Dynamic micro-isolation security protection method and system based on self-sovereign identity driving

Abstract

The application belongs to the field of network space security and distributed network technology, and provides a dynamic micro-isolation security protection method and system based on self-sovereign identity driving, which constructs a context vector based on collected multi-dimensional context information when an access request is initiated, converts credentials, context and flow information into a feature vector using a feature mapping function, calculates a dynamic risk score, and determines high-risk requests using an adaptive threshold mechanism; a user generates a commitment based on attributes and constructs a zero-knowledge proof, and a verifier verifies the validity of the credentials and whether the attributes meet the policy constraints without obtaining specific attribute values, generates a final permission determination in combination with the risk score; the identity and risk state of the upper layer are mapped into the network isolation rules of the bottom layer in real time; data transmission is performed in combination with the network isolation rules, and the generated hash digest is uploaded to the block chain for storage.

Description

Technical Field

[0001] This invention belongs to the field of cyberspace security and distributed network technology, and particularly relates to a dynamic micro-segmentation security protection method and system based on self-sovereign identity. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] With the deepening of digital transformation, modern network architecture is gradually evolving from centralized to distributed and edge-based architectures. In complex network scenarios such as the Internet of Things (IoT), edge computing, and mobile ad hoc networks, the number of devices is surging and widely distributed, nodes often exhibit high dynamic mobility, and network topology changes frequently. However, this openness and dynamism also bring serious security threats.

[0004] Traditional security models based on physical perimeter defense (such as firewalls and VPNs) have serious flaws: once an edge node or terminal is compromised, attackers can exploit the "implicit trust" within the internal network to move laterally, causing chain reactions of damage to the entire network system. Furthermore, in heterogeneous network interconnection and cross-domain collaboration scenarios, links frequently face risks of intermittent connectivity, signal interference, or hijacking, making it difficult to guarantee the reliability and security of data transmission.

[0005] Currently, in large-scale distributed network architectures, the rapid dynamic evolution of network topology and the instability of communication links are key factors affecting network security and collaboration efficiency. However, existing security protection models mainly rely on static perimeter defense and centralized identity authentication. Once attackers breach the perimeter, they can exploit the "implicit trust" within the network to move laterally, causing chain reactions of damage to the entire network. Furthermore, traditional identity management solutions heavily rely on centralized servers or a single source of trust. In environments with high network latency, intermittent connections, or heterogeneous networks, authentication is easily invalidated due to connection interruptions, and they struggle to meet the dual requirements of autonomous identity control and privacy protection in cross-organizational and cross-domain collaboration. Existing zero-trust architecture identity management solutions cannot effectively adapt to highly dynamic network environments and suffer from the problem of excessive disclosure of sensitive data regarding privacy protection. Summary of the Invention

[0006] To address at least one of the technical problems mentioned above, this invention provides a dynamic micro-segmentation security protection method and system based on self-sovereign identity. It dynamically generates and distributes underlying micro-segmentation strategies based on the real-time verification results of self-sovereign identity, thereby achieving refined traffic control and breaking the current separation between identity authentication and network control.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: The first aspect of the present invention provides a dynamic micro-segmentation security protection method based on self-sovereign identity, comprising the following steps: Define a core entity set and abstract user or device access behavior to services as network flow objects; Each entity generates a decentralized identifier and a public-private key pair, submits the identifier document hash to the blockchain registration, and an authoritative institution issues verifiable credentials to the entity. When an access request is initiated, a context vector is constructed based on the collected multi-dimensional context information. The credential, context and stream information are transformed into a feature vector using a feature mapping function. A dynamic risk score is calculated, and an adaptive threshold mechanism is used to determine high-risk requests. For access requests that require access permission determination, users generate commitments based on attributes and construct zero-knowledge proofs. The verifier verifies the validity of the credentials and whether the attributes meet the policy constraints without obtaining the specific attribute values. The verifier determines the corresponding verification strength based on the dynamic risk score and generates the final permission determination by combining the zero-knowledge proof verification results, access policy compliance, and dynamic risk score. Generate executable network isolation rules based on authentication results, dynamic risk scores, and access policies; A session key is generated based on the context, and an authentication and encryption mechanism is used to bind the context tag for data transmission. The generated hash digest is then uploaded to the blockchain for evidence storage.

[0008] Furthermore, the core entity set is defined to include the user set. A collection of devices or agents A collection of services or resources Network node set Micro-isolation domain set ; User or device access behavior to services is abstracted into network flow objects. Its structure is represented as: ,in, Indicates the source of access. Indicate the target of the visit. For communication protocol type, For port number, This is a collection of contextual information used to describe the environmental state at the time the access occurred.

[0009] Furthermore, the collected multidimensional context includes timestamps. Location or network topology status ,Role Data sensitivity Equipment posture or compliance .

[0010] Furthermore, the formula for calculating the dynamic risk score is as follows: , in, Indicates the user or entity that initiated the current access request. This represents the Sigmoid function. It is a weight vector, representing the importance of each feature in risk assessment, and a risk score. The value ranges from 0 to 1, with values ​​closer to 1 indicating higher risk. Represents the feature mapping function voucher Contextual information and flow information Transform it into an eigenvector.

[0011] Furthermore, when using an adaptive threshold mechanism to determine high-risk requests, historical risk scores are considered. The distribution of data is dynamically updated to determine the high-risk threshold. , is represented as: , in, and These represent the risk assessment threshold for the next time step, updated based on the current historical risk score distribution, and the risk assessment threshold used at the current time step, respectively. It's the learning rate. It is the first of the risk scores Quantiles This represents the set of risk scores obtained within a preset historical time window up to time t.

[0012] Furthermore, the network isolation rule is a traffic forwarding control rule compiled from higher-level identity / access policies and context labels, which can be executed by the SDN controller, host, or gateway, and is expressed as follows: Where m is the 5-tuple matching field, a is the processing action, and prio is the priority; ALLOW is when the policy is satisfied, DENY is when it is not satisfied, or rate limiting is performed, and then the rule is sent to the SDN controller or host side.

[0013] Furthermore, the method also includes a decentralized on-chain notarization and governance phase, whereby all critical operations are notarized on-chain via smart contracts to form an audit chain. A second aspect of the invention provides a dynamic micro-segmentation security protection system driven by self-sovereign identity, comprising: The entity and request layer is used for users or devices to initiate access requests and provides decentralized identifiers and verifiable credentials. The core service and control layer includes an identity and verifiable credential management module and a policy and risk controller. The identity and verifiable credential management module is used to interact with the blockchain to perform identity verification and credential status query. The policy and risk controller is used to collect context information, calculate dynamic risk scores and generate dynamic micro-segmentation policies. The blockchain network layer serves as a distributed trust anchor for decentralized identifier registration, verifiable credential status query, policy notarization, and audit log recording. The execution layer includes a network isolation executor and a micro-segmentation domain. The network isolation executor has a built-in software-defined network controller or policy compiler, which is used to compile high-level policies into network forwarding flow tables and deploy them to the micro-segmentation domain to perform fine-grained flow control.

[0014] A third aspect of the present invention provides a computer-readable storage medium.

[0015] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the self-sovereign identity-driven dynamic micro-segmentation security protection method described above.

[0016] A fourth aspect of the present invention provides a computer device.

[0017] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the steps of the self-sovereign identity-driven dynamic micro-segmentation security protection method described above.

[0018] Compared with the prior art, the beneficial effects of the present invention are: This invention establishes a real-time mapping mechanism between self-sovereign identity and network micro-segmentation strategies, achieving proactive, in-depth defense through "authentication equals isolation." This effectively solves the core technical problems of traditional micro-segmentation technologies' inability to adapt to high-speed dynamic topologies and the disconnect between identity authentication and network control in large-scale distributed networks. Therefore, it provides a secure, efficient, and privacy-controlled identity and network integration governance solution for highly dynamic, complex, and heterogeneous network environments.

[0019] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0020] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0021] Figure 1This is a flowchart of a dynamic micro-segmentation security protection method based on self-sovereign identity driven by an embodiment of the present invention; Figure 2 This is a collaborative security protection mechanism based on distributed heterogeneous networks provided in the embodiments of the present invention; Figure 3 This is a dynamic micro-segmentation security protection system framework based on self-sovereign identity driven by embodiments of the present invention. Detailed Implementation

[0022] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0023] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0024] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0025] This invention proposes a dynamic micro-segmentation security protection method based on self-sovereign identity, which effectively solves the core technical problems of traditional micro-segmentation technology's inability to adapt to high-speed dynamic topologies and the separation of identity authentication and network control in large-scale distributed networks. This invention achieves proactive, in-depth defense through the establishment of a real-time mapping mechanism between self-sovereign identity and network micro-segmentation strategies, enabling "authentication equals isolation." Its significant advantages are as follows: First, it breaks through the limitations of traditional static micro-segmentation that relies on fixed IPs or topologies, innovatively using identity credentials as the root trust source for generating network isolation rules. It leverages semantic context awareness technology to integrate multi-dimensional features such as spatiotemporal location and network quality in real time to drive risk assessment, enabling security policies to adapt to drastic network node movements and environmental changes. Second, through an identity-driven dynamic micro-segmentation architecture, it compiles and distributes upper-layer authentication results as SDN flow table rules for the underlying network in real time. Once an identity expires or the risk increases, the isolation boundary is immediately adjusted, effectively preventing attackers from using "implicit trust" to move laterally within the network. Furthermore, this invention uses blockchain as a distributed trust anchor to solve the trust barrier in policy execution during cross-domain collaboration, and integrates zero-knowledge proof technology to minimize the disclosure of sensitive information. Therefore, it provides a secure, efficient, and privacy-controlled identity and network integration governance solution for highly dynamic, complex, and heterogeneous network environments.

[0026] Example 1 This invention provides a dynamic micro-segmentation security protection method based on self-sovereign identity. It aims to construct a proactive defense system that adapts to highly dynamic topologies, supports cross-domain collaboration, and ensures privacy and security by combining decentralized identity management, semantic context-aware dynamic risk assessment, fine-grained micro-segmentation policy execution, and trusted blockchain notarization. The method comprises seven parts: system initialization, decentralized identity and credential generation, semantic context-aware dynamic risk assessment, zero-knowledge proof-based minimum disclosure authentication, identity-driven dynamic micro-segmentation and policy execution, adaptive encryption and on-chain auditing, and decentralized on-chain notarization and governance.

[0027] like Figure 1 As shown, the dynamic micro-segmentation security protection method based on self-sovereign identity driving specifically includes the following steps: Step 1: System initialization phase: Define the core entity set, and abstract the user or device access behavior to the service as network flow objects; In this embodiment, a core entity set is defined: Let For user collection, For a collection of devices or agents, For a collection of services or resources, For a set of network nodes, It is a set of micro-isolation domains.

[0028] User or device access behavior to services is abstracted into network flow objects. Its structure is represented as: , in, Indicates the source of access. Indicate the target of the visit. For communication protocol type, For port number, This is a collection of contextual information used to describe the environmental state at the time the access occurred: , in, These represent timestamps, geographic location / network access points, roles, data sensitivity, device compliance, and behavioral deviations, respectively.

[0029] Step 2: Decentralized Identity and Credential Generation Stage: Each entity generates a decentralized identifier and a public-private key pair, submits the identifier document hash to the blockchain registration, and an authoritative institution issues verifiable credentials to the entity; Specifically, the steps include the following: Step 201: Each entity generates a decentralized identifier. and public / private key pairs; Let entity The private key is The public key is ; Entities construct their decentralized identifier (DID) documents ,in, Representing entities Decentralized identifier, Indicates the entity used for verification The identity authentication information for controlling this decentralized identifier. Representation and entity Associated server endpoint information.

[0030] Step 202: Submit the identifier document hash to the blockchain registration; Through smart contracts The identifier document hash value is submitted to the blockchain for registration and stored in the DIDReg structure. All DID registrations and updates are confirmed through the blockchain's consensus mechanism to prevent single points of failure and tampering. A decentralized identifier representing the entity to be registered. This represents the hash value of the DID document corresponding to the decentralized identifier.

[0031] Step 203: Subsequently, the authoritative body issues a verifiable certificate to the entity. It contains a set of attributes of the entity (such as its organization, task permissions, etc.). The entity stores credentials in a local security unit to achieve self-sovereign management of its identity.

[0032] Step 3: Semantic Context Awareness and Dynamic Risk Assessment Stage: When an access request is initiated, a context vector is constructed based on the collected multi-dimensional context information. The credential, context, and stream information are transformed into feature vectors using a feature mapping function. A dynamic risk score is calculated, and an adaptive threshold mechanism is used to determine high-risk requests. Specifically, the steps include the following: Step 301: When an access request is initiated, construct a context vector based on the collected multidimensional context information; In this embodiment, multi-dimensional contextual information, including timestamps, is collected using semantic awareness technology. Location / Network Topology Status ,Role Data sensitivity Equipment attitude / compliance Wait, construct context vectors .

[0033] Step 302: Use the feature mapping function to convert the voucher, context and flow information into feature vectors, and calculate the dynamic risk score; For the currently arriving access requests, within the time window Internal collection of the context track associated with the access request This characterizes the environmental state changes of the access request within the most recent time window and serves as the temporal input for subsequent feature mapping and dynamic risk scoring. This indicates the length of the time window for collecting contextual information. Indicates at time The collected context sample vector associated with the current access request.

[0034] Simultaneously utilize the feature mapping function voucher Contextual information and flow information Transform it into a feature vector and calculate a dynamic risk score. : , in, This indicates the user / entity corresponding to the current access request. This represents the Sigmoid function. This is a weight vector, representing the importance of each feature in risk assessment. Risk Score The value ranges from 0 to 1, with the closer the value is to 1, the higher the risk.

[0035] Step 303: Use an adaptive threshold mechanism to determine high-risk requests; In this embodiment, if dynamic risk scoring Risk scoring threshold If so, the access request is considered a high-risk request; To adapt to this dynamic change in the network environment, the system adopts an adaptive threshold mechanism based on historical risk scores. The distribution of data is dynamically updated to determine the high-risk threshold. : , in, and These represent the risk assessment threshold for the next time step, updated based on the current historical risk score distribution, and the risk assessment threshold used at the current time step, respectively. It's the learning rate. It is the first of the risk scores Quantiles This represents the set of risk scores obtained within a preset historical time window up to time t. Step 4: Minimum Disclosure Authentication Stage Based on Zero-Knowledge Proof: For access requests to be granted access permission, the user generates a commitment based on the attribute to be verified and constructs a zero-knowledge proof. The verifier verifies the validity of the credential and whether the attribute meets the access policy constraints without obtaining the specific value of the attribute. The corresponding verification strength is determined based on the dynamic risk score obtained in Step 3, and the final permission determination is generated by combining the zero-knowledge proof verification result, the access policy satisfaction status, and the dynamic risk score. To protect user privacy and reduce the exposure of sensitive data on unreliable communication links, this embodiment employs zero-knowledge proofs for selective disclosure. For access requests requiring access permission determination, the user generates a commitment based on the attribute to be verified and constructs a zero-knowledge proof. The verifier verifies the validity of the credential and whether the attribute satisfies access policy constraints without obtaining the specific value of the attribute. Specifically: Users do not send plaintext attributes directly, but rather based on attributes Generate commitments and construct zero-knowledge proofs. : , in, This represents a zero-knowledge proof generation algorithm. Indicates the generation of the first The random blinding factor used when committing to an attribute. This represents the set of attribute constraint predicates to be proven. Represents the common parameters of a zero-knowledge proof system. Without obtaining specific attribute values, the verifier checks the validity of the credential and whether the attributes meet the policy constraints using the following verification function. : , Then, based on the dynamic risk score obtained in step 3, the corresponding verification strength is determined, and the final permission decision is generated by combining the zero-knowledge proof verification results, access policy satisfaction, and dynamic risk score, as expressed as: Combined with risk score Based on the zero-knowledge proof results, the system generates the final permission decision. : , in, This represents the semantic permission determination result obtained by policy verification based on entity identity information, verifiable credentials, context information, and network flow information. Representing entities Decentralized identity documents, This indicates the current risk tolerance threshold.

[0036] Specifically, when the dynamic risk score reaches the high-risk condition, the requirements for attribute proof or context proof are increased, or the access request is denied or isolated.

[0037] Step 5: Identity-driven dynamic micro-segmentation and policy enforcement phase: Generate executable network isolation rules based on authentication results, dynamic risk scores, and access policies; In this embodiment, the network isolation rule is a data plane traffic control rule deployed on a software-defined network controller, network node, or gateway device. It is used to determine the matching conditions, processing actions, and execution priorities of specific access traffic, and to control the access traffic to be allowed, blocked, rate-limited, or isolated through the network isolation rule.

[0038] For example, network isolation rules are traffic forwarding control rules compiled from higher-level identity / access policies and context labels, which can be executed by the SDN controller or host / gateway, and take the following form: Where m is the 5-tuple matching field, a is the processing action, and prio is the priority; ALLOW is when the policy is satisfied, DENY is when it is not satisfied, and rate limiting or other processing can also be performed. Then the rules are sent to the SDN controller or host side.

[0039] Specifically, the steps include the following: Step 501: Generate a context label bound to the stream; Generate a context label bound to the stream. The tag is encrypted and bound to the source node. and target node micro-isolation domain Risk level: , in, Represents a cryptographic hash function. Indicates the source node The micro-isolation domain to which it belongs after dynamic partitioning Represents the target node The micro-isolation domain to which it belongs after dynamic partitioning.

[0040] Step 502: Tag-based Compile and generate SDN (Software-Defined Networking) flow table rules The switching modules that distribute the data to network nodes (or gateway devices) are then configured to handle the data. , in, Match the five-tuple fields (source IP, destination IP, source port, destination port, protocol type). It is a stream processing operation. It refers to the priority of the rules.

[0041] In addition, the micro-isolation domain partitioning function is dynamically adjusted based on the risk score. This ensures that only traffic conforming to a specific semantic context can flow between isolated domains, achieving "authentication equals isolation".

[0042] Step 6: Adaptive Encryption and On-Chain Auditing Phase: Generate a session key based on the context, use an authentication encryption mechanism to bind the context tag for data transmission, and upload the generated hash digest to the blockchain for evidence storage; At the data transmission layer, a mechanism combining attribute-based encryption and authentication encryption is employed. The system generates session keys based on the context. and with context labels Binding: , This ensures that even if data is intercepted, it cannot be decrypted if the context (such as time or location) does not match. Finally, all access decisions, cross-domain policy changes, and critical operation logs generate hash digests. And uploaded to the blockchain for evidence storage via smart contract: , This enables full-process traceability and non-repudiation in cross-domain collaboration.

[0043] Step 7: Decentralized On-Chain Evidence Preservation and Governance Phase: All key operations are recorded on the blockchain through smart contracts to form an audit chain; All critical operations are recorded on the blockchain via smart contracts. Identity registration contract records. With document hashing; credential revocation and contract update Strategic Arbitration Contract Resolve cross-domain conflicts. Audit logs generate hash values:

[0044] And it is written into the blockchain to form an audit chain. This ensures that all access activities are traceable and non-repudiable.

[0045] Example 2 like Figure 2The diagram illustrates a collaborative security protection mechanism based on a distributed heterogeneous network. It depicts the overall network architecture, including a distributed network access layer, data transmission links, and a core management layer. The distributed network access layer comprises mobile nodes / edge devices, inter-node links, and edge computing payloads; the core management layer includes a management center, control center, data center, user terminals, and blockchain storage nodes. The diagram highlights the interaction flow of the network isolation layer, semantic communication and perception layer, and policy control layer. These layers work together to achieve risk assessment, micro-segmentation, and dynamic policy adjustment. Specifically, network nodes interact with data through dynamic links, the ground control center deploys smart contracts for identity registration and auditing, and blockchain nodes act as distributed trust anchors, ensuring transparency and tamper resistance in cross-domain collaboration. This mechanism collects information such as orbital phase and link quality through semantic context awareness, generates dynamic risk scores, and drives the micro-segmentation gateway to adjust the isolation domain boundaries, achieving proactive defense through "authentication equals isolation."

[0046] like Figure 3 As shown, this embodiment provides a dynamic micro-segmentation security protection system driven by self-sovereign identity, detailing the complete interaction logic from user-initiated requests to the underlying network executing security isolation. The system is divided into four logical layers from top to bottom: the entity and request layer, the core service and control layer, the blockchain network layer, and the execution layer, including: The entity and request layer is used to enable users or devices to initiate access requests to target services / resources and provides decentralized identifiers and verifiable credentials; During this process, users / devices need to provide decentralized identifiers and verifiable credentials. If the current environment is highly sensitive, the system may also require users to provide additional contextual proofs (optional), such as the device's security status or location information.

[0047] The core service and control layer includes an identity and verifiable credential management module and a policy and risk controller. The identity and verifiable credential management module is used to interact with the blockchain to perform identity verification and credential status query. The policy and risk controller is used to collect context information, calculate dynamic risk scores and generate dynamic micro-segmentation policies. After the request enters the core service and control layer, the identity and verifiable credential management module intervenes first. This module is responsible for receiving the credentials submitted by the user and interacting with the blockchain network layer to perform registration / query. and State operations. By querying immutable records on the blockchain, the validity of the user's identity and whether the credentials have been revoked are confirmed. Simultaneously, the blockchain network layer is also responsible for checking logs and storage / retrieval policies to ensure the traceability of all operations.

[0048] After successful authentication, the relevant information is passed to the policy and risk controller. This controller contains a context acquisition and risk assessment module and a policy engine. The system dynamically assesses access behavior based on real-time collected environmental context (such as time and link quality). The policy engine generates dynamic policy decisions based on the assessment results and preset security rules.

[0049] The blockchain network layer serves as a distributed trust anchor for providing decentralized identifier registration, verifiable credential status queries, dynamic micro-segmentation strategies, and audit log recording. The execution layer includes a network isolation executor and a micro-segmentation domain. The network isolation executor has a built-in software-defined network controller or policy compiler, which is used to compile high-level policies into network forwarding flow tables and deploy them to the micro-segmentation domain to perform fine-grained flow control.

[0050] The generated policy decisions and security rules are distributed to the execution layer. The network isolation executor (with a built-in SDN controller / policy compiler) receives the higher-level policies, compiles them into specific network forwarding flow tables, and these flow tables are deployed in micro-segmentation domains to form specific isolation rules.

[0051] Within the micro-segmentation domain, the system implements policy enforcement instructions to perform fine-grained control (such as allowing, blocking, or isolating) of traffic between users / devices and services / resources. Access request / response data streams can only be transmitted normally between the isolation domains when identity, risk score, and network policy are fully matched, thus achieving a deep integration of identity security and network control.

[0052] It should be noted that the specific implementation of the self-sovereign identity-driven dynamic micro-segmentation security protection system in this embodiment of the invention is similar to the specific implementation of the self-sovereign identity-driven dynamic micro-segmentation security protection method in this embodiment of the invention. For details, please refer to the description in the method section. To reduce redundancy, it will not be repeated here.

[0053] Example 3 This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the self-sovereign identity-driven dynamic micro-segmentation security protection method described above.

[0054] Example 4 This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps in the self-sovereign identity-driven dynamic micro-segmentation security protection method described above.

[0055] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0056] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0057] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0058] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0059] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0060] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A dynamic micro-segmentation security protection method based on self-sovereign identity driven, characterized in that, Includes the following steps: Define a core entity set and abstract user or device access behavior to services as network flow objects; Each entity generates a decentralized identifier and a public-private key pair, submits the identifier document hash to the blockchain registration, and an authoritative institution issues verifiable credentials to the entity. When an access request is initiated, a context vector is constructed based on the collected multi-dimensional context information. The credential, context and stream information are transformed into a feature vector using a feature mapping function. A dynamic risk score is calculated, and an adaptive threshold mechanism is used to determine high-risk requests. For access requests that require access permission determination, users generate commitments based on attributes and construct zero-knowledge proofs. The verifier verifies the validity of the credentials and whether the attributes meet the policy constraints without obtaining the specific attribute values. The verifier determines the corresponding verification strength based on the dynamic risk score and generates the final permission determination by combining the zero-knowledge proof verification results, access policy compliance, and dynamic risk score. Generate executable network isolation rules based on authentication results, dynamic risk scores, and access policies; A session key is generated based on the context, and an authentication and encryption mechanism is used to bind the context tag for data transmission. The generated hash digest is then uploaded to the blockchain for evidence storage.

2. The dynamic micro-segmentation security protection method based on self-sovereign identity as described in claim 1, characterized in that, The core entity set is defined to include the user set. A collection of devices or agents A collection of services or resources Network node set Micro-isolation domain set ; User or device access behavior to services is abstracted into network flow objects. Its structure is represented as: ,in, Indicates the source of access. Indicate the target of the visit. For communication protocol type, For port number, This is a collection of contextual information used to describe the environmental state at the time the access occurred.

3. The dynamic micro-segmentation security protection method based on self-sovereign identity as described in claim 1, characterized in that, The collected multidimensional context includes timestamps Location or network topology status ,Role Data sensitivity Equipment posture or compliance .

4. The dynamic micro-segmentation security protection method based on self-sovereign identity as described in claim 1, characterized in that, The formula for calculating dynamic risk score is: ， in, Indicates the user or entity that initiated the current access request. This represents the Sigmoid function. It is a weight vector, representing the importance of each feature in risk assessment, and a risk score. The value ranges from 0 to 1, with values ​​closer to 1 indicating higher risk. Represents the feature mapping function voucher Contextual information and flow information Transform it into an eigenvector.

5. The dynamic micro-segmentation security protection method based on self-sovereign identity as described in claim 1, characterized in that, When using an adaptive threshold mechanism to determine high-risk requests, historical risk scores are used. The distribution of data is dynamically updated to determine the high-risk threshold. , is represented as: ， in, and These represent the risk assessment threshold for the next time step, updated based on the current historical risk score distribution, and the risk assessment threshold used at the current time step, respectively. It's the learning rate. It is the first of the risk scores Quantiles This represents the set of risk scores obtained within a preset historical time window up to time t.

6. The dynamic micro-segmentation security protection method based on self-sovereign identity as described in claim 1, characterized in that, The network isolation rules are traffic forwarding control rules compiled from higher-level identity / access policies and context labels, and can be executed by the SDN controller, host, or gateway, as follows: Where m is the 5-tuple matching field, a is the processing action, and prio is the priority; ALLOW is when the policy is satisfied, DENY is when it is not satisfied, or rate limiting is performed, and then the rule is sent to the SDN controller or host side.

7. The dynamic micro-segmentation security protection method based on self-sovereign identity as described in claim 1, characterized in that, The method also includes a decentralized on-chain evidence storage and governance phase, where all key operations are stored on the chain through smart contracts to form an audit chain.

8. A dynamic micro-segmentation security protection system driven by self-sovereign identity, characterized in that: include: The entity and request layer is used for users or devices to initiate access requests and provides decentralized identifiers and verifiable credentials. The core service and control layer includes an identity and verifiable credential management module and a policy and risk controller. The identity and verifiable credential management module is used to interact with the blockchain to perform identity verification and credential status query. The policy and risk controller is used to collect context information, calculate dynamic risk scores and generate dynamic micro-segmentation policies. The blockchain network layer serves as a distributed trust anchor for decentralized identifier registration, verifiable credential status query, policy notarization, and audit log recording. The execution layer includes a network isolation executor and a micro-segmentation domain. The network isolation executor has a built-in software-defined network controller or policy compiler, which is used to compile high-level policies into network forwarding flow tables and deploy them to the micro-segmentation domain to perform fine-grained flow control.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the self-sovereign identity-driven dynamic micro-segmentation security protection method as described in any one of claims 1-7.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the self-sovereign identity-driven dynamic micro-segmentation security protection method as described in any one of claims 1-7.

Images