CN115587374B - Dynamic access control method and control system based on trust value - Google Patents
Dynamic access control method and control system based on trust value Download PDFInfo
- Publication number
- CN115587374B CN115587374B CN202211176094.9A CN202211176094A CN115587374B CN 115587374 B CN115587374 B CN 115587374B CN 202211176094 A CN202211176094 A CN 202211176094A CN 115587374 B CN115587374 B CN 115587374B
- Authority
- CN
- China
- Prior art keywords
- user
- trust
- evidence
- trust value
- value
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 32
- 230000006399 behavior Effects 0.000 claims abstract description 81
- 238000012544 monitoring process Methods 0.000 claims abstract description 31
- 239000011159 matrix material Substances 0.000 claims description 25
- 238000004364 calculation method Methods 0.000 claims description 12
- 230000006870 function Effects 0.000 claims description 7
- 238000011156 evaluation Methods 0.000 claims description 6
- 230000003542 behavioural effect Effects 0.000 claims description 4
- 230000005540 biological transmission Effects 0.000 claims description 4
- 230000004044 response Effects 0.000 claims description 4
- 238000000691 measurement method Methods 0.000 claims description 3
- 238000012545 processing Methods 0.000 claims description 3
- 206010000117 Abnormal behaviour Diseases 0.000 claims description 2
- 238000007726 management method Methods 0.000 description 13
- 238000009825 accumulation Methods 0.000 description 5
- 238000001514 detection method Methods 0.000 description 5
- 230000008569 process Effects 0.000 description 4
- 238000012550 audit Methods 0.000 description 3
- 230000008859 change Effects 0.000 description 2
- 208000036119 Frailty Diseases 0.000 description 1
- 241000700605 Viruses Species 0.000 description 1
- 230000002159 abnormal effect Effects 0.000 description 1
- 206010003549 asthenia Diseases 0.000 description 1
- ZPUCINDJVBIVPJ-LJISPDSOSA-N cocaine Chemical compound O([C@H]1C[C@@H]2CC[C@@H](N2C)[C@H]1C(=O)OC)C(=O)C1=CC=CC=C1 ZPUCINDJVBIVPJ-LJISPDSOSA-N 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000007613 environmental effect Effects 0.000 description 1
- 238000013507 mapping Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000010606 normalization Methods 0.000 description 1
- 238000012795 verification Methods 0.000 description 1
- 239000002699 waste material Substances 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/604—Tools and structures for managing or administering access control systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
- G06F17/10—Complex mathematical operations
- G06F17/16—Matrix or vector computation, e.g. matrix-matrix or matrix-vector multiplication, matrix factorization
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Software Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- Mathematical Physics (AREA)
- Mathematical Analysis (AREA)
- Data Mining & Analysis (AREA)
- Pure & Applied Mathematics (AREA)
- Computational Mathematics (AREA)
- Mathematical Optimization (AREA)
- Health & Medical Sciences (AREA)
- Computing Systems (AREA)
- Automation & Control Theory (AREA)
- Bioethics (AREA)
- Algebra (AREA)
- General Health & Medical Sciences (AREA)
- Databases & Information Systems (AREA)
- Storage Device Security (AREA)
Abstract
The invention provides a dynamic access control method based on a trust value and a control system thereof, which relate to the technical field of computer authority management and access control and comprise the following steps: the user logs in the system, and the system acquires the initial credit of the user; judging whether the initial reliability is within an initial reliability threshold range or not; when the user performs access operation, the system performs double monitoring on the user at the same time, including monitoring user behavior and monitoring trust, monitors and calculates the real-time trust and user trust of the user, and judges whether the user is in the trust threshold range; after the user safely and completely performs one access operation, the system calculates the final trust degree of the user, and the user exits the access operation. The dynamic access control method not only monitors the user trust degree during dynamic monitoring, but also increases the monitoring of the user operation behaviors, and implements multi-standard monitoring of the user behaviors.
Description
Technical Field
The invention belongs to the technical field of computer authority management and access control, and particularly relates to a dynamic access control method and a control system based on a trust value.
Background
With the continuous innovation of access control technology, on the basic framework of RBAC and ABAC, some new elements of access control security are introduced, and various aspects of access control resource security in a cloud computing distributed environment are more comprehensively considered, wherein the common aspects include trust evaluation, user behavior evaluation and cross-domain access.
Trust or confidence is a concept derived from sociology, representing a dependency, a very abstract concept, and not defined in detail. The confidence level is a subjective judgment after quantifying the behavior of the entity object, and the entity object has better confidence only under the condition that the behavior becomes good. In the access control process, the credit is an abstract concept, but in order to evaluate and measure the trust, the trust must be quantized into a trust value, namely, a trust degree, and the trust is an intuitive interval value with a set range, and the specific size can be set according to the actual application scene. The trust level value is changed according to the change of the environment, and the operation of the user is closely related to the trust level change. The degree of trust is often accompanied by real-time performance, i.e. the degree of timeliness of the behavior or operation changes of the user, and if the behavior of the user cannot be reflected in real time, the degree of trust cannot reflect the behavior of the user well.
In a cloud computing distributed environment, in order to prevent resource idling or waste, resources or services in the cloud can provide services for users in other domains, and then when access control operation is performed, local domain operation and cross-domain operation can occur. Taking the OpenStack cloud computing management platform as an example, when implementing cross-domain access operation, besides user authentication of a user, namely user name and password verification, other security judgment conditions need to be added, such as the user trust level and the like, the records of the resource access operation of the user in other domains are used as references, the cross-domain operation provides effective data, meanwhile, the similarity between domains can be judged according to the environmental characteristics between domains, the evaluation and judgment of the cross-domain access operation are weighted, the influence between the same time domain and the domain is mutual, the access operation of the user in a non-local domain can influence the credit value of the user in the original domain, so that the access control is finer in granularity and the judgment is more accurate.
In the prior art, the OpenStack only realizes a basic RBAC model, namely, a basic mapping relation between a user and a role and between the role and the authority is simply related, and obviously, the access control model cannot meet the access control requirement in a cloud computing distributed environment. Mainly has the following problems:
(1) Cross-domain problem
The distributed characteristics of cloud computing determine that the access operation of a user cannot be singly completed in a certain domain, the user logs in and operates resources in the cloud after finishing user authentication in the certain domain, and according to the resource scheduling and distribution of a cloud platform, the user can access the resources in other domains after logging in the local domain, so that the cross-domain operation needs to be considered.
(2) Monitoring standard single
Each role in the role-based access control of the OpenStack has corresponding authority, the system gives the user corresponding authority according to the information of the user, so that the user has the corresponding access authority, but the access control is simple, and the access operation under the complex cloud environment can not be well processed.
(3) Keystone object attribute singleness
The object attribute in the OpenStack is only role, user, group, domain, project and single in attribute, and can not achieve finer-granularity access operation monitoring.
Therefore, the relevant fields of the user trust attribute are required to be added, the user trust is monitored in cooperation with the monitoring, the monitoring of the user operation behavior is also increased, and the safety of resources is protected.
Disclosure of Invention
Based on the above problems, the invention discloses a dynamic access control method and a control system based on a trust value.
In order to achieve the above purpose, the present invention provides the following technical solutions:
a dynamic access control method based on trust values comprises the following steps:
s1, user U i Providing an access request to the system for the kth time, and verifying the identity of the user by the system;
s2, the system acquires an initial trust value TA (ui) of the user k The initial trust value TA (ui) k Including cross-domain direct trust value T ak And inter-domain trust value T bk ；
S3, judging whether or notThe method meets the following conditions: TA (ui) k TA (rs) is not less than or equal to the threshold value of the trust value, if not, the user is refused to continue to access, and if so, the user is allowed to access, and S4 is entered;
s4, judging the initial trust value TA (ui) k The user function access authority is given to the initial trust level;
s5, the system monitors the operation behaviors of the user in real time, obtains the evidence of the user behaviors, and calculates the current trust value TA (rt) of the user k Determining the current trust level of a user in real time, and distributing operation and access rights according to the current trust level;
s6, after the user safely and completely performs one access operation, the system acquires the current trust value and defines the current trust value as the final trust value TA (fi) of the user k The user exits the access operation, wherein T is the time when the (k+1) th time an access request is made to the system ak+1 ＝TA(fi) k 。
Preferably, the current trust value TA (rt) of the user when the user performs the access operation k The calculation method of (1) is as follows:
obtaining user behaviors, and dividing the user behaviors into n characteristics, wherein each characteristic comprises a plurality of evidences, and m is defined as the maximum value of the corresponding evidence quantity in the characteristics;
all evidence types are normalized, and a fuzzy matrix A= { a is established ij } n×m Wherein 0.ltoreq.a ij ≤1；
Obtaining an initial judgment matrix EQ= (EQ) by nine-level measurement method ij ) m×m ；
Converting the initial judgment matrix EQ into a fuzzy consistent matrix Q= (Q) ij ) m×m Wherein
Calculating weight vector ω= (w) of m pieces of evidence of the ith feature 1 ，w 2 ，…，w m ) T ；
According to the evidence matrix e= (E ij ) n×m And weight matrix w= (W ij ) m×n Calculate b=e×w T Values on the diagonal of the matrix B are acquired, and a characteristic evaluation value matrix f= (F) 1 ,f 2 ,…,f n )；
Calculating the user's current trust value TA (rt) k ，
Preferably, the characteristics include at least risk characteristics and performance characteristics, the risk characteristics including at least guest resources, resource vulnerabilities and threat behaviors.
Preferably, the threat behaviors at least comprise abnormal behaviors, default behaviors and malicious behaviors, threat levels of the threat behaviors are judged according to the dangerous severity of user operation, and standardized values of the threat behaviors of the user are obtained according to the threat levels of the user operation;
the evidence data form of the performance characteristics comprises a percentage form and a fixed numerical value form, and the standardized method is as follows: for the evidence data form of the percentage form, taking the original value by the standardized value;
and dividing the evidence data form of the determined numerical form into positive evidence, negative evidence, fixed evidence and interval evidence, and respectively carrying out standardization.
Preferably, the inter-domain trust value T bk The calculation method of (1) is as follows:
acquiring all cloud service providers C= { C accessed by users 1 ，c 2 ，…，c s J-th cloud facilitator to user U i Is T (c) j ，U i ) Then
Wherein T is j To the jth cloud clothesThe number of successful accesses in the business.
Preferably, the initial trust value TA (ui) k The calculation method of (1) is as follows:
TA(ui) k ＝α×T ak +β×T bk
wherein, alpha+beta=1, and alpha and beta respectively represent the proportion of the cross-domain trust value and the inter-domain trust value.
Preferably, a trust level g= (1, 2, …, q) is set, if t h ≤TA(ui) k ≤t h+1 Wherein
t h 、t h+1 And (1) h is equal to or more than q-1 and is the minimum value and the maximum value of a level trust value interval, and the trust level of the user is h.
Preferably, if user U i If no access requirement is set, the user has basic reference authority.
The invention also provides a dynamic access control system based on the trust value,
the system comprises an authentication sub-module, a user behavior monitoring sub-module and a trust management sub-module;
the authentication submodule is used for verifying the identity of the user and according to the initial trust value TA (ui) of the user k And a current trust value TA (rt) k Judging whether the trust value threshold is met or not, and giving the user function access authority and the allocation operation authority;
the user behavior monitoring submodule is used for monitoring the access behavior and operation of a user, acquiring the user behavior evidence and carrying out standardized processing;
and the trust management submodule is used for calculating and updating the initial trust value and the current trust value of the user according to the user behavior evidence.
Preferably, the trust management submodule comprises an evidence database, an operation center and a user management database, wherein the evidence database is used for acquiring the user behavior evidence from the user behavior monitoring submodule, the operation center is used for calculating and updating the initial trust value and the current trust value of the user, and the user management database is used for storing the current trust degree in different time sub-segments of the user.
Compared with the prior art, the invention has the following advantages:
the invention provides a dynamic access control method based on a trust value, which carries out trust degree weighted calculation according to user information and the previous trust degree of a user after the user logs in a system, monitors the trust degree of the user during dynamic monitoring, increases the monitoring of user operation behaviors, and implements multi-standard monitoring of the user behaviors. Once the time high-risk behavior is monitored, the user is directly forced to exit the system, so that the safety of resources is protected, and the credit accumulation can still be carried out by the traditional method, so that the multi-standard monitoring is higher in safety and instantaneity.
Drawings
FIG. 1 is a flow chart of a method of the present invention for dynamic access control based on trust values.
Detailed Description
In order that those skilled in the art will better understand the present invention, a technical solution in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in which it is apparent that the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the present invention without making any inventive effort, shall fall within the scope of the present invention.
It is noted that the terms "comprises" and "comprising," and any variations thereof, in the description and claims of the present invention and in the foregoing figures, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed or inherent to such process, method, article, or apparatus.
Firstly, in order to facilitate understanding of the embodiments of the present invention, the general design concept of the technical scheme is introduced:
after a user logs in the OpenStack platform, the system determines whether the user has permission to operate the resources to which access is applied according to the user credit, if the permission is insufficient, the user is prompted to log out, if the permission is met, the user can perform corresponding access operation on the object resources, in the operation process, the system can dynamically monitor the user behavior and calculate the real-time credit, and when the user behavior or the user credit does not meet the requirement, the user is forced to log out of the system. After each operation is completed, the system comprehensively judges the inter-domain reference trust level and the historical trust level according to the initial trust level of the user, calculates the final trust level of the user, and stores the final trust level as the user trust level when the user logs in next time.
As shown in fig. 1, the invention discloses a dynamic access control method and a control system based on trust values, and the complete access flow is as follows:
s1, user U i Providing an access request to the system for the kth time, and verifying the identity of the user by the system;
s2, the system acquires an initial trust value TA (ui) of the user k The initial trust value TA (ui) k Including cross-domain direct trust value T ak And inter-domain trust value T bk ；
Wherein the cross-domain direct trust value T ak Is in fact the final trust value TA (fi) of the end of the last access k-1 The method comprises the steps of carrying out a first treatment on the surface of the The inter-domain trust value T bk The calculation method of (1) is as follows:
acquiring all cloud service providers C= { C accessed by users 1 ，c 2 ，…，c s J-th cloud facilitator to user U i Is T (c) j ，U i ) Then
Wherein T is j For the number of successful accesses in the jth cloud facilitator.
S3, judging whether the following conditions are met: TA (ui) k TA (rs) is not less than or equal to the threshold value of the trust value, if not, the user is refused to continue to access, and if so, the user is allowed to accessThe user performs access operation and enters the next step;
s4, judging the initial trust value TA (ui) k The user function access authority is given to the initial trust level;
s5, the system monitors the operation behaviors of the user in real time, obtains the evidence of the user behaviors, and calculates the current trust value TA (rt) of the user k Determining the current trust level of a user in real time, and distributing operation and access rights according to the current trust level;
when the user performs access operation, the current trust value TA (rt) of the user k The calculation method of (1) is as follows:
obtaining user behaviors, dividing the user behaviors into n characteristics, wherein each characteristic comprises a plurality of user behavior evidences, each evidence can be obtained through software and hardware detection, and m is defined as the maximum value of the corresponding evidence quantity in the characteristic;
all evidence types are normalized, and a fuzzy matrix A= { a is established ij } n×m Wherein 0.ltoreq.a ij ≤1；
Obtaining an initial judgment matrix EQ= (EQ) by nine-level measurement method ij ) m×m The method comprises the steps of carrying out a first treatment on the surface of the To obtain an initial judgment matrix Eq= (EQ) ij ) mm Constructing a comparison matrix between every two elements, determining relative weights in the target,
converting the initial judgment matrix EQ into a fuzzy consistent matrix Q= (Q) ij ) m×m Wherein
Calculating weight vector ω= (w) of m pieces of evidence of the ith feature 1 ，w 2 ，…，w m ) T Wherein, the method comprises the steps of, wherein,
according to the moment of evidenceMatrix e= (E) ij ) n×m And weight matrix w= (W ij ) m×n Calculate b=e×w T Values on the diagonal of the matrix B are acquired, and a characteristic evaluation value matrix f= (F) 1 ,f 2 ,…,f n )；
Calculating the user's current trust value TA (rt) k ，
Wherein W is f ＝(w f1 ，w f2 ，…，w fn ) Is a weight of the user behavior characteristics.
The current method for obtaining the user behavior evidence mainly comprises the following steps: by using the existing intrusion detection systems such as RealSecur, snort and the like, the intrusion detection system has the functions of intrusion detection, behavior audit, flow statistics and the like, can detect malicious behaviors such as hacking, waxy worm attack, port scanning and the like, acquire the illegal connection times of users, try the illegal override times, scan the important port times, average attack times of other users and the like. The existing network traffic detection tools such as Band-widthd can be used for detecting IP anomaly rate of the user and checking the behavior evidence of the network state of the user. And by using a special network data acquisition tool such as a switch NetFlow Tracker and the like, the behavior evidences such as the network bandwidth occupancy rate of the user and the average virus carrying number of the user can be acquired in real time. System event records such as audit records, system logs, various data packets intercepted by a network management log, application logs, corresponding behavior operation records and the like generated by an audit and tracking system of the server.
The characteristics include at least risk characteristics including at least guest resources, resource vulnerabilities, and threat behaviors, and performance characteristics including at least memory occupancy, response time, and transmission speed.
Aiming at the risk characteristics, the estimated user behavior evidence is object resources, resource vulnerability and threat behaviors; the value of the object resource in the cloud service provider represents the importance of the object resource, and is proportional to the grade of the object resource, and the higher the importance is, the higher the grade is. The guest resource class specifications are shown in tables 1 and 2:
TABLE 1 guest resource class table
TABLE 2 guest resource class Table
| Grade | Resource category g | Description of the invention |
| 1 | Portal resources | Daily messages such as announcements in portals, page displays, etc |
| 2 | Application software | Daily software for players, calendars, notepads, etc |
| 3 | Shared resources | Data resources shared between users or tenants |
| 4 | System resources | Databases, networks, operating systems, etc |
| 5 | Infrastructure of | Storage resource pool, server resource, and the like infrastructure |
Resource vulnerability is mainly a security hidden trouble of representing software or application in a cloud platform, a system back door and the like. The higher the level of guest resources, the more serious the threat to the resources, as shown in tables 3 and 4:
TABLE 3 guest resource vulnerability rating Table
| Guest resource vulnerability level | Object resource vulnerability | Quantized value |
| W1 | Is very fragile | 0-0.1 |
| W2 | Is very fragile | 0.2-0.3 |
| W3 | Is weaker | 0.4-0.5 |
| W4 | Frailty of | 0.6-0.7 |
| W5 | Is generally fragile | 0.8-0.9 |
TABLE 4 guest resource vulnerability class description Table
| Grade | Description of the invention |
| 1 | The threat to the resources is small and can be ignored |
| 2 | Little harm to resources |
| 3 | Hazard to resources is generally severe |
| 4 | Severe harm to resources |
| 5 | The harm to resources is very serious |
The threat actions of the user on the object resources mainly comprise abnormal actions, illegal actions and malicious actions, and the more serious the threat actions are, the higher the level is, and the specific actions are shown in the table 5 and the table 6.
TABLE 5 operational threat level Table
| Operational risk level | Threat severity | Quantized value |
| A1 | Is very serious | 0-0.1 |
| A2 | Is very serious | 0.2-0.3 |
| A3 | More serious | 0.4-0.5 |
| A4 | Has little influence | 0.6-0.7 |
| A5 | Negligible | 0.8-0.9 |
TABLE 6 user behavior type List
The performance characteristics at least comprise memory occupancy rate, response time, transmission speed and the like, wherein the performance characteristics comprise two evidence data forms of percentage and determined value.
Assume that the initial behavioral evidence vector obtained is a= (a) 1 ,a 2 ,a 3 ,…,a n ) The normalized behavioural evidence vector is e= (E) 1 ,e 2 ,…,e n ) The normalization rule is as follows:
evidence data forms for percentage forms, such as memory occupancy, etc., since the data is already in [0,1]Within the scope, then directly define e i ＝a i ；
Aiming at the evidence data forms of the determined numerical form, such as response time, transmission speed and the like, the evidence data forms are divided into positive evidence, negative evidence, fixed evidence and interval evidence; the evidence with a larger value is called positive evidence, the evidence with a smaller value is called negative evidence, and the value is closer to a certain fixed value (set as mu i ) The better the index, the more the fixed evidence; the closer the value is to or falls within a certain fixed interval (set as [ D ] i1 ,D i2 ]) The better the index, called the interzone evidence, the normalized formula is:
initial trust value TA (ui) k The calculation method of (1) is as follows:
TA(ui) k ＝α×T ak +β×T bk
wherein, alpha+beta=1, and alpha and beta respectively represent the proportion of the cross-domain trust value and the inter-domain trust value.
Setting trust level g= (1, 2, …, q), if t h ≤TA(ui) k ≤t h+1 Wherein
t h 、t h+1 (h is more than or equal to 1 and less than or equal to q-1) is a level trust value intervalThe user's trust level is h.
If user U i If the access requirement is not proposed, the user has basic reference authority, and can reference the resources which can be checked by the common user.
S6, after the user safely and completely performs one access operation, the system acquires the current trust value and defines the current trust value as the final trust value TA (fi) of the user k The user exits the access operation, wherein T is the time when the (k+1) th time an access request is made to the system ak+1 ＝TA(fi) k 。
The invention also provides a dynamic access control system based on the trust value, which comprises an authentication sub-module, a user behavior monitoring sub-module and a trust management sub-module;
the authentication submodule is used for verifying the identity of the user and according to the initial trust value TA (ui) of the user k And a current trust value TA (rt) k Judging whether the trust value threshold is met or not, and giving the user function access authority and the allocation operation authority; the user behavior monitoring submodule is used for monitoring the access behavior and operation of the user, acquiring the evidence of the user behavior and carrying out standardized processing, and when the user behavior monitoring submodule monitors the user behavior, whether the user behavior is illegal or malicious or not can be dynamically judged, and if yes, the user is directly forced to exit the access operation. If not, continuing to monitor; and the trust management submodule is used for calculating and updating the initial trust value and the current trust value of the user according to the user behavior evidence.
The trust management submodule comprises an evidence database, an operation center and a user management database, wherein the evidence database is used for acquiring user behavior evidence from the user behavior monitoring submodule, the operation center is used for calculating and updating the initial trust value and the current trust value of the user, and the user management database is used for storing the current trust degree in different time sub-segments of the user.
The invention provides an improved access control method and device based on trust degree: after the user performs access operation in the non-local domain, the user credibility is recorded. And combining the relation between the domains, adding the credibility of the non-local domain through the inter-domain credibility correlation coefficient to be used as a recommendation credibility parameter in the historical credibility calculation of the user in the domain. After the user logs in the system, different values are distributed according to the previous trust degree of the user to carry out trust degree weighted calculation, namely under the condition of safe operation, the trust degree accumulation is slower when the trust degree is smaller than the initial trust degree of the user, and normal trust degree accumulation is not given until the trust degree is higher than the initial trust degree, and compared with the traditional method, the trust degree accumulation is slower; when the user operation is dynamically monitored, different behavior levels are determined according to the user behavior, different credit weighting values are given, the higher the operation risk is, the faster the trust degree decays, and meanwhile, the shorter the monitored time slice is. During dynamic monitoring, not only is the user trust monitored, but also the monitoring of the user operation behavior is increased, and multi-standard monitoring of the user behavior is implemented. Once the time high-risk behavior is monitored, the user is directly forced to exit the system, so that the safety of resources is protected, and the credit accumulation can still be carried out by the traditional method, so that the multi-standard monitoring is higher in safety and instantaneity.
The foregoing is a description of embodiments of the invention, which are specific and detailed, but are not to be construed as limiting the scope of the invention. It should be noted that it will be apparent to those skilled in the art that several variations and modifications can be made without departing from the spirit of the invention, which are all within the scope of the invention.
Claims (5)
1. A dynamic access control method based on trust values is characterized in that: the method comprises the following steps:
s1, user U i Providing an access request to the system for the kth time, and verifying the identity of the user by the system;
s2, the system acquires an initial trust value TA (ui) of the user k The initial trust value TA (ui) k Including cross-domain direct trust value T ak And inter-domain trust value T bk ；
The inter-domain trust value T bk The calculation method of (1) is as follows:
acquiring all cloud service providers C= { C accessed by users 1 ，c 2 ，…，c s J-th cloud facilitator to user U i Is T (c) j ，U i ) Then
Wherein T is j The number of successful access times in the jth cloud service provider;
initial trust value TA (ui) k The calculation method of (1) is as follows:
TA(ui) k ＝α×T ak +β×T bk
alpha+beta=1, and alpha and beta respectively represent the proportion of the cross-domain trust value and the inter-domain trust value;
s3, judging whether the following conditions are met: TA (ui) k TA (rs) is not less than or equal to the threshold value of the trust value, if not, the user is refused to continue to access, and if so, the user is allowed to access, and S4 is entered;
s4, judging the initial trust value TA (ui) k The user function access authority is given to the initial trust level;
s5, the system monitors the operation behaviors of the user in real time, obtains the evidence of the user behaviors, and calculates the current trust value TA (rt) of the user k Determining the current trust level of a user in real time, and distributing operation and access rights according to the current trust level;
when the user performs access operation, the current trust value TA (rt) of the user k The calculation method of (1) is as follows:
acquiring user behaviors, and dividing the user behaviors into n characteristics, wherein the characteristics at least comprise risk characteristics and performance characteristics; the risk characteristics at least comprise object resources, resource vulnerability and threat behaviors, and the performance characteristics at least comprise memory occupancy rate, response time and transmission speed; each characteristic comprises a plurality of evidences, and m is defined as the maximum value of the corresponding evidence quantity in the characteristic; the threat behaviors at least comprise abnormal behaviors, default behaviors and malicious behaviors, threat levels of the threat behaviors are judged according to the dangerous severity of user operation, and standardized values of the threat behaviors of the user are obtained according to the threat levels; the evidence data form of the performance characteristics comprises a percentage form and a fixed numerical value form, and the standardized method is as follows:
assume that the initial behavioral evidence vector obtained is a= (a) 1 ,a 2 ,a 3 ,…,a n ) The normalized behavioural evidence vector is e= (E) 1 ,e 2 ,…,e n )，
Defining e for evidence data form in percentage form i ＝a i ；
Aiming at the evidence data form of the fixed numerical form, the evidence data form is divided into positive evidence, negative evidence, fixed evidence and interval evidence, and the standard data form is standardized respectively, wherein the standardized formula is as follows:
wherein the fixed evidence indicates that the value is closer to a fixed value mu i The better the index of the present invention,
the interval evidence indicates that the closer the value is to or falls within the fixed interval [ D ] i1 ,D i2 ]The better the index;
all evidence types are normalized, and a fuzzy matrix A= { a is established ij } n×m Wherein 0.ltoreq.a ij ≤1；
Obtaining an initial judgment matrix EQ= (EQ) by nine-level measurement method ij ) m×m ；
Converting the initial judgment matrix EQ into a fuzzy consistent matrix Q= (Q) ij ) m×m Wherein
Calculating m certificates of the ith featureWeight vector ω= (w) 1 ，w 2 ，…，w m ) T ；
According to the evidence matrix e= (E ij ) n×m And weight matrix w= (W ij ) m×n Calculate b=e×w T Values on the diagonal of the matrix B are acquired, and a characteristic evaluation value matrix f= (F) 1 ,f 2 ,…,f n )；
Calculating the user's current trust value TA (rt) k ，
Wherein W is f ＝(w f1 ，w f2 ，…，w fn ) Is the weight of the user behavior characteristics;
s6, after the user safely and completely performs one access operation, the system acquires the current trust value and defines the current trust value as the final trust value TA (fi) of the user k The user exits the access operation, wherein T is the time when the (k+1) th time an access request is made to the system ak+1 ＝TA(fi) k 。
2. A trust value based dynamic access control method according to claim 1, wherein:
setting trust level g= (1, 2, …, q), if t h ≤TA(ui) k ≤t h+1 Wherein t is h 、t h+1 And (1) h is equal to or more than q-1 and is the minimum value and the maximum value of a level trust value interval, and the trust level of the user is h.
3. A trust value based dynamic access control method according to claim 1, wherein:
if user U i If no access requirement is set, the user has basic reference authority.
4. A trust value based dynamic access control system, characterized by:
for implementing a trust value based dynamic access control method according to any one of claims 1-3;
the system comprises an authentication sub-module, a user behavior monitoring sub-module and a trust management sub-module;
the authentication submodule is used for verifying the identity of the user and according to the initial trust value TA (ui) of the user k And a current trust value TA (rt) k Judging whether the trust value threshold is met or not, and giving the user function access authority and the allocation operation authority;
the user behavior monitoring submodule is used for monitoring the access behavior and operation of a user, acquiring the user behavior evidence and carrying out standardized processing;
and the trust management submodule is used for calculating and updating the initial trust value and the current trust value of the user according to the user behavior evidence.
5. A trust value based dynamic access control system according to claim 4 and wherein:
the trust management submodule comprises an evidence database, an operation center and a user management database, wherein the evidence database is used for acquiring user behavior evidence from the user behavior monitoring submodule, the operation center is used for calculating and updating the initial trust value and the current trust value of the user, and the user management database is used for storing the current trust degree in different time sub-segments of the user.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211176094.9A CN115587374B (en) | 2022-09-26 | 2022-09-26 | Dynamic access control method and control system based on trust value |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211176094.9A CN115587374B (en) | 2022-09-26 | 2022-09-26 | Dynamic access control method and control system based on trust value |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN115587374A CN115587374A (en) | 2023-01-10 |
| CN115587374B true CN115587374B (en) | 2023-12-08 |
Family
ID=84773311
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211176094.9A Active CN115587374B (en) | 2022-09-26 | 2022-09-26 | Dynamic access control method and control system based on trust value |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115587374B (en) |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111431843A (en) * | 2019-01-10 | 2020-07-17 | 中国科学院电子学研究所 | Access control method based on trust and attribute in cloud computing environment |
| CN113159866A (en) * | 2021-05-13 | 2021-07-23 | 北京计算机技术及应用研究所 | Method for building network user trust evaluation model in big data environment |
-
2022
- 2022-09-26 CN CN202211176094.9A patent/CN115587374B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111431843A (en) * | 2019-01-10 | 2020-07-17 | 中国科学院电子学研究所 | Access control method based on trust and attribute in cloud computing environment |
| CN113159866A (en) * | 2021-05-13 | 2021-07-23 | 北京计算机技术及应用研究所 | Method for building network user trust evaluation model in big data environment |
Non-Patent Citations (3)
| Title |
|---|
| 余波.云计算环境下基于属性和信任的RBAC模型研究.计算机工程与应用.2020,第84-92页. * |
| 宋国峰 等.一种基于用户行为信任的云安全访问控制模型.中国管理科学.2013,第669-676页. * |
| 陈彦竹.云计算环境下数据安全访问控制机制研究.中国优秀硕士学位论文全文数据库信息科技辑.2018,(第第2期期),第I138-164页. * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN115587374A (en) | 2023-01-10 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| TWI595375B (en) | Anomaly detection using adaptive behavioral profiles | |
| US9992213B2 (en) | Risk-adaptive access control of an application action based on threat detection data | |
| CN113347205B (en) | Method and device for detecting service access request | |
| RU2510982C2 (en) | User evaluation system and method for message filtering | |
| CN111953679A (en) | Intranet user behavior measurement method and network access control method based on zero trust | |
| CN112966245A (en) | Power grid information system access control method and system based on information measurement | |
| CN112583810B (en) | Zero trust method for context-based virtual network | |
| Krautsevich et al. | Risk-aware usage decision making in highly dynamic systems | |
| US8225407B1 (en) | Incident prioritization and adaptive response recommendations | |
| CN112737824A (en) | User trust measurement method in zero-trust SDN network | |
| CN116915515B (en) | Access security control method and system for industrial control network | |
| Daoud et al. | A model of role-risk based intrusion prevention for cloud environment | |
| CN115587374B (en) | Dynamic access control method and control system based on trust value | |
| CN115632884B (en) | Network security situation perception method and system based on event analysis | |
| CN115065512B (en) | Account login method, system, device, electronic equipment and storage medium | |
| CN114189383B (en) | Method, apparatus, electronic device, medium and computer program product for blocking | |
| Yang et al. | Research on way of evaluating cloud end user behavior's credibility based on the methodology of multilevel fuzzy comprehensive evaluation | |
| CN117254918A (en) | Zero trust dynamic authorization method and device, electronic equipment and readable storage medium | |
| CN115879156A (en) | Dynamic desensitization method, device, electronic equipment and storage medium | |
| Xi et al. | Quantitative threat situation assessment based on alert verification | |
| CN115022008A (en) | Access risk assessment method, device, equipment and medium | |
| Abercrombie et al. | Managing complex IT security processes with value based measures | |
| Shi et al. | Continuous trust evaluation of power equipment and users based on risk measurement | |
| CN109981600B (en) | Security assessment system for website reinforcement | |
| Neto et al. | Untrustworthiness: A trust-based security metric |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| CB02 | Change of applicant information |
Address after: 523000 one of 614, building A1, Tian'an Digital City, No. 1, Huangjin Road, Nancheng District, Dongguan City, Guangdong Province Applicant after: Guangdong Del Smart Technology Co.,Ltd. Applicant after: Guangdong Deyan Intelligent Technology Co.,Ltd. Address before: 523000 one of 614, building A1, Tian'an Digital City, No. 1, Huangjin Road, Nancheng District, Dongguan City, Guangdong Province Applicant before: GUANGDONG DEER SMART FACTORY TECHNOLOGY CO.,LTD. Applicant before: Guangdong Deyan Intelligent Technology Co.,Ltd. |
|
| CB02 | Change of applicant information | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |