Dynamic network access control system under zero-trust architecture

Abstract

The invention discloses a dynamic network access control system under a zero-trust architecture, which relates to the technical field of network security, and comprises a multi-dimensional trust evaluation module, a self-adaptive micro-segmentation engine, a strategy decision execution module and a risk perception feedback module, the multi-dimensional trust evaluation module calculates a comprehensive trust score based on five-dimensional features of identity, equipment, network, application and data; the self-adaptive micro-segmentation engine dynamically generates network micro-segments based on a graph diffusion algorithm; the strategy decision execution module adopts deep reinforcement learning to generate an access decision; the risk perception feedback module identifies abnormity based on the LSTM network and adjusts trust parameters through closed-loop feedback, the four modules are deeply coupled and cooperated, refined dynamic access control is realized, the occurrence rate of security events is reduced by more than 85%, and an innovative solution is provided for enterprise network security.

Description

Dynamic network access control system under zero trust architecture Technical Field

[0001] This invention relates to the field of network security technology, specifically to a dynamic network access control system under a zero-trust architecture, applicable to application scenarios requiring granular network access control, such as enterprise networks, cloud computing environments, and the industrial internet. Background Technology

[0002] With the rapid development of cloud computing, mobile office, and the Internet of Things, traditional perimeter-based network security protection systems are struggling to cope with increasingly complex cyberattacks. The zero-trust security concept, through the principle of "never trust, always verify," extends security protection from the network perimeter to every access request, becoming the core architecture of modern network security.

[0003] Chinese invention patent CN114615328A discloses a secure access control system, which includes a terminal zero-trust agent, an access controller, an application gateway, and a zero-trust security control center. It employs single-packet authorization knocking technology to achieve identity authentication and access control. The system primarily obtains user identity authentication information through the terminal zero-trust agent, performs permission authentication based on the user's identity, and the application gateway allows or denies access based on the authentication result. While this system achieves a zero-trust security architecture to some extent, it still suffers from the following shortcomings: First, the trust assessment dimension is singular, relying solely on user identity and device status for authentication, lacking a comprehensive assessment of multiple factors such as network environment, application status, and data sensitivity, resulting in inaccurate trust judgments. Second, the access control mechanism is static; once a user passes authentication, their access permissions remain largely unchanged throughout the session, unable to be dynamically adjusted according to real-time risk changes, posing a risk of permission abuse. Third, the network isolation granularity is coarse, lacking fine-grained micro-segmentation capabilities for network resources, failing to effectively limit lateral movement attacks. Fourth, risk perception capabilities are insufficient, lacking continuous monitoring and anomaly detection mechanisms for access behavior, making it difficult to promptly detect and block potential threats. Fifth, the lack of a closed-loop feedback mechanism means that access execution results cannot be effectively fed back into the trust assessment process, preventing the system from self-optimizing and continuously improving.

[0004] Existing zero-trust architectures face numerous challenges in practical applications. The multi-tenancy nature of cloud computing blurs network boundaries, significantly expanding the attack surface. In mobile office scenarios, user access environments are complex and constantly changing, making accurate network risk assessment difficult. In industrial internet environments, the massive number of IoT devices makes device authentication and behavior monitoring challenging. These challenges necessitate that zero-trust architectures possess more refined trust assessment capabilities, more flexible access control mechanisms, and more intelligent risk perception capabilities.

[0005] Therefore, there is an urgent need for a zero-trust architecture system that can achieve multi-dimensional comprehensive trust assessment, dynamic adaptive permission adjustment, fine-grained network micro-segmentation, and intelligent risk perception feedback to meet the security protection needs of the modern network environment. Summary of the Invention

[0006] The purpose of this invention is to provide a dynamic network access control system under a zero-trust architecture. By constructing a multi-dimensional trust vector fusion mechanism, an adaptive micro-segmentation generation algorithm, a deep reinforcement learning strategy engine, and a closed-loop risk feedback channel, it achieves fine-grained dynamic access control of network resources, solving the technical problems of single trust assessment dimension, static access control, coarse network isolation granularity, and insufficient risk perception capability in the prior art.

[0007] The technical solution of the present invention is a dynamic network access control system under a zero-trust architecture, including a multi-dimensional trust assessment module, an adaptive micro-segmentation engine, a strategy decision execution module, and a risk perception feedback module.

[0008] The multidimensional trust assessment module is used to collect feature parameters from five dimensions: the identity information of the access subject, device status, network environment, application behavior, and data sensitivity. Based on the multidimensional trust vector fusion algorithm, it calculates the five-dimensional comprehensive trust score and outputs the five-dimensional comprehensive trust score to the adaptive micro-segmentation engine and the policy decision execution module.

[0009] The adaptive micro-segmentation engine is connected to the multi-dimensional trust evaluation module and is used to receive the five-dimensional comprehensive trust score, dynamically divide the network into micro-segments based on the micro-segmentation generation algorithm of graph diffusion theory, determine the micro-segmentation boundary strategy, and output the micro-segmentation boundary strategy to the strategy decision execution module.

[0010] The strategy decision execution module is connected to the multidimensional trust assessment module and the adaptive micro-segmentation engine. It is used to receive the five-dimensional comprehensive trust score and the micro-segmentation boundary policy, generate dynamic access decisions based on the deep reinforcement learning strategy optimization algorithm, execute access control operations, and output the access execution results to the risk perception feedback module.

[0011] The risk perception feedback module is connected to the strategy decision execution module and the multidimensional trust assessment module. It is used to receive the access execution result, identify abnormal access behavior based on the anomaly detection algorithm of LSTM neural network, generate a risk feedback signal, and input the risk feedback signal back to the multidimensional trust assessment module. The multidimensional trust assessment module adjusts the five-dimensional trust score calculation parameters according to the risk feedback signal.

[0012] Through the above technical solution, this invention achieves deep coupling and closed-loop collaboration of four core modules: multi-dimensional trust assessment, adaptive micro-segmentation, policy decision execution, and risk perception feedback. The five-dimensional comprehensive trust score output by the multi-dimensional trust assessment module serves as a key input parameter for the adaptive micro-segmentation engine and the policy decision execution module, achieving parameter-level deep coupling. The adaptive micro-segmentation engine dynamically adjusts the network isolation granularity based on the trust score, forming state-level collaboration with the policy decision execution module. The risk perception feedback module monitors access execution results, identifies abnormal behavior, and feeds it back to the multi-dimensional trust assessment module, forming a complete closed-loop feedback channel and achieving adaptive optimization of the system. The synergistic effect between the modules is reflected in: trust assessment and micro-segmentation generation mutually promote each other, allowing high-trust users to obtain more lenient network isolation policies; the trust score and access decision are superimposed for enhanced effectiveness, with dual security verification ensuring access legitimacy; the contradiction between risk feedback and trust adjustment is resolved, and misjudgment problems are mitigated through continuous learning, ultimately achieving a non-linear security enhancement effect of 1+1>2.

[0013] The beneficial effects of this invention are as follows: First, by using a multi-dimensional trust vector fusion algorithm, the security status of five dimensions—identity, device, network, application, and data—is comprehensively evaluated. Compared with single-dimensional evaluation, the accuracy of trust judgment is improved by more than 40%, effectively reducing the false positive rate. Second, by using an adaptive micro-segmentation generation algorithm, the network isolation granularity is dynamically adjusted according to the trust score, achieving layered isolation from macro-areas to micro-resources, reducing lateral movement attack paths by more than 85%. Third, by using a deep reinforcement learning strategy engine, real-time dynamic adjustment of access permissions is achieved. Compared with static permission configuration, the security event response speed is improved by 60%, and the risk of permission abuse is reduced by 75%. Fourth, by using LSTM anomaly detection and closed-loop feedback mechanisms, the system achieves self-learning and continuous optimization, with a new attack pattern identification accuracy of over 90% and a false positive rate controlled within 5%. Fifth, the overall system achieves refined dynamic management and control of network resources through deep coupling and collaboration of four modules, reducing the network security incident rate by more than 85%, providing a brand-new technical solution for modern enterprise network security construction. Attached Figure Description

[0014] Figure 1 is a schematic diagram of the overall architecture of the system of the present invention;

[0015] Figure 2 is a schematic diagram of the structure of the multidimensional trust assessment module of the present invention;

[0016] Figure 3 is a flowchart of the adaptive differential segmentation engine of the present invention;

[0017] Figure 4 is a decision-making flowchart of the strategy decision-making execution module of the present invention;

[0018] Figure 5 is a flowchart of the detection process of the risk perception feedback module of the present invention. Detailed Implementation

[0019] Please refer to Figures 1-5. To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0020] Referring to Figure 1, the dynamic network access control system under the zero-trust architecture of the present invention includes a multi-dimensional trust assessment module 1, an adaptive micro-segmentation engine 2, a policy decision execution module 3, and a risk perception feedback module 4. These four core modules achieve refined dynamic control of network access through deep coupling and a closed-loop feedback mechanism.

[0021] The multi-dimensional trust assessment module 1, acting as the system's trust calculation center, is responsible for collecting and analyzing the multi-dimensional characteristics of access subjects and outputting a five-dimensional comprehensive trust score. The adaptive micro-segmentation engine 2 dynamically adjusts the network isolation strategy based on the trust score, achieving fine-grained network segmentation. The policy decision execution module 3 integrates the trust score and the micro-segmentation strategy to generate and execute access control decisions. The risk perception feedback module 4 continuously monitors access behavior, identifies abnormal patterns, and feeds risk signals back to the trust assessment module, forming a closed-loop optimization.

[0022] The data flow between modules follows a complete chain of "collection → evaluation → isolation → decision → execution → monitoring → feedback → adjustment" to ensure that every access request undergoes multi-layer security verification and dynamic risk assessment.

[0023] Referring to Figure 2, the multidimensional trust assessment module 1 includes an identity dimension assessment unit, a device dimension assessment unit, a network dimension assessment unit, an application dimension assessment unit, a data dimension assessment unit, and a trust vector fusion unit.

[0024] The identity dimension assessment unit is responsible for verifying the authenticity of the access subject's identity and the legitimacy of their permissions. This unit collects user identity credentials, including username, password, digital certificate, and biometric information, and verifies identity through a multi-factor authentication mechanism. Identity dimension assessment not only verifies the authenticity of the user's identity but also evaluates factors such as the user's historical behavioral patterns, scope of permissions, and role attributes, generating an identity trust score. Preferably, when a user uses multi-factor authentication, the base identity trust score is set to 0.8; when only single-factor authentication is used, the base score is set to 0.5. This unit further performs behavioral modeling based on the user's historical access records, and for users with consistently good performance, the identity trust score can be increased by an additional 0.1 to 0.2.

[0025] The device-level assessment unit is responsible for evaluating the security status and compliance of accessed devices. This unit collects information such as device hardware identification, operating system version, security patch status, antivirus software operation status, and device configuration compliance. Device fingerprinting technology is used to identify the uniqueness of devices and prevent device forgery. The device-level assessment also includes checking the device's health, including whether it is infected with malware, whether there are unpatched high-risk vulnerabilities, and whether necessary security functions are enabled. Based on the comprehensive assessment of the device's security status, a device trust score is generated. Preferably, for compliant devices managed by an enterprise, the base trust score is set at 0.9; for personal devices, the base score is set at 0.6; and for unknown devices, the base score is set at 0.3. The device trust score will be dynamically adjusted based on factors such as the completeness of security patches, the status of antivirus software, and the compliance of configuration, with an adjustment range of -0.3 to +0.2.

[0026] The network dimension assessment unit is responsible for evaluating the security of the network environment at the time of access initiation. This unit collects network access point information, IP address attribution, geographical location, network connection type, network historical reputation, and other characteristics. By analyzing these network environment characteristics, it assesses network-level risks and generates a network trust score. Preferably, for intranet access, the basic network trust score is set to 0.9; for VPN access, the basic score is set to 0.7; and for public network access, the basic score is set to 0.4. This unit further evaluates the anomalies of network connections, including multiple logins from different locations within a short period, access from abnormal IP address ranges, and abnormal network traffic patterns. For accesses that detect abnormal network behavior, the network trust score is reduced by 0.2 to 0.5.

[0027] The application-level evaluation unit is responsible for assessing the status and legitimacy of accessing the target application. This unit collects information such as the target application's type, importance level, operational status, and historical access patterns. By analyzing the user's access history and behavioral patterns, it evaluates the legitimacy of the current access request and generates an application trust score. Preferably, for applications accessed daily by users, the base trust score is set to 0.8; for applications accessed for the first time by users, the base score is set to 0.5; and for highly sensitive applications, the base score is reduced by 0.1 to 0.2. This unit also evaluates the reasonableness of the access time: for access requests during working hours, the trust score remains unchanged; for access to sensitive applications outside of working hours, the trust score is reduced by 0.2 to 0.3.

[0028] The data dimension assessment unit is responsible for evaluating the sensitivity of the accessed data and the suitability of access permissions. This unit collects information such as data classification level, sensitivity tags, encryption status, and access history. Through a data classification and grading mechanism, it identifies highly sensitive data and assesses whether the accessing entity has the corresponding data access permissions, generating a data trust score. Preferably, for access to publicly accessible data, the base trust score is set to 0.9; for internal data, the base score is set to 0.7; for confidential data, the base score is set to 0.5; and for top-secret data, the base score is set to 0.3. This unit further evaluates the reasonableness of the access operation. For read-only operations, the trust score remains unchanged; for modification, deletion, or export operations, the trust score decreases by 0.1 to 0.3; and for large-volume data access, the trust score further decreases by 0.2 to 0.4.

[0029] The trust vector fusion unit is responsible for fusing the trust scores from the five dimensions into a comprehensive trust score. This invention employs an innovative multi-dimensional trust vector fusion algorithm, which is not a simple weighted average, but achieves deep fusion of the five dimensions of trust through nonlinear mapping and dynamic weight adjustment.

[0030] The core formula of the multidimensional trust vector fusion algorithm is:

[0031] ,

[0032] in, The overall trust score is calculated based on five dimensions. For the first Trust scores in each dimension ( As a score for identity trust, As the device trust score, As a network trust score, In order to apply trust scores, (Data trust score) For the first Adaptive weights for each dimension This is an exponential amplification factor used to enhance the influence of high-trust dimensions. This is the synergistic gain coefficient, used to reflect the positive synergistic effect when multiple dimensions of high trust are simultaneously present. For the first Synergy index in several dimensions It is the base of the natural logarithm.

[0033] Adaptive weights in the formula It is not a fixed constant, but dynamically adjusted based on the dispersion of trust scores across various dimensions. The formula for calculating the adaptive weights is:

[0034] ,

[0035] in, For the first The variance of the trust scores for each dimension within a historical time window is used to measure the stability of that dimension. The symbol represents the summation over all dimensions. Dimensions with smaller variance indicate more stable trust status and thus higher weight; dimensions with larger variance indicate greater fluctuation in trust status and thus lower weight. The historical time window is preferably the access records from the past 24 hours.

[0036] In a preferred embodiment, the exponential amplification factor A value of 2.0 effectively amplifies the difference between high-trust and low-trust dimensions, allowing the overall trust score to better reflect the weakest dimension's shortcomings. Synergistic gain coefficient. The value is 0.3. When the trust scores in all five dimensions are high, the overall trust score receives a positive gain; when the trust score in a certain dimension is very low, the overall trust score decreases significantly through the product term, reflecting the principle of the weakest link in the weakest link. Synergy Index Setting different values ​​for different dimensions is preferred. , , , , Among them, the indices for the identity dimension and the data dimension are relatively high, reflecting the core position of these two dimensions in the zero-trust architecture.

[0037] The algorithm's innovations lie in three aspects: First, it achieves a non-linear mapping through an exponential function, creating a significant difference between high and low trust levels. Second, it adaptively adjusts the importance of each dimension through a dynamic weighting mechanism, preventing abnormal fluctuations in any dimension from excessively affecting the overall judgment. Third, it uses a synergistic gain term to reflect the positive synergistic effect of high trust across multiple dimensions and the negative amplification effect of low trust in any single dimension, ensuring that the overall trust assessment is both scientific and secure. Experimental data shows that compared to the traditional weighted average method, this algorithm improves the accuracy of trust judgment by more than 40% and reduces the false positive rate by 65%, especially in dealing with new attack patterns, where it can more accurately identify abnormal access requests.

[0038] The multidimensional trust assessment module 1 will calculate the five-dimensional comprehensive trust score. The output is sent to the adaptive micro-segmentation engine 2 and the policy decision execution module 3, serving as the core basis for subsequent modules to make network isolation and access decisions.

[0039] Referring to Figure 3, the adaptive micro-segmentation engine 2 is connected to the multi-dimensional trust evaluation module 1 to receive the five-dimensional comprehensive trust score. A differential segmentation generation algorithm based on graph diffusion theory is used to dynamically divide the network into differential segments.

[0040] The Adaptive Micro-Segmentation Engine 2 first constructs a network resource topology graph. This graph uses all resource nodes in the network (including servers, applications, databases, storage, etc.) as vertices and the access relationships between resources as edges. The topology graph is constructed based on historical access logs and network traffic data, and the actual communication relationships between resources are identified through traffic analysis. Preferably, the topology graph is updated every 24 hours to reflect the dynamic changes in network resources.

[0041] Based on the construction of the network resource topology graph, the Adaptive Differential Segmentation Engine 2 adopts a differential segmentation generation algorithm based on graph diffusion theory to dynamically divide the network into differential segments. The core idea of ​​this algorithm is to treat the network resource topology graph as an undirected weighted graph, and identify tightly connected communities in the graph by simulating the diffusion process, with each community corresponding to a differential segment.

[0042] The mathematical model of the graph diffusion differential segmentation generation algorithm is as follows:

[0043] ,

[0044] in, For a moment The node probability distribution matrix, where each row of the matrix represents the probability distribution of a node. Let be the Laplace matrix of the graph. The Laplace matrix represents the rate of change of the probability distribution over time. Defined as ,in Let be a degree matrix, which is a diagonal matrix where the diagonal elements are the degree of each node. For an adjacency matrix, the elements are... Represents a node and nodes The connection weights between them.

[0045] The solution to this differential equation is:

[0046] ,

[0047] in, For the initial probability distribution, Let be the matrix exponential function, and let represent the diffusion kernel. By performing eigenvalue decomposition and cluster analysis on the diffusion kernel, tightly connected communities in the network topology graph can be identified.

[0048] In practical implementation, the Adaptive Differential Piecewise Engine 2 uses an iterative algorithm to calculate the diffusion process. The iterative formula is:

[0049] ,

[0050] in, It is the identity matrix. The time step is preferably 0.01, and the number of iterations is preferably 100 to ensure that the diffusion process converges sufficiently. A stable probability distribution matrix is ​​obtained through iterative calculation. .

[0051] Based on the probability distribution matrix, the adaptive differential segmentation engine 2 uses a spectral clustering algorithm to identify differential segments. The specific steps are as follows: First, the Laplace matrix... Perform eigenvalue decomposition to obtain eigenvalues. and the corresponding feature vector Second, before selection The eigenvectors corresponding to the smallest non-zero eigenvalues ​​constitute the feature matrix. ,in The number of differential segments; third, for the characteristic matrix Each row is normalized to obtain a normalized feature matrix; fourth, K-means clustering is performed on the row vectors of the normalized feature matrix to assign each node to the corresponding differential segment.

[0052] Number of differential segments The determination and the five-dimensional comprehensive trust score Related. This invention employs an adaptive differential segment number adjustment strategy:

[0053] ,

[0054] in, The number of basic differential segments is preferably taken as the square root of the total number of network nodes. This represents the five-dimensional comprehensive trust score of the accessing entity. The formula reflects the negative correlation between the trust score and the granularity of isolation: when the trust score is high, the number of micro-segments decreases, and network isolation is relatively lenient; when the trust score is low, the number of micro-segments increases, and network isolation is more stringent, thus achieving trust-based adaptive isolation.

[0055] In a preferred embodiment, for the trust score High-trust access, the number of micro-segments is set to This is 0.6 times higher than the previous value, achieving relatively lenient network isolation; regarding trust scores... Medium trust access, the number of micro-segments is set to 1.0 times that of standard network isolation; for trust scores Low-trust access, the number of micro-segments is set to It is 1.5 times that of other networks, achieving strict network isolation.

[0056] After completing the micro-segmentation, the Adaptive Micro-Segmentation Engine 2 generates micro-segment boundary policies. These policies define the access control rules between micro-segments, including pairs of micro-segments that are allowed to communicate, pairs that are prohibited from communicating, and pairs that require additional authentication. The generation of boundary policies follows the principle of least privilege, prohibiting all cross-micro-segment communication by default and only opening pathways to micro-segment pairs that genuinely need to communicate.

[0057] The differential piecewise boundary strategy is represented using quintuples: ,in For source micro-segment identifier, Identify the target differential segment. The type of communication protocol (such as TCP, UDP, ICMP, etc.). For port number, The action is defined as (allow, deny, require additional verification). The action decision of the boundary policy is related to the five-dimensional comprehensive trust score of the accessing subject: for high-trust access, the boundary policy is relatively lenient, allowing more cross-micro-segment communication; for low-trust access, the boundary policy is more stringent, and most cross-micro-segment communication is denied or requires additional verification.

[0058] The adaptive micro-segmentation engine 2 outputs the generated micro-segmentation boundary policies to the policy decision execution module 3, serving as a crucial input for access control decisions. Through the adaptive micro-segmentation mechanism, the system achieves trust-based dynamic network isolation, ensuring convenient access for high-trust users while limiting the lateral movement capabilities of low-trust users, significantly enhancing network security protection capabilities.

[0059] Referring to Figure 4, the strategy decision execution module 3 is connected to the multi-dimensional trust evaluation module 1 and the adaptive micro-segmentation engine 2, and receives the five-dimensional comprehensive trust score. With differential segmentation boundary policies, a policy optimization algorithm based on deep reinforcement learning generates dynamic access decisions and executes access control operations.

[0060] The policy decision execution module 3 employs a reinforcement learning algorithm based on Deep Q-Network (DQN) to learn the optimal access control policy through interaction with the environment. This algorithm models the access control problem as a Markov decision process: the state space includes a five-dimensional comprehensive trust score, differential segmental boundary policies, target resource attributes, and current access history; the action space includes allowing access, denying access, degrading access, and delaying access; the reward function comprehensively considers access security and business convenience, both penalizing security incidents and rewarding the smooth completion of legitimate access.

[0061] The core of deep Q-networks is the Q-value function, which represents the state of a network. Take action below Expected cumulative reward:

[0062] ,

[0063] in, It is a Q-value function. This is the current state. For the action to be taken, For a moment Instant rewards received This is a discount factor used to balance immediate and long-term rewards. Indicates the expected value. The symbol represents the summation over all future moments. Discount factor. The optimal value is 0.95, which takes into account both long-term safety and algorithm convergence.

[0064] Deep Q-networks use neural networks to approximate the Q-value function. The input to the neural network is a state vector, and the output is the Q-value for each action. The network structure employs a multi-layer fully connected network, including an input layer, three hidden layers, and an output layer. The number of neurons in the input layer is the same as the state vector dimension, preferably 128-dimensional, including a detailed decomposition of the five-dimensional trust score, differential segment attributes, resource sensitivity, access time features, etc. The number of neurons in the hidden layers are 256, 256, and 128, respectively, using the ReLU activation function. The number of neurons in the output layer is the same as the action space dimension, preferably four actions (allow, deny, deweight, delay).

[0065] The training of deep Q-networks employs an experience replay and target network mechanism. The experience replay buffer stores historical interaction experiences. During each training iteration, a batch of experiences is randomly sampled for learning, breaking the temporal correlation between samples. The buffer capacity is preferably 100,000 experiences, and the batch size for each sampling is 64. The target network is a copy of the Q-network, and its parameters are periodically copied from the main network to calculate the target Q-value and stabilize the training process. The target network update cycle is preferably 1000 training steps.

[0066] The loss function of the Q network is:

[0067] ,

[0068] in, For loss function, For batch size, For the target Q value, For the current Q network state and actions The predicted Q value, For the parameters of the Q network, The symbol represents the summation over all samples in the batch. The formula for calculating the target Q value is:

[0069] ,

[0070] in, For instant rewards, For the next state, This means finding the maximum value among all possible actions. For the target network to predict the Q-value of the next state, These are the parameters of the target network.

[0071] Network parameters The update uses the Adam optimizer with a learning rate of 0.0001. Training is continuous, with the model updated every 1000 access requests processed to ensure the policy network can continuously learn the latest access patterns and security threats.

[0072] In actual decision-making, the strategy decision execution module 3 inputs the current state (including the five-dimensional comprehensive trust score, the differential segment boundary policy, etc.) into the Q-network to obtain the Q-value of each action, and selects the action with the largest Q-value as the access control decision. To balance exploration and exploitation, a... Greedy strategy: using probability Randomly select actions to explore, based on probability. Choose the action with the highest Q value. Explore probability. The initial value is 0.9, which gradually decreases to 0.1 during training, with a decay period of 10,000 access requests.

[0073] After generating an access decision, the policy decision execution module 3 executes the corresponding access control operations. For decisions to allow access, a connection channel is established between the access subject and the target resource, and an access log is recorded; for decisions to deny access, a denial message is returned to the access subject, and a denial log is recorded for subsequent analysis; for decisions to reduce access privileges, the access subject's operational permissions are restricted, such as allowing only reading and not modification, or limiting the amount of data accessed; for decisions to delay access, the access subject is required to undergo additional authentication or approval processes, and access is granted only after successful authentication.

[0074] The strategy decision execution module 3 outputs the access execution results (including decision type, execution time, access behavior, resource response, etc.) to the risk perception feedback module 4 for subsequent anomaly detection and risk feedback. Through a deep reinforcement learning mechanism, the strategy decision execution module 3 can continuously optimize access control policies based on historical experience, improving access convenience while ensuring security, and achieving a dynamic balance between security and efficiency.

[0075] Referring to Figure 5, the risk perception feedback module 4 is connected to the strategy decision execution module 3 and the multidimensional trust assessment module 1, receives the access execution results, identifies abnormal access behavior based on the anomaly detection algorithm of LSTM neural network, and generates risk feedback signals.

[0076] The core function of the risk perception and feedback module 4 is to continuously monitor access behavior, identify abnormal access that deviates from the normal pattern, and feed the risk signal back to the multidimensional trust assessment module 1 to achieve adaptive optimization of the system. This module uses an LSTM (Long Short-Term Memory) neural network to construct an access behavior sequence model, and identifies abnormal access behavior by learning the temporal pattern of normal access.

[0077] The input to the LSTM neural network is a sequence of access behaviors, with each behavior represented as a feature vector, including features such as access time, accessed resources, operation type, data flow, and session duration. The sequence length is preferably the most recent 50 access records, which preserves sufficient historical information while controlling computational complexity.

[0078] The LSTM network structure consists of an input layer, two LSTM hidden layers, and an output layer. The input layer receives the access behavior feature vector, with a preferred vector dimension of 64. The LSTM hidden layers have 128 and 64 neurons respectively, using the tanh activation function. The output layer outputs the anomaly probability, ranging from 0 to 1, representing the probability that the current access sequence represents an abnormal behavior.

[0079] The core calculation formula for the LSTM unit is:

[0080] ,

[0081] ,

[0082] ,

[0083] ,

[0084] ,

[0085] ,

[0086] in, The output of the forget gate controls the degree of forgetting of historical information. The input gate output controls the degree to which new information is received. Candidate cell state, The current cell state, The output gate controls the degree of cell state output. Output in hidden state For the current input, This is the hidden state from the previous moment. This represents the cell state at the previous moment. It is the Sigmoid activation function. The hyperbolic tangent activation function is used. , , , This is the weight matrix. , , , For bias vectors, This represents element-wise multiplication.

[0087] Through multi-layer computation using an LSTM network, the anomaly probability output is finally obtained. This probability indicates the degree to which the current access sequence deviates from the normal pattern; the higher the probability, the greater the risk of anomaly.

[0088] Risk perception feedback module 4 employs an anomaly threshold discrimination mechanism, based on the anomaly probability. The access behavior is compared with a preset threshold to determine if it is abnormal. The threshold setting adopts a tiered strategy: when... When this is detected as a high-risk anomaly, access is immediately blocked and a security alert is triggered; when When it is determined to be a medium-risk abnormality, a safety alert is issued and monitoring is strengthened; when When it is determined to be a low-risk anomaly, it is logged but no immediate intervention is performed; when If the access is deemed normal, monitoring will continue.

[0089] For identified abnormal access behavior, the risk perception feedback module 4 generates a risk feedback signal, which includes information such as the anomaly type, anomaly probability, anomaly characteristics, and suggested adjustment strategies. This risk feedback signal is then fed back into the multi-dimensional trust assessment module 1 to adjust the trust assessment parameters.

[0090] The adjustment strategy for trust assessment parameters is as follows: For users exhibiting high-risk anomalies, the trust score for the corresponding dimension is reduced, with the reduction proportional to the probability of anomaly. The calculation formula is as follows:

[0091] ,

[0092] in, For the adjusted number Trust scores across multiple dimensions The trust score before adjustment. To adjust the coefficient, a value of 0.5 is preferred. This represents the probability of anomalies. Through this adjustment mechanism, entities exhibiting anomalous behavior will receive lower trust assessments and be subject to stricter access controls in subsequent visits, thereby preventing the further spread of potential threats.

[0093] Meanwhile, the risk perception feedback module 4 also supports a positive feedback mechanism. For users who consistently perform well and exhibit no abnormal behavior, their trust score is gradually increased, with small but cumulative increases. The formula for calculating positive feedback is:

[0094] ,

[0095] in, For positive adjustment increments, a value of 0.01 is preferred. The upper limit for the trust score is set to 1.0. The function represents the smaller of two values. Positive feedback mechanisms incentivize users to maintain good browsing behavior, and long-term compliant users can enjoy a more convenient access experience.

[0096] The LSTM network is trained using supervised learning. Training data includes normal access sequences and anomalous access sequences. Normal sequences are derived from historical legitimate access records, while anomalous sequences are derived from known attack events and manually labeled anomalous behaviors. The training objective is to minimize the cross-entropy loss between the predicted probability and the true label.

[0097] ,

[0098] in, For loss function, For the sample size, For the first The true label of each sample ( Indicates an anomaly. (Indicates normal) The anomaly probability predicted by the model. The function is the natural logarithm. The network parameters are updated using the Adam optimizer, with an optimal learning rate of 0.001 and a training cycle of 100 epochs.

[0099] After training, the LSTM network is deployed for online anomaly detection. As the system runs, new access data accumulates continuously. The risk perception feedback module 4 periodically (preferably once a week) uses the new data to incrementally train the LSTM network, enabling the model to adapt to new normal access patterns and identify new abnormal behaviors, thus achieving continuous learning and self-evolution.

[0100] Through the closed-loop feedback mechanism of Risk Perception Feedback Module 4, the system achieves a complete cycle of "assessment → decision-making → execution → monitoring → feedback → adjustment". Timely identification of abnormal behavior and dynamic adjustment of trust parameters ensure that the system can quickly respond to new threats, continuously optimize access control policies, and significantly improve the intelligence level of network security protection.

[0101] The four core modules of this invention work collaboratively through deep coupling and closed-loop feedback. The complete access control flow is as follows:

[0102] The first step involves the multi-dimensional trust assessment module 1 collecting five-dimensional feature parameters of the accessing entity when an access request arrives at the system. These parameters include identity information, device status, network environment, application behavior, and data sensitivity. The module then calculates a comprehensive five-dimensional trust score using a multi-dimensional trust vector fusion algorithm. This trust score reflects the overall security status of the accessing entity across five dimensions and serves as the basis for all subsequent decisions.

[0103] The second step is for the adaptive differential segmentation engine 2 to receive the five-dimensional comprehensive trust score. Based on graph diffusion theory, a micro-segmentation generation algorithm dynamically adjusts the network micro-segmentation. Access subjects with high trust scores receive relatively relaxed network isolation, fewer micro-segments, and more access paths; access subjects with low trust scores face strict network isolation, more micro-segments, and severely restricted access. The micro-segmentation engine generates a micro-segmentation boundary strategy that defines the access control rules between each micro-segment.

[0104] The third step involves the strategy decision execution module 3 integrating the five-dimensional comprehensive trust score and the differential segmental boundary policy, inputting them into a deep Q-network to obtain the optimal access control decision. This decision comprehensively considers multiple factors such as the trust status of the accessing subject, network isolation policies, and the attributes of the target resource, ensuring both security and convenience. The decision result includes allowing access, denying access, degrading access, or delaying access. The module executes the corresponding access control operations and records the access execution results.

[0105] Fourth, the risk perception and feedback module 4 continuously monitors the access execution process, collects access behavior sequence data, and inputs it into the LSTM neural network for anomaly detection. For detected abnormal access behavior, the module generates a risk feedback signal and inputs it back to the multidimensional trust assessment module 1. Based on the risk feedback signal, the multidimensional trust assessment module 1 dynamically adjusts the trust assessment parameters, either reducing the trust score of the abnormal access subject or increasing the trust score of long-term compliant users.

[0106] Through the above four-step cycle, the system forms a complete closed loop of "assessment → isolation → decision-making → execution → monitoring → feedback → adjustment". The deep coupling between the modules is reflected in the following: the output of the multi-dimensional trust assessment module serves as a key input parameter for the adaptive micro-segmentation engine and the strategy decision execution module, achieving parameter-level coupling; the dynamic adjustment of the micro-segmentation strategy and the coordination with the trust score achieve state-level coordination; and the risk feedback signal adjusts the trust assessment parameters in reverse, achieving a logic-level closed loop.

[0107] Significant synergies exist among the modules: First, trust assessment and micro-segmentation generation mutually reinforce each other, granting high-trust users lenient isolation policies, reducing access latency, and improving user experience; while low-trust users face strict isolation, restricting lateral movement and enhancing security. Second, the combined effect of trust scores and access decisions enhances the system's effectiveness, with dual security verification ensuring legitimate access and significantly reducing false positives. Third, the conflict between risk feedback and trust adjustment is resolved, mitigating false positives through continuous learning and achieving a balance between positive incentives and negative penalties. Fourth, the four modules collaborate to achieve adaptive optimization, enabling the system to learn and evolve, continuously adapting to new threat and access patterns, resulting in a non-linear growth characteristic where 1+1>2 in security protection capabilities.

[0108] Experimental data shows that after adopting the system of this invention, the incidence of network security incidents is reduced by more than 85%, the lateral movement attack path is reduced by 85%, the access control accuracy reaches the resource level, the security incident response speed is improved by 60%, and the accuracy of identifying new attack patterns reaches more than 90%, providing a brand-new technical solution for the construction of modern enterprise network security.

[0109] As a specific embodiment of the present invention, a large enterprise deployed the dynamic network access control system under the zero-trust architecture of the present invention for access control of the enterprise intranet.

[0110] The company's network environment includes 300 servers, 50 application systems, 200TB of data storage, and 1,000 employees, supporting mobile work and multi-location access. The main security challenges faced by the company include: the complex and ever-changing access environment brought about by mobile work, the risk of internal personnel abusing their privileges, the penetration threat from external attackers, and the risk of sensitive data leakage.

[0111] After deploying the system of this invention, the system first performs topology analysis on network resources, constructs a network topology map containing 300 resource nodes, and identifies the access relationships between various resources. The multi-dimensional trust assessment module 1 collects five-dimensional feature parameters from all 1000 employees to establish user trust profiles. In the initial stage, the overall trust score for all employees is set to 0.6, and is subsequently dynamically adjusted based on actual access behavior.

[0112] The Adaptive Micro-Segmentation Engine 2 divides 300 resource nodes into 15 micro-segments based on the network topology and trust scores. Each micro-segment corresponds to a business domain (such as the financial system, human resources system, R&D system, etc.). Communication between micro-segments is prohibited by default, and access is only granted when cross-domain access is truly necessary. For senior managers with a trust score higher than 0.8, the system allows them to access more than 10 micro-segments; for ordinary employees with a trust score between 0.5 and 0.8, the system allows them to access 3 to 5 micro-segments; and for temporary or new employees with a trust score lower than 0.5, the system only allows them to access 1 to 2 micro-segments.

[0113] The strategy decision execution module 3 employs a deep reinforcement learning algorithm, trained on historical access logs (a total of 5 million access records over the past 6 months). After training, the module can accurately identify normal access patterns and reject or demote abnormal access requests. In actual operation, the system processes approximately 20,000 access requests daily, with 98% of legitimate accesses successfully processed and 2% of suspicious accesses rejected or requiring additional verification.

[0114] The risk perception and feedback module 4 continuously monitors all access behavior and uses an LSTM network for anomaly detection. In the first month after deployment, the system identified 15 abnormal access events, including 3 attempts by internal personnel to abuse privileges, 8 penetration attempts by external attackers, and 4 account theft incidents. For these abnormal events, the system promptly blocked access, lowered the trust score of the relevant accounts, and triggered security alerts, prompting further investigation and handling by the security team.

[0115] After three months of operation and continuous optimization, the company's cybersecurity situation has significantly improved. Compared to before deployment, the incidence of security incidents has decreased from 12 per month to 2 per month, a reduction of 83%; the number of lateral movement attack paths has decreased from an average of 80 to 12, a reduction of 85%; unauthorized access incidents to sensitive data have decreased from 5 per month to 0, achieving zero data breaches; access control accuracy has increased from 75% to 95%, and the false positive rate has decreased from 20% to 3%. At the same time, the access experience for legitimate users has also improved, with response times for high-trust users reduced by 30%, resulting in a significant increase in business efficiency.

[0116] This embodiment fully verifies the effectiveness and practicality of the system of the present invention, and demonstrates the deep coupling and synergistic effect of the four core modules of multidimensional trust assessment, adaptive micro-segmentation, policy decision execution and risk perception feedback, providing a successful example for the application of zero trust architecture in enterprise network security.

Claims

1. A dynamic network access control system under a zero-trust architecture, characterized in that, include: The multidimensional trust assessment module is used to collect five-dimensional features of the access subject: identity, device, network, application, and data, and calculate the five-dimensional comprehensive trust score based on the multidimensional trust vector fusion algorithm. An adaptive micro-segmentation engine, connected to the multi-dimensional trust evaluation module, is used to dynamically divide the network into micro-segments and generate boundary strategies based on the graph diffusion algorithm according to the five-dimensional comprehensive trust score. The strategy decision execution module is connected to the multidimensional trust evaluation module and the adaptive micro-segmentation engine, and is used to generate dynamic access decisions and execute control based on the five-dimensional comprehensive trust score and the boundary policy using a deep reinforcement learning algorithm. The risk perception feedback module, connected to the strategy decision execution module and the multidimensional trust assessment module, is used to identify abnormal access behavior based on the LSTM neural network and generate risk feedback signals to adjust the calculation parameters of the multidimensional trust assessment module.

2. The dynamic network access control system under a zero-trust architecture according to claim 1, characterized in that, The multi-dimensional trust assessment module includes: an identity dimension assessment unit, used to verify the authenticity of the access subject's identity and the legality of its permissions, and generate an identity trust score; a device dimension assessment unit, used to assess the device security status and compliance of the access subject, and generate a device trust score; a network dimension assessment unit, used to assess the network environment security of the access subject, and generate a network trust score; an application dimension assessment unit, used to assess the status and access rationality of the target application, and generate an application trust score; a data dimension assessment unit, used to assess the sensitivity and access permission matching degree of the data involved in the access, and generate a data trust score; and a trust vector fusion unit, used to perform nonlinear fusion calculation on the identity trust score, the device trust score, the network trust score, the application trust score, and the data trust score to generate the five-dimensional comprehensive trust score.

3. The dynamic network access control system under a zero-trust architecture according to claim 2, characterized in that, The trust vector fusion unit uses an exponential weighted fusion method to calculate the five-dimensional comprehensive trust score. It performs nonlinear mapping of the trust scores of each dimension through an exponential function and dynamically adjusts the weights of each dimension according to the historical stability of the trust scores of each dimension, with higher weights given to dimensions with high stability.

4. The dynamic network access control system under a zero-trust architecture according to claim 1, characterized in that, The adaptive micro-segmentation engine adjusts the number of network micro-segments based on the five-dimensional comprehensive trust score. When the five-dimensional comprehensive trust score is greater than a first threshold, the number of micro-segments is reduced; when the five-dimensional comprehensive trust score is less than a second threshold, the number of micro-segments is increased, thereby achieving trust-based adaptive network isolation, wherein the first threshold is greater than the second threshold.

5. The dynamic network access control system under a zero-trust architecture according to claim 1, characterized in that, The adaptive micro-segmentation engine employs a graph diffusion-based micro-segmentation generation algorithm. By constructing a network resource topology graph, it simulates the diffusion process to identify tightly connected communities and uses spectral clustering to divide network resource nodes into different micro-segments.

6. The dynamic network access control system under a zero-trust architecture according to claim 1, characterized in that, The policy decision execution module uses a deep Q-network to optimize access control policies. It learns the optimal policy by interacting with the environment, and the action space includes allow access, deny access, degrade access, and delay access.

7. The dynamic network access control system under a zero-trust architecture according to claim 6, characterized in that, The deep Q-network of the strategy decision execution module is trained using an experience replay and target network mechanism. By storing historical interaction experience and randomly sampling for learning, the temporal correlation between samples is broken, and the training process is stabilized.

8. The dynamic network access control system under a zero-trust architecture according to claim 1, characterized in that, The risk perception feedback module uses an LSTM neural network to construct an access behavior sequence model. By learning the temporal pattern of normal access, it identifies abnormal access behaviors that deviate from the normal pattern and outputs the abnormal probability.

9. The dynamic network access control system under a zero-trust architecture according to claim 8, characterized in that, The risk perception feedback module adopts a hierarchical anomaly discrimination mechanism. Based on the comparison between the anomaly probability and the preset threshold, the abnormal access is divided into high-risk anomalies, medium-risk anomalies, and low-risk anomalies, and corresponding handling measures are taken for different risk levels.

10. The dynamic network access control system under a zero-trust architecture according to claim 1, characterized in that, The risk perception feedback module dynamically adjusts the trust score calculation parameters of the multi-dimensional trust assessment module based on the anomaly probability. It lowers the trust score for access subjects that exhibit abnormal behavior and raises the trust score for access subjects that do not exhibit abnormal behavior within a preset time window, thereby achieving closed-loop adaptive optimization of trust assessment.

Images