Zero trust access algorithms
A method includes converting the data into attributes. The method includes applying the attributes to a binary decision model. The binary decision module is configured to output a first access approval or a first access denial based on one more preventive measures decision algorithms. The method includes, in response to the binary decision model outputting a first approval, applying the data to a secondary discreet model. The secondary discreet model is configured to output a score based on one or more detective measures algorithms. The method includes comparing the score to an access threshold. The method includes outputting a second access approval or a second access denial based on comparing the score to the access threshold.
1 . A method for zero-trust access control, comprising:
determining, for each of three or more computer systems, data representing the operational state of the three or more computer systems;
converting, for each of three or more computer systems, the data into binary attributes for each of three or more computer systems, the binary attributes comprising the following: AuthN, No Self-Signed Certificate, No Forged Certificate, Confidentiality, Integrity Check, Key Exchange, Non-Repudiation, Digital Signature, Encryption Data At Rest, Encryption Data In Transit, Encryption Data In Use, Citizenship, Releasable To, Time, Location, Password Complexity, Steganography, Chain Of Custody, Secure Download/Upload, and Deep Inspection;
applying, for each of three or more computer systems, the attributes to a binary decision model for preventive measures, wherein the binary decision module is configured to output, for each of three or more computer systems and using the respective attributes, a binary decision model output that is either a first access approval or a first access denial, the binary decision module using the following Logical Function (LF):
LF (AuthN/No Self-Signed Certificate/No Forged Certificate)∧(Confidentiality∧Integrity Check∧Key Exchange∧Non-Repudiation∧Digital Signature/Encryption Data At Rest∧Encryption Data In Transit∧Encryption Data In Use)∧(Citizenship A Releasable To A Time∧Location)∧(Password Complexity∧Steganography∧Chain Of Custody∧Secure Download/Upload∧Deep Inspection)==>the binary decision model output);
determining, for a first computer system in the three or more computer systems, that the binary decision model output the first access denial;
determining, for a second computer system and a third computer system in the three or more computer systems, that the binary decision model output the first access approval;
in response to the binary decision model outputting the first access approval, applying, for each of the second computer system and the third computer system in the three or more computer systems, the data to a secondary discreet model for detective measures, wherein the secondary discreet model is configured to output a score, the secondary discreet model comprising each of the following procedural methods:
a granular tree structure, eigenvalue extraction using the QR algorithm for filtering outliers, risk inputs, a figure of merit (FoM), a floor function, and a square matrix formulation of experts' opinions, the square matrix formulation using the equation:
[
E
]
t
=
[
[
O
]
]
×
[
W
]
t
,
where: E 1 . . . E n are experts, W 1 . . . W n are weights, O 11 . . . O nn are the opinions from the experts about the weights,
wherein the inputs to the secondary discreet model are discrete attribute scores in the range of [0.0-1.0];
converting, for each of the second computer system and the third computer system in the three or more computer systems, the data into discreet attributes for each of the second computer system and the third computer system in the three or more computer systems, the discreet attributes comprising the following:
System Review Test (SRT); Privacy Threshold Assessment (PTA); Controls; Interim Authorization To Test (IATT); Security Assessment Plan (SAP); Self-Testing; Independent Testing; Security Assessment Report (SAR); Plan of Action and Milestones (POAM); Authorization To Operate (ATO); Vulnerabilities of level: Critical, High, Medium, and Low; Continuous Monitoring (ConMon); Risk Assessment; Continuous Assessment; POAM Aging at periods of: >30 days, >60 days, >90 days, and >120 days; Auditing; Hunting; and Forensics;
in response to outputting, for each of the second computer system and the third computer system in the three or more computer systems, the score, comparing the score to an access threshold using a Weighted Average Function (WAF) of:
WAF (SRT; PTA; Controls; IATT; SAP; Self-Testing; Independent Testing; SAR; POAM; ATO; Vulnerabilities of level: Critical, High, Medium, and Low; ConMon; Risk Assessment; Continuous Assessment; POAM Aging at periods of: >30 days, >60 days, >90 days, and >120 days; Auditing; Hunting; and Forensics);
in response to comparing the score, determining that the score for the second computer system in the three or more computer systems is less than the access threshold;
in response to comparing the score, determining that the score for the third computer system in the three or more computer systems is greater than or equal to the access threshold;
in response to determining that the score for the second computer system in the three or more computer systems is less than the access threshold, outputting a second access denial;
in response to determining that the score for the third computer system in the three or more computer system is greater than or equal to the access threshold; outputting a second access approval; and
performing, for each of three or more computer systems, the zero-trust access control based on one of: the first access denial, the second access approval, or the second access denial.