Data access method and device based on software defined boundary

Abstract

According to the data access method and device based on the software-defined boundary, the software-defined boundary controller and the micro-service gateway are combined and independently run outside the gateway, safety protection of continuous evolution can be achieved in an infinite extension mode, and the safety of the micro-service gateway is improved. And more security support is provided for the system under the micro-service architecture. Through establishment of black and white list verification, device authentication, user identity authentication and user authority authentication, only legal devices and users can access resources in a multi-level manner. And after the verification is passed, the access request is subjected to flow limiting control, so that network congestion and resource abuse caused by excessive requests are prevented. And comparing the access feature data with the behavior feature data by using a comparison engine, and detecting and preventing potential attack behaviors and risk operations in time. The risk level of the access request is calculated through the pre-trained risk assessment model, the high-risk access flow is intercepted and recorded, and potential threats are effectively controlled.

Description

Technical Field

[0001] The present invention relates to the field of data communication technology, and in particular to a data access method and device based on software-defined boundaries. Background Art

[0002] Due to the rapid development of the Internet, more and more enterprises or organizations want their business systems to appear on the Internet in some way. They deploy firewalls / NAT devices between the internal network and the Internet to divide security domains and create internal security zones, isolation zones, and untrusted areas (Internet). However, as the needs of enterprises or organizations become more complex, they may have internal networks, remote offices, mobile terminals, and cloud services at the same time, which results in the enterprise or organization having no single, identifiable boundary, and the "zero trust" network architecture is born.

[0003] As a popular system architecture, the microservice framework is adopted by many enterprises or organizations. It is highly practical and easy to expand. The gateway in the microservice framework is responsible for checking and protecting the access to API (application programming interface) services. It is also the last line of defense for the business system of an enterprise or organization in a "zero trust" network. Improving the security of the gateway in the microservice architecture will undoubtedly improve the security of the system. However, the existing technology lacks a clear network data access solution to use the gateway to build a microservice framework to achieve a "zero trust network." Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a data access method and device based on software-defined boundaries to eliminate or improve one or more defects existing in the prior art and solve the problem of how to combine the software-defined boundary architecture and the microservice gateway to realize the construction of a zero-trust network architecture for the business system.

[0005] One aspect of the present invention provides a data access method based on a software-defined boundary, the method is used to run on a software-defined boundary gateway, the software-defined boundary gateway includes a software-defined boundary controller and a microservice gateway, the software-defined boundary gateway connects a client and a server, and the method includes the following steps:

[0006] The microservice gateway serves as an access layer to receive an access request sent by a client, wherein the access request is marked with the device information and user information of the client; the device information includes an IP address, a device identifier, and device space information; the user information includes a user identity identifier and permission information;

[0007] The access layer performs a blacklist and whitelist check on the device information and the user information, and performs flow control and audit management on the access request if the check passes;

[0008] The software-defined boundary controller acts as a control layer to perform authentication management on the device information and the user information, including device authentication, user identity authentication and user authority authentication. If the authentication is successful, the access flow corresponding to the access request is preprocessed, access feature data and behavior feature data are divided, and data serialization and vectorization are performed; the access feature data and the behavior feature data are handed over to the comparison engine, and the access feature data is compared with the data in the preset local network attack feature library for similarity, and abnormal access with attack behavior is checked, and the behavior feature data is compared with the data in the preset local personal behavior portrait library for similarity, and abnormal access with risky operations is checked; if there is no abnormal access, the access flow is handed over to the pre-trained risk assessment model to calculate the risk level, and the access flow belonging to high risk is intercepted and marked as accessible and recorded in the log, otherwise it is forwarded to the server by the microservice gateway as the distribution layer.

[0009] In some embodiments, the flow limiting management includes: counting the access requests, rejecting or queuing the access flows that exceed the set threshold, limiting the number of requests and smoothing the flow; the audit management includes: collecting external logs and obtaining the analysis engine.

[0010] In some embodiments, the method also includes: obtaining the latest standard network attack feature library based on a first preset link, and updating the local network attack feature library according to a first preset time node; obtaining the latest standard personal behavior portrait library based on a second preset link, and updating the local personal behavior portrait library according to a second preset time node; and the comparison engine uses cosine similarity or Euclidean distance for similarity comparison.

[0011] In some embodiments, the risk assessment model training step includes:

[0012] Obtaining a training sample set, the training sample set includes multiple sample access flows and annotates risk levels, the risk levels include normal, low risk, medium risk and high risk;

[0013] Performing data cleaning on the sample access stream to fill in missing values ​​and remove outliers;

[0014] An initial neural network model is obtained, the initial neural network model is trained using the training sample set, and a cross entropy loss is constructed to update model parameters to obtain the risk assessment model; the initial neural network model includes: a decision tree, a random forest, a support vector machine or a convolutional neural network.

[0015] In some embodiments, the method also includes: storing the access flows and their corresponding risk levels generated during the operation in a local database, and incorporating the access flows and risk levels in the local database as samples into the training sample set at preset time intervals, and using the merged training sample set to train and update the risk assessment model.

[0016] In some embodiments, the method further comprises:

[0017] The distribution layer performs load balancing to balance the requests distributed to the backend services;

[0018] The distribution layer performs routing management and distributes data according to the preferred path;

[0019] The distribution layer performs fuse management to limit the access flow when the backend service fails or is under high load;

[0020] The distribution layer performs cache management to store and reuse frequently accessed data, reducing the load and response time of backend services.

[0021] In some embodiments, the method performs data serialization and vectorization, including:

[0022] The data is serialized into JSON or Pickle, and the data is encoded into one-hot encoding or word embedding encoding.

[0023] On the other hand, the present invention also provides a data access gateway based on software-defined boundaries, including a software-defined boundary controller and a microservice gateway, characterized in that the software-defined boundary controller and the microservice gateway are used to store and execute computer programs / instructions, and when the computer program / instructions are executed, the gateway implements the steps of the above method.

[0024] On the other hand, the present invention further provides a computer-readable storage medium having a computer program / instruction stored thereon, wherein the computer program / instruction implements the steps of the above method when executed by a processor.

[0025] On the other hand, the present invention also provides a computer program product, comprising a computer program / instruction, which implements the steps of the above method when executed by a processor.

[0026] The beneficial effects of the present invention are at least:

[0027] The data access method and device based on software-defined boundaries described in the present invention combine the software-defined boundary controller with the microservice gateway, and operate independently outside the gateway. This can achieve continuously evolving security protection through infinite expansion, and provide more security support for systems under the microservice architecture.

[0028] Furthermore, by establishing blacklist and whitelist verification, device authentication, user identity authentication, and user authority authentication, we ensure that only legitimate devices and users can access resources at multiple levels. After the verification is passed, access requests are limited to prevent network congestion and resource abuse caused by too many requests.

[0029] Furthermore, the comparison engine is used to compare access feature data and behavior feature data to timely detect and block potential attack behaviors and risky operations. The risk level of access requests is calculated through a pre-trained risk assessment model, and high-risk access flows are intercepted and recorded, effectively controlling potential threats.

[0030] Furthermore, after receiving the access request from the client, the entire method can quickly perform verification, authentication, preprocessing, comparison and risk assessment to ensure that the access request is processed in a timely manner. After the risk assessment is passed, the access flow can be quickly forwarded to the server through the distribution layer to ensure the smooth operation of normal business.

[0031] Additional advantages, purposes, and features of the present invention will be described in part in the following description, and will become apparent to those skilled in the art after studying the following, or may be learned from the practice of the present invention. The purposes and other advantages of the present invention may be achieved and obtained by the structures specifically indicated in the specification and the accompanying drawings.

[0032] Those skilled in the art will appreciate that the objectives and advantages that can be achieved with the present invention are not limited to the above specific description, and the above and other objectives that can be achieved by the present invention will be more clearly understood from the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The drawings described herein are used to provide a further understanding of the present invention, constitute a part of the present application, and do not constitute a limitation of the present invention. In the drawings:

[0034] Figure 1 This is a logical diagram of a data access method based on software-defined boundaries according to an embodiment of the present invention.

[0035] Figure 2 This is a schematic diagram of the logical architecture of a software-defined border gateway according to an embodiment of the present invention.

[0036] Figure 3A schematic diagram of a client-to-gateway deployment mode in a software-defined border gateway according to an embodiment of the present invention.

[0037] Figure 4 This is a logical diagram of access flow control in a software-defined gateway according to an embodiment of the present invention.

[0038] Figure 5 The present invention is a schematic diagram of the access flow process in the authentication management of the software defined gateway according to an embodiment of the present invention.

[0039] Figure 6 This is a logical diagram of the risk management function in the software defined gateway described in one embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments and the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0041] It should also be noted that, in order to avoid obscuring the present invention due to unnecessary details, only structures and / or processing steps closely related to the solutions according to the present invention are shown in the accompanying drawings, while other details that are not closely related to the present invention are omitted.

[0042] It should be emphasized that the term “include / comprises” when used herein refers to the presence of features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0043] It should also be noted that, unless otherwise specified, the term “connection” herein may refer not only to a direct connection but also to an indirect connection involving an intermediate.

[0044] In order to build a "zero trust" network architecture for a business system and improve the security of the business system, the present invention provides a data access method based on a software-defined boundary, the method is used to run on a software-defined boundary gateway, the software-defined boundary gateway includes a software-defined boundary controller and a microservice gateway, the software-defined boundary gateway connects a client and a server, and the method includes the following steps S101-S103:

[0045] Step S101: The microservice gateway as the access layer receives the access request sent by the client, and the access request is marked with the client's device information and user information; the device information includes the IP address, device identifier and device space information; the user information includes the user identity identifier and permission information.

[0046] Step S102: The access layer performs a blacklist and whitelist check on the device information and user information. If the check passes, the access request is subjected to flow control and audit management.

[0047] Step S103: The software-defined boundary controller acts as the control layer to perform authentication management on device information and user information, including device authentication, user identity authentication and user authority authentication. If the authentication is successful, the access flow corresponding to the access request is preprocessed, the access feature data and behavior feature data are divided, and the data is serialized and vectorized; the access feature data and behavior feature data are handed over to the comparison engine, and the access feature data is compared with the data in the preset local network attack feature library for similarity, and abnormal access with attack behavior is checked, and the behavior feature data is compared with the data in the preset local personal behavior portrait library for similarity, and abnormal access with risky operations is checked; if there is no abnormal access, the access flow is handed over to the pre-trained risk assessment model to calculate the risk level, and the high-risk access flow is intercepted and marked as accessible and recorded in the log, otherwise it is forwarded to the server by the microservice gateway as the distribution layer.

[0048] It should be noted that the microservice framework splits the application into a set of small, independently deployed and collaborative services, each of which focuses on a specific business function and interacts through lightweight communication protocols (such as HTTP / REST); this framework supports independent development, deployment and expansion, improves the flexibility and maintainability of the system, enhances fault isolation capabilities, and promotes continuous integration and delivery to adapt to rapidly changing business needs.

[0049] like Figure 1 As shown in the figure, in the microservice system architecture, the microservice gateway is independent of the system service and exists only as a system that provides REST API interface services. It mainly exists as a system for managing website access. Its main responsibilities are: request access, business aggregation, intermediary strategy and unified management. Among them, the intermediary strategy refers to the basic processing strategy for system security, external access verification, access request caching, etc.

[0050] In the microservice architecture, the use of microservice gateways can reduce the exposure of microservice application clusters and improve the security of microservices. In addition, the gateway implements non-business functions such as access control and load balancing for each microservice, making it easier for operation and maintenance personnel to manage.

[0051] Software-defined perimeter (SDP) is a network security approach based on the zero-trust model that protects network resources through default denial policies, authentication and authorization, dynamic access control, and encrypted communications. SDP provides fine-grained access control, and unauthorized users and devices cannot see any resources in the network, thereby reducing the attack surface. Its functions include multi-factor authentication, end-to-end encryption, dynamic resource allocation, and continuous monitoring to enhance network security and access control. SDP simplifies network architecture through virtualization and software-defined methods, supports remote work and cloud computing, improves compliance, reduces operating costs, improves operational efficiency, and adapts to the security and flexibility needs of modern enterprises.

[0052] SDP focuses on protecting critical organizational resources rather than organizational perimeters. It is able to define and implement risk-based, dynamic, identity-centric, and context-aware access policies at all layers of the network. It replaces traditional physical protection boundary devices through logical dynamic control. In the SDP architecture shown in the figure above, all requests from the SDP initiating host must pass through the SDP controller, and only access flows authenticated by the SDP controller can obtain data from the SDP receiving host. Therefore, the SDP controller is the "brain" of this solution, serving as the decision point for zero-trust policies to implement identity authentication and access control.

[0053] In steps S101 and S102, the blacklist and whitelist management of access flows is implemented in the gateway through the following steps: First, define at least one blacklist and / or whitelist, the blacklist contains all IP addresses, domain names or user identifiers that need to be blocked, and the whitelist contains all IP addresses, domain names or user identifiers that need to be released. Then, integrate the blacklist check module and the whitelist check module in the gateway configuration; each time there is an access request, first check whether the source of the request is in the blacklist. If it is in the blacklist, the request is directly rejected and the relevant logs are recorded for review; then check whether the source of the request is in the whitelist, and if it exists, it is directly released. Finally, regularly update and maintain the blacklist and whitelist to respond to new security threats and dynamically changing attack sources. Through these steps, bad traffic can be effectively prevented from entering the network and the security of the system can be guaranteed.

[0054] In some embodiments, flow limiting management includes: counting access requests, rejecting or queuing access flows that exceed set thresholds, limiting the number of requests and smoothing traffic; audit management includes: collecting external logs and obtaining analysis engines.

[0055] Specifically, the microservice gateway acts as the access layer and implements current limiting control, which can be done through the following steps:

[0056] 1. Determine the current limiting strategy: Determine the current limiting strategy based on business needs, such as the maximum number of requests allowed per second, the maximum number of requests per minute, etc. The strategy can be based on dimensions such as IP, user, and interface.

[0057] 2. Configure current limiting rules: Configure current limiting rules in the gateway. Many gateways and API management tools (such as NGINX, Kong, Zuul, etc.) support the configuration of current limiting rules. Rules can include: the maximum number of requests per second, per minute, and per hour; current limiting rules for different users or IP addresses; current limiting rules for different interfaces or paths;

[0058] 3. Counter implementation: Implement a counter to track the number of requests. You can use memory storage, distributed cache (such as Redis), or other persistent storage to save the request count.

[0059] 4. Request interception and current limiting: When a request reaches the gateway, first check whether the current request count exceeds the current limiting threshold. If not, allow the request to continue and update the counter; if it exceeds, return a current limiting response (such as HTTP429Too Many Requests).

[0060] 5. Dynamic adjustment and monitoring: Regularly monitor the flow limiting situation and collect flow limiting data in order to analyze and adjust the flow limiting strategy. You can set an alarm mechanism to trigger an alarm when the request volume approaches the flow limiting threshold, prompting the administrator to make necessary adjustments.

[0061] 6. Cache and distributed support: For distributed systems, you can use distributed cache (such as Redis) to implement global current limiting and ensure consistency between multiple nodes. At the same time, you can consider using sliding window algorithms, token bucket algorithms, etc. to optimize the current limiting effect.

[0062] Through the above steps, current limiting control can be effectively implemented in the gateway to prevent system overload caused by excessive burst requests and ensure service stability and availability.

[0063] Furthermore, the audit management function of the access layer is connected to the log collection and analysis engine to provide support for the evolution of the system.

[0064] In step S103, the software-defined border controller serves as a control layer and mainly performs authentication management, risk management and log management.

[0065] Among them, authentication management mainly verifies the device, user identity and permissions to confirm whether the corresponding access request meets the permission requirements. Risk management audits and evaluates risky behaviors through the comparison engine and the introduction of pre-trained risk assessment models. Through log management operation, risky or abnormal access flows are recorded.

[0066] First, clean the original data and deal with missing values, outliers, duplicate data, etc.

[0067] The cleaned data is divided into access feature data and behavior feature data.

[0068] Access feature data usually describes the properties of a single access request, which may include the following: Timestamp, which marks the specific time of the access. User ID, which is the unique identifier of the visitor. IP address, which is the IP address that initiated the request. URL request, which marks the specific URL accessed. HTTP method, which includes GET, POST, etc. User agent, which includes browser and operating system information. Request parameters, which mark the parameters carried in the request.

[0069] Behavioral feature data usually describes the user's behavior pattern over a period of time, and can specifically include the following: Session Duration, which marks the total duration of a user's single access session. Number of Requests, which indicates the total number of requests issued by a user in a session. Average Response Time, which indicates the average response time of user requests. Request Distribution, which marks the distribution of user requests in different URLs or different time periods. Request Frequency, which marks the user's request frequency per unit time. Error Rate, which marks the proportion of errors in user requests.

[0070] In some embodiments, the method performs data serialization and vectorization, including: performing JSON serialization or Pickle serialization on the data, and performing hot encoding or word embedding encoding on the data.

[0071] Furthermore, to compare the similarity between the access feature data and the data in the preset local network attack feature library, and the similarity between the behavior feature data and the data in the preset local personal behavior portrait library, you first need to prepare the access feature data, behavior feature data, network attack feature library and personal behavior portrait library. Next, select a suitable similarity calculation method, such as Euclidean distance, cosine similarity, Jaccard similarity, etc., and pre-process the data (such as standardization and normalization). Then, calculate the similarity between the access feature data and the attack feature library data, and the similarity between the behavior feature data and the personal behavior portrait library data. By setting a reasonable similarity threshold, abnormal access and potential attack behaviors can be identified. Finally, generate a report and take corresponding security measures to deal with the detected abnormal behaviors.

[0072] In some embodiments, the method also includes: obtaining the latest standard network attack feature library based on a first preset link, and updating the local network attack feature library according to the first preset time node; obtaining the latest standard personal behavior portrait library based on a second preset link, and updating the local personal behavior portrait library according to the second preset time node; and the comparison engine uses cosine similarity or Euclidean distance for similarity comparison.

[0073] Furthermore, the access flow is finally evaluated through a risk assessment model.

[0074] In some embodiments, the risk assessment model training steps include S201 to S203:

[0075] The process comprises S201: obtaining a training sample set, wherein the training sample set comprises a plurality of sample access flows and annotates risk levels, wherein the risk levels comprise normal, low risk, medium risk and high risk.

[0076] Including S202: performing data cleaning on the sample access flow, filling in missing values ​​and removing outliers.

[0077] Including S203: obtaining an initial neural network model, using a training sample set to train the initial neural network model, and constructing a cross entropy loss to update model parameters to obtain a risk assessment model; the initial neural network model includes: a decision tree, a random forest, a support vector machine or a convolutional neural network.

[0078] In some embodiments, the method also includes: storing the access flows and their corresponding risk levels generated during the operation in a local database, and incorporating the access flows and risk levels in the local database as samples into a training sample set at preset time intervals, and using the merged training sample set to train and update the risk assessment model.

[0079] In some embodiments, the method further comprises:

[0080] The distribution layer performs load balancing to balance the requests distributed to the backend services; in the network, the load balancing function of the gateway can effectively distribute incoming and outgoing traffic to optimize resource utilization, maximize throughput, reduce response time, and avoid overloading of a single resource. The following are the specific operation methods of the gateway to load balance access flows: polling, weighted polling, least connection, weighted least connection, IP hashing, and shortest response time.

[0081] The distribution layer performs routing management and distributes data along the preferred path; first, it evaluates the pros and cons of each available path based on the preset routing rules and real-time network status (such as bandwidth, delay, packet loss rate, etc.), and then selects the optimal path for data distribution. Specific operations include: regularly collecting path performance data, calculating the preferred score of the path, dynamically adjusting the routing table, and sending the data packet along the path with the highest score to ensure the best transmission efficiency and quality.

[0082] The distribution layer performs circuit breaker management to limit access flow when the backend service fails or is under high load. When the gateway performs circuit breaker management, it monitors the status of the backend service (such as response time, error rate, etc.) in real time. When a service failure or high load is detected, the circuit breaker mechanism is triggered to temporarily stop forwarding requests to the service and quickly return the preset downgrade response or error information. During this period, it will periodically try to restore the connection to ensure that the service is restored to normal before reconnecting the traffic to prevent the spread of the fault and ensure system stability.

[0083] The distribution layer performs cache management to store and reuse frequently accessed data, reducing the load and response time of backend services. When the gateway performs cache management, it caches frequently accessed data in the local or distributed cache. When a new request arrives, it first checks whether the cache already has the corresponding data. If so, it directly returns the cache content. Otherwise, it forwards the request to the backend service to obtain the data and stores it in the cache, and then returns the result to the client. This effectively reduces the load and response time of the backend service, improving system performance and user experience.

[0084] On the other hand, the present invention also provides a data access gateway based on software-defined boundaries, including a software-defined boundary controller and a microservice gateway, characterized in that the software-defined boundary controller and the microservice gateway are used to store and execute computer programs / instructions, and when the computer program / instructions are executed, the gateway implements the steps of the above method.

[0085] On the other hand, the present invention further provides a computer-readable storage medium having a computer program / instruction stored thereon, wherein the computer program / instruction implements the steps of the above method when executed by a processor.

[0086] On the other hand, the present invention also provides a computer program product, comprising a computer program / instruction, which implements the steps of the above method when executed by a processor.

[0087] The present invention is described below in conjunction with a specific embodiment:

[0088] This embodiment provides a software defined boundary (SPD) microservice gateway, implements the function of an SDP controller in the microservice gateway, and adds an SDP control layer to the microservice gateway to implement the function of the SDP controller.

[0089] like Figure 2 As shown in the figure, the software-defined editing gateway is logically divided into three layers, namely the access layer, the SDP control layer and the distribution layer. The access layer and the distribution layer implement the functions of the traditional microservice gateway, and the SDP control layer is embedded in the middle to implement the functions of the SDP controller.

[0090] Access layer: This layer is mainly responsible for interacting with users (or front-end programs) and roughly filtering access flows. Its main functions include blacklist and whitelist management, current limiting control, etc. The audit management function is mainly to realize the aggregation, analysis and display of logs at each layer. The audit management function of the access layer is connected to the log collection and analysis engine, and can also provide support for the evolution of the system.

[0091] SDP control layer: This layer is the functional core of the software-defined border gateway, which mainly includes three functions: authentication management, risk management, and log management. The access flow is authenticated and the legal access flow is determined before entering the risk management module for risk assessment. The system will record the authentication process and the assessment process, as well as high-risk access. Combined with an external machine learning engine, a relatively complete risk protection system can be formed.

[0092] Distribution layer: distributes relatively safe access flows filtered by the access layer and SDP control layer, and completes other functions of the microservice gateway. Mainly including: load balancing, routing management, fuse management, cache management, etc. The logs recorded in this layer will also be imported into the access layer audit management function for unified processing.

[0093] like Figure 3 As shown, in the deployment model of SDP, a client-to-gateway deployment model is provided. In this model, the SDP gateway connects the initiating host and the receiving host.

[0094] In this mode, all servers are protected by the SDP gateway, so direct access by the initiating and receiving hosts is secure and has clear boundaries regardless of the topology of the underlying network.

[0095] Based on the SDP deployment model, the microservice gateway is integrated with the SDP controller. After integration, the identity authentication function is included in the SDP controller, and the SDP controller is deployed independently. The SDP controller can call on more resources to achieve more stringent protection.

[0096] Reference Figure 1 , the SDP controller can use an independent database, machine learning algorithm engine and log analysis engine to achieve more complete network attack behavior identification. Such a deployment architecture provides more possibilities for the security protection of the SDP microservice gateway.

[0097] The biggest difference between the SDP microservice gateway and the traditional microservice gateway is the addition of the SDP control layer. Therefore, the functions implemented by the SDP control layer are the core functions of software-defined edge microservices. The SDP control layer mainly has three functions: authentication management, risk management, and log management.

[0098] Authentication management mainly implements the "identity recognition" problem of access flow. After completing the legitimacy authentication of the device and identity, permissions are assigned according to the user identity. Users can only access the background services allowed by the permission.

[0099] Risk management uses machine learning algorithms to form an intelligent engine, which is combined with a known high-risk network attack feature library to identify network attack behaviors. At the same time, relevant algorithms are used to form personnel portraits based on the system usage habits of individuals and devices, and abnormal operations of personnel are identified, thereby forming a risk identification mechanism.

[0100] Ultimately, the results of authentication and risk identification will be recorded to form a log, which will serve as a data source for risk management on the one hand, and will be aggregated to the interface layer on the other hand to form a unified log of gateway access as one of the basic data for audit management, providing a basis for system evolution.

[0101] When the client sends an access request, the access data flow enters the gateway, first through whitelist confirmation and flow limiting filtering, and then begins to determine the legitimacy of the device and identity. After the device and identity are successfully authenticated, permissions are assigned to the access flow to ensure that the background application is minimized. Then, after risk management analyzes the access flow and user access habits, it is determined that the access flow is secure, and load balancing, cache management and other functions are turned on to start forwarding to the application service. In addition, the authentication process and risk management identification process are logged, and the logs are aggregated for unified analysis. The software-defined gateway access control function is implemented as follows: Figure 4 shown.

[0102] The client access flow should cover the relevant information of the device and user when entering the gateway. After passing the blacklist and whitelist control and flow control of the gateway, the device information should be authenticated first. The authentication content includes the device's IP address, device identification, device space information, etc., and then the user authentication will begin. After the authentication is completed, the permission information is obtained. The device information, user information and permission information are connected with other information of the access flow to enter the risk management module.

[0103] like Figure 5 As shown, the authentication management module is similar to the system login and identity authentication modules. Only after the device and user authentication are successful and the authority is successfully obtained, will the risk management module be entered to start access risk assessment.

[0104] Relying on the deployment architecture of the SDP microservice gateway, the implementation of the risk management module is as follows: Figure 6 As shown in the figure: after the legitimate access flow is confirmed by the authentication management, it will enter the risk management module to pre-process the data first, and divide the data into two categories: access feature data and behavior feature data, and complete the serialization and vectorization of the data at the same time. The access feature data mainly contains the spatial features, time features and other information of the access flow; the behavior feature data is related to the user, mainly including the permission features, operation features, etc. The two types of data are submitted to the feature comparison engine, which relies on the network attack feature library and the personal behavior feature library to identify the access flow. After confirming that there is no abnormal access, it is submitted to the risk assessment model to evaluate the access flow. If the assessed risk is high, it will be recorded in the log. After the log is uniformly processed by the audit management module, the assessment result will be displayed to the system administrator. After the system administrator confirms that it is an attack access, it will be returned to the machine learning algorithm engine as part of the training data as a training model. After the training is completed, the risk assessment model will be updated in time. In addition, the personal behavior portrait library can be connected to the human resources related system, and combined with the permission change, it can be continuously improved by using its own machine learning engine; the network attack feature library can obtain professional data from professional institutions or from its own log analysis results.

[0105] This embodiment introduces the concept of software-defined boundaries into the microservice gateway, and finds a basis for identity authentication as a function that the microservice gateway must provide; the SDP controller is combined with the microservice gateway, and the method of running independently outside the gateway can achieve continuously evolving security protection through unlimited expansion, providing more security support for systems under the microservice architecture. As a key part of the microservice architecture, the microservice gateway plays a vital role in the process of program interaction. The use of the concept of software-defined boundaries (SDP) architecture to strengthen the microservice gateway not only allows the system developed by the microservice architecture to have good security from the beginning, but also provides natural support for organizations and enterprises to deploy systems in zero-trust networks.

[0106] Corresponding to the above method, the present invention also provides an apparatus / system, which includes a computer device, the computer device includes a processor and a memory, the memory stores computer instructions, the processor is used to execute the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the apparatus / system implements the steps of the method described above.

[0107] The embodiment of the present invention also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the aforementioned edge computing server deployment method are implemented. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0108] To sum up, the data access method and device based on software-defined boundaries described in the present invention combine the software-defined boundary controller with the microservice gateway, and run independently outside the gateway, which can achieve continuously evolving security protection through infinite expansion and provide more security support for systems under the microservice architecture.

[0109] Furthermore, by establishing blacklist and whitelist verification, device authentication, user identity authentication, and user authority authentication, we ensure that only legitimate devices and users can access resources at multiple levels. After the verification is passed, access requests are limited to prevent network congestion and resource abuse caused by too many requests.

[0110] Furthermore, the comparison engine is used to compare access feature data and behavior feature data to timely detect and block potential attack behaviors and risky operations. The risk level of access requests is calculated through a pre-trained risk assessment model, and high-risk access flows are intercepted and recorded, effectively controlling potential threats.

[0111] Furthermore, after receiving the access request from the client, the entire method can quickly perform verification, authentication, preprocessing, comparison and risk assessment to ensure that the access request is processed in a timely manner. After the risk assessment is passed, the access flow can be quickly forwarded to the server through the distribution layer to ensure the smooth operation of normal business.

[0112] It should be understood by those skilled in the art that the exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present invention are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0113] It should be clear that the present invention is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present invention.

[0114] In the present invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with features of other embodiments or replace features of other embodiments.

[0115] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the embodiments of the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A data access method based on software-defined boundaries, characterized in that: The method is used to run on a software-defined border gateway, the software-defined border gateway includes a software-defined border controller and a microservice gateway, the software-defined border gateway connects a client and a server, and the method includes the following steps: The microservice gateway serves as an access layer to receive an access request sent by a client, wherein the access request is marked with the device information and user information of the client; the device information includes an IP address, a device identifier, and device space information; the user information includes a user identity identifier and permission information; The access layer performs a blacklist and whitelist check on the device information and the user information, and performs flow control and audit management on the access request if the check passes; The software-defined boundary controller acts as a control layer to perform authentication management on the device information and the user information, including device authentication, user identity authentication and user authority authentication. If the authentication is successful, the access flow corresponding to the access request is preprocessed, access feature data and behavior feature data are divided, and data serialization and vectorization are performed; the access feature data and the behavior feature data are handed over to the comparison engine, and the access feature data is compared with the data in the preset local network attack feature library for similarity, and abnormal access with attack behavior is checked, and the behavior feature data is compared with the data in the preset local personal behavior portrait library for similarity, and abnormal access with risky operations is checked; if there is no abnormal access, the access flow is handed over to the pre-trained risk assessment model to calculate the risk level, and the access flow belonging to high risk is intercepted and marked as accessible and recorded in the log, otherwise it is forwarded to the server by the microservice gateway as the distribution layer.

2. The data access method based on software-defined boundaries according to claim 1, characterized in that: The flow limiting management includes: counting the access requests, rejecting or queuing the access flows that exceed the set threshold, limiting the number of requests and smoothing the flow; the audit management includes: collecting external logs and obtaining the analysis engine.

3. The data access method based on software-defined boundaries according to claim 1, characterized in that: The method further comprises: Acquire the latest standard network attack feature library based on the first preset link, and update the local network attack feature library according to the first preset time node; Obtaining the latest standard personal behavior portrait library based on the second preset link, and updating the local personal behavior portrait library according to the second preset time node; Furthermore, the comparison engine uses cosine similarity or Euclidean distance for similarity comparison.

4. The data access method based on software-defined boundaries according to claim 1, characterized in that: The training steps of the risk assessment model include: Acquire a training sample set, the training sample set includes multiple sample access flows and annotates risk levels, the risk levels include normal, low risk, medium risk and high risk; Performing data cleaning on the sample access stream to fill in missing values ​​and remove outliers; An initial neural network model is obtained, the initial neural network model is trained using the training sample set, and a cross entropy loss is constructed to update model parameters to obtain the risk assessment model; the initial neural network model includes: a decision tree, a random forest, a support vector machine or a convolutional neural network.

5. The data access method based on software-defined boundaries according to claim 4, characterized in that: The method also includes: storing the access flows and their corresponding risk levels generated during the operation in a local database, and incorporating the access flows and risk levels in the local database as samples into the training sample set at preset time intervals, and using the merged training sample set to train and update the risk assessment model.

6. The data access method based on software-defined boundaries according to claim 1, characterized in that: The method further comprises: The distribution layer performs load balancing to balance the requests distributed to the backend services; The distribution layer performs routing management and distributes data according to the preferred path; The distribution layer performs fuse management to limit the access flow when the backend service fails or is under high load; The distribution layer performs cache management to store and reuse frequently accessed data, reducing the load and response time of backend services.

7. The data access method based on software-defined boundaries according to claim 1, characterized in that: The method performs data serialization and vectorization, including: The data is serialized into JSON or Pickle, and the data is encoded into one-hot encoding or word embedding encoding.

8. A data access gateway based on software-defined boundaries, comprising a software-defined boundary controller and a microservice gateway, characterized in that: The software-defined border controller and the microservice gateway are used to store and execute computer programs / instructions. When the computer programs / instructions are executed, the gateway implements the steps of the method as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method as claimed in any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images