtain the final dynamic trust threshold for this visit.

[0166] After obtaining the baseline trust threshold, scene similarity, and situation adjustment factor, the system performs adaptive threshold calculation to obtain the final dynamic trust threshold used for decision-making. The calculation method comprehensively considers two adjustment dimensions: scene matching degree and security situation.

[0167] First, the system adjusts the baseline threshold based on scene similarity. High scene similarity indicates that the current access pattern closely matches historical normal access patterns, indicating a high level of system trust, and the baseline threshold can be maintained. Low scene similarity indicates that the current access deviates from the normal pattern, and the system conducts additional review, raising the threshold to achieve stricter verification requirements.

[0168] The scene adjustment uses a linear interpolation method. When the similarity is high, the adjustment coefficient is the baseline value. As the similarity gradually decreases, the adjustment coefficient gradually increases. The maximum adjustment coefficient is limited within a reasonable range to avoid being overly strict.

[0169] The system then multiplies the scene-adjusted threshold by a situation adjustment factor to obtain the final dynamic trust threshold. Through this two-level adjustment mechanism, the system achieves dual adaptation of the threshold to scene features and the global situation.

[0170] The system also performs boundary checks on the calculated dynamic thresholds to ensure that the thresholds do not exceed a reasonable range due to adjustments. The system sets minimum and maximum threshold boundaries; when the calculated result is lower than the minimum value, it corrects to the minimum value; when the calculated result is higher than the maximum value, it corrects to the maximum value.

[0171] The revised dynamic trust threshold is the final output of this step. This threshold will be used in the next step to compare with the user's trust value to make an authorization decision.

[0172] S4 receives the user's identity trust value, dynamic trust threshold, and resource sensitivity level, and uses a hierarchical decision-making and progressive verification method to obtain access authorization decisions and access control tokens.

[0173] This step is the core decision-making stage of access control. Based on the trust assessment results and threshold parameters calculated in the previous steps, the system comprehensively determines whether to authorize the user to access the target resource, and determines a refined scope of permissions if authorization is granted. This step adopts a hierarchical decision-making mechanism, employing differentiated processing strategies for access requests with different trust levels. Through progressive verification, it provides supplementary verification opportunities for requests with insufficient trust values ​​but close to the threshold.

[0174] S41, Receive the user's comprehensive identity trust value and final dynamic trust threshold, and use a threshold comparison and decision-making diversion mechanism to obtain the preliminary authorization decision category;

[0175] The system first compares the trust value with the threshold. The system reads two values: the user's overall identity trust value and the final dynamic trust threshold, and calculates the difference between the trust value and the threshold as a trust margin indicator.

[0176] The system categorizes access requests into three decision categories based on the size and sign of the trust margin. The first category is the high-trust category, where access requests are classified when the trust value is significantly higher than the threshold, meaning the trust margin exceeds the preset sufficient margin boundary. The high-trust category indicates that the user's trust status far exceeds the resource access requirements, and the system adopts a fast-through strategy for such requests.

[0177] The second category is the boundary trust category. When the trust value is slightly below the threshold and the difference is within an acceptable range (i.e., the trust margin is a small negative value but the absolute value does not exceed the compensation verification threshold), the access request is classified into this category. The boundary trust category indicates that the user's trust status is close to but not fully meets the requirements. The system initiates a progressive supplementary verification process for this type of request, giving the user the opportunity to improve their trust value through additional verification.

[0178] The third category is the low-trust category. When the trust value is far below the threshold, i.e., the trust margin is significantly negative, access requests are classified into this category. The low-trust category indicates that there is a certain gap between the user's current trust status and the resource requirements, and the system adopts a direct rejection policy for this type of request.

[0179] The system determines the preliminary authorization decision category of the current request based on the comparison between the trust margin and the preset boundary, and outputs the decision category identifier.

[0180] S42, Receive the initial authorization decision category, and use the classification processing flow to perform enhanced verification method selection for the boundary trust category to obtain supplementary verification requirements;

[0181] When the initial authorization decision category is the boundary trust category, the system initiates a supplementary verification process. The system first analyzes the main reasons why the user's current trust value is below the standard. The system then reviews the trust value calculation process to identify which dimensions' scores lowered the overall trust value.

[0182] If the low device trust level is the primary reason, the system selects the enhanced device security verification method, requiring the user to re-initiate access on a more trusted device or to perform security hardening verification on the current device. If the low behavior matching degree is the primary reason, the system selects the identity reconfirmation verification method, confirming through biometrics or video verification that the current operator is indeed the legitimate account holder.

[0183] If a user has a history of security incidents related to their reputation, the system will select the administrator approval verification method and submit the access request to a higher-level administrator or security administrator for manual approval. The system also determines the verification strength level based on the specific difference between the trust value and the threshold.

[0184] When the discrepancy is small, lightweight verification such as SMS verification code or email confirmation link is used. When the discrepancy is large, strong verification such as hardware token or on-site approval is used. The system generates a supplementary verification requirement description, including verification method type, verification operation instructions, verification validity period, etc., and returns the verification requirement to the user or relevant verification party.

[0185] The system also marks the current session state as pending verification and assigns a verification task identifier for subsequent tracking of verification results.

[0186] S43, receive supplementary verification requests and verification result feedback, and use the trust value incremental update method to obtain the improved user trust value;

[0187] After receiving the supplementary verification request, the user completes the corresponding verification operation according to the instructions. Once the verification system completes the verification, it sends the verification result back to the access control system. The system receives the verification result; if verification fails, it terminates the current access process and records the verification failure event.

[0188] If verification is successful, the system needs to recalculate the user's trust score to reflect the trust increase resulting from the supplementary verification. The trust score recalculation uses an incremental update method, with the system determining the corresponding trust increase based on the type and strength of the supplementary verification.

[0189] High-strength verification, such as successful biometric identification, leads to a significant increase in trust, while low-strength verification, such as successful SMS verification, leads to a smaller increase in trust. The system adds this increase in trust to the original trust value to obtain the improved user trust value.

[0190] For device security verification, the system updates the device trust level label upon successful verification, and the new device trust level is used to recalculate the trust value. For identity reconfirmation verification, the system increases the user's identity credibility score upon successful verification.

[0191] For administrator approval verification, the system grants a temporary trust boost upon approval, which remains in effect for the duration of the current session. After the system recalculates the trust value, it outputs the increased user trust value, which will then be compared with the dynamic threshold to determine the final authorization decision.

[0192] S44 receives the enhanced user trust value or the trust value of the high trust category and the final sensitivity level of the resource, and uses a refined permission calculation method to obtain the authorization scope parameters and the authorization validity period.

[0193] When a user's trust value reaches or exceeds a dynamic threshold, the system determines whether to grant access permissions and calculates a refined scope of authorization. The scope of authorization includes two dimensions: data access scope and operation permission scope.

[0194] Data access scope defines which parts of a target resource a user can access. For structured data resources, the system determines the set of accessible data fields based on user roles and resource sensitivity. For resources containing content with mixed levels of sensitivity, the system determines the accessible sensitivity range based on the margin between the user's trust value and the threshold.

[0195] When there is sufficient trust margin, access to the entire content of the resource is allowed. When the trust margin is limited, only access to the less sensitive parts of the resource is allowed, while highly sensitive parts are anonymized or hidden. The scope of operation permissions defines which types of operations a user can perform on the resource.

[0196] Basic access permissions include read and browse, while extended permissions include edit, copy, download, print, and share. The system determines which permissions to grant based on the match between the user's trust level and the sensitivity of the resource. For highly sensitive resources, even with authorized access, high-risk operations such as downloading and printing are restricted.

[0197] The system also calculates the authorization validity period, i.e. how long the authorization remains valid. The duration is determined based on the expected stability of the trust value and the size of the trust margin. For users with stable trust values ​​and sufficient margin, the system grants a longer validity period, such as continuous validity within an eight-hour workday.

[0198] For users whose trust level has just met the requirements or who have uncertainties, the system grants a shorter validity period, such as thirty minutes or a single session validity, after which re-authentication is required. The system encapsulates the authorization scope parameters and authorization validity period into an authorization policy object for output.

[0199] S45 receives the authorization scope parameters and authorization validity period, uses security token generation technology to obtain the access control token and issues it to the resource access agent;

[0200] The system generates access control tokens based on the authorization policy object. An access control token is an encrypted data structure containing authorization information, used to verify and enforce access control during subsequent resource access. The token contains fields including user identifier, resource identifier, authorization scope description, authorization validity period, session identifier, and token issuance timestamp.

[0201] To prevent tokens from being tampered with or forged, the system uses digital signature technology to sign the token content. The system uses the access control system's private key to hash the token content and encrypt the hash value to generate a digital signature, which is then appended to the token.

[0202] To protect the confidentiality of the token's content, the system can choose to encrypt the token using the resource access agent's public key, ensuring that only the target agent can decrypt and read the token. After generating the token, the system distributes it to the resource access agent through a secure channel. The resource access agent is an access control enforcement component deployed on the resource server, responsible for actually controlling users' resource access requests based on the authorization information in the token.

[0203] Upon receiving the token, the agent first verifies its digital signature to ensure it hasn't been tampered with. Then, it parses the token content to obtain the authorization policy. Subsequent user access to resources is then subject to fine-grained access control based on this policy. The system also records the token identifier and authorization information in the access log for auditing and monitoring purposes.

[0204] For requests whose initial decision category is low trust, the system does not generate an access control token, but instead generates a denial response message and returns it to the user. The response message explains the reason for the denial and suggests the user to take corrective measures such as replacing the device or contacting the administrator.

[0205] S5 receives the access control token, uses lightweight behavior monitoring and incremental anomaly detection methods to obtain session monitoring results and updated user trust scores;

[0206] This step enables continuous security monitoring of authorized access sessions, ensuring that users' actual access behavior after authorization complies with security requirements. Traditional solutions cease monitoring after authorization, leading to the failure to promptly detect abnormal behavior by authorized users. This step, by deploying lightweight monitoring probes and employing incremental analysis algorithms, achieves real-time monitoring and risk response of session behavior without impacting business performance.

[0207] S51 receives the access control token and uses monitoring probe deployment technology to obtain session monitoring instances and baseline behavior records;

[0208] When a user is authorized to access resources, the system initiates a session monitoring process. The system creates a session monitoring instance in the session monitoring platform based on the session identifier in the access control token. The session monitoring instance records baseline information for this session, including contextual information such as the user's trust value at the time of authorization, the scope of authorization, the authorization time, and resource sensitivity. The system deploys lightweight behavior monitoring probes along the resource access path.

[0209] The probes employ a bypass monitoring mode, acquiring user operation data through mirroring or log collection to avoid introducing performance overhead on the main business path. For file system resources, the probes are deployed on the file server to monitor file access API calls. For database resources, the probes connect to the database's audit log interface to obtain SQL query records.

[0210] For application system resources, probes are integrated into the application middleware layer to collect user operation events. The behavioral data collected by the probes includes key features such as operation timestamps, operation types, accessed data objects, data volume, and operation time. To reduce data transmission and storage costs, the probes perform feature extraction and aggregation on the raw logs locally, reporting only key behavioral features rather than the entire log. The system associates and stores session baseline information with monitoring probe configuration information, outputting a session monitoring instance identifier.

[0211] S52 receives session monitoring instances and uses streaming data acquisition technology to obtain the user's real-time operation behavior feature sequence;

[0212] After the session monitoring instance starts, the monitoring probe continuously collects user action data. The collection uses a streaming processing mode, with the probe sending the collected action events to the streaming data processing platform in real time. The streaming platform performs preliminary processing on the event stream, including data cleaning, format conversion, and feature extraction. Data cleaning filters out automated system operations and duplicate events, retaining valid action events triggered by the user.

[0213] Format conversion transforms heterogeneous logs from different sources into a standardized behavioral event format. Feature extraction extracts key features for anomaly detection from behavioral events. Extracted features include behavioral frequency features (e.g., the number of operations per unit time), data volume features (e.g., the number of data records accessed or file size per operation), and behavioral pattern features (e.g., sequence patterns of operation types).

[0214] The system employs a sliding time window technique to aggregate and statistically analyze features. The time window is set to a duration of several minutes. Within the window, statistical calculations are performed on behavioral features, such as average operation frequency, maximum data access volume, and operation type distribution. The system organizes the aggregated features of each time window into feature vectors, arranging them chronologically to form a sequence of real-time user behavior features. This feature sequence is continuously updated in a streaming manner; whenever a new aggregated feature is generated by the sliding time window, the new feature vector is appended to the end of the sequence.

[0215] S53: Receive the user's real-time operation behavior feature sequence, and use an anomaly detection algorithm based on temporal convolutional network and attention mechanism to obtain a behavior anomaly score;

[0216] The system uses a deep temporal anomaly detection model to analyze real-time behavioral feature sequences to identify abnormal behaviors. Considering the significant temporal dependencies and periodic patterns in user access behavior within manufacturing scenarios, the system employs a deep learning architecture combining a Temporal Convolutional Network (TCN) with a multi-head self-attention mechanism. The TCN, constructed using causal convolution and dilated convolution techniques, efficiently captures behavioral dependencies over long time spans.

[0217] Causal convolution ensures that the model uses only historical information prior to time t when predicting behavior at time t, meeting the causality requirements of real-time detection. Dilated convolution expands the receptive field by introducing holes in the convolution kernel, enabling the model to capture long-term dependencies with fewer layers and reducing computational complexity. The system inputs the user's real-time operation behavior feature sequence into a multi-layer TCN network, where each TCN layer extracts behavioral pattern features at different time scales through one-dimensional convolution operations.

[0218] Shallow TCNs capture short-term behavioral patterns, such as the sequential features of several consecutive operations, while deep TCNs capture long-term behavioral trends, such as changes in access frequency within an hour. To address the varying importance of different operation types in manufacturing scenarios, the system introduces a multi-head self-attention layer on top of the TCN. The attention mechanism calculates an attention weight for each time step in the sequence, reflecting the importance of that time step in the current anomaly detection. Higher weights are assigned to access operations involving core technical data, while lower weights are assigned to routine query operations.

[0219] Multi-head attention captures key features of behavioral sequences from different perspectives by computing multiple sets of attention weights in parallel. The system employs a variational autoencoder (VAE) architecture for anomaly detection. The encoder maps the behavioral feature sequence processed by the TCN and attention layers into a low-dimensional latent representation, and the decoder attempts to reconstruct the original behavioral sequence from the latent representation. The VAE is trained by minimizing the reconstruction error and the KL divergence of the latent space, learning a compact representation of normal behavior. During real-time detection, the system calculates the reconstruction error of the current behavioral sequence; a large reconstruction error indicates that the current behavior deviates from the normal pattern.

[0220] The system also calculates the Mahalanobis distance between the latent representation and the latent space; a larger distance indicates that the current behavior is statistically anomalous. The system combines the reconstruction error and the Mahalanobis distance to calculate the final behavior anomalousness score. To improve the detection capability of novel attack patterns, the system introduces a contrastive learning mechanism. By constructing enhanced sample pairs of normal behavior, it learns more discriminative behavior representations, enhancing the model's sensitivity to subtle anomalies.

[0221] S54, Receive the behavior anomaly score, use multi-level response threshold judgment to obtain the response level and the response action to be executed;

[0222] The system determines the appropriate response based on the anomaly score. The system has preset multi-level response thresholds, categorizing anomalies into different risk levels. The system sets four threshold levels, corresponding to low risk, medium risk, high risk, and severe risk, respectively. When the anomaly score is below the first-level threshold, the behavior is considered normal, and the system does not intervene but continues monitoring.

[0223] When the anomaly score exceeds the first-level threshold but falls below the second-level threshold, it is classified as a low-risk anomaly. The system records an alarm and sends a notification to security operations personnel, but does not interrupt the user session. When the anomaly score exceeds the second-level threshold but falls below the third-level threshold, it is classified as a medium-risk anomaly. The system executes permission restriction actions, specifically restricting certain high-risk operation permissions based on the detected anomaly type, such as prohibiting data export or batch operations, while allowing the user to continue performing other low-risk operations.

[0224] When the anomaly score exceeds the third-level threshold but is below the fourth-level threshold, it is considered a high-risk anomaly. The system requires the user to re-authenticate. If authentication is successful, the trust value is reassessed and authorization is adjusted; if authentication fails, the session is terminated. When the anomaly score exceeds the fourth-level threshold, it is considered a serious risk. The system immediately terminates the access session, revokes all granted permissions, freezes the user account to prevent new access, and reports the security incident to the security operations center to trigger the emergency response process.

[0225] The system determines the response level based on a comparison of the current anomaly score with thresholds at each level, and then executes the corresponding response action. The execution of the response action is achieved by sending control commands to the resource access agent. Upon receiving the command, the agent updates the access control policy or terminates the user connection. The system records information such as the response level, response action type, and execution time in the session monitoring log.

[0226] S55 receives the result of the response action execution, and uses a state synchronization and trust update mechanism to obtain the updated user trust score and session state.

[0227] After executing a response, the system needs to feed the response result back to the user trust assessment model to dynamically update the trust status. For low-risk responses that record alarms but are not intervened in, the system slightly lowers the user's trust score; the reduction is small, indicating that the user has a minor abnormality but is still within an acceptable range. For medium-risk responses that involve restricted access permissions, the system moderately lowers the user's trust score and records this abnormal behavior event in the user profile. This event will affect the trust assessment of the user's subsequent visits.

[0228] For high-risk responses requiring re-authentication, if the user successfully completes re-authentication, the system restores the user's trust score to the level after re-authentication. If the user fails or refuses authentication, the system significantly lowers the trust score and marks the user account as high-risk. For severe risk responses involving session termination, the system lowers the user's trust score to the lowest level and records detailed event information in the security event database, including abnormal behavior characteristics, scope of impact, and handling measures. This event will trigger a comprehensive security review of the user.

[0229] The system synchronizes the updated user trust score to the distributed identity authentication center, updating the trust score field in the user profile database. Simultaneously, the system updates the session status, including values ​​such as "in progress," "restricted access," "pending re-authentication," and "terminated." Session status information is stored in association with the session identifier for querying by other system components. The system outputs the updated user trust score and current session status, which will be used for subsequent access decisions and security analysis.

[0230] S6 receives session monitoring results and access decision history data, and uses federated learning and reinforcement learning methods to obtain globally optimized access control policy parameters.

[0231] This step enables continuous optimization of access control policies. By analyzing historical decisions and monitoring data, the system automatically learns and improves the parameters of the decision model, enhancing the accuracy and adaptability of access control. This step employs a federated learning framework to protect the data privacy of various business systems while achieving cross-system collaborative optimization. Reinforcement learning methods are used to optimize decision-making effectiveness through a policy reward and punishment feedback mechanism.

[0232] S61 receives session monitoring logs and response records, and uses local sample collection and feature engineering methods to obtain a decision optimization training sample set;

[0233] The system extracts historical data from the session monitoring platform and access control log system to construct a training sample set for policy optimization. Sample collection is conducted locally within each business system, with each system collecting access decision records within its jurisdiction. Each sample record contains a complete access decision process, and the input features of the sample include various input parameters for decision-making, such as user identity trust value, device trust level, resource sensitivity, context feature vector, and dynamic trust threshold.

[0234] The output labels of the sample include information such as the authorization decision made, the actual session behavior, the detected anomalies, the executed response actions, and the final security result. Security results are divided into two categories: correct decision and incorrect decision. Correct decision includes normal user access without anomalies after authorization and effective prevention of risky access after denying authorization. Incorrect decision includes false alarms (denying normal access requests) and missed alarms (authorizing malicious access requests).

[0235] The system labels samples, combining automated rules with manual review. Samples that trigger a severe risk response are automatically labeled as high-risk. Samples that do not trigger a response but whose users report access is blocked are labeled as potentially false alarms and submitted for manual review. Security operations personnel review suspicious samples and correct sample labels based on the review results. The system anonymizes sample data, removing sensitive information such as user identity and specific resource paths, while retaining feature values ​​and statistical attributes used for model training.

[0236] The system also performs feature engineering, including feature standardization, missing value imputation, and class encoding. The system balances the sample set; since normal access samples far outnumber abnormal access samples, oversampling or undersampling techniques are used to balance the ratio of positive to negative samples, preventing model training from being biased towards the majority class. The system stores the processed training sample set in a local secure environment, ensuring that the original data does not leave the local system.

[0237] S62 receives the decision optimization training sample set, uses graph neural network modeling and meta-learning optimization methods to obtain the locally optimized decision model parameters;

[0238] Each business system trains its decision optimization model locally using a training sample set. Addressing the complex relationships between multiple entities such as users, resources, equipment, and environment involved in access control decisions in manufacturing scenarios, the system employs a Graph Neural Network (GNN) to model the decision space. The system first constructs an access control knowledge graph, representing entities such as users, resources, equipment, departments, and roles as nodes in the graph, and access relationships, dependency relationships, and trust relationships as edges. Each node is associated with its attribute feature vector; for example, user nodes include attributes such as trust score and historical behavior characteristics, while resource nodes include attributes such as sensitivity level and access frequency.

[0239] The system employs Graph Convolutional Networks (GCNs) for representation learning of the knowledge graph. GCNs update node representations by aggregating neighbor information, thus incorporating the node representation's contextual information within the graph structure. After multiple layers of graph convolution, each node's representation not only includes its own attributes but also encodes its structural position and relational patterns within the entire access control network. For each access decision, the system extracts the GCN embedding representations of the involved user and resource nodes, concatenates the two embedding vectors, and inputs them into a multilayer perceptron for decision prediction. To address the cold start problem caused by the continuous emergence of new users and resources in the manufacturing scenario, the system introduces a meta-learning mechanism.

[0240] The goal of meta-learning is to learn how to quickly adapt to new tasks. The system treats each business scenario as a task and performs meta-training on multiple tasks. Meta-training employs the MAML (Model-Agnostic Meta-Learning) algorithm, which optimizes the initial parameters of the learning model through second-order gradient descent, enabling the model to quickly fine-tune on a small number of new task samples to achieve good performance. In practical applications, when new users or resources appear, the system only needs a small number of labeled samples to adapt the model to the new scenario through a few gradient updates. The system also introduces an adversarial training mechanism to improve the model's robustness.

[0241] Adversarial training generates adversarial examples by adding carefully designed perturbations to the input features, requiring the model to make correct decisions even on these adversarial examples. This allows the model to learn more fundamental decision-making patterns, rather than relying on surface features, thus improving its defense against attackers attempting to bypass access controls. After training is complete, the system outputs the GNN model parameters and meta-learning initialization parameters.

[0242] S63 receives the local optimization decision model parameters from each business system and uses a federated learning aggregation protocol to obtain the globally aggregated model parameters.

[0243] The system initiates a federated learning coordination process, where the coordination server interacts with various business systems to aggregate the global model. The federated learning framework adopts a horizontal federated learning model, where each business system shares the same feature space but uses different sample sets. The federated learning process consists of multiple iterations, each including four stages: local training, parameter uploading, global aggregation, and parameter distribution. During the parameter uploading stage, each business system uploads the gradients of its locally trained model parameters to the central coordination server.

[0244] To protect data privacy, the system does not upload raw training data or plaintext model parameters; it only uploads gradient information or encrypted parameter updates. The system may choose to employ differential privacy technology, adding carefully designed noise to the uploaded gradients to prevent the inference of the original data from the gradients while maintaining their statistical properties. During the global aggregation phase, the coordinating server collects gradient information uploaded by all participants and performs secure aggregation calculations. The aggregation algorithm uses a weighted average method, assigning different aggregation weights based on the sample size and model performance of each business system; systems with larger sample sizes and better model performance receive higher weights.

[0245] The server calculates the weighted average gradient of each parameter as the global gradient, and uses this global gradient to update the global model parameters. The update employs a gradient descent optimization algorithm, shifting the global model parameters along the opposite direction of the global gradient by a preset step size. The system outputs the updated global model parameters.

[0246] S64 receives the globally aggregated model parameters, uses simulation testing and performance evaluation methods to obtain the evaluation results of the strategy optimization effect;

[0247] After the coordination server distributes the global model parameters to each business system, each system needs to test and verify the new model. Testing is conducted in a simulation environment to avoid the risk of applying an unverified model directly to the production environment. The simulation environment uses historical access logs for replay testing. The system re-enters real access requests from the historical time period into the new model in chronological order to simulate the new model's decision-making process. The system compares the new model's decision results with the actual decisions executed at the time and the final security outcome.

[0248] Evaluation metrics include decision accuracy (the proportion of correct decisions), false positive rate (the proportion of denied legitimate access), false negative rate (the proportion of authorized abnormal access), and response time (the time spent calculating decisions). The system also evaluates the balance between security and usability of the new model, measuring its overall performance by calculating a combined score of security and user experience metrics. The system compares the performance metrics of the new model with those of the current production environment model to determine whether the new model delivers a performance improvement.

[0249] If the new model outperforms the current model in key metrics, the system determines the optimization is effective. If some metrics of the new model deteriorate, the system analyzes the reasons for the performance degradation and determines whether the decline in generalization ability is due to the new model over-adapting to certain specific scenarios. The system outputs a strategy optimization effect evaluation report, which includes comparative data for various performance metrics, performance trend charts, and typical case analyses.

[0250] S65 receives the evaluation results of the strategy optimization effect, uses gray release and continuous monitoring methods to obtain the updated production environment decision model and establish a feedback mechanism.

[0251] When the optimization evaluation results indicate that the new model outperforms the current model, the system initiates the model update deployment process. Deployment employs a canary release strategy, gradually applying the new model to the production environment. The system first selects a small user group or low-risk business scenarios as the canary release targets, using the new model to make decisions for these access requests, while other requests continue to use the old model.

[0252] The system closely monitors the decision-making effectiveness and system stability during the canary release phase. If any anomalies are detected, it immediately rolls back to the old model. If the canary release phase is stable, the system gradually expands the application scope of the new model, eventually completing a full replacement. The system updates the decision-making model parameters in the production environment, including the weight coefficients of the trust assessment model, the parameters of the threshold calculation formula, and the judgment thresholds of the anomaly detection model.

[0253] The system establishes a continuous model performance monitoring mechanism, tracking the performance of new models in real-world environments after deployment. Monitoring metrics include decision accuracy, user complaint rate, and security incident rate. The system sets performance monitoring alarm thresholds; when monitoring metrics deviate from expected ranges, alarms are triggered and troubleshooting is initiated. The system also establishes feedback collection channels, allowing users and security operations personnel to submit feedback on access control decisions. Feedback information is recorded in a sample library for use in the next round of model optimization.

[0254] Through a closed-loop mechanism of model deployment, monitoring, and feedback, the system enables continuous evolution and optimization of access control policies, constantly adapting to changing business needs and security threats. The system outputs updated production environment decision model version identifiers and feedback mechanism configuration information.

[0255] In one embodiment of the present invention, an application example of an information security protection method based on a zero-trust architecture is provided:

[0256] The examples focus on information security protection applications in the digital transformation process of large manufacturing enterprises. The following specific application examples demonstrate the practical application effects of the method of the present invention.

[0257] A multinational manufacturing company has R&D centers, production bases, and sales networks distributed globally. Its IT architecture includes a private cloud at headquarters, public cloud SaaS applications, an industrial IoT platform, and a mobile office system. R&D engineer Li needs to remotely access the product design database to query the technical parameters of core components.

[0258] The data example is shown in Table 1:

[0259] Table 1, User Access Request Information

[0260]

[0261] The system conducts an identity trust assessment on Li. Li submits his username and password to complete basic authentication, and the system obtains a pre-calculated basic trust score of 75. The system collects the fingerprint of Li's currently used personal laptop device, matches it against the device trust database, and identifies it as a known device with a medium-to-high trust level. The system analyzes Li's access time (9:30 PM, outside of working hours) and location (home address, a frequently used location), resulting in a medium match. The system calculates Li's overall identity trust score to be 68.

[0262] The system performs sensitivity identification on the target resource product design database. Resource metadata indicates that the database is a core asset of the R&D department, containing product formulas and process parameters. The system triggers a content scan and identifies that the database contains sensitive data classified as technical secrets. Combined with historical access records showing that the database has only been accessed by a small number of R&D personnel, the system calculates a resource sensitivity score of 85, classifying it as a confidential resource.

[0263] The system performs scenario analysis and threshold calculation. The current access context features are non-working hours, home network, and remote access. The system matches this feature vector with the scenario database, identifying it as a weekday nighttime remote access scenario. The baseline trust threshold for this scenario corresponding to confidential resources is 80 points. The system queries the global security posture; the current posture level is normal, and the posture adjustment factor is the baseline value. Considering the moderate scenario similarity, the system slightly increases the baseline threshold, resulting in a final dynamic trust threshold of 82 points.

[0264] The system executes an authorization decision. Li's overall identity trust score of 68 is lower than the dynamic trust threshold of 82, with a trust margin of -14, classifying him as a borderline trust user. The system analyzes that the main reasons for insufficient trust are access outside of working hours and a low device trust level. The system generates supplementary verification requirements, demanding Li perform secondary authentication via SMS verification code. After Li completes the SMS verification, the system applies the standard verification success factor to the trust value calculation, increasing the trust value to 83, exceeding the dynamic threshold of 82. The system generates an authorization decision; due to the small trust margin of only one point, the system grants Li read-only access and prohibits data export operations, with an authorization duration of one hour. The system generates an access control token and issues it to the database access agent.

[0265] Mr. Li began accessing the database, and the system deployed a session monitoring probe to collect his access behavior. During the 30-minute access period, Mr. Li queried 50 technical parameter records, with an average query frequency of 1.7 times per minute, and did not perform any write or export operations. The system's real-time anomaly detection calculated an anomaly score of 12 points, which was below the low-risk threshold of 20 points, and was therefore judged as normal behavior. The system did not take any intervention measures, and the session was completed smoothly. After the access ended, the system recorded the decision-making process and behavioral data of this access, which were then used as samples for input into the strategy optimization process.

[0266] As can be seen from this application example, the method of the present invention can make comprehensive decisions based on the user's identity credibility, device security status, access scenario characteristics and resource sensitivity, provide progressive verification opportunities for access requests with insufficient trust, and continuously monitor access behavior after authorization, thus achieving an effective balance between security protection and business convenience.

[0267] The embodiments of the present invention have been described above. However, the embodiments are not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make more equivalent embodiments under the guidance of the present embodiments, and all of them are within the protection scope of the present embodiments.

Claims

1. An information security protection method based on a zero-trust architecture, characterized in that, Includes the following steps: S1: Obtain user access request and identity credentials, and use a layered verification and multi-factor weighted fusion method to obtain user identity trust value; S2 receives the user's identity trust value and uses intelligent content analysis and historical access pattern mining methods to obtain the resource sensitivity level and sensitive feature tags; S3 receives resource sensitivity levels and user access requests, and uses scenario clustering and adaptive threshold adjustment methods to obtain the dynamic trust threshold required for access decisions. S4 receives the user's identity trust value, dynamic trust threshold, and resource sensitivity level, and uses a hierarchical decision-making and progressive verification method to obtain access authorization decisions and access control tokens. S5 receives the access control token, uses lightweight behavior monitoring and incremental anomaly detection methods to obtain session monitoring results and updated user trust scores; S6 receives session monitoring results and access decision history data, and uses federated learning and reinforcement learning methods to obtain globally optimized access control policy parameters.

2. The information security protection method based on a zero-trust architecture according to claim 1, characterized in that, S1 includes: Receive the identity credentials submitted by the user, and use the fast authentication protocol of the distributed identity authentication center to obtain the user's basic identity identifier and pre-calculated trust score; Receive the user's basic identity identifier, collect the hardware and software features of the device to construct the device fingerprint, match the device fingerprint vector with the device trust database to obtain the device trust level label and the corresponding trust value; Receive the device trust level label and the access target resource identifier, and search in the verification strength decision matrix according to the device trust level and the initial sensitivity identifier of the resource to obtain the verification strength level; Receive the verification strength level, use the corresponding strength of the authentication method combination to execute the verification process, and obtain the verification pass mark and verification success factor; The system receives and verifies the identity through the identifier, verification success factor, pre-calculated trust score, and device trust value. It then calculates the time matching degree, location matching degree, and resource type matching degree to obtain the comprehensive behavior matching degree. Finally, it weights and sums the authentication contribution item, device contribution item, and behavior contribution item using preset weight coefficients and normalizes them to obtain the comprehensive identity trust value of the user's current session.

3. The information security protection method based on a zero-trust architecture according to claim 1, characterized in that, S2 includes: Receive the identifier of the target resource and use resource metadata extraction technology to obtain the structured attribute information of the resource; The system receives structured attribute information of resources, adopts a multimodal sensitivity prediction method based on a pre-trained language model, and fuses textual semantic features and visual features through a cross-modal attention fusion mechanism to obtain a preliminary sensitivity level of the resources. The initial sensitivity level of the received resources is determined. When the resources are determined to be confidential or internal, a deep content scan is performed using named entity recognition algorithm and keyword matching combined with semantic similarity calculation to obtain sensitive data feature identifiers. Receive sensitive data feature identifiers, accumulate weight coefficients according to the sensitive feature weight table to obtain a basic sensitivity score, and adjust it in combination with the resource's access breadth index, access frequency index and sensitive operation frequency to obtain the current sensitivity score of the resource; Receive the current sensitivity score of the resource, map the score to public, internal and confidential levels according to the preset threshold, generate sensitive labels and store them in the resource profile library, and obtain the final sensitivity level and sensitive feature labels of the resource.

4. The information security protection method based on a zero-trust architecture according to claim 1, characterized in that, S3 includes: Receive the final sensitivity level of the resource and the access request, collect time context, spatial context, network context and business context information, encode the features of each dimension and concatenate them into a multi-dimensional context feature vector; Receive multi-dimensional context feature vectors, use scene clustering algorithm to cluster historical access records, calculate the similarity between the current access context feature vector and the scene cluster center vector to obtain scene category identifier and scene similarity; Receive scene category identifier, scene similarity and final resource sensitivity level, and query the corresponding baseline trust threshold configuration from the scene threshold configuration library; The system receives the baseline trust threshold configuration, obtains indicators from the security situation awareness platform in terms of threat intelligence, security incidents, and system health, and comprehensively evaluates them to obtain the situation adjustment factor. The system receives a baseline trust threshold, scene similarity, and situation adjustment factor. It adjusts the baseline threshold based on scene similarity, multiplies it by the situation adjustment factor, and performs boundary checks to obtain the final dynamic trust threshold.

5. The information security protection method based on a zero-trust architecture according to claim 1, characterized in that, S4 includes: Receive the user's comprehensive identity trust value and final dynamic trust threshold, calculate the difference between the trust value and the threshold as the trust margin, and classify access requests into high trust category, boundary trust category and low trust category based on the trust margin; Receive the initial authorization decision category, analyze the reasons why the trust value does not meet the standard for the boundary trust category, and select the device security enhancement verification, identity reconfirmation verification or administrator approval verification method to obtain supplementary verification requirements; Receive supplementary verification requests and verification result feedback, determine the trust increase amount based on the type and intensity of the supplementary verification, add the trust increase amount to the original trust value, and obtain the increased user trust value; Receive the enhanced user trust value and the final sensitivity level of the resource, determine the data access scope and operation permission scope based on the margin between the trust value and the threshold, calculate the authorization validity period, and obtain the authorization scope parameters; Receive the authorization scope parameters and authorization validity period, generate an access control token containing user identifier, resource identifier, authorization scope description, and authorization validity period, sign it using digital signature technology, and then send it to the resource access agent.

6. The information security protection method based on a zero-trust architecture according to claim 1, characterized in that, S5 includes: Receive access control tokens, deploy lightweight behavior monitoring probes on resource access paths, collect operation behavior data in bypass listening mode, and obtain session monitoring instances and baseline behavior records; Receive session monitoring instances, use sliding time window technology to aggregate and statistically analyze behavioral features, and obtain a sequence of real-time user operation behavior features. The system receives real-time user operation behavior feature sequences, uses a temporal convolutional network combined with a multi-head self-attention mechanism to extract behavior pattern features, and calculates reconstruction error and Mahalanobis distance through a variational autoencoder to obtain a behavior anomaly score. Receive behavior anomaly score, classify the anomaly into different risk levels according to preset multi-level response thresholds, and execute corresponding response actions such as recording alarms, restricting permissions, re-authenticating, or terminating the session. Receive the response action execution result, adjust the user trust score according to the response level, synchronize the updated trust score to the distributed identity authentication center, and obtain the updated user trust score and session status.

7. The information security protection method based on a zero-trust architecture according to claim 1, characterized in that, S6 includes: Receive session monitoring logs and response records, extract access decision records locally in each business system to build training samples, perform desensitization and balancing processing on the samples, and obtain a decision optimization training sample set; Receive the decision optimization training sample set, construct an access control knowledge graph using a graph neural network for representation learning, introduce a meta-learning mechanism, and obtain locally optimized decision model parameters; Receive local optimization decision model parameters from each business system, perform secure aggregation calculations using a federated learning aggregation protocol, and obtain global aggregation model parameters; Receive globally aggregated model parameters, perform replay tests in a simulation environment, evaluate decision accuracy, false positive rate, and false negative rate, and obtain the evaluation results of policy optimization effect; The system receives the evaluation results of the strategy optimization effect, applies the new model to the production environment using a canary release strategy, establishes a continuous monitoring mechanism for model performance and a feedback collection channel, and obtains the updated production environment decision model.

8. The information security protection method based on a zero-trust architecture according to claim 2, characterized in that, The verification strength levels are divided into basic verification, standard verification, and enhanced verification; The standard verification requires a password plus a dynamic token or SMS verification code; the enhanced verification requires biometric authentication, including fingerprint recognition and facial recognition. Fingerprint recognition uses a minutiae matching algorithm, and facial recognition calculates similarity using liveness detection and facial key point feature vectors.

9. The information security protection method based on a zero-trust architecture according to claim 5, characterized in that, The high trust category is defined as a trust margin exceeding a preset boundary, in which the system adopts a fast passage strategy. When the boundary trust category has a negative trust margin but does not exceed the compensation verification threshold, the system initiates a progressive supplementary verification process; when the low trust category has a significantly negative trust margin, the system adopts a direct rejection strategy.

10. An information security protection system based on a zero-trust architecture, used to execute the steps of an information security protection method based on a zero-trust architecture as described in any one of claims 1-9, characterized in that, include: The identity trust assessment module is used to obtain user access requests and identity credentials, and uses a layered verification and multi-factor weighted fusion method to obtain the user identity trust value. The resource sensitivity identification module receives user identity trust values ​​and uses intelligent content analysis and historical access pattern mining methods to obtain resource sensitivity levels and sensitive feature tags. The dynamic threshold calculation module receives resource sensitivity levels and user access requests, and uses scenario clustering and adaptive threshold adjustment methods to obtain the dynamic trust threshold required for access decisions. The access authorization decision module receives user identity trust value, dynamic trust threshold and resource sensitivity level, and uses a hierarchical decision and progressive verification method to obtain access authorization decision and access control token. The session monitoring module receives access control tokens and uses lightweight behavior monitoring and incremental anomaly detection methods to obtain session monitoring results and updated user trust scores. The policy optimization module receives session monitoring results and access decision history data, and uses federated learning and reinforcement learning methods to obtain globally optimized access control policy parameters.

Images