Attribute-Based Access Control (ABAC) has become the most suitable access control method for cloud environments due to its flexibility and fine-grained advantages. However, it suffers from issues such as insufficient dynamic adaptability and a lack of risk perception capabilities. The Zero Trust Architecture (ZTA) provides a new approach to addressing these problems through continuous trust evaluation, but its high dependence on the Policy Decision Point (PDP) component in the control plane introduces new security risks. To this end, this paper proposes a Zero-Trust Access Control Model based on Attributes and dynamic user Trust scores (AT-ZTAC). The model incorporates a trust evaluation module, which quantifies the user’s trustworthiness in real time through positive trust values and negative risk values, and dynamically integrates this quantification into access decisions to achieve fine-grained, dynamic, and secure authorization. In addition, to address the single-point trust risk of the PDP component, the model adopts a BLS-based threshold signature scheme to ensure the normal operation of the control plane even under limited intrusions, while supporting decision traceability. Theoretical analysis shows that this model significantly improves the overall security of the control plane. Experiments demonstrate that AT-ZTAC outperforms comparative models in terms of trust evaluation effectiveness, access decision throughput (reaching 1850 req/s, a 54% increase compared to traditional ABAC), and access control accuracy (reaching 96.8%). Compared with traditional solutions, it has advantages in flexibility, accuracy, and efficiency, demonstrating its potential for applications in cloud environments.

To address the dual challenges of achieving high classification accuracy and real-time performance when detecting abnormal traffic in cloud environments, this study introduces an improved lightweight real-time detection model, IM-MobileNetV3. By standardizing features, dividing time windows, mapping spatially, and reshaping images, the model converts traffic features into 224 × 224 × 3RGB images, enabling multi-angle representation of traffic features and adapting to the model’s input requirements. Additionally, the MobileNet-Small model is improved by introducing the ECA module to replace the original SE module, avoiding the information loss that is often caused by channel dimension reduction, and the initial convolutional layer, bottleneck layer, and tail structure are optimized to enhance the feature extraction capability. The experimental results show that, on the CIC-IDS2018 dataset, IM-MobileNetV3 achieves an accuracy rate of 96.9%, reduces the number of parameters by 33% compared to the original model, and has a single-sample inference time of only 2.8 ms, significantly outperforming mainstream models.

The advent of Decentralized Identity (DID) technology is fundamentally changing the way digital identity is managed, allowing user-controlled, privacy-preserving authentication across trust domains a fundamental requirement if zero trust architectures are to be realized, in which continuous verification and least-privilege access are inherent properties. Under traditional ABS (attribute-based signature) schemes, these are difficult to achieve as fine-grained access control is not always possible in practice and anonymity may not be straightforward when policy is evolving dynamically and different authorities may be involved. In this paper, we present a new multi-authority attribute ring signature scheme, which leverages DID philosophy and anonymous credential techniques, enabling users to mix attributes dynamically according to the policies of veriers without disclosing their pseudonyms or partial attributes. The proposed scheme enables distributed key generation by multiple authorities and is shown to be secure in the random oracle model, achieving existential unforgeability against adaptive chosen-message, identity, and attribute attacks (EUF-CMIAA) as well as full signer and attribute anonymity. Based on the SM9 cryptographic standard, our approach reduces the number of $$\mathbb {G}_T$$ exponentiations and scalar multiplications during signing by approximately 30% compared to existing ring signatures, offering a practical and efficient authentication solution for emerging DID-driven zero-trust networks.

Intelligent systems are those in which behavior is determined by environmental inputs, and actions are taken to maximize the probability of achieving specific goals. Intelligent systems are widely applied across various fields, particularly in distributed intelligent systems. At the same time, due to the extensive interaction with user data, intelligent systems face significant challenges regarding security. This study proposes an optimized distributed key generation (DKG) scheme for identity-based cryptography (IBC) using the SM9 standard. Our scheme introduces a (t, n)-threshold system that functions without a trusted center, addressing the vulnerability of single points of failure in conventional key generation centers (KGCs). We reduce communication and computational demands by refining the Paillier share transformation protocol, ensuring efficient, centerless operations. The scheme’s security, validated in the existential unforgeability against adaptive chosen identity attacks (EUF-CIA) model, demonstrates its practical applicability and enhanced security for distributed intelligent systems.