Zero-trust cybersecurity access control system using continuous identity verification

Abstract

A system for zero-trust cybersecurity access control using continuous identity verification (100), comprising: a Policy Decision and Enforcement Orchestrator (1) configured to receive an access request from a user device and enforce a session with minimal privileges; an engine for continuous identity verification (2) configured to generate a time-dependent identity trust score by continuously verifying the user identity during an active session; a device state and telemetry collector (3) configured to acquire device state parameters, runtime signals and network telemetry and to generate a state value; a module for detecting behavioral risks and anomalies (4) that is configured to create behavioral profiles and detect anomalies based on user activity patterns, contextual signals and the history of resource access; a cryptographic authentication and secure token module (5) configured to issue and update a short-lived, bound access token associated with at least the identity trust value and the state value; and an adaptive response and microsegmentation module (6) configured to dynamically adjust access permissions, network segmentation and session privileges in real time, based on an aggregated risk assessment derived from modules (2) to (4), where the system (100) continuously reassesses trustworthiness during the session and selectively allows, restricts, requires enhanced authentication or terminates the session based on the aggregated risk assessment.

Description

INVENTION AREA

[0001] The present invention relates to cybersecurity access control. In particular, the invention relates to a zero-trust access control system that performs continuous identity verification and continuous authorization to dynamically allow, restrict, subject to enhanced authentication, or terminate access sessions based on a risk-based trust assessment. BACKGROUND OF THE INVENTION

[0002] The subject matter discussed in the "Background" section should not be considered prior art solely because it is mentioned in that section. Likewise, a problem mentioned in the "Background" section or related to the subject matter of the "Background" section should not be considered prior art. The subject matter in the "Background" section merely presents various approaches, which could themselves also be inventions.

[0003] Traditional cybersecurity access control frameworks—such as password-based login, role-based access control (RBAC), and even many modern single sign-on (SSO) implementations—typically follow a paradigm of authentication first and trust second. In such systems, once a user successfully logs in (often by providing credentials and sometimes a one-time password), the system assumes that the identity remains valid and trusted throughout the session until logout or timeout. This approach creates a critical security vulnerability because it treats authentication as a one-time event rather than a constantly evolving trust condition.

[0004] In real-world environments, access sessions are often lengthy, and the threat landscape during a session is dynamic. For example, a session can be compromised through session cookie theft, token leakage, or man-in-the-middle attacks, allowing the attacker to impersonate the user without needing to log in again. Similarly, token replay attacks can allow an attacker to reuse an authentication token from a different device or environment. In many architectures, subsequent access requests, even if the user identity was verified at login, are authorized simply because the session token remains valid, which can unintentionally extend access to an attacker who has gained control of the token.

[0005] Furthermore, the endpoint itself can become insecure after login. A user might authenticate from a functioning device, but during the session, the device could be compromised by malware, remote access trojans, keyloggers, or privilege escalation exploits. If the access control system does not continuously assess the device's health, it may continue to grant access to sensitive resources despite compromised device integrity. In modern work environments, the diversity of endpoints is significant, including personal devices under BYOD policies, unmanaged devices, public network usage, and remote work scenarios, increasing the likelihood of state changes during active sessions.

[0006] Even when multi-factor authentication (MFA) is used, it is often only performed at login or on sporadic triggers. This means that while MFA can prevent some credential-based attacks, it does not fully protect against risks where the attacker hijacks an already authenticated session, manipulates application tokens, steals browser cookies, or gains access via compromised devices. Furthermore, the user context can change over time—for example, through sudden changes in geolocation, device fingerprint, IP address, reputation, or usage patterns—indicating increased risk that a one-time MFA measure cannot address.

[0007] Modern computing environments exacerbate these problems because access is no longer limited to a single monolithic application. Users typically access a variety of distributed resources, including cloud services, microservices, internal APIs, SaaS applications, third-party integrations, and data platforms. In such distributed architectures, an attacker who compromises a session or obtains a token may attempt to move laterally to other services if fine-grained segmentation and continuous authorization are not enforced.

[0008] Zero Trust security principles are based on the premise that no user, device, application, or network segment should be considered trusted by default, even if it is within traditional corporate boundaries. With Zero Trust, trust must be explicitly established, continuously verified, and granted only to a minimum extent. This requires the access system to treat identity, device integrity, and behavioral context as time-dependent signals, not as static attributes set at login. Therefore, a true Zero Trust model requires continuous reassessment to determine whether it is still the same user, whether the device remains compliant and secure, and whether the behavior is consistent with legitimate use.

[0009] However, existing solutions often do not offer a unified mechanism that simultaneously addresses the following points in a coordinated and enforceable manner: Continuous identity verification throughout the entire session, creating time-dependent assurance that the current actor is the legitimate user; Continuous evaluation of the device's health, capturing changes in the device's security status, such as missing patches, disabled endpoint protection, integrity errors, or suspicious runtime signals; Real-time detection of behavioral anomalies, which can identify abnormal usage such as impossible journeys, abnormal data transfers, abuse of permissions, or suspicious resource access sequences; Cryptographic binding of access tokens to device / session certificates to prevent token duplication and reduce the risk of stolen tokens being reused on other devices or in other contexts; and dynamic micro-segmentation and adaptive enforcement so that, as the risk increases, the system can reduce privileges, restrict accessible services, enforce enhanced authentication, quarantine a session, or terminate access immediately, thereby minimizing the radius of damage.

[0010] In many deployments, these functions exist only as separate tools—identity providers, endpoint security, SIEM analytics, token systems, and network segmentation—without a tightly coupled rule-based feedback loop that continuously assesses risks and enforces adaptive decisions on a per-session and per-resource basis. As a result, despite seemingly “strong security controls” on paper, an organization can still be vulnerable to session hijacking, insider threats, compromised endpoints, and lateral movement.

[0011] Accordingly, there is a need for a cybersecurity system that implements continuous identity verification and continuous authorization using real-time identity trust, device health assessment and behavioral risk detection, and enforces risk-based zero-trust access control ( ) using short-lived cryptographically bound tokens and dynamic micro-segmentation across resources.

[0012] The use of any examples or illustrative phrases (e.g., "as") relating to specific embodiments serves only to better illustrate the invention and does not constitute a limitation of the otherwise claimed scope of the invention. No phrase in the description should be interpreted as referring to an unclaimed element that is essential for carrying out the invention.

[0013] The information disclosed above in this "Background" section is provided solely for a better understanding of the background of the invention and may therefore contain information that is not part of the prior art already known to a person skilled in the art in this country. SUMMARY

[0014] Before describing the systems presented here, it should be noted that this application is not limited to the specific systems and methods described, as there may be several possible embodiments not expressly presented in this disclosure. It should also be noted that the terminology used in the description serves only to describe the specific versions or embodiments and is not intended to limit the scope of this application.

[0015] In one embodiment, the invention discloses a system (100) for zero-trust cybersecurity access control using continuous identity verification.The system (100) comprises: an orchestrator (1) for deciding on policies and enforcing them for least-privilege session control; an engine (2) for continuous identity verification that generates a time-dependent identity trust score during the session; a collector (3) for device health and telemetry that generates a health score from device health and telemetry signals; a behavioral risk and anomaly detection module (4) that generates anomaly / risk outputs based on user activity patterns and contexts; a cryptographic attestation and secure token module (5) that issues and updates short-lived, bound access tokens associated with the scores and attestation outputs; and an adaptive response and micro-segmentation module (6) that dynamically adjusts permissions and network segmentation based on an aggregated risk assessment.Optionally, a session record ledger (7) stores tamper-proof session events to enable traceability and auditability.

[0016] The system (100) continuously reassesses trustworthiness and selectively allows, restricts, strengthens authentication or terminates access sessions in real time. BRIEF DESCRIPTION OF THE DRAWING

[0017] To clarify various aspects of some embodiments of the present invention, a more detailed description of the invention is given with reference to specific embodiments shown in the accompanying drawing. It is understood that this drawing represents only illustrative embodiments of the invention and is therefore not to be considered a limitation of its scope. The invention is described and explained with additional accuracy and detail using the accompanying drawing.

[0018] To make the advantages of the present invention easily understandable, a detailed description of the invention is given below in conjunction with the accompanying drawing, which, however, should not be regarded as limiting the scope of the invention to the accompanying drawing. Fig. Figure 1 shows a block diagram representation of the system (100) for zero-trust cybersecurity access control using continuous identity verification. DETAILED DESCRIPTION

[0019] The present invention relates to the system (100) for zero-trust cybersecurity access control using continuous identity verification.

[0020] Fig. shows a detailed block diagram representation of the system (100) for zero-trust cybersecurity access control using continuous identity verification.

[0021] With reference to Fig. The present invention provides a zero-trust cybersecurity access control system (100) using continuous identity verification, configured to enforce access control decisions according to a "never trust, always verify" model in enterprise, cloud, hybrid, or distributed computing environments. The system (100) can be used to protect resources such as applications, services, APIs, databases, file repositories, privileged consoles, and data platforms, and furthermore supports access scenarios involving remote work, BYOD endpoints, internal networks, and untrusted networks.

[0022] In one embodiment, the system (100) can be deployed as a centralized security service, as distributed services near enforcement points, or as a hybrid architecture where policy calculation is centralized while enforcement is distributed. The system (100) can integrate with, but is not limited to, identity providers, endpoint agents, enterprise gateways, reverse proxies, API gateways, service meshes, network controllers, and security information and event management systems, so that access requests are continuously evaluated during session creation and throughout session execution.

[0023] The system (100) comprises an orchestrator for policy decisions and enforcement (1), a continuous identity verification engine (2), a collector for device states and telemetry data (3), a behavioral risk and anomaly detection module (4), a cryptographic authentication and secure token module (5), and an adaptive response and micro-segmentation module (6). In an optional embodiment, the system (100) further comprises a session record register (7) for maintaining tamper-proof session decision records. These modules work together to continuously reassess trust during an active session and selectively allow, restrict, reinforce, quarantine, or terminate access based on a continuously calculated risk status. Orchestrator for policy decisions and enforcement (1)

[0024] The Policy Decision and Enforcement Orchestrator (1) acts as the policy brain and enforcement coordinator of the system (100). In one embodiment, the orchestrator (1) includes a policy decision point that evaluates policy rules and one or more policy enforcement points that enforce the evaluated decision at relevant gateways, endpoints, service meshes, or application boundaries. The orchestrator (1) is configured to receive an access request associated with a user identity, a device identity, a requested resource, and context parameters, and is further configured to enforce least-privilege access permissions for the session.

[0025] During operation, the orchestrator (1) evaluates policies based on risk and trust signals received from modules (2), (3), and (4), and also considers the resource sensitivity classification, the type of requested action, the authorization history, and administrative rules. The orchestrator (1) can grant access with restricted permissions, require enhanced authentication, limit the scope of accessible resources, impose additional restrictions such as read-only access, enforce request throttling, or terminate or quarantine the session if the risk exceeds predefined thresholds.

[0026] In one embodiment, the orchestrator (1) implements continuous authorization, meaning that authorization is not static for the entire session but is regularly re-evaluated at defined time intervals, upon defined number of requests, or upon event triggers such as a change in device configuration, anomaly detection, a shift in geolocation, or a token update request. Accordingly, the orchestrator (1) enforces authorization decisions as a continuously updated control loop rather than as a one-time decision. Continuous identity verification engine (2)

[0027] The continuous identity verification engine (2) is configured to continuously verify a user's identity during an active session and generate a time-dependent identity trust score. Unlike the one-time authentication at the beginning of the session, the engine (2) operates throughout the entire session to determine whether the actor currently executing the session matches the legitimate user identity.

[0028] In one embodiment, the identity trust score is generated by combining multiple identity signals, including periodic cryptographic challenge-response, device-based identity attestation, behavioral biometrics, biometric verification on supported endpoints, and contextual consistency checks such as geolocation continuity and network reputation continuity. The identity trust score can be expressed as a normalized value or as bandwidth levels representing verified, uncertain, or failed identity states.

[0029] During operation, the engine (2) outputs the identity trust score as a function of time, e.g., ICS(t), and also provides an identity status indicating whether the session continues to meet identity requirements. If the identity trust score falls below a threshold defined in the policy, the orchestrator (1) can initiate enhanced authentication, restrict permissions, reduce the scope of accessible resources, or terminate the session to prevent session takeovers, the misuse of stolen tokens, or unauthorized continued access. Device status and telemetry collector (3)

[0030] The device health and telemetry collector (3) is configured to collect device health parameters, endpoint compliance data, runtime signals, and network telemetry, and to calculate a time-dependent health value for the session. The collector (3) can receive health attestations from endpoint agents, operating system telemetry, endpoint detection and response tools, certificate and key stores, Secure Boot or Trusted Platform attestations, network monitoring sensors, and policy compliance services.

[0031] In one embodiment, the status value is calculated based on parameters including the patch status of the operating system and applications, the presence and state of endpoint security processes, certificate validity, integrity measurement results, detection of suspicious process behavior, and network indicators such as DNS anomalies or IP reputation. The collector (3) can also generate status flags that identify specific status errors, such as outdated patch status, disabled security tools, revoked certificates, device integrity errors, or untrusted network conditions.

[0032] During operation, the Collector (3) outputs the security score as a function of time, e.g., PS(t), and the security flags are provided to the Orchestrator (1) for policy evaluation. If the security state deteriorates, the System (100) can reduce the trust level without requiring a full session restart and immediately trigger restrictive controls, thus maintaining the zero-trust requirement that device integrity must be continuously assessed. Module for the detection of behavioral risks and anomalies (4)

[0033] The behavioral risk and anomaly detection module (4) is configured to monitor session activity and calculate behavioral risk based on user behavior sequences, resource access history, request patterns, timing patterns, and contextual signals. The module (4) is configured to build baseline activity models for a user, device, peer group, or resource type and then detects deviations that indicate abnormal or malicious behavior.

[0034] In one embodiment, the module (4) evaluates access frequency, inconsistencies regarding the time of day, unusual navigation patterns, anomalous command sequences, unusual API call structures, high-speed requests indicative of automated abuse, privilege escalation attempts, and data transfer patterns consistent with data exfiltration. The module (4) generates an anomaly score and / or a behavioral risk score and can also generate event descriptors such as "impossible journey," "credential stuffing behavior," "abnormal exfiltration pattern," or "abnormal privilege change request."

[0035] During operation, the module (4) continuously updates the behavioral risk scores during the session and transmits these scores to the orchestrator (1) to support enforcement actions in near real time. This allows insider threats, compromised sessions, and abuse patterns to be detected and mitigated during the session, rather than only after damage has occurred. Aggregated risk assessment and reassessment of trustworthiness

[0036] In one embodiment, the system (100) calculates an aggregated risk score R(t) by combining the identity trust score ICS(t) from the engine (2), the posture score PS(t) from the collector (3), and the anomaly score AS(t) from the module (4). The aggregation can be implemented as a weighted combination, threshold logic, policy-based assessment, or hybrid logic, the specific formula being non-restrictive as long as the aggregated risk score represents a continuously updated confidence status of the session.

[0037] In an illustrative embodiment, the aggregated risk score is calculated as R(t) = w1·(1 - ICS(t)) + w2·(1 - PS(t)) + w3·AS(t), where w1, w2, and w3 are policy-defined weights. The orchestrator (1) compares the aggregated risk score to thresholds, including a first threshold T1 associated with restrictions or enhanced authentication, and a second threshold T2 associated with termination, where T2 is higher than T1. The thresholds can be configured differently for different resource sensitivity classes.

[0038] Based on the aggregated risk assessment and the policy assessment, the system (100) selectively allows the session to continue normally, restricts permissions, invokes enhanced authentication, isolates the session into minimal segments, or terminates the session and invalidates authorization artifacts. Accordingly, trust is treated as a continuously reassessed condition rather than a static property set at login. Cryptographic authentication and secure token module (5)

[0039] The cryptographic authentication and secure token module (5) is configured to issue and update short-lived access tokens that are cryptographically protected and bound to the device and session context. In one embodiment, the module (5) issues a token that includes a token identifier, a session identifier, a device binding value derived from a certificate or attestation identity, an expiration timestamp, and trust-related parameters representing proof references or score bands, and also includes a cryptographic signature to prevent tampering.

[0040] In operation, the token is configured to be invalid if it is replayed from an unauthorized device, from a different session context, or if the proof of authentication fails verification. Module (5) updates the token only if the policy criteria are met, including the minimum acceptable identity trust score and the security score, and module (5) may require re-authentication before updating.

[0041] In one embodiment, the bound nature and short lifetime of the token reduces the attack window for stolen tokens and mitigates repetitive attacks. Furthermore, the module (5) works in conjunction with the orchestrator (1) such that token updates are denied in cases of increased risk, thereby forcing enhanced authentication or session termination under high-risk conditions. Module for adaptive response and microsegmentation (6)

[0042] The adaptive response and microsegmentation module (6) is configured to dynamically adjust the scope of access, network segmentation, and session privileges during the session based on the aggregated risk assessment and policy rules. In one embodiment, the module (6) restricts access to subsets of services, APIs, or network segments by updating the session segmentation rules, thereby limiting the possibilities for lateral movement.

[0043] In operation, the module (6) can enforce permissions per resource and per action, e.g., restrict write operations while allowing read operations, reduce bandwidth or request rates, require explicit approvals for privileged operations, or isolate a suspicious session in a limited quarantine segment. Such segmentation and restriction can be implemented using network controllers, service meshes, API gateways, reverse proxies, or endpoint firewall policies.

[0044] Even if a session is partially compromised, the system (100) reduces the blast radius by dynamically shrinking the reachable area, and the controls are continuously adapted to the evolving risks. Optional session record ledger (7)

[0045] In an optional embodiment, the system (100) includes a session record register (7) configured to store session events in a tamper-proof manner for auditability and forensic analysis. The session record register (7) can record token issuance and updates, risk assessment transitions, anomaly flags, policy decisions, enforcement actions, enhanced authentication triggers, and termination events.

[0046] In one embodiment, the ledger entries are cryptographically linked such that each entry contains a hash reference to a previous entry, thereby making unauthorized changes detectable. The ledger (7) can be stored locally, in a centralized logging infrastructure, or in a distributed audit storage system without restriction.

[0047] Accordingly, the ledger (7) enables post-incident analysis and the creation of compliance reports, while maintaining the integrity of the history of meeting decisions. Example of a work / operational process

[0048] With reference to Fig. When a user device initiates an access request to a protected resource, the orchestrator (1) receives the request along with user identity parameters, device attributes, and requested resource information. The orchestrator (1) invokes the identity verification engine (2) and the telemetry collector (3) to obtain time-dependent identity reliability and security assessments, and also receives behavioral anomaly outputs from the module (4) based on early session signals and historical baseline values.

[0049] The orchestrator (1) calculates or retrieves the aggregated risk assessment and evaluates the policy for the requested resource. If the policy allows access, the secure token module (5) issues a short-lived, bound token, and access is enforced via the orchestrator (1) and enforcement points. During the session, the identity engine (2), collector (3), and behavior module (4) continuously update their outputs, and the orchestrator (1) performs continuous authorization by re-evaluating access on a schedule and upon event triggers.

[0050] If the aggregated risk assessment exceeds the first threshold, the system (100) triggers enhanced authentication or reduces privileges, and the microsegmentation module (6) can restrict accessible services to limit lateral movement. If the aggregated risk assessment exceeds the second threshold, the orchestrator (1) terminates the session and invalidates the authorization artifacts, thus preventing further misuse. In the optional embodiment, session actions and risk transitions are recorded in the session record register (7) to provide a tamper-proof record of how the session was controlled.

[0051] Although the implementations of the invention have been described in a language specifically relating to structural features, it should be noted that the appended claims are not necessarily limited to the specific features described. Rather, the specific features are disclosed as examples of implementations of the invention. QUOTES INCLUDED IN THE DESCRIPTION

[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited non-patent literature

[0000] The Policy Decision and Enforcement Orchestrator (1) acts as the policy brain and enforcement coordinator of the system (100

[0024]

Claims

[1] A zero-trust cybersecurity access control system using continuous identity verification (100), comprising: a Policy Decision and Enforcement Orchestrator (1) configured to receive an access request from a user device and enforce a session with minimal privileges; an engine for continuous identity verification (2) configured to generate a time-dependent identity trust score by continuously verifying the user identity during an active session; a device state and telemetry collector (3) configured to acquire device state parameters, runtime signals and network telemetry and to generate a state value; a module for detecting behavioral risks and anomalies (4) that is configured to create behavioral profiles and detect anomalies based on user activity patterns, contextual signals and the history of resource access; a cryptographic authentication and secure token module (5) configured to issue and update a short-lived, bound access token associated with at least the identity trust value and the state value; and an adaptive response and microsegmentation module (6) configured to dynamically adjust access permissions, network segmentation and session privileges in real time, based on an aggregated risk assessment derived from modules (2) to (4), where the system (100) continuously reassesses trustworthiness during the session and selectively allows, restricts, requires enhanced authentication or terminates the session based on the aggregated risk assessment. [2] System (100) according to claim 1, wherein the continuous identity verification engine (2) performs continuous multi-factor verification using at least one of the following elements: biometrics, behavioral biometrics, cryptographic device binding, location consistency and challenge-response verification. [3] System (100) according to claim 1, wherein the device state and telemetry collector (3) determines the state assessment using at least one of the following elements: OS patch status, endpoint security status, certificate validity, device integrity status, process behavior and network reputation. [4] System (100) according to claim 1, wherein the behavioral risk and anomaly detection module (4) generates the aggregated risk assessment using at least one of the following methods: sequence modeling, deviation assessment, peer group comparison and historical baseline comparison, and identifies anomalies such as impossible trips, credential stuffing behavior, abnormal data exfiltration patterns or privilege expansion attempts. [5] System (100) according to claim 1, wherein the cryptographic authentication and secure token module (5) issues the short-lived, bound access token as a cryptographically signed token that is bound to at least one device identifier, one session identifier and one authentication output, such that the repetition of the token from another device or session is rejected by the policy decision and enforcement coordinator (1). [6] System (100) according to claim 1, wherein the adaptive response and microsegmentation module (6) enforces risk-based microsegmentation by dynamically restricting access to a subset of services, APIs or network segments based on the classification of resource sensitivity and the aggregated risk assessment. [7] System (100) according to claim 1, wherein the Policy Decision and Enforcement Orchestrator (1) performs continuous authorization by re-evaluating access permissions at predefined intervals, on event triggers or on a change in the Posture Score or the Identity Confidence Score. [8] System (100) according to claim 1, further comprising a session record register (7) configured to store tamper-proof session events including issued tokens, risk assessment transitions and policy decisions, wherein the session record register (7) enables the auditability of access decisions. [9] System (100) according to claim 1, wherein the system (100) performs a strengthened authentication measure when the aggregated risk assessment exceeds a first threshold, and performs an automatic termination of the session when the aggregated risk assessment exceeds a second threshold which is higher than the first threshold. [10] System (100) according to claim 1, wherein the policy decision and enforcement orchestrator (1) enforces least privilege access by issuing resource-related permissions with an expiration time, and wherein the cryptographic authentication and secure token module (5) updates the short-lived bound access token only when the identity trust score and security score meet predefined policy criteria.

Images