Dynamic access control policy evaluation method for microservices
Patent Information
- Application Number
- CN202210052856.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-01-18
- Publication Date
- 2024-12-17
- Estimated Expiration
- 2042-01-18
AI Technical Summary
In a microservice environment, existing access control policies are inefficient in evaluation and cannot support dynamic policy evaluation, resulting in long evaluation time and possible errors when the policy library changes dynamically.
The attribute-based Jaccard similarity calculation method is used to resolve conflicts and redundant policies, and the matching tree structure is used to perform local maintenance of policy updates to support dynamic policy evaluation, reduce irrelevant policy interference and improve evaluation efficiency.
Effectively reduce irrelevant policy interference, improve policy evaluation efficiency, support dynamic policy evaluation in microservice environment, and ensure the security of microservice access control and data security.
Smart Images
Figure CN114519196B_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of access control security technology in a microservice environment, and proposes a dynamic access control policy evaluation method in a microservice environment. The method is mainly based on two technologies: one is a Jaccard similarity calculation method based on attributes, which is used to resolve conflicts and redundant policies; the other is to maintain the policy update locally based on the matching tree structure, and continue to evaluate the policy for the rest. The method proposed by the present invention can effectively reduce the interference of irrelevant policies and improve the efficiency of policy evaluation; it can also ensure that the local maintenance under the dynamic update of the microservice policy does not affect the policy evaluation of the rest. Background Art
[0002] In recent years, with the rapid development of information technology and the substantial increase in the number of users, new industry demands such as agile development and deployment, and autonomy have emerged in the field of software architecture. Based on this, microservice architecture came into being and became an inevitable trend in the development of future software architecture. In 2014, Martin Fowler formally proposed the concept of microservice architecture. Microservice is an architectural style that develops a single application into a set of small services. The overall microservice system has the characteristics of dynamic and flexible expansion, and each service module has the characteristics of independent development and deployment and flexible technology stack.
[0003] Microservice architecture has gradually become the mainstream architecture, so its security issues are a key issue that a mature architecture must consider. Microservice architecture splits the software system into a group of "small and micro" services, so when it completes complex business, it requires multiple microservices to be flexibly combined and coordinated. Most of the current microservice systems use gateways for unified authentication and authorization, and a sharp increase in access volume in a short period of time will produce an avalanche effect; since access requests in a microservice environment are generally stateless requests, containing all the information of the request, all access requests need to be controlled, resulting in a large workload for access control; and because the microservice architecture has the characteristics of dynamic and flexible expansion, each service module is dynamically started and deregistered, and can flexibly join or exit the system, so the policy library of the microservice system will change dynamically. The existing policy evaluation method needs to wait for the policy library to be updated before the policy evaluation can be performed, resulting in a long evaluation time; or the evaluation is performed during the policy library update process, resulting in incorrect evaluation results. Therefore, how to ensure secure access to the microservice system is an important issue.
[0004] Access control is one of the important technical means to protect system security. However, the autonomy, dynamic and flexible expansion, and flexible technology stack of microservice architecture have brought new challenges to the existing access control policy evaluation: 1) With the development of business, the number of service modules in the microservice system will gradually increase, resulting in the continuous expansion of its access control policy library, which in turn leads to longer and longer policy evaluation time, and the efficiency and experience of policy evaluation are greatly affected; 2) Under the microservice architecture, each service module independently sets access control policies and can flexibly join and exit the microservice system, resulting in dynamic changes in the microservice policy library. Therefore, a method that supports dynamic policy evaluation when the microservice policy library changes is needed. Most existing studies focus on the efficiency of access control policy evaluation in a microservice environment, and do not pay enough attention to dynamic policy evaluation in a microservice environment. Therefore, it is of great significance to study a microservice access control policy evaluation method that supports dynamicity. Summary of the invention
[0005] In view of the problems of insufficient efficiency of policy evaluation of access control in a microservice environment and insufficient support for dynamic policy evaluation in the prior art, the present invention proposes a dynamic access control policy evaluation method for microservices. The method of the present invention uses an attribute-based Jaccard similarity calculation method to resolve conflicts and redundant policies; and uses a matching tree to perform dynamic access control policy evaluation in a microservice environment. The present invention can not only reduce the interference of irrelevant policies and improve the efficiency of policy evaluation, but also support dynamic policy evaluation in a microservice environment, thereby ensuring the safe implementation of microservice access control and protecting its data security.
[0006] The access control process in the existing microservice environment is generally carried out at the service gateway, mainly for the evaluation of access control policies. Microservice access control scenarios such as Figure 1 Therefore, the present invention mainly studies the content of the three stages of policy simplification and optimization, matching tree construction, and microservice dynamic access control policy evaluation based on matching tree at the service gateway in the microservice environment. The specific microservice access control process is as follows Figure 2 As shown, the access control sequence is as follows Figure 3 shown.
[0007] The first stage is the policy streamlining and optimization stage. First, based on the received access request, the access control policy required by the request is extracted; then the policy is streamlined and optimized, and the attribute-based Jaccard similarity calculation method is used to resolve conflicts and redundant policies in a fine-grained manner.
[0008] First, according to the key attribute information in the access request, a policy set with key attribute matching is selected from the policy library at the service gateway. Key attribute matching means that the key attribute in the access request matches the corresponding attribute in the access control policy or contains the same item.
[0009] Secondly, the Jaccard similarity calculation method based on attributes is used to simplify the optimization strategy set. For the selected strategies, the Jaccard similarity calculation method based on attributes is used in formula (1), where Pi and Pi are any two strategies required for strategy evaluation, and their similarity coefficient is the ratio of the intersection and union of the same attributes in the two strategies, and the ratio is between 0 and 1. The larger the Jaccard coefficient value, the higher the similarity of the attributes compared in the two strategies.
[0010] Analyze the access control process in the microservice environment. For a request sent by the client to access a resource microservice, if there are two policy adaptations for the request at the same time, but the utility attributes are opposite, one policy allows access and the other denies access, then the two policies are conflicting policies; if the utility attributes of the two policies are the same, both are allowed or denied, then they are redundant policies. In addition, since each service module in the microservice is dynamically started and deregistered, its access control process has a certain timeliness. Therefore, when the resource attributes, operation attributes, and time attributes of the two policies are the same or contain the same items, conflicting policies or redundant policies are generated according to the value of the utility attribute.
[0011] Therefore, we first group the access control policies according to the resource attributes, operation attributes, and time attributes in the policies, and group those with the same resource attributes, operation attributes, and time attributes into one group, and those with some of the same attributes into another group. Then, we further discuss the fine-grained classification based on other attributes in the policies.
[0012] (1) Simplification of conflicting strategies. If both strategies belong to the strategy set required for strategy evaluation, the Jaccard coefficient values of their resource attributes, operation attributes, and time attributes are all 1, and their utility attributes are opposite, one allows the operation and the other denies the operation, then the conditions for refining the conflicting strategies are met and the following operations are performed:
[0013] 1) If two strategies P i and P j The Jaccard coefficient values of other attributes are all 1, such as subject attributes and environmental attributes. For security reasons, the utility attributes are set to have allowed utility attributes and not include rejected utility attributes, that is, rejection takes precedence.
[0014] 2) If the subject attributes and environment attributes of the two strategies have an intersection, delete the intersection of the attributes in the two strategies and update P i and P j The attribute set of the strategy is the remaining attribute set in the two strategies. i and P j The strategies continue to use their original utility properties.
[0015] (2) Simplification of redundant strategies. If two strategies P i and P j All of them belong to the policy set required for policy evaluation, and their resource attributes, operation attributes, and time attributes are partially the same, and P i and P j The utility attributes of are the same, both are allowed or denied, then the conditions for redundant strategy refinement are met, and the following operations are performed:
[0016] 1) If two strategies P i and P j If the Jaccard coefficient values of resource attributes, operation attributes, time attributes, subject attributes, and environment attributes are all 1, then the policy Pj is deleted.
[0017] 2) If two strategies P i and P j The Jaccard coefficient values of resource attributes, operation attributes, and time attributes are 1, and the Jaccard coefficient values of subject attributes and environmental attributes are between 0 and 1, then the new attribute range is P i and P j The union of the attributes of P and assign the new attribute range to P i , and finally delete P j .
[0018]
[0019] Algorithm 1. Simplified optimization algorithm of strategy:
[0020]
[0021]
[0022] The second stage is the matching tree construction stage, where the matching tree is constructed using the streamlined and optimized strategy.
[0023] The matching tree is a relatively efficient policy index structure used by the present invention to evaluate access control policies, which can guarantee the semantics of the original policy to the greatest extent. The process of constructing the matching tree is described in detail below.
[0024] (1) Determine the definition of all nodes in the matching tree. The node types in the matching tree include policy assembly nodes, policy nodes, and rule nodes. The root node is the policy assembly node, and the following layers are policy nodes and rule nodes. The rule node is a leaf node, which is the smallest unit of policy primitives.
[0025] (2) Determine the relationship between nodes. The relationship between nodes includes the parent-child node relationship (indicated by the letter P) and the sibling node relationship (indicated by the letter B). Suppose there are nodes a and b, and a is the parent node of b and b is the child node of a, then there is the relationship aPb; suppose there is also a node c, and nodes b and c are sibling nodes, then there is the relationship bBc.
[0026] (3) Specify the node adaptation conditions. When a policy contains the attribute information required by a request, the policy is the adaptation node of the request; when the attribute element in the policy is empty, the policy is applied to all requests by default.
[0027] (4) Determine the path information in the matching tree. In the process of matching from the root node of the tree to a leaf node, the set of all the nodes passed is the path of the tree. Each path is a specific rule of the policy set. The leaf node stores the specific rule information of the path, that is, the decision result path information.
[0028] (5) Determine the judgment result path. The request starts from the root node and traverses the matching tree in depth-first order. When the request matches from the root node to the rule node and all nodes are adapted, the path information stored in the rule node is the corresponding judgment result; or when the request traverses all nodes and does not match a suitable result, that is, there is no suitable judgment result, the request is rejected.
[0029] (6) Construct an index structure of the judgment result path information. Construct a path information index structure with the judgment result path information in all leaf nodes, remove duplicate information in the path information during the construction process, and realize the construction of a simplified index structure of the judgment result path.
[0030] Algorithm 2. Matching tree construction algorithm:
[0031]
[0032]
[0033] The third stage is the dynamic access control policy evaluation stage for microservices based on matching trees. Since each service module in a microservice environment can dynamically and flexibly join or withdraw from the system, the microservice access control policy library will change dynamically. In addition, the existing access control methods in microservice environments do not take into account the dynamic policy evaluation when the policy library changes dynamically, and do not support dynamic access control policy evaluation in a microservice environment. Therefore, an access control method that supports uninterrupted policy evaluation during dynamic changes in the policy library is required. This paper uses matching trees for dynamic policy evaluation. The process is as follows: Figure 5 shown.
[0034] To evaluate the policy based on the matching tree, first check whether there is any policy update in the policy to be evaluated. If there is a policy update, set the matching tree status value to 0, locally lock the updated policy, and continue the policy evaluation for the rest of the policy. Generate a new matching tree and perform policy update and maintenance on the newly generated matching tree. When the local maintenance of the policy update is completed, set the status value to 1 and replace the original matching tree with the maintained new matching tree. If there is no policy update, continue the policy evaluation and give a judgment result. Finally, respond to the access request.
[0035] The specific matching tree strategy maintenance details are as follows:
[0036] When a policy update is detected, the original matching tree is partially locked, and after a new matching tree is generated, the new matching tree is updated and maintained. The present invention adopts an attribute-based access control method, first analyzing the specific content of a certain attribute that has changed in the update strategy:
[0037] (1) First, determine whether the resource attribute, operation attribute, and time attribute have changed. If the specific content of these three attributes has not changed, or the content of one of the three attributes has partially changed, then perform operations (2) and (3). If one or more of the three attributes have changed, and the content of the attribute is completely different from that contained in the matching tree, then the policy does not belong to the evaluation policy of the access request, and the policy is directly removed from the matching tree without performing the next step.
[0038] (2) Determine whether the utility attribute of the strategy has changed. If the utility attribute remains unchanged, identify the specific content of the remaining attributes that have changed and merge them with the existing attribute content in the matching tree as the updated attribute content;
[0039] (3) If the utility attribute changes, identify the specific attribute content that has changed, then use the updated attribute and the original attribute content in the matching tree to take the union and intersection, and subtract the intersection from the union to obtain the updated content.
[0040] Compared with the prior art, the present invention has the following advantages:
[0041] The existing access control policy evaluation in the microservice environment only focuses on the efficiency of policy evaluation, and does not consider the policy evaluation problem under the condition of dynamic changes in the policy library in the microservice environment. Since microservices have the characteristics that each service module can be dynamically started and deregistered, its policy library has dynamic changes, and the access control policy evaluation work in the existing microservice environment does not consider the dynamic changes of the policy library; or adopts the traditional evaluation method, when the policy library is updated, the overall policy library is disabled for update and maintenance, until the update is completed, and then the policy is evaluated, which leads to a long policy evaluation time; and since all microservices perform access control at the service gateway, the access control workload is large, and the deactivation of the overall policy library during policy update will affect the access control work of the overall microservice system and threaten the security of the microservice system. Therefore, a highly efficient dynamic access control policy evaluation method in a microservice environment is needed. The present invention proposes dynamic policy evaluation based on a matching tree, supports maintenance of only the updated part in the matching tree during the dynamic update of the microservice system policy library, and does not affect the policy evaluation of the rest of the parts, thereby realizing dynamic policy evaluation in a microservice environment. BRIEF DESCRIPTION OF THE DRAWINGS
[0042] Figure 1 The following is a schematic diagram of the access control scenario for microservice architecture.
[0043] Figure 2 This is a specific process diagram of access requests at the gateway of the microservice system architecture. Relevant policies are extracted at the policy administration point (PAP), the policies are streamlined and optimized, a tree structure is constructed, and then the dynamic access control policy evaluation of microservices is performed based on the tree structure.
[0044] Figure 3 When a user issues an access request, the microservice gateway is given a decision strategy for the access request and provides a timing diagram of the overall process of the corresponding microservice resources.
[0045] Figure 4 It is the technical roadmap of the present invention.
[0046] Figure 5 Flowchart for dynamic policy evaluation based on matching trees.
[0047] Keyword Description
[0048] This table lists the definitions of all keywords used in this invention.
[0049] Table 1 Keyword naming
[0050]
[0051] DETAILED DESCRIPTION
[0052] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.
[0053] The access control scenario of the dynamic access control policy evaluation method for microservices described in the present invention is shown in Figure 1, which is deployed in the service gateway Spring Cloud Gateway as the access request entry of the entire microservice system. External access requests can access the corresponding resource microservices only after passing the access control of the service gateway. The present invention uses attribute-based access control (ABAC) to perform access control policy evaluation for all access requests at the gateway. The overall technical route is as follows: Figure 4 The specific evaluation steps are as follows:
[0054] Step 1: Receive and process access requests.
[0055] Step 1.1: The user requests access to microservice resources and issues an access request.
[0056] The user side includes mobile phone users, PC users, etc. The access request mainly includes subject attributes, resource attributes, operation attributes, time attributes, environment attributes, etc.
[0057] Step 1.2: The PEP in the service gateway receives and processes the user's access request and forwards the request to the PDP.
[0058] Step 1.3: The policy decision point (PDP) at the serving gateway receives and forwards the access request to the PAP.
[0059] Step 2: Streamlining and optimization of strategies.
[0060] Firstly, the required access control policies are extracted according to the received access requests; then the policies are streamlined and optimized, and the attribute-based Jaccard similarity calculation method is used to eliminate conflicts and redundant policies.
[0061] Step 2.1: Based on the received access request, extract the policy set required by the request.
[0062] According to the key attribute information in the access request, a policy set with key attribute matching is selected from the policy library of the service gateway. Key attribute matching means that the key attribute in the access request matches the corresponding attribute in the access control policy or contains the same attribute content item.
[0063] Step 2.2: Use the attribute similarity calculation method to streamline and optimize the access control policy set and eliminate conflicts and redundant policies.
[0064] (1) Using the attribute similarity calculation method, the policies are preliminarily grouped according to resource attributes, operation attributes, and time attributes. Strategies with the same three attributes are grouped into one group, and those with partially the same three attributes are grouped into another group.
[0065] (2) The strategies that have been preliminarily divided are divided into fine-grained groups according to the subject attributes and environmental attributes. Those with the same subject attributes and environmental attributes are divided into one group, and those with partially the same subject attributes are divided into another group.
[0066] (3) Finally, based on the utility attribute (i.e., allowing access or denying access), conflicting and redundant strategies are resolved.
[0067] Step 3: Use the streamlined and optimized strategy set to build a matching tree.
[0068] Step 3.1: Determine the definition of all nodes in the matching tree. The node types in the matching tree include strategy assembly node, policy node, and rule node. The root node is the strategy assembly node, and the following layers are the policy node and rule node. The rule node is a leaf node, which is the smallest unit of the policy primitive and stores the decision result path information.
[0069] Step 3.2: Determine whether the current node is a root node. If it is a root node and the policy set node is not empty, store the policy set in the current node; if the current node is a child node of the root node, and the policy set in the root node contains a corresponding sub-policy, store the sub-policy in the current node; if the sub-policy contains a corresponding rule, store the rule in the child node of the sub-policy, and so on, to build a matching tree.
[0070] Step 3.3: Construct a determination result index for the determination result path information stored in the matching leaf nodes, and remove duplicate determination result information.
[0071] Step 4: Perform dynamic strategy evaluation based on the matching tree.
[0072] Step 4.1: Check whether there is any policy update in the policy to be evaluated. If there is no policy update, perform policy evaluation and give a judgment result.
[0073] Step 4.2: Check whether there is any policy update in the policy to be evaluated. If there is a policy update, perform the following operations.
[0074] (1) The matching tree state value is set to 0, the updated strategy is partially locked, and the rest of the strategy can continue to be evaluated;
[0075] (2) Generate a new matching tree and perform strategy update and maintenance on the newly generated matching tree;
[0076] Since the attribute-based access control method is adopted, the specific content of a certain attribute that has been changed in the update strategy is analyzed first:
[0077] 1) First, determine whether the resource attribute, operation attribute, and time attribute have changed. If the specific contents of the three attributes have not changed, or the content of one of the three attributes has partially changed, then perform operations 2) and 3); if one or more of the three attributes have changed, and the content of the attribute is completely different from that contained in the matching tree, then directly remove the policy from the matching tree without performing the next step;
[0078] 2) Determine whether the utility attribute of the strategy has changed. If the utility attribute remains unchanged, identify the specific content of the remaining attributes that have changed and merge them with the existing attribute content in the matching tree as the updated attribute content;
[0079] 3) If the utility attribute changes, identify the specific attribute content that has changed, then use the updated attribute and the original attribute content in the matching tree to take the union and intersection, and subtract the intersection from the union to obtain the updated content;
[0080] (3) When the local maintenance of the strategy update is completed, the state value is set to 1, and the new matching tree that has been maintained is used to replace the original matching tree;
[0081] Step 5: Respond to the access request and call the corresponding microservice resources based on the judgment result.
Claims
1. A dynamic access control policy evaluation method for microservices, characterized by: The following steps are involved: Step 1: Receive and process access requests; Step 1.1: The user requests to access microservice resources and issues an access request; The user end includes mobile phone and PC users, and the access request includes subject attributes, resource attributes, operation attributes, time attributes, and environment attributes; Step 1.2: The policy enforcement point PEP in the service gateway receives and processes the user's access request and forwards the request to the policy decision point PDP; Step 1.3: The policy decision point PDP at the service gateway receives and forwards the access request to the policy administration point PAP; Step 2: Streamlining and optimization of strategies; First, the required access control policies are extracted based on the received access requests; then the policies are streamlined and optimized, and the attribute-based Jaccard similarity calculation method is used to eliminate conflicts and redundant policies; Step 2.1: Extract the policy set required by the request based on the received access request; According to the key attribute information in the access request, a policy set with key attribute matching is selected from the policy library of the service gateway. Key attribute matching means that the key attribute in the access request matches the corresponding attribute in the access control policy or contains the same attribute content item; Step 2.2: Use the attribute-based Jaccard similarity calculation method to streamline the optimization strategy set; Step 3: Build a matching tree; Step 4: Evaluate the dynamic access control policy of microservices based on the matching tree; Step 4.1: Check whether there is a policy update in the policy to be evaluated. If there is no policy update, perform policy evaluation and give a judgment result; Step 4.2: Check whether there is a policy update in the policy to be evaluated. If there is a policy update, perform the following operations; (1) Set the matching tree state value to 0, lock the updated strategy locally, and continue to evaluate the strategy in the rest of the tree; (2) Generate a new matching tree and perform strategy update and maintenance on the newly generated matching tree; (3) When the local maintenance of the strategy update is completed, the state value is set to 1, and the new matching tree that has been maintained is used to replace the original matching tree; Step 5: Respond to the access request and call the corresponding microservice resources based on the judgment result.
2. The microservice-oriented dynamic access control strategy evaluation method according to claim 1 is characterized in that: The step 2.2 uses the attribute-based Jaccard similarity calculation method to simplify the optimization strategy set, including the following steps: (1) For the selected strategies, the attribute-based Jaccard similarity calculation method is used, P i and P j are any two strategies required for strategy evaluation. The similarity coefficient is the ratio of the intersection and union of the attributes in the two strategies. The ratio is between 0 and 1. The larger the Jaccard coefficient value, the higher the similarity of the attributes compared in the two strategies. (2) Preliminary grouping of access control policies based on resource attributes, operation attributes, and time attributes in the policies. Grouping those with completely identical resource attributes, operation attributes, and time attributes into one group and those with partially identical resource attributes into another group. (3) Conduct fine-grained classification discussions based on other attributes in the strategy; 1) Simplification of conflicting strategies: If both strategies belong to the strategy set required for strategy evaluation, the Jaccard coefficient values of their resource attributes, operation attributes, and time attributes are all 1, and their utility attributes are opposite, one allows the operation and the other denies the operation, then the conditions for refining the conflicting strategies are met, and the following operations are performed: If two strategies P i and P j The Jaccard coefficient values of other attributes are all 1. Considering security, the utility attribute is chosen to be rejected first, and deleting the utility attribute is a permitted strategy; If the subject attributes and environment attributes of the two strategies have an intersection, delete the intersection of the attributes in the two strategies and update P i and P j The attribute set of the strategy is the remaining attribute set in the two strategies. i and P j The strategies continue to use the original utility attributes respectively; 2) Simplification of redundant strategies; if two strategies P i and P j All of them belong to the policy set required for policy evaluation, and their resource attributes, operation attributes, and time attributes are partially the same, and P i and P j The utility attributes of are the same, both are allowed or denied, then the conditions for redundant strategy refinement are met, and the following operations are performed: If two strategies P i and P j If the Jaccard coefficient values of resource attributes, operation attributes, time attributes, subject attributes, and environment attributes are all 1, then the deletion strategy P j ; If two strategies P i and P j The Jaccard coefficient values of resource attributes, operation attributes, and time attributes are 1, and the Jaccard coefficient values of subject attributes and environmental attributes are between 0 and 1, then the new attribute range is P i and P j The union of the attributes of P and assign the new attribute range to P i , and finally delete P j .
3. The microservice-oriented dynamic access control strategy evaluation method according to claim 1 is characterized in that: The step 3 constructs a matching tree, comprising the following steps: Use matching trees to evaluate dynamic access control policies. Matching trees are an efficient policy index structure that can guarantee the original semantics to the greatest extent. The process of constructing a matching tree is as follows: (1) Determine the definitions of all nodes in the matching tree; the node types in the matching tree include strategy set nodes, policy nodes, and rule nodes; the root node is the strategy set node, and the following layers are the policy nodes and rule nodes, respectively. The rule node is a leaf node, which is the smallest unit of the policy primitive; (2) Determine the relationship between nodes; the relationship between nodes includes the parent-child node relationship, represented by the letter P, and the sibling node relationship, represented by the letter B. Suppose there are nodes a and b, and a is the parent node of b and b is the child node of a, then there is a relationship aPb; suppose there is also a node c, and nodes b and c are sibling nodes, then there is a relationship bBc; (3) Specify the node adaptation conditions. When a policy contains the attribute information required by a request, the policy is the adaptation node of the request. When the attribute element in the policy is empty, the policy is adapted to all requests. (4) Determine the path information in the matching tree. In the process of matching from the root node of the tree to a leaf node, the set of all nodes passed is the path of the tree. Each path is a specific rule of the policy set. The leaf node stores the specific rule information of the path, that is, the decision result path information. (5) Determine the judgment result path; the request traverses the matching tree from the root node in depth-first order. When the request matches from the root node to the rule node and all nodes are adapted, the path information stored in the rule node is the corresponding judgment result; or when the request traverses all nodes and no result is matched, that is, there is no judgment result, the request is rejected; (6) Constructing an index structure of the judgment result path information; constructing a judgment result path information index structure from the judgment result path information in all leaf nodes, removing duplicate information during the construction process, and constructing a simplified judgment result path index structure.