Trusted data space dynamic access control method and system based on zero-trust architecture
By constructing a baseline for access behavior and conducting risk assessments based on a zero-trust architecture for dynamic access control of trusted data spaces, this approach addresses the insufficient adaptability of traditional access control models in complex network environments, achieving flexible access control and enhanced security.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- LINGSHU TECH CO LTD
- Filing Date
- 2026-02-26
- Publication Date
- 2026-05-15
AI Technical Summary
Traditional access control models based on perimeter protection are ill-suited to complex and ever-changing network environments and dynamic user behaviors, resulting in poor flexibility and an inability to effectively address multi-dimensional access scenarios and permission management needs, leading to resource waste.
A dynamic access control method for trusted data spaces based on a zero-trust architecture is adopted. By constructing an access behavior baseline, calculating the similarity coefficient between the access monitoring behavior feature sequence and the baseline, combining the set of access risk influencing factors to statistically analyze the historical incident trigger probability, and conducting access risk assessment, the verification logic is dynamically configured according to the score to achieve flexible access control.
It enhances the security and flexibility of access to trusted data spaces in complex network environments, reduces the risk of data leakage and unauthorized access, and dynamically adjusts the verification strength to adapt to changes in user behavior and multi-dimensional scenarios.
Smart Images
Figure CN122053181A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of data security technology, specifically to a method and system for dynamic access control of trusted data spaces based on a zero-trust architecture. Background Technology
[0002] With the rapid development of information technology and the deepening of digital transformation, data has become a key production factor. However, the security risks faced by data in the process of sharing, circulation, and use are also increasing. Traditional access control models based on boundary protection are difficult to adapt to the current complex and ever-changing network environment and data security needs.
[0003] Meanwhile, static access control policies cannot effectively cope with dynamic changes in user behavior, multi-dimensional access scenarios, and increasingly complex permission management needs. They are inflexible and prone to resource waste. Summary of the Invention
[0004] This application provides a method and system for dynamic access control of trusted data spaces based on a zero-trust architecture, which solves the technical problems of insufficient adaptability of existing access control models in complex network environments and the difficulty of static policies in dealing with dynamic user behavior and multi-dimensional scenarios.
[0005] The technical solution to the above-mentioned technical problems in this application is as follows: Firstly, this application provides a method for dynamic access control of trusted data space based on a zero-trust architecture, the method comprising: Based on user identity and request type, construct an access behavior baseline and calculate the similarity coefficient between the access monitoring behavior feature sequence and the access behavior baseline; Traverse the set of factors affecting access risks, and combine the similarity coefficient, the user identity, and the request type to statistically analyze the historical incident trigger probability set; Based on the historical incident trigger probability set, an access risk assessment is performed to obtain an access risk score. When the access risk score is less than or equal to the first risk score threshold, the recommended access verification logic is configured and dynamic access control of the trusted data space is executed according to the constraint rule that the higher the access risk score, the more access verification elements are required.
[0006] Secondly, this application provides a trusted data space dynamic access control system based on a zero-trust architecture, including: The coefficient calculation module is used to construct an access behavior baseline based on user identity and request type, and calculate the similarity coefficient between the access monitoring behavior feature sequence and the access behavior baseline. The probability statistics module is used to traverse the set of factors affecting access risks, and combine the similarity coefficient, the user identity, and the request type to respectively count the probability set of historical incidents. The risk assessment module is used to perform an access risk assessment based on the historical incident trigger probability set and obtain an access risk score; The access control module is used to configure recommended access verification logic and execute dynamic access control of the trusted data space when the access risk score is less than or equal to the first risk score threshold, according to the constraint rule that the higher the access risk score, the more access verification elements are required.
[0007] This application provides one or more technical solutions, which have at least the following technical effects or advantages: This application provides a dynamic access control method and system for trusted data spaces based on a zero-trust architecture. First, an access behavior baseline is constructed based on user identity and request type to characterize the normal access pattern of a specific user under a specific request type. Second, the similarity coefficient between the access monitoring behavior feature sequence and this baseline is calculated, reflecting the degree of deviation between the current access behavior and the normal pattern. Third, the set of access risk influencing factors is traversed, and the historical incident trigger probability set is statistically analyzed in conjunction with the similarity coefficient, user identity, and request type. This achieves a comprehensive assessment of the trigger probability of access risks from multiple dimensions and factors. Based on this, an access risk assessment is performed to obtain an access risk score, quantitatively evaluating the risk level of the current access. Finally, recommended access verification logic is dynamically configured based on the risk score. When the risk score is less than or equal to a first risk score threshold, control is executed according to the rule that higher risks require more verification elements, achieving dynamic adjustment of the access control strategy.
[0008] Through the above technical solution, this application breaks through the limitations of traditional static access control strategies, and can flexibly adjust the verification strength according to the dynamic changes of user behavior and multi-dimensional access scenarios, thereby improving the security and flexibility of access to trusted data space in complex network environments and effectively reducing the risk of data leakage and unauthorized access. Attached Figure Description
[0009] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0010] Figure 1 This is a flowchart illustrating the dynamic access control method for trusted data space based on a zero-trust architecture provided in an embodiment of this application. Figure 2 This is a schematic diagram of the structure of a trusted data space dynamic access control system based on a zero-trust architecture provided in an embodiment of this application.
[0011] The components represented by each number in the attached diagram are explained below: Module 11 for coefficient calculation, Module 12 for probability statistics, Module 13 for risk assessment, and Module 14 for access control. Detailed Implementation
[0012] This application provides a method and system for dynamic access control of trusted data spaces based on a zero-trust architecture, which addresses the technical problems of insufficient adaptability of existing access control models in complex network environments and the difficulty of static policies in dealing with dynamic user behavior and multi-dimensional scenarios.
[0013] Example 1, as Figure 1 As shown, this application provides a method for dynamic access control of trusted data space based on a zero-trust architecture, including: S10: Based on user identity and request type, construct an access behavior baseline and calculate the similarity coefficient between the access monitoring behavior feature sequence and the access behavior baseline; In this embodiment of the application, to build an access behavior baseline, it is first necessary to collect user identity and request type. Since the normal behavior patterns of the same user performing data query operations and data modification operations may differ, it is necessary to build corresponding baselines for different request types. Even if different users have the same request type, their baselines will also be different due to differences in operating habits, business needs, etc.
[0014] Furthermore, constrained by user identity and request type, several historical user access behavior feature sequences of normal access are collected, and then the similarity coefficient between the access monitoring behavior feature sequence and the access behavior baseline is calculated.
[0015] Among them, an access behavior baseline is constructed based on user identity and request type, including: Based on the user identity and the request type, collect several historical user access behavior feature sequences for normal access. The number of trigger times of i behavioral features is counted for the several historical user access behavior feature sequences to obtain multiple number of trigger times of i behavioral features, where the initial value of i is equal to 1, i is an integer, and i represents the number of behavioral features in the selected behavioral feature sequence. Based on the number of triggers of the multiple i-items of behavior features, the i-items of behavior features whose trigger counts are less than or equal to the threshold are deleted from the several historical user access behavior feature sequences to obtain several updated historical user access behavior feature sequences. Update the value of i using the number of behavioral features in the shortest behavioral feature sequence among the aforementioned sequences of updated historical user access behavior features, and execute the loop. Until the number of feature triggers of any remaining behavioral feature sequence is greater than the threshold, several remaining historical user access behavior feature sequences are spliced together in chronological order to obtain the access behavior baseline.
[0016] In this embodiment of the application, firstly, based on user identity and request type as constraints, all normal access records of the user under the request type are filtered out from the historical access log, and several historical user access behavior feature sequences are extracted from them. The behavior feature sequences contain features of multiple dimensions, such as access time, access IP address, accessed data resource identifier, operation duration, data transmission volume, etc.
[0017] Secondly, the number of times each of the i behavioral features is triggered is counted for the historical user access behavior feature sequence. The initial value of i is set to 1. For example, when i=1, if a certain behavioral feature appears only 3 times in all sequences, and the preset number threshold is 5, then the behavioral feature will be judged as an atypical feature and deleted from all historical sequences, and each long sequence will become multiple short sequences.
[0018] Subsequently, the value of i is updated to the number of behavioral features in the shortest sequence of the remaining updated historical user access behavior feature sequence. For example, if the shortest sequence in the updated sequence contains 4 behavioral features, then i is updated to 4. At this time, the number of times the combination of 4 consecutive behavioral features is triggered in the sequence is counted. Then, the combination of 4 behavioral features with a trigger count less than or equal to the threshold is deleted, and the value of i is updated again in a loop.
[0019] By using the above methods, behavioral features or feature combinations that occur infrequently and are not representative are gradually filtered out, and the core behavioral feature sequences that are triggered more than the threshold and can reflect the user's normal access patterns are ultimately retained.
[0020] Finally, the remaining historical user access behavior feature sequences are spliced together according to their chronological order during the actual access process. At the same time, there may be multiple concurrent baselines. By splicing them together, a complete access behavior baseline is formed.
[0021] Furthermore, the similarity coefficient between the access monitoring behavior feature sequence and the access behavior baseline is calculated, including: From the access monitoring behavior feature sequence, extract the j-th access monitoring behavior feature, where j is an integer, the initial value of j is equal to 1, and j represents the sequence number of the behavior feature sequence; Extract the feature of the j-th access behavior baseline from the access behavior baseline; Calculate the behavioral similarity between the access monitoring behavior feature of the j-th sequence number and the baseline feature of the access behavior of the j-th sequence number to obtain the behavioral similarity of the j-th sequence number; Increment j by one, execute the loop until the similarity of all sequence number behaviors is obtained, calculate the mean of the similarity of all sequence number behaviors, and set it as the similarity coefficient.
[0022] In this embodiment of the application, firstly, the behavior features of each sequence number are extracted sequentially from the access monitoring behavior feature sequence. For example, when j=1, the first behavior feature in the sequence is extracted, and at the same time, the first baseline feature corresponding to the access behavior baseline is extracted.
[0023] Secondly, for the monitoring features and baseline features of the j-th sequence number, the behavioral similarity of the j-th sequence number is calculated. Then, the j-th value is incremented by 1, and the above extraction and calculation steps are repeated until all behavioral features in the access monitoring behavioral feature sequence have been traversed, obtaining the behavioral similarity of all sequences.
[0024] Finally, the arithmetic mean of the behavioral similarity of all sequences is calculated. This mean is the similarity coefficient between the access monitoring behavioral feature sequence and the access behavior baseline. The closer the coefficient is to 1, the higher the consistency between the current access behavior and the normal baseline, and the smaller the risk of deviation.
[0025] Specifically, calculating the behavioral similarity between the access monitoring behavior feature of the j-th sequence number and the baseline feature of the access behavior of the j-th sequence number to obtain the behavioral similarity of the j-th sequence number includes: When the behavioral feature is a type feature, the proportion of the number of identical access monitoring behavioral features of the jth sequence number and the baseline features of the jth sequence number is set as the similarity of the jth sequence number behavior. When the behavioral feature is a quantitative feature, the proportion of the number of features whose feature deviation is less than or equal to the corresponding feature attribute threshold between the j-th sequence access monitoring behavioral feature and the j-th sequence access behavior baseline feature is calculated and set as the similarity of the j-th sequence behavior.
[0026] In this embodiment of the application, firstly, the type features include discrete features such as the identifier of the accessed data resource and the type of operation, and the quantitative features include continuous features such as access time, operation duration, and data transmission volume.
[0027] For type features, there may be multiple concurrent features at each time point in the baseline. For example, the same user may simultaneously request access to multiple different data resource identifiers. In this case, the baseline will record these concurrent resource identifiers as type features. When calculating the similarity between the access monitoring behavior feature of the j-th sequence number and the baseline feature, the number of monitoring features that are completely consistent with the baseline concurrent features is counted, and then divided by the total number of baseline concurrent features. The resulting percentage is the behavior similarity of the type feature of that sequence number.
[0028] For example, if the baseline's type feature at index j contains two concurrent features, "Data Resource A" and "Data Resource B", and the monitoring feature at index j contains "Data Resource A" and "Data Resource C", then the number of consistent features is 1, the total number is 2, and the behavioral similarity is 50%.
[0029] For quantitative features, such as operation time, if the operation time of the baseline feature is 120 seconds and the corresponding feature attribute threshold is 30 seconds, and the operation time of the monitored feature is 140 seconds with a deviation of 20 seconds, which is less than the threshold of 30 seconds, then the quantity ratio of this quantitative feature is 1; if the operation time of the monitored feature is 160 seconds with a deviation of 40 seconds, which is greater than the threshold of 30 seconds, then the quantity ratio is 0, and thus the behavioral similarity of this sequence number is obtained.
[0030] S20: Traverse the set of factors affecting access risks, and combine the similarity coefficient, the user identity, and the request type to calculate the historical accident trigger probability set respectively; In this embodiment of the application, the set of factors affecting access risk includes device status, network type, request timestamp, and user location. Then, by traversing the set of factors affecting access risk and combining the similarity coefficient, user identity, and request type calculated above, the probability set of historical incidents is statistically analyzed.
[0031] Specifically, step S20 in the method includes: Extract the first access risk influencing factor from the set of access risk influencing factors, and load the status value of the first access risk influencing factor; Historical access log sets are collected, constrained by the status value of the first access risk influencing factor, the similarity coefficient, the user identity, and the request type. The percentage of abnormal access logs in the historical access log set is calculated and set as the first historical incident trigger probability, and then added to the historical incident trigger probability set.
[0032] In this embodiment of the application, firstly, a specific influencing factor is selected from the set of access risk influencing factors as the first access risk influencing factor, such as "device status", and its current status value is obtained, such as "normal", "abnormal" or a specific fault code.
[0033] Secondly, using the status value of the first access risk influencing factor, the previously calculated similarity coefficient, user identity, and request type as joint constraints, all historical access records that simultaneously meet the conditions are filtered out from the historical access log database to form a historical access log set.
[0034] Then, the logs in the historical access log set are analyzed, the number of logs marked as abnormal access or causing security incidents is counted, and the proportion of them in the log set is calculated as the first historical incident trigger probability under the current constraints, and added to the historical incident trigger probability set.
[0035] For example, suppose the current primary risk factor for access is "device status" with a status value of "abnormal," the user identity is "userA," the request type is "data modification," and the similarity coefficient is 0.6. Then, all historical access records with a device status of "abnormal," a user identity of "userA," a request type of "data modification," and a similarity coefficient within the range of 0.6 ± 0.05 are selected from the historical access logs. If this set contains 100 log entries, and 15 of them are marked as abnormal access or caused a security incident, then the probability of triggering the first historical incident is 15%, and this probability value is added to the historical incident trigger probability set.
[0036] Finally, continue to select the next influencing factor from the set of access risk influencing factors, such as "network type", and repeat the above process of extracting status values, collecting log sets, calculating the proportion of anomalies and calculating probabilities until all factors in the set of access risk influencing factors have been traversed, thereby obtaining a complete set containing the historical incident trigger probabilities corresponding to each influencing factor.
[0037] S30: Based on the historical accident trigger probability set, perform an access risk assessment to obtain an access risk score; In this embodiment, the access risk assessment first involves normalizing the probability values in the historical incident trigger probability set. Then, each factor in the access risk influencing factor set is assigned a preset weight value, which is determined based on the degree of influence of each factor on access risk. The normalized historical incident trigger probability is multiplied by its corresponding weight to obtain the weighted probability value of each factor. All weighted probability values are summed to obtain a preliminary risk assessment value, which is then converted into an access risk score.
[0038] Specifically, step S30 in the method includes: Obtain the risk score set preset by the administrator for the set of access risk influencing factors, wherein the risk score is the risk score when the probability of an incident triggering is greater than or equal to one time the triggering probability threshold; Traverse the set of historical accident trigger probabilities and compare them with the trigger probability threshold to obtain a set of risk ratios. When the risk ratio is less than 1, the risk ratio is set to zero. The risk ratio set corresponding to each attribute is multiplied by the risk allocation set, and the product results are summed to obtain the access risk score.
[0039] In this embodiment of the application, firstly, according to the importance of each access risk influencing factor, a corresponding risk score is pre-set for each factor in the access risk influencing factor set. The risk score represents the risk score corresponding to when the accident trigger probability of the factor reaches or exceeds a preset trigger probability threshold by one time.
[0040] For example, if the trigger probability threshold of "device status" is 10%, its preset risk score is 20 points, which means that when the historical accident trigger probability of "device status" reaches 20%, the risk score contributed by this factor is 20 points.
[0041] Secondly, each probability value in the historical accident trigger probability set is iterated through, compared with a preset trigger probability threshold, and the ratio is calculated to obtain a risk ratio set. During the calculation process, if the trigger probability of a certain historical accident is less than the trigger probability threshold, that is, the risk ratio is less than 1, the risk ratio is forcibly set to zero, indicating that the factor does not make a substantial contribution to the risk under the current circumstances.
[0042] For example, if the trigger probability threshold for "network type" is 5%, and the current historical accident trigger probability is 3%, then the risk ratio is 3% / 5%=0.6, which is less than 1, so the risk ratio is set to 0.
[0043] Subsequently, each ratio in the risk ratio set is multiplied by the risk allocation value corresponding to the attribute in the risk allocation value set to obtain the risk contribution score of each factor. Then, the risk contribution scores of all factors are summed, and the final sum is the access risk score.
[0044] For example, suppose the set of factors affecting access risk includes two factors: "device status" and "network type," with risk scores of 20 and 15 points respectively, and a trigger probability threshold of 10% for both. If the historical incident trigger probability for "device status" is 15%, the risk ratio is 15% ÷ 10% = 1.5; and the historical incident trigger probability for "network type" is 8%, with a risk ratio set to 0. Then, the access risk score = 1.5 × 20 + 0 × 15 = 30 points.
[0045] S40: When the access risk score is less than or equal to the first risk score threshold, according to the constraint rule that the higher the access risk score, the more access verification elements are required, the recommended access verification logic is configured, and dynamic access control of the trusted data space is executed.
[0046] In this embodiment, a first risk score threshold is first set. This threshold is used to determine whether enhanced verification is needed for the current access. When the access risk score is less than or equal to the first risk score threshold, it indicates that the current access poses a certain risk, but has not yet reached the level of direct rejection. In this case, recommended access verification logic needs to be dynamically configured based on the risk score. The constraint rule is that the higher the access risk score, the more access verification elements are required, so as to improve the security of access control through multi-dimensional verification.
[0047] Specifically, the recommended access verification logic can be configured by constructing a mapping table between access risk score and the number of access verification elements. For example, when the access risk score is in the range [0, 30), one verification element is mapped, such as password verification only; when the score is in the range [30, 60), two verification elements are mapped, such as password + SMS verification code; when the score is in the range [60, first risk score threshold], three verification elements are mapped, such as password + SMS verification code + biometric recognition (fingerprint / face).
[0048] Furthermore, based on the calculated access risk score, the corresponding number of verification elements is automatically matched in the mapping table, and recommended access verification logic containing the corresponding verification steps is automatically generated. When executing dynamic access control for the trusted data space, the user's identity is verified according to the recommended access verification logic. Only when the user passes all verification elements is access to the requested trusted data space resource allowed; if the user fails any verification, access is denied.
[0049] Furthermore, the dynamic access control method for trusted data spaces based on a zero-trust architecture also includes: If the access risk score is greater than the first risk score threshold, the user's access is denied. When the access risk score is less than the second risk score threshold, the verification process is canceled and access is directly authorized, wherein the second risk score threshold is less than the first risk score threshold; When the access risk score is greater than or equal to the second risk score threshold and less than or equal to the first risk score threshold, the recommended access verification logic is configured based on the access risk score.
[0050] In this embodiment of the application, firstly, when the access risk score is greater than the first risk score threshold, it indicates that the current access behavior has a high security risk and may pose a threat to the resource security of the trusted data space. At this time, the user's access request is rejected to prevent potential security incidents from occurring.
[0051] Secondly, when the access risk score is less than the second risk score threshold, it indicates that the current access behavior is consistent with the normal baseline and the risk is extremely low. In order to improve the user experience and reduce unnecessary verification processes, the verification step is canceled and the user is directly authorized to access the requested resources.
[0052] Finally, when the access risk score is between the second risk score threshold and the first risk score threshold, i.e. the risk is at a medium level, according to the aforementioned constraint rules, the corresponding recommended access verification logic is configured based on the specific risk score value. By dynamically adjusting the number and type of verification elements, access efficiency is taken into account while ensuring security.
[0053] For example, the second risk score threshold is 20 points and the first risk score threshold is 80 points. When the access risk score is 45 points, two-factor authentication of "password + hardware token" is configured; when the score rises to 70 points, it may be upgraded to three-factor authentication of "password + biometric recognition + security question answer", thereby realizing fine-grained dynamic access control based on risk level.
[0054] In summary, compared with existing technologies, this application quantifies the similarity between access behavior feature sequences and baselines, combines multi-dimensional access risk influencing factors to statistically analyze historical incident trigger probabilities, and then achieves access risk scoring through risk allocation and ratio calculation. Finally, it dynamically configures verification logic based on the score, thereby realizing closed-loop management of the entire process from risk assessment to access control.
[0055] In summary, the embodiments of this application have at least the following technical effects: This application provides a dynamic access control method for trusted data spaces based on a zero-trust architecture. First, an access behavior baseline is constructed based on user identity and request type to characterize the normal access pattern of a specific user under a specific request type. Second, the similarity coefficient between the access monitoring behavior feature sequence and this baseline is calculated, reflecting the degree of deviation between the current access behavior and the normal pattern. Third, the set of access risk influencing factors is traversed, and the historical incident trigger probability set is statistically analyzed in conjunction with the similarity coefficient, user identity, and request type. This achieves a comprehensive assessment of the trigger probability of access risks from multiple dimensions and factors. Based on this, an access risk assessment is performed to obtain an access risk score, quantitatively evaluating the risk level of the current access. Finally, recommended access verification logic is dynamically configured based on the risk score. When the risk score is less than or equal to a first risk score threshold, control is executed according to the rule that higher risks require more verification elements, thus achieving dynamic adjustment of the access control strategy.
[0056] Through the above technical solution, this application breaks through the limitations of traditional static access control strategies, and can flexibly adjust the verification strength according to the dynamic changes of user behavior and multi-dimensional access scenarios, thereby improving the security and flexibility of access to trusted data space in complex network environments and effectively reducing the risk of data leakage and unauthorized access.
[0057] Example 2, as Figure 2 As shown, based on the same inventive concept as the trusted data space dynamic access control method based on zero-trust architecture provided in Embodiment 1, this application also provides a trusted data space dynamic access control system based on zero-trust architecture, including: The coefficient calculation module 11 is used to construct an access behavior baseline based on user identity and request type, and calculate the similarity coefficient between the access monitoring behavior feature sequence and the access behavior baseline. The probability statistics module 12 is used to traverse the set of factors affecting access risks, and combine the similarity coefficient, the user identity and the request type to respectively count the probability set of historical incidents. Risk assessment module 13 is used to perform access risk assessment based on the historical accident trigger probability set and obtain an access risk score; Access control module 14 is used to configure recommended access verification logic and execute dynamic access control of trusted data space when the access risk score is less than or equal to the first risk score threshold, according to the constraint rule that the higher the access risk score, the more access verification elements are required.
[0058] Furthermore, in one application embodiment, an access behavior baseline is constructed based on user identity and request type, including: Based on the user identity and the request type, collect several historical user access behavior feature sequences for normal access. The number of trigger times of i behavioral features is counted for the several historical user access behavior feature sequences to obtain multiple number of trigger times of i behavioral features, where the initial value of i is equal to 1, i is an integer, and i represents the number of behavioral features in the selected behavioral feature sequence. Based on the number of triggers of the multiple i-items of behavior features, the i-items of behavior features whose trigger counts are less than or equal to the threshold are deleted from the several historical user access behavior feature sequences to obtain several updated historical user access behavior feature sequences. Update the value of i using the number of behavioral features in the shortest behavioral feature sequence among the aforementioned sequences of updated historical user access behavior features, and execute the loop. Until the number of feature triggers of any remaining behavioral feature sequence is greater than the threshold, several remaining historical user access behavior feature sequences are spliced together in chronological order to obtain the access behavior baseline.
[0059] Furthermore, in one embodiment of the application, calculating the similarity coefficient between the access monitoring behavior feature sequence and the access behavior baseline includes: From the access monitoring behavior feature sequence, extract the j-th access monitoring behavior feature, where j is an integer, the initial value of j is equal to 1, and j represents the sequence number of the behavior feature sequence; Extract the feature of the j-th access behavior baseline from the access behavior baseline; Calculate the behavioral similarity between the access monitoring behavior feature of the j-th sequence number and the baseline feature of the access behavior of the j-th sequence number to obtain the behavioral similarity of the j-th sequence number; Increment j by one, execute the loop until the similarity of all sequence number behaviors is obtained, calculate the mean of the similarity of all sequence number behaviors, and set it as the similarity coefficient.
[0060] Further, the behavioral similarity between the access monitoring behavior feature of the j-th sequence number and the baseline feature of the access behavior of the j-th sequence number is calculated to obtain the behavioral similarity of the j-th sequence number, including: When the behavioral feature is a type feature, the proportion of the number of identical access monitoring behavioral features of the jth sequence number and the baseline features of the jth sequence number is set as the similarity of the jth sequence number behavior. When the behavioral feature is a quantitative feature, the proportion of the number of features whose feature deviation is less than or equal to the corresponding feature attribute threshold between the j-th sequence access monitoring behavioral feature and the j-th sequence access behavior baseline feature is calculated and set as the similarity of the j-th sequence behavior.
[0061] In one embodiment, the probability statistics module 12 is specifically used for: Extract the first access risk influencing factor from the set of access risk influencing factors, and load the status value of the first access risk influencing factor; Historical access log sets are collected, constrained by the status value of the first access risk influencing factor, the similarity coefficient, the user identity, and the request type. The percentage of abnormal access logs in the historical access log set is calculated and set as the first historical incident trigger probability, and then added to the historical incident trigger probability set.
[0062] In one embodiment, the risk assessment module 13 is specifically used for: Obtain the risk score set preset by the administrator for the set of access risk influencing factors, wherein the risk score is the risk score when the probability of an incident triggering is greater than or equal to one time the triggering probability threshold; Traverse the set of historical accident trigger probabilities and compare them with the trigger probability threshold to obtain a set of risk ratios. When the risk ratio is less than 1, the risk ratio is set to zero. The risk ratio set corresponding to each attribute is multiplied by the risk allocation set, and the product results are summed to obtain the access risk score.
[0063] Furthermore, the dynamic access control method for trusted data spaces based on a zero-trust architecture also includes: If the access risk score is greater than the first risk score threshold, the user's access is denied. When the access risk score is less than the second risk score threshold, the verification process is canceled and access is directly authorized, wherein the second risk score threshold is less than the first risk score threshold; When the access risk score is greater than or equal to the second risk score threshold and less than or equal to the first risk score threshold, the recommended access verification logic is configured based on the access risk score.
Claims
1. A method for dynamic access control of trusted data space based on zero-trust architecture, characterized in that, include: Based on user identity and request type, construct an access behavior baseline and calculate the similarity coefficient between the access monitoring behavior feature sequence and the access behavior baseline; Traverse the set of factors affecting access risks, and combine the similarity coefficient, the user identity, and the request type to statistically analyze the historical incident trigger probability set; Based on the historical incident trigger probability set, an access risk assessment is performed to obtain an access risk score. When the access risk score is less than or equal to the first risk score threshold, the recommended access verification logic is configured and dynamic access control of the trusted data space is executed according to the constraint rule that the higher the access risk score, the more access verification elements are required.
2. The method as described in claim 1, characterized in that, Based on user identity and request type, construct an access behavior baseline, including: Based on the user identity and the request type, collect several historical user access behavior feature sequences for normal access. The number of trigger times of i behavioral features is counted for the several historical user access behavior feature sequences to obtain multiple number of trigger times of i behavioral features, where the initial value of i is equal to 1, i is an integer, and i represents the number of behavioral features in the selected behavioral feature sequence. Based on the number of triggers of the multiple i-items of behavior features, the i-items of behavior features whose trigger counts are less than or equal to the threshold are deleted from the several historical user access behavior feature sequences to obtain several updated historical user access behavior feature sequences. Update the value of i using the number of behavioral features in the shortest behavioral feature sequence among the aforementioned sequences of updated historical user access behavior features, and execute the loop. Until the number of feature triggers of any remaining behavioral feature sequence is greater than the threshold, several remaining historical user access behavior feature sequences are spliced together in chronological order to obtain the access behavior baseline.
3. The method as described in claim 1, characterized in that, Calculate the similarity coefficient between the access monitoring behavior feature sequence and the access behavior baseline, including: From the access monitoring behavior feature sequence, extract the j-th access monitoring behavior feature, where j is an integer, the initial value of j is equal to 1, and j represents the sequence number of the behavior feature sequence; Extract the feature of the j-th access behavior baseline from the access behavior baseline; Calculate the behavioral similarity between the access monitoring behavior feature of the j-th sequence number and the baseline feature of the access behavior of the j-th sequence number to obtain the behavioral similarity of the j-th sequence number; Increment j by one, execute the loop until the similarity of all sequence number behaviors is obtained, calculate the mean of the similarity of all sequence number behaviors, and set it as the similarity coefficient.
4. The method as described in claim 3, characterized in that, Calculate the behavioral similarity between the access monitoring behavior feature of the j-th sequence number and the baseline feature of the access behavior of the j-th sequence number to obtain the behavioral similarity of the j-th sequence number, including: When the behavioral feature is a type feature, the proportion of the number of identical access monitoring behavioral features of the jth sequence number and the baseline features of the jth sequence number is set as the similarity of the jth sequence number behavior. When the behavioral feature is a quantitative feature, the proportion of the number of features whose feature deviation is less than or equal to the corresponding feature attribute threshold between the j-th sequence access monitoring behavioral feature and the j-th sequence access behavior baseline feature is calculated and set as the similarity of the j-th sequence behavior.
5. The method as described in claim 1, characterized in that, Traverse the set of factors influencing access risks, and combine the similarity coefficient, user identity, and request type to statistically analyze the historical incident trigger probability set, including: Extract the first access risk influencing factor from the set of access risk influencing factors, and load the status value of the first access risk influencing factor; Historical access log sets are collected, constrained by the status value of the first access risk influencing factor, the similarity coefficient, the user identity, and the request type. The percentage of abnormal access logs in the historical access log set is calculated and set as the first historical incident trigger probability, and then added to the historical incident trigger probability set.
6. The method as described in claim 1, characterized in that, Based on the aforementioned historical incident trigger probability set, an access risk assessment is performed to obtain an access risk score, including: Obtain the risk score set preset by the administrator for the set of access risk influencing factors, wherein the risk score is the risk score when the probability of an incident triggering is greater than or equal to one time the triggering probability threshold; Traverse the set of historical accident trigger probabilities and compare them with the trigger probability threshold to obtain a set of risk ratios. When the risk ratio is less than 1, the risk ratio is set to zero. The risk ratio set corresponding to each attribute is multiplied by the risk allocation set, and the product results are summed to obtain the access risk score.
7. The method as described in claim 1, characterized in that, Also includes: If the access risk score is greater than the first risk score threshold, the user's access is denied. When the access risk score is less than the second risk score threshold, the verification process is canceled and access is directly authorized, wherein the second risk score threshold is less than the first risk score threshold; When the access risk score is greater than or equal to the second risk score threshold and less than or equal to the first risk score threshold, the recommended access verification logic is configured based on the access risk score.
8. A trusted data space dynamic access control system based on a zero-trust architecture, characterized in that, The method for implementing the trusted data space dynamic access control method based on zero-trust architecture as described in any one of claims 1-7 includes: The coefficient calculation module is used to construct an access behavior baseline based on user identity and request type, and calculate the similarity coefficient between the access monitoring behavior feature sequence and the access behavior baseline. The probability statistics module is used to traverse the set of factors affecting access risks, and combine the similarity coefficient, the user identity, and the request type to respectively count the probability set of historical incidents. The risk assessment module is used to perform an access risk assessment based on the historical incident trigger probability set and obtain an access risk score; The access control module is used to configure recommended access verification logic and execute dynamic access control of the trusted data space when the access risk score is less than or equal to the first risk score threshold, according to the constraint rule that the higher the access risk score, the more access verification elements are required.