Self-adaptive context-aware access control method and system based on zero-trust architecture

Abstract

The invention discloses an adaptive context-aware access control method and system based on a zero-trust architecture. The method comprises the following steps: constructing a standardized access request object; performing identity authentication and trust evaluation to generate a trust evaluation result; constructing a context information set, and forming a context data object; based on the access request object, the trust evaluation result and the context data object, matching a preset access control policy and screening out candidate policies, and sorting and selecting the candidate policies by adopting a multi-level priority judgment mechanism to generate an authorization decision result; executing a corresponding control operation on the access request based on the authorization decision result; and continuously acquiring an access behavior state, and adjusting an authorization state based on the access behavior state. According to the method, a continuous identity verification mechanism, a multi-dimensional context sensing mechanism and a strategy decision-making mechanism with a priority judgment capability are introduced, and an access authorization decision-making process is integrally reconstructed, so that fine control on a dynamic access behavior is realized.

Description

Technical Field

[0001] This invention relates to the field of information security and access control technology, and in particular to an adaptive context-aware access control method and system based on a zero-trust architecture. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] With the deepening of digital transformation in education, modern university information systems have widely covered multiple core areas such as teaching, research, management, and services, encompassing diverse and complex business processes including student course selection, online teaching, research data management, grade evaluation, and human resources and finance. These systems handle a wide variety of data types with high resource sensitivity, and face application scenarios involving frequent overlap of user roles and diverse access methods. This places more stringent demands on the security, flexibility, and scalability of access control mechanisms, necessitating the construction of a refined, dynamic, and secure access control system to ensure stable system operation and data security.

[0004] Currently, role-based access control (RBAC) is widely used in educational information systems for permission management, with some scenarios supplemented by static attribute access control (ABAC). Both rely on predefined role-permission mapping relationships or fixed attribute matching rules to achieve authorization management. RBAC simplifies the permission configuration process in multi-user scenarios by dividing users into different roles and then assigning corresponding permissions to those roles. Static ABAC, on the other hand, makes authorization judgments based on the inherent attributes of the access subject and resource object, thus improving the fine-grainedness of permission control to some extent.

[0005] However, existing access control methods still have many significant shortcomings in practical applications: First, the authorization mechanism is static and lacks responsiveness; User identity and behavior status are highly dynamic. For example, teachers may simultaneously assume multiple roles such as teaching, research, and management, with frequent role switching. The RBAC model struggles to reflect these identity and behavior changes in real time, which can easily lead to authorization delays or permission generalization issues. The static ABAC model also cannot adapt to the dynamic adjustments of user status and business scenarios in a timely manner.

[0006] Secondly, it lacks the ability to dynamically perceive and adapt to the access context; Existing models generally focus on user identity and inherent resource attributes, paying insufficient attention to contextual factors such as device status, network location, access time, and behavioral characteristics when access occurs. They fail to incorporate these dynamic factors into a unified authorization judgment logic, making it difficult to dynamically adjust authorization strategies according to changes in risk, thus increasing security risks of identity theft and abuse of permissions.

[0007] Third, the strategy granularity is too coarse, and the conflict resolution mechanism is insufficient; In environments with multi-system integration and multi-role collaborative operation, the number of access control policies is constantly increasing and their structure is becoming more complex. Traditional models lack clear policy priority management and conflict resolution mechanisms, which can easily lead to overlapping authorization rules, policy coverage, or inconsistent decision results, seriously affecting the security consistency and management controllability of the system.

[0008] Fourth, it lacks a continuous verification mechanism and has limited ability to control trust boundaries; Most systems use a one-time authentication method, which maintains access permissions for a long time after user authentication. This fails to continuously assess subsequent behavioral changes and session risks. This "default trust" authorization model is difficult to meet dynamic security protection needs and increases internal security risks such as lateral movement and account sharing to some extent.

[0009] In summary, while existing access control methods in educational information systems achieve basic management of user identity and resource permissions, their authorization decision-making mechanisms are primarily based on static rules and single authentication. They lack comprehensive consideration of key factors such as changes in access context, policy conflict adjudication, and the evolution of session risks. In the context of multi-role, multi-terminal, and highly dynamic educational informatization applications, it is difficult to achieve an effective balance between security, flexibility, and consistency. This has become a key technical bottleneck restricting the further improvement of the security protection capabilities and operational effectiveness of existing access control systems. Summary of the Invention

[0010] To address the aforementioned issues, this invention proposes an adaptive context-aware access control method and system based on a zero-trust architecture. This invention reconstructs the access authorization decision-making process by introducing a continuous authentication mechanism, a multi-dimensional context-aware mechanism, and a policy decision-making mechanism with priority adjudication capabilities during the access request processing, thereby achieving refined control over dynamic access behavior.

[0011] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides an adaptive context-aware access control method based on a zero-trust architecture, comprising the following steps: Obtain the access request issued by the accessing entity, parse the access request, and construct a standardized access request object; Based on the access subject, perform identity authentication and trust assessment to generate trust assessment results that characterize the trustworthiness of the access; Obtain environmental information parameters related to the access request, construct a collection of context information corresponding to the access request based on the environmental information parameters, and form a context data object to characterize the access scenario. Based on the access request object, trust assessment result, and context data object, a preset access control policy is matched and candidate policies are selected. A multi-level priority adjudication mechanism combined with auxiliary factors is used to sort and select the candidate policies, generate a unique authorization decision result, and obtain the authorization status corresponding to the access request. Based on the authorization decision results, perform corresponding control operations on the access request; and continuously acquire the access behavior status, and dynamically adjust the authorization status corresponding to the access request based on the access behavior status.

[0012] As an alternative implementation, the access request is parsed to extract the subject identifier, target resource identifier, and operation type, and a unique identifier is generated for the access request to identify the request processing chain.

[0013] As an optional implementation, the identity authentication adopts a multi-factor authentication method, which includes one or more of the following: username and password authentication, dynamic password authentication, biometric authentication, and device fingerprint recognition authentication.

[0014] As an alternative implementation, the environmental information parameters related to the access request include terminal device information, network connection status, access time characteristics, geographical location information, and user behavior characteristics.

[0015] As an optional implementation, the preset access control policy includes access subject attributes, resource object attributes, context environment conditions, authorization actions, and priority identifiers. The multi-level priority adjudication mechanism includes one or more combinations of static priority, conditional priority, coverage priority, risk perception priority, and time window priority; and when sorting the candidate strategies, they are sorted level by level according to preset priority meta-rules, which are used to specify the adjudication order between different types of priorities.

[0016] As an alternative implementation, when there are still ties among candidate strategies after being sorted by a multi-level priority decision mechanism, auxiliary factors are used to select the candidate strategies; the auxiliary factors include the scope of policy application, the weight of the policy source, and the sensitivity of access operations.

[0017] Secondly, the present invention provides an adaptive context-aware access control system based on a zero-trust architecture, comprising the following modules: The user request management module is configured to: obtain access requests issued by the access subject, parse the access requests, and construct standardized access request objects; The identity authentication and trust management module is configured to: perform identity authentication and trust assessment based on the access subject, and generate trust assessment results to characterize the trustworthiness of the access; The context-aware module is configured to: acquire environmental information parameters related to the access request, construct a set of context information corresponding to the access request based on the environmental information parameters, and form a context data object to characterize the access scenario. The strategy decision module is configured to: match the preset access control policy and filter candidate policies based on the access request object, trust assessment result and context data object, sort and select the candidate policies using a multi-level priority adjudication mechanism combined with auxiliary factors, generate a unique authorization decision result, and obtain the authorization status corresponding to the access request. The access control enforcement and feedback module is configured to: perform corresponding control operations on access requests based on the authorization decision results; and continuously acquire access behavior status, and dynamically adjust the authorization status corresponding to the access request based on the access behavior status.

[0018] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention constructs a full-process dynamic authorization system encompassing "standardized access request processing—dynamic trust assessment—context awareness—dynamic policy matching—real-time authorization status adjustment," effectively adapting to dynamic changes in user identity status, access environment, and business scenarios. Unlike traditional role-based static authorization models, this invention continuously correlates the real-time status and environmental changes of the accessing subject during access request processing. Authorization decisions are no longer limited to predefined rules but can be adjusted promptly based on dynamic scenarios such as multi-role switching and cross-terminal access, solving the pain points of authorization lag or permission generalization and significantly improving the flexibility and adaptability of access control.

[0019] To address the shortcomings of existing mechanisms in lacking dynamic context awareness and adaptation capabilities, this invention proactively acquires environmental parameters related to access requests, constructs a complete set of contextual information, and forms a structured data object, which serves as one of the core inputs for authorization decisions. This multi-dimensional context-driven authorization logic enables the system to accurately perceive differences in access scenarios and changes in risk, breaking the limitations of traditional models that rely solely on user identity and resource attributes. This makes authorization judgments more aligned with the rationality and security of actual access scenarios, significantly reducing security risks such as identity theft and abuse of permissions.

[0020] To address the shortcomings of conflict resolution mechanisms in scenarios with multiple coexisting strategies, this invention employs a multi-level priority resolution mechanism combined with auxiliary factors for strategy selection, effectively resolving the problem of inconsistent authorization results. When an access request matches multiple preset strategies, the multi-level priority resolution mechanism sorts the candidate strategies in an orderly manner, and combines auxiliary factors for refined selection, generating a unique authorization decision. This mechanism ensures the consistency and controllability of authorization decisions in complex scenarios, avoiding the decision chaos caused by strategy overlap and coverage in traditional models, and significantly improving the system's security consistency and management controllability.

[0021] To address the shortcomings of existing mechanisms in terms of continuous verification and limited trust boundary control, this invention implements the core concept of "always-verified" zero-trust through a closed-loop design of "identity authentication and trust assessment—continuous monitoring of access behavior—dynamic adjustment of authorization status." After initial identity authentication and authorization, instead of maintaining fixed permissions indefinitely, the system continuously monitors access behavior. When abnormal access behavior, changes in the context, or a decline in trust assessment results are detected, the authorization status is dynamically adjusted in a timely manner. This continuous verification and dynamic adjustment mechanism effectively compensates for the deficiencies of one-time authentication, achieves dynamic control of the trust boundary, and significantly reduces internal security risks such as lateral movement, account sharing, and credential abuse.

[0022] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0023] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0024] Figure 1 This is a general framework diagram of the present invention; Figure 2 This is a logical structure diagram of the functional modules of the present invention; Figure 3 This is a flowchart of the access control method of the present invention; Figure 4 This is a flowchart of the strategy matching and conflict resolution mechanism of the present invention; Figure 5 This is a structural diagram illustrating the contextual information classification and modeling of the present invention. Figure 6 This is a path diagram for determining the priority of the strategy in this invention. Detailed Implementation

[0025] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0026] It should be noted that the following detailed description is exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0027] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0028] Zero Trust Architecture (ZTA): A cybersecurity concept that emphasizes "never trust, always verify".

[0029] ABAC: Attribute-Based Access Control.

[0030] PBAC: Policy-Based Access Control.

[0031] Context awareness: Dynamically adjust access control policies based on real-time information such as access time, location, device status, and user behavior.

[0032] Example 1 like Figure 3 As shown, this embodiment provides an adaptive context-aware access control method based on a zero-trust architecture. Taking access requests as the processing object, it achieves dynamic authorization control of access behavior through the collaborative processing of identity status, context environment, and access policies. This method is particularly suitable for educational informatization application scenarios involving multiple roles, multiple terminals, and multiple systems operating in parallel. This embodiment uses a multi-role, multi-terminal access control scenario of an educational informatization platform to explain the implementation process of this method in detail, as follows: S1: Obtain the access request issued by the access subject, parse the access request, and construct a standardized access request object.

[0033] In step S1, when an access subject (such as a teacher, student, or administrator) initiates an access request to a target resource in the education information system through a terminal device (computer, mobile phone, tablet, etc.) or application service (online teaching platform, scientific research data management system, academic affairs management system, etc.), the following operations are performed: The system obtains access requests, parses the request content, and extracts key information for access control decisions. This key information includes at least the access subject identifier, the target resource identifier, and the access operation type. The subject identifier includes, for example, a teacher's employee ID, a student's student ID, or an administrator account. The target resource identifier includes, for example, online courseware for a specific course, experimental data for a research project, a student grade database, or an entry point to a financial reimbursement system. The access operation type includes, for example, viewing, editing, downloading, deleting, or submitting. A unique identifier is generated for the access request, which is used to uniquely identify and trace the access request during the access control process. The unique identifier runs through the entire access control process, for example, as a request identifier (RequestID) or a session identifier (SessionID). The access request is then passed to the identity authentication and trust management module according to a predetermined process, thereby realizing unified scheduling and management of access requests.

[0034] The extracted subject identifier, target resource identifier, operation type, and generated unique identifier are integrated to construct a standardized access request object. This object serves as the unified input for subsequent processing steps, ensuring consistent data format and complete and traceable information.

[0035] S2: Based on the access subject, perform identity authentication and trust assessment to generate trust assessment results that characterize the trustworthiness of the access.

[0036] In step S2, identity authentication adopts a multi-factor authentication method to verify the legitimacy of the access subject. Depending on the security requirements and access scenario, the multi-factor authentication method includes one or more of the following: username and password authentication, dynamic password authentication, biometric authentication, and device fingerprint recognition authentication.

[0037] Building upon identity authentication, the system further incorporates the historical behavioral characteristics of the accessing entity and the status of the terminal device to perform a trust assessment of the current access session, generating trust information to characterize the access's credibility. This trust assessment result serves as a crucial input for access authorization decisions, participating in subsequent policy decision-making processes to achieve continuous verification and dynamic trust control of the access session.

[0038] This embodiment achieves real-time perception and response to access risks by continuously assessing the trust of access sessions and dynamically adjusting the authorization decision path based on contextual information. It can identify potential abnormal behavior during access and trigger stricter access control measures when the risk level escalates. In a mixed dataset containing approximately 12% high-risk access samples, this embodiment achieves a 92.5% identification and interception rate for unauthorized or abnormal access requests, significantly higher than the 72.4% of the ordinary ABAC model and the 48.3% of the RBAC model. By introducing a continuous verification mechanism, this embodiment effectively avoids the security risks associated with long-term trust after one-time authentication, achieving dynamically controllable trust boundary management.

[0039] S3: Obtain environmental information parameters related to the access request, construct a collection of context information corresponding to the access request based on the environmental information parameters, and form a context data object to characterize the access scenario.

[0040] In step S3, after identity authentication and trust assessment are completed, the context of the access request is processed. For the scenario in which the access request occurs, the acquired environmental information parameters related to the access request include terminal device information, network connection status, access time characteristics, geographical location information, and user behavior characteristics.

[0041] The acquired environmental information parameters are normalized, and the raw data of different formats and dimensions are converted into a unified standard format (such as structured key-value pair data). Then, the context information set corresponding to the access request is constructed through structured processing, and finally a context data object that can represent the characteristics of the access scenario is formed.

[0042] S4: Based on the access request object, trust assessment result, and context data object, match the preset access control policy and filter out candidate policies. Use a multi-level priority adjudication mechanism combined with auxiliary factors to sort and select the candidate policies, generate a unique authorization decision result, and obtain the authorization status corresponding to the access request.

[0043] In the attribute-based access control (ABAC) model, access authorization typically relies on the matching relationship between access subject attributes, resource object attributes, and environment attributes. While this model can achieve fine-grained access control, it is prone to problems such as policy conflicts, non-unique decision results, and uncertain authorization paths in complex application scenarios where multiple policies are applied concurrently. It is particularly difficult to adapt to the authorization requirements of educational information systems where multiple roles, multiple terminals, and dynamic contexts coexist.

[0044] To address the aforementioned issues, this embodiment introduces a policy priority-based access control mechanism (PBAC) on top of the attribute-matching-based access control framework. This mechanism is used to determine a unique and controllable authorization decision when the same access request matches multiple authorization policies.

[0045] In step S4, the preset access control policy includes at least access subject attributes, resource object attributes, contextual conditions, authorization actions, and priority identifiers. The access subject attributes characterize the identity and access capabilities of the request initiator, and may include, but are not limited to, the access subject's role attributes, organizational affiliation attributes, permission or responsibility attributes, session state attributes, and security and trust attributes. The resource object attributes characterize the business characteristics and security attributes of the accessed resource, and may include, but are not limited to, resource type, resource sensitivity level, system or business module to which the resource belongs, and resource operation constraint attributes. The contextual conditions characterize the environmental state when the access request occurs, and may include, but are not limited to, terminal device characteristics, network environment characteristics, access time characteristics, and behavioral characteristics. The authorization action indicates the control method executed on the access request when the policy conditions are met, and may include allowing access, denying access, restricting access, or conditional access. The priority identifier indicates the decision-making order of policies in the authorization decision-making process when multiple access control policies simultaneously meet the conditions, and may include static priority identifiers, condition-triggered priority identifiers, risk-aware priority identifiers, or overriding priority identifiers.

[0046] like Figure 4 As shown, in the policy matching stage, the access control policies in the policy library are first matched based on the access request object, authentication result and context information, and all candidate policies that meet the matching conditions are selected.

[0047] When the candidate strategy set contains multiple strategies, the candidate strategies are further sorted and selected based on a multi-level priority adjudication mechanism to avoid ambiguity in the authorization decision results. This embodiment defines a variety of composable strategy priority types to adapt to conflict adjudication requirements in different authorization scenarios. The multi-level priority adjudication mechanism includes, but is not limited to, one or more combinations of static priority, conditional priority, coverage priority, risk perception priority, and time window priority.

[0048] Static priority: During the policy definition phase, a fixed priority level (P1, P2, P3) is configured for the policy, which is used to describe the basic decision order of the policy; Conditional Priority: Dynamically adjust policy priority at runtime based on access context information, such as increasing or decreasing policy weight during specific time periods or network environments; Coverage Priority: Used to override the authorization results of other policies by using the preset high-priority policy P0-Override when abnormal behavior or emergency control needs are detected; Risk perception priority: Based on the access risk assessment results, the high-priority strategy P1-Risk-High corresponding to the risk level is dynamically activated to achieve immediate convergence of high-risk access behaviors; Time window priority: Select the corresponding set of policies based on the time interval in which the access occurs, so as to avoid conflicts caused by policies taking effect at the same time.

[0049] The above priority types can be used individually or in combination to form a policy decision rule system suitable for different application scenarios.

[0050] When sorting candidate strategies, they are sorted step by step according to the preset priority meta-rules. The priority meta-rules are used to specify the adjudication order between different types of priorities to ensure that the conflict resolution process is deterministic and consistent.

[0051] In authorization scenarios where multiple policies are applied concurrently, this embodiment introduces a multi-level priority adjudication mechanism to orderly adjudicate multiple simultaneously matching access control policies, avoiding the problems of non-unique authorization results or difficult policy conflict resolution in traditional ABAC models. Candidate policies are sorted and filtered through various adjudication methods such as static priority, conditional priority, and risk-aware priority, ensuring a unique and controllable authorization decision in the final output. In the experimental simulation environment, when an access request matches multiple policy rules, the average time required for policy adjudication in this embodiment is 4.2 milliseconds, which is about 35% shorter than the traditional ABAC model without a priority adjudication mechanism, improving authorization consistency while maintaining processing efficiency.

[0052] When there are still ties among candidate strategies after being sorted by a multi-level priority decision mechanism, auxiliary factors are used to select the candidate strategy. The auxiliary factors include the scope of the strategy, the weight of the strategy source, and the sensitivity of the access operation.

[0053] This invention integrates access subject attributes, resource object attributes, and access environment information during the access control decision-making process to construct a multi-dimensional context-driven authorization judgment mechanism. It can dynamically generate structured context information based on contextual elements such as terminal type, network status, access time, and behavioral characteristics, and use this information as a crucial input condition for authorization decisions. This allows authorization judgment to move beyond static identity attributes and comprehensively reflect the rationality of access behavior and the level of environmental risk. Experimental results show that in typical educational service access scenarios, this invention significantly outperforms traditional RBAC models and ordinary ABAC models in terms of authorization judgment accuracy, effectively improving the reliability of authorization decisions in complex dynamic scenarios.

[0054] To enhance the adaptability of access control to dynamic environmental changes, this embodiment further introduces a context-driven policy dynamic activation mechanism. During the access process, the context-aware engine generates structured context information characterizing the access environment. Based on this context information, it quickly indexes policies in the policy library and activates only the set of policies matching the current access scenario to participate in authorization decisions.

[0055] By introducing a context-driven policy activation mechanism during the policy matching phase, the scope of policy application can be dynamically adjusted when the access environment changes, avoiding irrelevant policies from participating in conflict adjudication, thereby improving the efficiency of authorization decisions and reducing the probability of policy conflicts.

[0056] Through the aforementioned strategy matching and conflict resolution mechanism, this embodiment maintains the flexibility of attribute-based access control while achieving controllable adjudication of the authorization decision process in multi-strategy concurrent scenarios. This enables the access control system to output unique, stable, and interpretable authorization decision results in complex and dynamic environments, significantly improving the system's security and manageability.

[0057] S5: Execute corresponding control operations on access requests based on the authorization decision results; and continuously acquire access behavior status, and dynamically adjust the authorization status corresponding to the access request based on the access behavior status.

[0058] In step S5, based on the authorization decision result, corresponding control operations are performed on the access request. If the authorization decision result indicates that access is allowed, the access request is released; if it indicates that access is denied or restricted, the access request is intercepted or downgraded. Simultaneously, the processing result of the access request and related contextual information are recorded to support subsequent auditing and analysis.

[0059] During or after the execution of an access request, the system continuously monitors the access behavior status. When abnormal characteristics of the access behavior are detected, the context changes, or the session trust assessment result declines, the system dynamically adjusts the authorization status corresponding to the access request, including re-triggering identity authentication, adjusting the access permission scope, or terminating the access request, in order to achieve adaptive control of access risks.

[0060] Through the above specific implementation methods, refined, dynamic, and full lifecycle access control of access requests in the education information platform is achieved. It strictly follows the core concept of zero trust, "never trust, always verify," and effectively solves the problems of static authorization, insufficient context awareness, difficulty in adjudicating policy conflicts, and limited trust boundary control in existing access control mechanisms. This significantly improves the security, flexibility, and manageability of the education information system.

[0061] Example 2 This embodiment provides an adaptive context-aware access control system based on a zero-trust architecture, including the following modules: The user request management module is configured to: obtain access requests issued by the access subject, parse the access requests, and construct standardized access request objects; The identity authentication and trust management module is configured to: perform identity authentication and trust assessment based on the access subject, and generate trust assessment results to characterize the trustworthiness of the access; The context-aware module is configured to: acquire environmental information parameters related to the access request, construct a set of context information corresponding to the access request based on the environmental information parameters, and form a context data object to characterize the access scenario. The strategy decision module is configured to: match the preset access control policy and filter candidate policies based on the access request object, trust assessment result and context data object, sort and select the candidate policies using a multi-level priority adjudication mechanism combined with auxiliary factors, generate a unique authorization decision result, and obtain the authorization status corresponding to the access request. The access control enforcement and feedback module is configured to: perform corresponding control operations on access requests based on the authorization decision results; and continuously acquire access behavior status, and dynamically adjust the authorization status corresponding to the access request based on the access behavior status.

[0062] It should be noted that the above modules correspond to the steps in Embodiment 1, and the examples and application scenarios implemented by the above modules and their corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should also be noted that the above modules can be executed in a computer system as part of the system.

[0063] In further embodiments, the following is also provided: An electronic device includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, which, when executed by the processor, perform the method described in Embodiment 1. For brevity, further details are omitted here.

[0064] It should be understood that in this embodiment, the processor can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0065] A computer-readable storage medium for storing computer instructions that, when executed by a processor, perform the method of Embodiment 1.

[0066] The method in Example 1 can be directly executed by a hardware processor, or it can be executed by a combination of hardware and software modules within the processor. The software modules can reside in readily available storage media in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, a detailed description is not provided here.

[0067] A computer program product includes a computer program that, when executed by a processor, implements the method in Embodiment 1.

[0068] The present invention also provides at least one computer program product tangibly stored on a non-transitory computer-readable storage medium. The computer program product includes computer-executable instructions, such as instructions included in program modules, which execute in a device on a target real or virtual processor to perform the processes / methods described above. Typically, program modules include routines, programs, libraries, objects, classes, components, data structures, etc., that perform specific tasks or implement specific abstract data types. In various embodiments, the functionality of program modules can be combined or divided among program modules as needed. The machine-executable instructions for the program modules can execute within a local or distributed device. In a distributed device, the program modules can reside in both local and remote storage media.

[0069] The computer program code used to implement the methods of the present invention may be written in one or more programming languages. This computer program code may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the computer or other programmable data processing device, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a computer, partially on a computer, as a stand-alone software package, partially on a computer and partially on a remote computer, or entirely on a remote computer or server.

[0070] In the context of this invention, computer program code or related data may be carried by any suitable carrier to enable a device, apparatus, or processor to perform the various processes and operations described above. Examples of carriers include signals, computer-readable media, and the like. Examples of signals may include electrical, optical, radio, sound, or other forms of propagation signals, such as carrier waves, infrared signals, etc.

[0071] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. An adaptive context-aware access control method based on zero-trust architecture, characterized in that, Includes the following steps: Obtain the access request issued by the accessing entity, parse the access request, and construct a standardized access request object; Based on the access subject, perform identity authentication and trust assessment to generate trust assessment results that characterize the trustworthiness of the access; Obtain environmental information parameters related to the access request, construct a collection of context information corresponding to the access request based on the environmental information parameters, and form a context data object to characterize the access scenario. Based on the access request object, trust assessment result, and context data object, a preset access control policy is matched and candidate policies are selected. A multi-level priority adjudication mechanism combined with auxiliary factors is used to sort and select the candidate policies, generate a unique authorization decision result, and obtain the authorization status corresponding to the access request. Based on the authorization decision results, execute the corresponding control operations on the access request; It continuously acquires access behavior status and dynamically adjusts the authorization status corresponding to the access request based on the access behavior status.

2. The adaptive context-aware access control method based on zero-trust architecture as described in claim 1, characterized in that, The access request is parsed to extract the subject identifier, target resource identifier, and operation type. At the same time, a unique identifier is generated for the access request to identify the request processing link.

3. The adaptive context-aware access control method based on zero-trust architecture as described in claim 1, characterized in that, The identity authentication adopts a multi-factor authentication method, which includes one or more of the following: username and password authentication, dynamic password authentication, biometric authentication, and device fingerprint recognition authentication.

4. The adaptive context-aware access control method based on zero-trust architecture as described in claim 1, characterized in that, The environmental information parameters related to the access request include terminal device information, network connection status, access time characteristics, geographical location information, and user behavior characteristics.

5. The adaptive context-aware access control method based on zero-trust architecture as described in claim 1, characterized in that, The preset access control policy includes access subject attributes, resource object attributes, context environment conditions, authorization actions, and priority identifiers. The multi-level priority adjudication mechanism includes one or more combinations of static priority, conditional priority, coverage priority, risk perception priority, and time window priority; and when sorting the candidate strategies, they are sorted level by level according to preset priority meta-rules, which are used to specify the adjudication order between different types of priorities.

6. The adaptive context-aware access control method based on zero-trust architecture as described in claim 5, characterized in that, When there are still ties among candidate strategies after being sorted by a multi-level priority decision mechanism, auxiliary factors are used to select the candidate strategy; the auxiliary factors include the scope of the strategy, the weight of the strategy source, and the sensitivity of the access operation.

7. An adaptive context-aware access control system based on a zero-trust architecture, characterized in that, include: The user request management module is configured to: obtain access requests issued by the access subject, parse the access requests, and construct standardized access request objects; The identity authentication and trust management module is configured to: perform identity authentication and trust assessment based on the access subject, and generate trust assessment results to characterize the trustworthiness of the access; The context-aware module is configured to: acquire environmental information parameters related to the access request, construct a set of context information corresponding to the access request based on the environmental information parameters, and form a context data object to characterize the access scenario. The strategy decision module is configured to: match the preset access control policy and filter candidate policies based on the access request object, trust assessment result and context data object, sort and select the candidate policies using a multi-level priority adjudication mechanism combined with auxiliary factors, generate a unique authorization decision result, and obtain the authorization status corresponding to the access request. The access control enforcement and feedback module is configured to perform corresponding control operations on access requests based on the authorization decision results. It continuously acquires access behavior status and dynamically adjusts the authorization status corresponding to the access request based on the access behavior status.

8. An electronic device, characterized in that, It includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, which, when executed by the processor, perform the adaptive context-aware access control method based on a zero-trust architecture as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, Used to store computer instructions, which, when executed by a processor, perform the adaptive context-aware access control method based on a zero-trust architecture as described in any one of claims 1-6.

10. A computer program product, characterized in that, The method includes a computer program that, when executed by a processor, implements the adaptive context-aware access control method based on a zero-trust architecture as described in any one of claims 1-6.

Images