Zero-trust security system and control method based on bidirectional authentication of subject and data

Abstract

The application relates to the technical field of computer security, in particular to a zero-trust security system and control method based on bidirectional authentication of subjects and data, which comprises a decentralized identity management module, which is used for generating decentralized digital identities for access subjects and data assets, and bidirectionally verifying the identities of the access subjects and the data assets; an AI dynamic trust evaluation module, which is used for continuously collecting multidimensional real-time data streams, and generating a dynamically updated comprehensive trust score through a deep learning model; a dynamic strategy generation and execution module, which is used for generating real-time access control strategies based on the comprehensive trust score and data asset attributes, and executing the real-time access control strategies; and a closed-loop feedback optimization module, which is used for dynamically optimizing parameters of the deep learning model through a reinforcement learning algorithm according to strategy execution effect data. Through bidirectional decentralized authentication of subjects and data, AI dynamic trust evaluation and reinforcement learning closed-loop optimization, the application realizes safer, smarter and more flexible fine-grained access control.

Description

Technical Field

[0001] This invention relates to the field of computer security technology, and in particular to a zero-trust security system and control method based on two-way authentication of subjects and data, which is implemented using a zero-trust security architecture, decentralized identity management, dynamic access control and artificial intelligence risk assessment technology. Background Technology

[0002] Traditional network security architectures are mostly based on the "perimeter defense" model. Once external threats breach the perimeter, the internal network will lack sufficient protection. With the popularization of cloud computing, mobile technology, and remote work, network boundaries are becoming increasingly blurred, and traditional static access control policies (such as IP address whitelists and fixed account passwords) are no longer suitable for the dynamically changing security environment.

[0003] The zero-trust security concept requires continuous verification, authorization, and the assignment of least privileges to any entity attempting to access resources. However, existing zero-trust systems still face challenges:

[0004] Centralized identity management risks: Most systems rely on centralized identity providers, which poses a single point of failure and data leakage risks.

[0005] Focusing solely on the subject dimension: Traditional strategies emphasize assessing the identity and behavior of visitors while ignoring the risk attributes and context of the accessed data assets themselves, failing to achieve two-way authentication between the subject and the data and fine-grained control.

[0006] Trust assessment is static or lagging: Most risk assessment models update slowly and cannot capture minor anomalies or sudden threats in the behavior of subjects in real time, resulting in a delayed response.

[0007] Therefore, there is an urgent need for a zero-trust security system that can achieve two-way dynamic authentication between the subject and the data, real-time risk assessment based on AI, and adaptive strategy optimization capabilities. Summary of the Invention

[0008] To address the problems of centralized identity management, focus solely on the subject dimension, and static lag in trust assessment in existing zero-trust systems, this invention proposes a zero-trust security system and control method based on two-way authentication of subjects and data. By integrating decentralized identity management, AI-driven dynamic trust assessment, and adaptive policy generation, it achieves continuous, trustworthy, context-aware, and fine-grained access control.

[0009] To achieve the above objectives, the technical solution adopted is:

[0010] This invention provides a zero-trust security system based on two-way authentication of subjects and data, including a decentralized identity management module, an AI dynamic trust assessment module, a dynamic policy generation and execution module, and a closed-loop feedback optimization module. These modules collaborate to construct a fully closed-loop adaptive security protection system; wherein:

[0011] The decentralized identity management module is used to generate and manage decentralized digital identities for the access subject and data assets respectively, and to perform two-way verification of the identities of the access subject and data assets for each access request.

[0012] The AI ​​dynamic trust assessment module is used to continuously collect and integrate multi-dimensional real-time data streams after identity verification, and generate a dynamically updated comprehensive trust score through a deep learning model.

[0013] The dynamic policy generation and execution module is used to generate and execute fine-grained, context-aware real-time access control policies based on comprehensive trust scores and data asset attributes.

[0014] The closed-loop feedback optimization module is used to dynamically optimize the parameters of the deep learning model based on the policy execution effect data through reinforcement learning algorithms.

[0015] According to the zero-trust security system based on two-way authentication of subjects and data of the present invention, the decentralized identity management module further adopts a distributed trust anchor node construction scheme based on BLS threshold signature. In the consortium blockchain network, public key fragments are aggregated through a secure multi-party computation protocol to generate the system root public key. During authorization, signature fragments from at least t trust anchor nodes need to be collected to form a complete signature. The complete signature is verified by performing a bilinear pairing operation using the system root public key. The subject DID is generated in the following way: a key pair is generated when the data connector starts. The first 20 bytes of the public key material are calculated using the Keccak-256 hash algorithm and then constructed into a decentralized identifier conforming to the W3C DID standard through Base58 encoding. The data asset DID is generated by the data provider through the data connector by calculating the data integrity hash and combining it with the usage rules.

[0016] According to the zero-trust security system based on subject and data two-way authentication of the present invention, the data connector is further deployed at the entry point of each business domain or data space to encapsulate and integrate the functions of the decentralized identity management module, the AI ​​dynamic trust assessment module, and the dynamic policy generation and execution module, so as to provide unified two-way authentication, real-time trust score acquisition, and access policy generation and execution for access requests.

[0017] According to the zero-trust security system based on two-way authentication of subjects and data of the present invention, the decentralized identity management module further adopts a hybrid storage architecture, in which the status index information of identity and credentials is stored on the consortium blockchain, and the detailed credential declaration data is stored in the off-chain distributed storage network.

[0018] According to the zero-trust security system based on two-way authentication of subjects and data of the present invention, the multi-dimensional real-time data stream collected by the AI ​​dynamic trust assessment module includes subject behavior logs, device fingerprints, network context information, data asset sensitivity levels, threat intelligence correlation, and historical interaction records; the deep learning model is a CNN-LSTM hybrid model, wherein the CNN branch performs convolution operations and max pooling on the input sequence through multiple one-dimensional convolution kernels to extract local behavioral features and spatial correlation patterns, and the LSTM branch captures long-term temporal dependencies and behavioral change trends through a gating mechanism. After concatenating and fusing the output feature vectors of the two branches, the system inputs them into a fully connected neural network and outputs a real-time trust score in the range of 0 to 1 through an activation function.

[0019] According to the zero-trust security system based on two-way authentication of subjects and data of the present invention, the AI ​​dynamic trust assessment module further includes a feature engineering unit, which uses a sliding window mechanism to divide the data stream and calculates the information entropy of the behavior sequence, the Z-score normalized value of the operation frequency, and the time series difference features for the data in each window.

[0020] According to the zero-trust security system based on two-way authentication of subjects and data of the present invention, the dynamic policy generation and execution module further includes a policy engine and a policy execution point. The policy engine maintains a dynamic policy rule base based on conditional judgment functions and uses the Rete algorithm to efficiently match rules and generate access control policies. The input variables for rule matching include the real-time trust score of the subject and the confidentiality level attribute of the data assets. The policy execution point is deployed in the access control layer of the gateway, middleware or database and executes the access control policies generated by the policy engine, including allowing access, denying access, upgrading authentication and downgrading permissions.

[0021] According to the zero-trust security system based on two-way authentication of subjects and data of the present invention, the permission downgrade further includes restricting accessible fields, reducing access frequency, and restricting write operations.

[0022] According to the zero-trust security system based on subject and data two-way authentication of the present invention, the reinforcement learning algorithm further models the trust assessment process as a Markov decision process, the state space consists of the current fused features and historical assessment records, the action space is defined as the dynamic adjustment strategy for trust scores, and the reward function is a multi-objective composite function that integrates the occurrence of security events, the smoothness of business operations, and the consumption of system resources; a proximal policy optimization algorithm is used to search for the optimal policy, and the deep learning model parameters are updated through policy gradient, with the objective of maximizing the expected discount cumulative reward.

[0023] Furthermore, the present invention also provides a zero-trust security control method based on two-way authentication of the subject and data, applied to the system described above, comprising the following steps:

[0024] Identity Management and Two-Way Authentication: When an access party initiates a request, the data connector first verifies the authenticity and validity of the subject DID and data asset DID. If the verification fails, access is denied and the process ends.

[0025] AI dynamic trust assessment: After verification, the system collects multi-source data in real time, processes it through feature engineering, and then inputs it into a deep learning model to generate a real-time trust score.

[0026] Dynamic policies and enforcement: The policy engine receives trust scores, matches them with the dynamic policy rule base using the Rete algorithm, generates access control policies, and implements them by the policy enforcement point;

[0027] Closed-loop feedback optimization: Collect data on the effectiveness of policy execution and dynamically optimize the parameters of the deep learning model through reinforcement learning algorithms.

[0028] The beneficial effects achieved by adopting the above technical solution are:

[0029] This invention integrates three core innovations: decentralized trusted identity, real-time dynamic AI evaluation, and reinforcement learning adaptive optimization, to build a more secure, intelligent, and flexible zero-trust security system.

[0030] 1. Comprehensive upgrade of security protection: Innovatively realize two-way decentralized identity authentication of subjects and data, which not only verifies the credibility of the accessing subject, but also confirms the authenticity and integrity of data assets, realizing dual credible confirmation of "who is accessing" and "what is being accessed", completely changing the traditional zero-trust single protection model that only focuses on the subject dimension, effectively resisting malicious attacks such as identity forgery and data tampering, and greatly improving the system's risk resistance capability.

[0031] 2. Decentralized architecture eliminates single point of failure risks: The distributed trust anchor node design based on BLS threshold signature manages the system master key through multi-node collaborative management, eliminating the risk of single point of failure and data leakage in traditional centralized identity management, ensuring the anti-attack capability and fault tolerance of the identity system. Even if some nodes are abnormal, the stability and security of the system's root of trust can still be guaranteed, providing a highly reliable trust foundation for complex network environments.

[0032] 3. Breakthrough in the accuracy and real-time performance of trust assessment: By adopting a CNN-LSTM hybrid deep learning model, the model collaboratively captures local anomaly patterns and long-term temporal dependencies of the subject's behavior. Combined with the fusion analysis of multi-dimensional real-time data streams, it achieves millisecond-level assessment and dynamic updates of trust status, accurately identifies minor behavioral anomalies and sudden threats, and solves the problems of static lag and high false positive and false negative rates of traditional assessment models, making risk response more timely and decision-making more accurate.

[0033] 4. Adaptive optimization for full lifecycle protection: Introducing the Proximal Policy Optimization (PPO) reinforcement learning algorithm to build a closed-loop optimization mechanism of "evaluation-decision-execution-feedback", continuously optimizing the accuracy of trust assessment and the adaptability of access control policies based on the policy execution effect, so as to achieve continuous evolution of security capabilities without manual intervention. Attached Figure Description

[0034] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings of the embodiments of the present invention will be briefly described below. The drawings are merely illustrative of some embodiments of the present invention and are not intended to limit the scope of the present invention to all embodiments.

[0035] Figure 1 This is a block diagram of a zero-trust security system architecture based on two-way authentication of subjects and data, according to an embodiment of the present invention.

[0036] Figure 2 This is a logic diagram of the construction of trust anchor nodes and DID generation in the decentralized identity management module of this invention embodiment;

[0037] Figure 3 This is a flowchart illustrating a zero-trust security control method based on two-way authentication of the subject and data, according to an embodiment of the present invention. Detailed Implementation

[0038] The exemplary solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Unless otherwise defined, the technical or scientific terms used in this invention should have the ordinary meaning understood by one of ordinary skill in the art.

[0039] This invention discloses a zero-trust security system based on two-way authentication of subjects and data, such as... Figure 1As shown, the system includes a decentralized identity management module, an AI dynamic trust assessment module, a dynamic policy generation and execution module, and a closed-loop feedback optimization module. These modules work together to build a fully closed-loop adaptive security protection system from identity recognition and dynamic assessment to intelligent policy execution. The functions of each module are as follows.

[0040] (1) Decentralized Identity Management Module: This module generates and manages decentralized digital identities (DIDs) for both the accessing entity and data assets. Each identity is generated based on distributed identifier technology, possessing global uniqueness and verifiability. The registration, update, and revocation lifecycle of the identity is jointly maintained by distributed trust anchor nodes. During each access request, the system not only authenticates the accessing entity but also the accessed data asset, achieving two-way identity verification. This ensures the non-repudiation and authenticity of the identities of both parties, fundamentally replacing the traditional trust model based on boundaries and static credentials. Specifically, it includes entity DID generation, data asset DID generation, distributed trust anchor node construction, and a hybrid storage architecture. The logical principle is as follows: Figure 2 As shown.

[0041] Main DID Generation: When the data connector starts, it generates a key pair. The first 20 bytes of the public key material are hashed using the Keccak-256 algorithm and then encoded using Base58 to construct a decentralized identifier conforming to the W3C DID standard.

[0042]

[0043] Where P represents the public key material of the access subject, and futuredid is the specified DID method. Base58 encoding is used to ensure the readability and compatibility of the identifier. Base58Encode represents the Base58 encoding operation, Keccak256 represents the Keccak-256 hash algorithm, and [0:20] represents taking the first 20 bytes of the hash result. The generated DID document uses this DID as a unique identifier and contains complete public key information associated with this DID, authentication method, and server endpoint. It is permanently registered on the consortium blockchain through transactions, forming a globally resolvable identity foundation.

[0044] Data Asset DID Generation: The data provider accesses the data through a data connector, calculates the data integrity hash, and generates a data identity (Data DID) by combining this hash with usage rules (e.g., downloading is not allowed, online queries are supported only; access is limited to finance department employees within the office network, etc.). The Data DID is also registered in a public verification system for verifying its origin and integrity.

[0045] Distributed Trust Anchor Node Construction (BLS Threshold Signature): The decentralized identity management module adopts a distributed trust anchor node construction scheme based on BLS threshold signature. In the consortium blockchain network, public key fragments are aggregated through a secure multi-party computation protocol to generate the system root public key. During authorization, signature fragments from at least t trust anchor nodes (each signature fragment is generated by signing the message hash using the corresponding node's private key fragment) are collected and combined to form a complete signature. This complete signature is then verified using the system root public key through a bilinear pairing operation. Specifically, the DID document generated in the previous step needs to be registered with the consortium blockchain to achieve its characteristics of public visibility, permanent storage, and immutability. This registration process must be completed through transaction submission, and the operation of submitting the DID document registration transaction to the consortium blockchain must be authorized: First, the decentralized identity management module initiates the construction of a DID document registration transaction. The transaction must include a complete signature composed of signature fragments from at least t trust anchor nodes (this signature is generated based on the BLS threshold signature scheme; each trust anchor node partially signs the registration transaction using its own private key fragments, and then aggregates them into a complete signature through a secure protocol and appends it to the transaction). After receiving a transaction, the consortium blockchain network will verify the complete signature by performing a bilinear pairing operation using the pre-set aggregate root public key (generated by aggregating public key fragments from each trusted anchor node through a secure multi-party computation protocol). Only when the signature verification passes (confirming that the signature was indeed jointly generated by a cluster of trusted anchor nodes that meet the threshold requirements) will the transaction be accepted by the consortium blockchain. The DID document will then be permanently and immutably recorded on the chain, becoming a globally resolvable and trusted identity credential.

[0046] Hybrid storage architecture: Identity and credential status index information is stored on the consortium blockchain, while detailed credential declaration data is stored off-chain in a distributed storage network.

[0047] The following explains the data connector mentioned above:

[0048] Microservice architecture: Functions such as identity management, data registration, access judgment, policy execution, behavior analysis, and audit logging are broken down into fine-grained microservices. Each service is encapsulated in a lightweight container (such as Docker), packaging its runtime environment, application code, and dependency libraries to ensure environment consistency, fast startup, and cross-platform portability.

[0049] Container deployment: Each container, especially those in the decentralized identity management module, is deployed on the edge of the existing system or on business nodes. Kubernetes provides unified scheduling and management, and supports automatic scaling.

[0050] Data Connector: A set of closely cooperating containerized microservices are logically encapsulated and presented to the outside world as a unified data connector. As the core execution component of the trusted data space, it is embedded into various business domains or data space entry points. Specifically, it is used to encapsulate and integrate the functions of the decentralized identity management module, the AI ​​dynamic trust assessment module, and the dynamic policy generation and execution module to provide unified two-way authentication, real-time trust score acquisition, and access policy generation and execution for access requests.

[0051] (2) AI Dynamic Trust Assessment Module: As the core intelligent decision-making unit of the system, it continuously collects and integrates multi-dimensional real-time data streams after identity verification, including subject behavior logs, device fingerprints, network context information, data asset sensitivity levels, threat intelligence correlation, and historical interaction records. Through a deep learning model, it performs real-time analysis and anomaly detection of subject behavior patterns, data sensitivity changes, and environmental risks to generate a comprehensive trust score based on the current session. This score is not a fixed value but is continuously updated throughout the interaction process, truly reflecting the trust level between the subject and the data at this moment and in this context. Specifically, it includes data fusion, feature engineering units, and deep learning assessment.

[0052] Data fusion: Receive and preprocess information from subject-specific dimensions such as behavior logs, device fingerprints, network context information, data asset sensitivity levels, threat intelligence correlation, and historical interaction records to construct multivariate time-series data.

[0053] Feature Engineering Unit: The data stream is segmented using a sliding window mechanism. Deep feature engineering is performed on the data within each window, calculating features including the information entropy of the behavior sequence, the Z-score normalized value of the operation frequency, and temporal difference features. These features effectively capture the dynamic changes in behavior, providing a rich information foundation for subsequent model training. The information entropy of the behavior sequence quantifies the discreteness of the subject's behavior sequence, reflecting the probability of abnormal behavior patterns. The calculation formula is as follows:

[0054]

[0055] Where H is the information entropy of the behavior sequence, and n represents the total number of behavior types within the sliding window (such as the number of different operation categories like login, query, modify, and delete). This represents the i-th specific behavior type in the behavior sequence. This represents the probability of the i-th behavior type occurring within the sliding window.

[0056] The Z-score standardization of operation frequency is used to eliminate the dimensional differences in the frequency of different behaviors, transforming the frequency into a statistic under a standard normal distribution. The calculation formula is as follows:

[0057]

[0058] Where z is the Z-score standardized value of the frequency of a certain type of behavior, x is the actual frequency of the target behavior within the current sliding window, μ represents the historical mean of the frequency of this type of behavior, and σ represents the historical standard deviation of the frequency of this type of behavior.

[0059] Temporal difference features are used to capture the changing trends of subject behavior over time, quantifying dynamic abrupt changes in behavior. The calculation formula is as follows:

[0060]

[0061] in This represents the temporal difference feature value of the t-th time window. This represents the core behavioral indicator value (such as the frequency of behavioral operations) within the t-th time window. This represents the core behavioral indicator value within the (t-1)th time window.

[0062] Deep learning evaluation: Input the feature sequence into the CNN-LSTM hybrid model, which includes three modules: CNN branch, LSTM branch, and fused output.

[0063] CNN Branch: Extracts local behavioral features and spatial correlation patterns. Specifically, the CNN branch of the model is dedicated to handling the local correlation of behavioral features in the spatial dimension. It performs convolution operations on the input feature sequence through multiple one-dimensional convolution kernels, and the process is defined as follows:

[0064]

[0065] in, This represents the convolution operation. This represents the feature vectors of l consecutive time steps from time step t-l+1 to time step t, where l is the size of the convolution kernel (e.g., if the kernel size is 3, then l = 3). This represents the weight matrix of the convolution kernel. For bias terms, This represents the output feature value of the convolution. By alternating between multiple layers of convolution and max pooling operations, CNN branches can progressively extract spatial feature representations from low to high order. These features can effectively identify abnormal operating patterns and behavioral patterns.

[0066] LSTM branch: Capturing long-term temporal dependencies and behavioral trends, it regulates information flow and memory updates through sophisticated gating mechanisms. The computation process of LSTM at each time step is as follows:

[0067]

[0068] in, It is the forget gate vector. It is the weight matrix of the forget gate. It is the bias vector of the forget gate. It is the Sigmoid activation function. It is the input vector at the current time step. It is the hidden state vector of the previous time step. It is the cell state vector from the previous time step. It is the input gate vector. It is the weight matrix of the input gate. It is the bias vector of the input gate. It is the candidate cell state vector. It is the weight matrix of the candidate cell states. It is the bias vector of the candidate cell state. It is the hyperbolic tangent activation function. It is the updated cell state vector at the current time step. It is element-wise multiplication. It is the output gate vector. It is the weight matrix of the output gate. It is the bias vector of the output gate. It is the hidden state vector at the current time step. Through this gating mechanism, LSTM can effectively capture long-term dependencies and avoid the vanishing or exploding gradient problem.

[0069] Output fusion: The two outputs are concatenated and fused to combine the spatial features of the CNN branch outputs. The final hidden state of the LSTM branch Vector concatenation is performed to form a unified deep feature representation:

[0070]

[0071] This fusion strategy leverages the strengths of both spatial feature extraction and time-series modeling to achieve a unified encoding of agent intent and data context risk, providing a more comprehensive information foundation for trust assessment. This fused feature is then incorporated into a multi-layered, fully connected neural network for the final trust score prediction.

[0072]

[0073] in, For the final real-time trust score, It is the Sigmoid activation function. The fused feature vector This is the weight matrix. This is the bias term. It is activated by the Sigmoid function. Output a real-time trust score (from 0 to 1), which is essentially a quantitative assessment of the overall credibility of the "current subject" in the "current data and environmental context".

[0074] (3) Dynamic Policy Generation and Execution Module: This module receives a comprehensive trust score and, in conjunction with the attributes of the data assets (such as sensitivity levels), automatically generates fine-grained, context-aware real-time access control policies through a policy logic model. The policies can dynamically adjust the scope of permissions, such as allowing read-only access, restricted write access, anonymized access, or real-time blocking. After policy determination, unified access control actions are implemented through distributed execution nodes to achieve real-time matching of permissions and risks. The Dynamic Policy Generation and Execution Module includes a policy engine and policy execution points.

[0075] Policy Engine: The policy engine maintains a dynamic policy rule base based on conditional judgment functions and uses the Rete algorithm to efficiently match rules and generate access control policies. The input variables for rule matching include the subject's real-time trust score and the data asset security level attribute. The access control policies include allow access (high score, low risk), deny access (extremely low score, high risk), upgrade authentication (medium score, requiring secondary verification) and permission downgrade (restricting accessible fields, reducing access frequency, and restricting write operations).

[0076] Policy Enforcement Point (PEP): Deployed at the gateway, middleware, or database access control layer, it executes access control decisions generated by the policy engine. When access is granted, the data connector processes the data locally according to data usage rules (such as field masking and returning calculation results), minimizing data exposure.

[0077] (4) Closed-loop feedback optimization module: It is used to optimize the parameter set of the deep learning model based on the policy execution effect data (whether it is blocked correctly, false alarms, system latency, etc.) to form an adaptive security closed loop: The parameters of the deep learning model are dynamically optimized through reinforcement learning algorithms so that the trust score output can maximize the long-term security benefits.

[0078] Reinforcement learning algorithms model the trust assessment process as a Markov decision process, employing the Proximal Policy Optimization (PPO) algorithm. Specifically, the trust assessment process is modeled as a Markov decision process, where the state space... Based on current fusion characteristics Composed of historical assessment records, action space Defined as a dynamic adjustment strategy for trust scores, while the reward function... It is a multi-objective composite function that integrates security incident occurrence, business operation smoothness, and system resource consumption. A near-end policy optimization algorithm is used to search for the optimal policy. The goal of optimization is to maximize the expected cumulative reward from the discount:

[0079]

[0080] in, It is a strategy The objective function is θ, where θ represents all the parameters of the deep learning model. It is the expectation operator, representing the expectation of a trajectory. Take the expected value based on its probability of occurrence. This is the summation symbol, which sums the rewards for all future time steps, starting from time step t=0. It is the instant reward obtained at time t. It's a discount factor used to balance the importance of immediate and future rewards. This is achieved through policy gradients. Perform parameter updates, where These are the parameters for the k-th iteration. These are the parameters for the (k+1)th iteration. It's the learning rate. It is the objective function Regarding the gradient of parameter θ; based on policy execution feedback (such as false alarm rate and blocking success rate), the parameters of the deep learning model are continuously optimized to make the control policy more accurate.

[0081] Based on the above system, embodiments of the present invention also disclose a zero-trust security control method based on two-way authentication of subject and data, such as... Figure 3 As shown, it includes the following steps:

[0082] Step S1, Identity Management and Two-Way Authentication: When the accessing party initiates a request, the data connector first verifies the authenticity and validity of the subject DID and data asset DID. If the verification fails, access is denied and the process ends.

[0083] Step S2, AI Dynamic Trust Assessment: After verification, the system collects multi-source data in real time, processes it through feature engineering, and inputs it into a deep learning model to generate a real-time trust score.

[0084] Step S3, Dynamic Policy and Execution: The policy engine receives the trust score, matches it with the dynamic policy rule base using the Rete algorithm, generates access control policies, and implements them by the policy execution point;

[0085] Step S4, Closed-loop feedback optimization: Collect data on the policy execution effect and dynamically optimize the parameters of the deep learning model through reinforcement learning algorithms.

[0086] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A zero-trust security system based on two-way authentication of subjects and data, characterized in that, This includes a decentralized identity management module, an AI-powered dynamic trust assessment module, a dynamic policy generation and execution module, and a closed-loop feedback optimization module. These modules work together to construct a fully closed-loop adaptive security protection system. The decentralized identity management module is used to generate and manage decentralized digital identities for the access subject and data assets respectively, and to perform two-way verification of the identities of the access subject and data assets for each access request. The AI ​​dynamic trust assessment module is used to continuously collect and integrate multi-dimensional real-time data streams after identity verification, and generate a dynamically updated comprehensive trust score through a deep learning model. The dynamic policy generation and execution module is used to generate and execute fine-grained, context-aware real-time access control policies based on comprehensive trust scores and data asset attributes. The closed-loop feedback optimization module is used to dynamically optimize the parameters of the deep learning model based on the policy execution effect data through reinforcement learning algorithms.

2. The zero-trust security system based on two-way authentication of subject and data as described in claim 1, characterized in that, The decentralized identity management module adopts a distributed trust anchor node construction scheme based on BLS threshold signatures. In the consortium blockchain network, public key fragments are aggregated through a secure multi-party computation protocol to generate the system root public key. During authorization, signature fragments from at least t trust anchor nodes need to be collected to form a complete signature. The complete signature is then verified by performing a bilinear pairing operation using the system root public key. The subject DID is generated as follows: a key pair is generated when the data connector starts. The first 20 bytes of the public key material are calculated using the Keccak-256 hash algorithm and then constructed into a decentralized identifier conforming to the W3C DID standard using Base58 encoding. The data asset DID is generated by the data provider through the data connector by calculating the data integrity hash and combining it with usage rules.

3. The zero-trust security system based on two-way authentication of subject and data as described in claim 2, characterized in that, The data connectors are deployed at the entry points of various business domains or data spaces to encapsulate and integrate the functions of the decentralized identity management module, the AI ​​dynamic trust assessment module, and the dynamic policy generation and execution module, so as to provide unified two-way authentication, real-time trust score acquisition, and access policy generation and execution for access requests.

4. The zero-trust security system based on two-way authentication of subject and data according to claim 2, characterized in that, The decentralized identity management module adopts a hybrid storage architecture, where the status index information of identity and credentials is stored on the consortium blockchain, while detailed credential declaration data is stored in an off-chain distributed storage network.

5. The zero-trust security system based on two-way authentication of subject and data according to claim 1, characterized in that, The AI ​​dynamic trust assessment module collects multi-dimensional real-time data streams including subject behavior logs, device fingerprints, network context information, data asset sensitivity levels, threat intelligence correlation, and historical interaction records. The deep learning model is a CNN-LSTM hybrid model, where the CNN branch performs convolution operations and max pooling on the input sequence through multiple one-dimensional convolution kernels to extract local behavioral features and spatial correlation patterns, and the LSTM branch captures long-term temporal dependencies and behavioral change trends through a gating mechanism. The output feature vectors of the two branches are concatenated and fused, and then input into a fully connected neural network. The activation function outputs a real-time trust score in the range of 0 to 1.

6. The zero-trust security system based on two-way authentication of subject and data according to claim 5, characterized in that, The AI ​​dynamic trust assessment module also includes a feature engineering unit, which uses a sliding window mechanism to segment the data stream and calculates the information entropy of the behavior sequence, the Z-score normalized value of the operation frequency, and the time series difference features for the data in each window.

7. The zero-trust security system based on two-way authentication of subject and data according to claim 1, characterized in that, The dynamic policy generation and execution module includes a policy engine and a policy execution point. The policy engine maintains a dynamic policy rule base based on condition judgment functions and uses the Rete algorithm to efficiently match rules and generate access control policies. The input variables for rule matching include the subject's real-time trust score and the data asset security level attribute. The policy execution point is deployed at the gateway, middleware, or database access control layer to execute access control policies generated by the policy engine, including allowing access, denying access, upgrading authentication, and downgrading permissions.

8. The zero-trust security system based on two-way authentication of subject and data according to claim 7, characterized in that, The permission downgrade includes restricting accessible fields, reducing access frequency, and restricting write operations.

9. The zero-trust security system based on two-way authentication of subject and data according to claim 1, characterized in that, The reinforcement learning algorithm models the trust assessment process as a Markov decision process. The state space consists of the current fused features and historical assessment records. The action space is defined as a dynamic adjustment strategy for the trust score. The reward function is a multi-objective composite function that integrates the occurrence of security events, the smoothness of business operations, and the consumption of system resources. A proximal policy optimization algorithm is used to search for the optimal policy. The deep learning model parameters are updated through policy gradients, with the goal of maximizing the expected discount cumulative reward.

10. A zero-trust security control method based on two-way authentication of subject and data, characterized in that, Applied to the system as described in any one of claims 1-9, comprising the following steps: Identity Management and Two-Way Authentication: When an access party initiates a request, the data connector first verifies the authenticity and validity of the subject DID and data asset DID. If the verification fails, access is denied and the process ends. AI dynamic trust assessment: After verification, the system collects multi-source data in real time, processes it through feature engineering, and then inputs it into a deep learning model to generate a real-time trust score. Dynamic policies and enforcement: The policy engine receives trust scores, matches them with the dynamic policy rule base using the Rete algorithm, generates access control policies, and implements them by the policy enforcement point; Closed-loop feedback optimization: Collect data on the effectiveness of policy execution and dynamically optimize the parameters of the deep learning model through reinforcement learning algorithms.

Images