A data access method and device based on software-defined perimeter

Abstract

The present invention provides a data access method and device based on software-defined boundaries, which combines a software-defined boundary controller with a microservice gateway and runs independently outside the gateway. It can achieve continuously evolving security protection through unlimited expansion, and provide more security support for systems under the microservice architecture. By establishing black and white list verification, device authentication, user identity authentication and user authority authentication, multiple levels ensure that only legitimate devices and users can access resources. After the verification is passed, the access request is flow-limited to prevent network congestion and resource abuse caused by too many requests. The comparison engine is used to compare access feature data and behavioral feature data to detect and prevent potential attack behaviors and risky operations in a timely manner. The risk level of the access request is calculated through a pre-trained risk assessment model, and high-risk access flows are intercepted and recorded to effectively control potential threats.

Description

Technical Field

[0001] The present invention relates to the field of data communication technology, and in particular to a data access method and device based on software-defined boundaries. Background Art

[0002] With the rapid development of the internet, more and more businesses and organizations want their business systems to be available online in some way. They are deploying firewalls / NAT devices between their internal networks and the internet to create security zones, internal security zones, isolated zones, and untrusted zones (the internet). However, as businesses and organizations' needs become increasingly complex, they may simultaneously operate internal networks, remote offices, mobile devices, and cloud services. This results in the loss of a single, identifiable boundary within the enterprise or organization, leading to the birth of the "zero trust" network architecture.

[0003] The microservices framework, a popular system architecture currently adopted by many enterprises and organizations, is characterized by its high practicality and ease of scalability. The gateway within the microservices framework is responsible for verifying and protecting access to API (Application Programming Interface) services, and serves as the last line of defense for an enterprise or organization's business systems in a "zero trust" network. Improving the security of the gateway within the microservices architecture will undoubtedly improve overall system security. However, existing technologies lack a clear network data access solution for implementing a "zero trust network" by leveraging gateways within a microservices framework. Summary of the Invention

[0004] In view of this, an embodiment of the present invention provides a data access method and device based on software-defined boundaries to eliminate or improve one or more defects in the existing technology and solve how to combine the software-defined boundary architecture and microservice gateway to realize the construction of a zero-trust network architecture for business systems.

[0005] One aspect of the present invention provides a data access method based on a software-defined boundary. The method is used to run on a software-defined boundary gateway. The software-defined boundary gateway includes a software-defined boundary controller and a microservice gateway. The software-defined boundary gateway connects a client and a server. The method includes the following steps:

[0006] The microservice gateway serves as an access layer to receive access requests sent by the client, wherein the access requests are marked with the client's device information and user information; the device information includes the IP address, device identifier, and device space information; the user information includes the user identity identifier and permission information;

[0007] The access layer performs a blacklist and whitelist check on the device information and the user information, and performs flow control and audit management on the access request if the check passes;

[0008] The software-defined boundary controller acts as a control layer to perform authentication management on the device information and the user information, including device authentication, user identity authentication, and user authority authentication. If the authentication is successful, the access flow corresponding to the access request is preprocessed, access feature data and behavior feature data are divided, and data serialization and vectorization are performed; the access feature data and the behavior feature data are handed over to the comparison engine, and the access feature data is compared with the data in the preset local network attack feature library for similarity to check for abnormal access with attack behavior, and the behavior feature data is compared with the data in the preset local personal behavior portrait library for similarity to check for abnormal access with risky operations; if there is no abnormal access, the access flow is handed over to the pre-trained risk assessment model to calculate the risk level, and the access flow belonging to high risk is intercepted and marked as accessible and recorded in the log. Otherwise, the microservice gateway acts as the distribution layer to forward it to the server.

[0009] In some embodiments, the flow control includes: counting the access requests, rejecting or queuing the access flows that exceed the set threshold, limiting the number of requests and smoothing the traffic; the audit management includes: collecting external logs and obtaining the analysis engine.

[0010] In some embodiments, the method further includes: obtaining the latest standard network attack feature library based on a first preset link, and updating the local network attack feature library according to a first preset time node; obtaining the latest standard personal behavior portrait library based on a second preset link, and updating the local personal behavior portrait library according to a second preset time node; and, the comparison engine uses cosine similarity or Euclidean distance for similarity comparison.

[0011] In some embodiments, the risk assessment model training step includes:

[0012] Obtaining a training sample set, the training sample set including multiple sample access flows and annotating risk levels, the risk levels including normal, low risk, medium risk, and high risk;

[0013] Performing data cleaning on the sample access stream to fill in missing values and remove outliers;

[0014] An initial neural network model is obtained, the initial neural network model is trained using the training sample set, and a cross entropy loss is constructed to update the model parameters to obtain the risk assessment model; the initial neural network model includes: a decision tree, a random forest, a support vector machine or a convolutional neural network.

[0015] In some embodiments, the method further includes: storing the access flows and their corresponding risk levels generated during operation in a local database, and incorporating the access flows and risk levels in the local database as samples into the training sample set at preset time intervals, and using the merged training sample set to train and update the risk assessment model.

[0016] In some embodiments, the method further comprises:

[0017] The distribution layer performs load balancing to balance requests distributed to backend services;

[0018] The distribution layer performs routing management and distributes data along the preferred path;

[0019] The distribution layer performs circuit breaker management to limit the access flow when the backend service fails or is under high load;

[0020] The distribution layer performs cache management to store and reuse frequently accessed data, reducing the load and response time of backend services.

[0021] In some embodiments, the method performs data serialization and vectorization, including:

[0022] JSON serialization or Pickle serialization is performed on the data, and one-hot encoding or word embedding encoding is performed on the data.

[0023] On the other hand, the present invention also provides a data access gateway based on software-defined boundaries, including a software-defined boundary controller and a microservice gateway, characterized in that the software-defined boundary controller and the microservice gateway are used to store and execute computer programs / instructions, and when the computer program / instructions are executed, the gateway implements the steps of the above method.

[0024] On the other hand, the present invention further provides a computer-readable storage medium having a computer program / instruction stored thereon, wherein the computer program / instruction implements the steps of the above method when executed by a processor.

[0025] On the other hand, the present invention also provides a computer program product, comprising a computer program / instruction, which implements the steps of the above method when executed by a processor.

[0026] The beneficial effects of the present invention are at least:

[0027] The data access method and device based on software-defined boundaries described in the present invention combine the software-defined boundary controller with the microservice gateway, and operate independently outside the gateway. It can achieve continuously evolving security protection through infinite expansion and provide more security support for systems under the microservice architecture.

[0028] Furthermore, through the establishment of blacklist and whitelist verification, device authentication, user identity authentication, and user permission authentication, we ensure at multiple levels that only legitimate devices and users can access resources. After verification, access requests are throttled to prevent network congestion and resource abuse caused by excessive requests.

[0029] Furthermore, a comparison engine compares access signature data with behavioral signature data to promptly detect and prevent potential attacks and risky operations. A pre-trained risk assessment model calculates the risk level of access requests, intercepting and recording high-risk access flows to effectively control potential threats.

[0030] Furthermore, upon receiving a client's access request, the entire method rapidly performs verification, authentication, pre-processing, comparison, and risk assessment, ensuring timely processing. If the risk assessment passes, the access flow is quickly forwarded to the server via the distribution layer, ensuring smooth business operations.

[0031] Additional advantages, objects, and features of the present invention will be set forth in part in the following description and will become apparent to those skilled in the art upon examination of the following or may be learned from practice of the present invention. The objects and other advantages of the present invention may be realized and obtained by the structures particularly pointed out in the description and drawings.

[0032] Those skilled in the art will understand that the purposes and advantages that can be achieved by the present invention are not limited to the above specific descriptions, and the above and other purposes that can be achieved by the present invention will be more clearly understood based on the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The drawings described herein are used to provide a further understanding of the present invention, constitute a part of this application, and do not constitute a limitation of the present invention. In the drawings:

[0034] Figure 1 This is a logical diagram of a data access method based on software-defined boundaries according to an embodiment of the present invention.

[0035] Figure 2 This is a schematic diagram of the logical architecture of a software-defined border gateway according to an embodiment of the present invention.

[0036] Figure 3This is a schematic diagram of the client-to-gateway deployment mode in the software-defined border gateway according to an embodiment of the present invention.

[0037] Figure 4 This is a logical diagram of access flow control in a software-defined gateway according to an embodiment of the present invention.

[0038] Figure 5 This is a schematic diagram of the access flow process in authentication management in a software-defined gateway according to an embodiment of the present invention.

[0039] Figure 6 This is a logical diagram of the risk management function in the software-defined gateway according to an embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments and the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0041] It should also be noted that, in order to avoid obscuring the present invention due to unnecessary details, the accompanying drawings only show structures and / or processing steps closely related to the solutions according to the present invention, while other details that are not closely related to the present invention are omitted.

[0042] It should be emphasized that the term "include / comprises" when used herein refers to the existence of features, elements, steps or components, but does not exclude the existence or addition of one or more other features, elements, steps or components.

[0043] It should also be noted that, unless otherwise specified, the term "connection" herein may refer not only to a direct connection but also to an indirect connection involving an intermediate.

[0044] In order to build a "zero trust" network architecture for business systems and improve the security of business systems, the present invention provides a data access method based on a software-defined boundary. The method is used to run on a software-defined boundary gateway. The software-defined boundary gateway includes a software-defined boundary controller and a microservice gateway. The software-defined boundary gateway connects the client and the server. The method includes the following steps S101 to S103:

[0045] Step S101: The microservice gateway, as the access layer, receives an access request sent by the client. The access request is marked with the client's device information and user information; the device information includes the IP address, device identifier, and device space information; the user information includes the user identity identifier and permission information.

[0046] Step S102: The access layer performs a blacklist and whitelist check on the device information and user information. If the check passes, the access request is subjected to flow control and audit management.

[0047] Step S103: The software-defined boundary controller acts as the control layer to perform authentication management on device information and user information, including device authentication, user identity authentication, and user authority authentication. If the authentication is successful, the access flow corresponding to the access request is preprocessed, access feature data and behavior feature data are divided, and data serialization and vectorization are performed; the access feature data and behavior feature data are handed over to the comparison engine, and the access feature data is compared with the data in the preset local network attack feature library for similarity to check for abnormal access with attack behavior, and the behavior feature data is compared with the data in the preset local personal behavior portrait library for similarity to check for abnormal access with risky operations; if there is no abnormal access, the access flow is handed over to the pre-trained risk assessment model to calculate the risk level, and the access flow belonging to high risk is intercepted and marked as accessible and recorded in the log. Otherwise, the microservice gateway acts as the distribution layer to forward it to the server.

[0048] It should be noted that the microservice framework splits the application into a set of small, independently deployed and collaborative services, each of which focuses on a specific business function and interacts through lightweight communication protocols (such as HTTP / REST); this framework supports independent development, deployment and expansion, improves the flexibility and maintainability of the system, enhances fault isolation capabilities, and promotes continuous integration and delivery to adapt to rapidly changing business needs.

[0049] like Figure 1 As shown in the figure, the microservices gateway exists independently of the system services within the microservices architecture, serving solely as a system that provides REST API interface services. Its primary function is to manage website access. Its primary responsibilities include request access, service aggregation, intermediary policies, and unified management. Intermediary policies include fundamental processing strategies for system security, external access verification, and access request caching.

[0050] In a microservice architecture, the use of a microservice gateway can reduce the exposure of microservice application clusters and improve the security of microservices. In addition, the gateway implements non-business functions such as access control and load balancing for each microservice, making it easier for operation and maintenance personnel to manage them.

[0051] Software-defined perimeter (SDP) is a network security approach based on a zero-trust model that protects network resources through default-deny policies, authentication and authorization, dynamic access control, and encrypted communications. SDP provides fine-grained access control, preventing unauthorized users and devices from seeing any resources on the network, thereby reducing the attack surface. Its features include multi-factor authentication, end-to-end encryption, dynamic resource allocation, and continuous monitoring to enhance network security and access control. SDP simplifies network architecture through virtualization and software-defined approaches, supports remote work and cloud computing, improves compliance, reduces operating costs, and increases operational efficiency, adapting to the security and flexibility needs of modern enterprises.

[0052] SDP focuses on protecting critical organizational resources, not the organizational perimeter. It defines and enforces risk-based, dynamic, identity-centric, and context-aware access policies across all network layers. Through logical dynamic control, it replaces traditional physical perimeter devices. In the SDP architecture shown in the figure above, all requests from the SDP initiating host must pass through the SDP controller. Only access flows authenticated by the SDP controller can retrieve data from the SDP receiving host. Therefore, the SDP controller is the "brain" of this solution, serving as the decision point for zero-trust policies and implementing identity authentication and access control.

[0053] In steps S101 and S102, the blacklist and whitelist management of access flows are implemented in the gateway through the following steps: First, define at least one blacklist and / or whitelist, the blacklist contains all IP addresses, domain names or user identifiers that need to be blocked, and the whitelist contains all IP addresses, domain names or user identifiers that need to be released. Then, integrate the blacklist check module and the whitelist check module in the gateway configuration; each time there is an access request, first check whether the source of the request is in the blacklist. If it is in the blacklist, the request is directly rejected and the relevant logs are recorded for review; then check whether the source of the request is in the whitelist, and if it is, it is directly released. Finally, regularly update and maintain the blacklist and whitelist to deal with new security threats and dynamically changing attack sources. Through these steps, bad traffic can be effectively prevented from entering the network and the security of the system can be guaranteed.

[0054] In some embodiments, flow control includes: counting access requests, rejecting or queuing access flows that exceed the set threshold, limiting the number of requests and smoothing the flow; audit management includes: collecting external logs and obtaining the analysis engine.

[0055] Specifically, the microservice gateway acts as the access layer and implements current limiting control, which can be done through the following steps:

[0056] 1. Determine the rate limiting strategy: Determine the rate limiting strategy based on business needs, such as the maximum number of requests allowed per second, the maximum number of requests per minute, etc. The strategy can be based on dimensions such as IP, user, and interface.

[0057] 2. Configure rate limiting rules: Configure rate limiting rules in the gateway. Many gateways and API management tools (such as NGINX, Kong, Zuul, etc.) support the configuration of rate limiting rules. Rules can include: maximum number of requests per second, per minute, and per hour; rate limiting rules for different users or IP addresses; rate limiting rules for different interfaces or paths;

[0058] 3. Counter implementation: Implement a counter to track the number of requests. You can use memory storage, distributed cache (such as Redis), or other persistent storage to save the request count.

[0059] 4. Request interception and rate limiting: When a request reaches the gateway, it first checks whether the current request count exceeds the rate limiting threshold. If not, the request is allowed to proceed and the counter is updated. If it exceeds, a rate limiting response (such as HTTP 429 Too Many Requests) is returned.

[0060] 5. Dynamic Adjustment and Monitoring: Regularly monitor throttling and collect throttling data to analyze and adjust throttling strategies. Alarms can be set up to trigger when the number of requests approaches the throttling threshold, prompting administrators to make necessary adjustments.

[0061] 6. Cache and distributed support: For distributed systems, you can use distributed caches (such as Redis) to implement global throttling and ensure consistency across multiple nodes. You can also consider using sliding window algorithms, token bucket algorithms, and other algorithms to optimize throttling.

[0062] Through the above steps, current limiting control can be effectively implemented in the gateway to prevent system overload caused by excessive sudden requests and ensure service stability and availability.

[0063] Furthermore, the audit management function of the access layer is connected to the log collection and analysis engine to provide support for the evolution of the system.

[0064] In step S103 , the software-defined border controller serves as the control layer and mainly performs authentication management, risk management, and log management.

[0065] Authentication management primarily verifies device and user identities and permissions to confirm whether access requests meet permission requirements. Risk management audits and evaluates risky behaviors through a comparison engine and pre-trained risk assessment models. Log management records risky or abnormal access flows.

[0066] First, clean the original data and deal with missing values, outliers, duplicate data, etc.

[0067] The cleaned data is divided into access feature data and behavior feature data.

[0068] Access feature data typically describes the attributes of a single access request and may include the following: Timestamp, which marks the specific time of the access. User ID, which uniquely identifies the visitor. IP Address, which is the IP address that initiated the request. URL Request, which marks the specific URL accessed. HTTP Method, which includes GET and POST. User Agent, which includes browser and operating system information. Request Parameters, which mark the parameters carried in the request.

[0069] Behavioral feature data generally describes the user's behavior pattern over a period of time, and can specifically include the following: Session Duration, which marks the total duration of a user's single access session. Number of Requests, which indicates the total number of requests issued by the user in a session. Average Response Time, which indicates the average response time of user requests. Request Distribution, which marks the distribution of user requests across different URLs or time periods. Request Frequency, which marks the frequency of user requests per unit time. Error Rate, which marks the proportion of errors that occur in user requests.

[0070] In some embodiments, the method performs data serialization and vectorization, including: performing JSON serialization or Pickle serialization on the data, and performing one-hot encoding or word embedding encoding on the data.

[0071] Furthermore, to compare the similarity between access feature data and the data in the preset local network attack feature library, and the similarity between behavioral feature data and the data in the preset local personal behavior portrait library, it is first necessary to prepare access feature data, behavioral feature data, network attack feature library and personal behavior portrait library. Next, select a suitable similarity calculation method, such as Euclidean distance, cosine similarity, Jaccard similarity, etc., and preprocess the data (such as standardization and normalization). Then, calculate the similarity between the access feature data and the attack feature library data, as well as the similarity between the behavioral feature data and the personal behavior portrait library data. By setting a reasonable similarity threshold, abnormal access and potential attack behavior can be identified. Finally, generate a report and take corresponding security measures to deal with the detected abnormal behavior.

[0072] In some embodiments, the method further includes: obtaining the latest standard network attack feature library based on a first preset link, and updating the local network attack feature library according to a first preset time node; obtaining the latest standard personal behavior portrait library based on a second preset link, and updating the local personal behavior portrait library according to a second preset time node; and, the comparison engine uses cosine similarity or Euclidean distance for similarity comparison.

[0073] Furthermore, the access flow is finally evaluated through a risk assessment model.

[0074] In some embodiments, the risk assessment model training steps include S201 to S203:

[0075] The process includes S201: obtaining a training sample set, where the training sample set includes a plurality of sample access flows and annotates risk levels, wherein the risk levels include normal, low risk, medium risk, and high risk.

[0076] Including S202: performing data cleaning on the sample access flow, filling in missing values and removing outliers.

[0077] Including S203: obtaining an initial neural network model, using a training sample set to train the initial neural network model, and constructing a cross entropy loss to update model parameters to obtain a risk assessment model; the initial neural network model includes: a decision tree, a random forest, a support vector machine or a convolutional neural network.

[0078] In some embodiments, the method further includes: storing the access flows and their corresponding risk levels generated during the operation process in a local database, and incorporating the access flows and risk levels in the local database as samples into a training sample set at preset time intervals, and using the merged training sample set to train and update the risk assessment model.

[0079] In some embodiments, the method further comprises:

[0080] The distribution layer performs load balancing to evenly distribute requests to backend services. Within the network, the gateway's load balancing function effectively distributes incoming and outgoing traffic to optimize resource utilization, maximize throughput, reduce response times, and avoid overloading individual resources. The following are specific methods for gateway load balancing access flows: round-robin, weighted round-robin, least connections, weighted least connections, IP hashing, and shortest response time.

[0081] The distribution layer performs routing management and distributes data along the preferred path. It first evaluates the pros and cons of available paths based on pre-set routing rules and real-time network status (such as bandwidth, latency, and packet loss), then selects the optimal path for data distribution. This includes regularly collecting path performance data, calculating the optimal path score, and dynamically adjusting the routing table to route packets along the highest-scoring path, ensuring optimal transmission efficiency and quality.

[0082] Circuit breaker management, performed by the distribution layer, is used to limit access traffic when backend services fail or are under high load. When the gateway performs circuit breaker management, it monitors the status of backend services (such as response time, error rate, etc.) in real time. When a service failure or high load is detected, the circuit breaker mechanism is triggered, temporarily stopping forwarding requests to the service and quickly returning a preset degraded response or error message. During this period, it will periodically attempt to restore the connection to ensure that the service returns to normal before re-accessing traffic to prevent the spread of the fault and ensure system stability.

[0083] The distribution layer performs cache management, storing and reusing frequently accessed data to reduce the load and response time of backend services. When the gateway performs cache management, it caches frequently accessed data in a local or distributed cache. When a new request arrives, it first checks whether the cache already has the corresponding data. If so, the cached content is directly returned. Otherwise, the request is forwarded to the backend service to obtain the data, store it in the cache, and then return the result to the client. This effectively reduces the load and response time of backend services, improving system performance and user experience.

[0084] On the other hand, the present invention also provides a data access gateway based on software-defined boundaries, including a software-defined boundary controller and a microservice gateway, characterized in that the software-defined boundary controller and the microservice gateway are used to store and execute computer programs / instructions, and when the computer program / instructions are executed, the gateway implements the steps of the above method.

[0085] On the other hand, the present invention further provides a computer-readable storage medium having a computer program / instruction stored thereon, wherein the computer program / instruction implements the steps of the above method when executed by a processor.

[0086] On the other hand, the present invention also provides a computer program product, comprising a computer program / instruction, which implements the steps of the above method when executed by a processor.

[0087] The present invention will be described below in conjunction with a specific embodiment:

[0088] This embodiment provides a software-defined boundary (SPD) microservice gateway, implements the function of an SDP controller in the microservice gateway, and adds an SDP control layer to the microservice gateway to implement the function of the SDP controller.

[0089] like Figure 2 As shown in Figure 1, the software-defined editing gateway is logically divided into three layers: the access layer, the SDP control layer, and the distribution layer. The access layer and the distribution layer implement the functions of a traditional microservice gateway, while the SDP control layer is embedded in the middle to implement the functions of the SDP controller.

[0090] Access layer: This layer primarily interacts with users (or front-end programs) and performs rough filtering of access flows. Key functions include blacklist and whitelist management, rate limiting, and audit management, which aggregates, analyzes, and displays logs from various layers. The access layer's audit management functions integrate with external log collection and analysis engines, supporting system evolution.

[0091] SDP Control Layer: This layer is the core functionality of the software-defined border gateway and primarily includes three functions: authentication management, risk management, and log management. Access flows undergo authentication management, and only those deemed legitimate enter the risk management module for risk assessment. The system records the authentication and assessment process, as well as high-risk access. Combined with an external machine learning engine, this creates a comprehensive risk protection system.

[0092] The distribution layer distributes relatively secure access flows filtered by the access layer and SDP control layer, completing other functions of the microservice gateway. These include load balancing, routing management, circuit breaker management, and cache management. Logs recorded by this layer are also fed into the access layer's audit management function for unified processing.

[0093] like Figure 3 As shown, in the SDP deployment model, a client-to-gateway deployment model is provided. In this model, the SDP gateway connects the initiating host and the accepting host.

[0094] In this mode, all servers are protected by the SDP gateway, so direct access by the initiating and receiving hosts is secure and has clear boundaries regardless of the underlying network topology.

[0095] Based on the SDP deployment model, the microservices gateway is integrated with the SDP controller. After integration, identity authentication functions are integrated into the SDP controller, which is then deployed independently. This allows the SDP controller to utilize more resources and achieve more stringent protection.

[0096] Reference Figure 1 The SDP controller can use an independent database, machine learning algorithm engine, and log analysis engine to achieve more complete identification of network attack behaviors. This deployment architecture provides more possibilities for the security protection of the SDP microservice gateway.

[0097] The biggest difference between an SDP microservices gateway and a traditional microservices gateway is the addition of the SDP control layer. Therefore, the functions implemented by the SDP control layer are the core functions of software-defined edge microservices. The SDP control layer has three main functions: authentication management, risk management, and log management.

[0098] Authentication management mainly implements the "identity recognition" problem of access flow. After completing the legitimacy authentication of the device and identity, permissions are assigned according to the user's identity. Users can only access the background services allowed by the permissions.

[0099] Risk management uses machine learning algorithms to form an intelligent engine, which is combined with a known high-risk network attack feature library to identify network attack behaviors. At the same time, relevant algorithms are used to form personnel portraits based on the system usage habits of individuals and devices, and abnormal behaviors of personnel operations are identified, thereby forming a risk identification mechanism.

[0100] Ultimately, the results of authentication and risk identification will be recorded to form a log. On the one hand, it will serve as a data source for risk management. On the other hand, it will be aggregated to the interface layer to form a unified log of gateway access as one of the basic data for audit management, providing a basis for system evolution.

[0101] When the client sends an access request, the access data flow enters the gateway, first through whitelist confirmation and flow limiting filtering, and then begins to determine the legitimacy of the device and identity. After the device and identity are successfully authenticated, permissions are assigned to the access flow to ensure that the background application is minimized. Then, after risk management analyzes the access flow and user access habits, it is determined that the access flow is secure, load balancing, cache management and other functions are enabled, and forwarding to the application service begins. In addition, the authentication process and risk management identification process are logged, and the logs are aggregated for unified analysis. The software-defined gateway access control function is implemented as follows: Figure 4 shown.

[0102] The client access flow should cover relevant information of the device and user when entering the gateway. After passing the gateway's blacklist and whitelist control and flow control, the device information should be authenticated first. The authentication content includes the device's IP address, device identification, device space information, etc., and then the user authentication will begin. After the authentication is completed, the permission information is obtained. The device information, user information and permission information are combined with other information of the access flow to enter the risk management module.

[0103] like Figure 5 As shown, the authentication management module is similar to the system login and identity authentication modules. Only after the device and user authentication are successful and the permissions are successfully obtained, will the risk management module be entered to start access risk assessment.

[0104] Relying on the deployment architecture of the SDP microservice gateway, the implementation of the risk management module is as follows: Figure 6 As shown in the figure, legitimate access flows that have passed authentication management verification enter the risk management module, where data preprocessing is performed. The data is divided into access signature data and behavioral signature data, and serialization and vectorization are performed simultaneously. Access signature data primarily includes spatial and temporal characteristics of the access flow; behavioral signature data is user-related and primarily includes permission and operation characteristics. Both types of data are then submitted to the signature comparison engine, which uses a database of network attack signatures and individual behavior signatures to identify the access flow. After confirming that there are no abnormal accesses, the data is submitted to the risk assessment model for evaluation. If the access flow is assessed as high risk, it is logged. After unified processing by the audit management module, the assessment results are displayed to the system administrator. Once the system administrator confirms the access as an attack, the data is fed back into the machine learning algorithm engine as part of the training data. Once the training is complete, the risk assessment model is updated promptly. Furthermore, the individual behavior profile library can be connected to human resources systems and continuously refined using its own machine learning engine based on changes in permissions. The network attack signature library can obtain professional data from professional institutions or from its own log analysis results.

[0105] This embodiment introduces the concept of software-defined boundaries into the microservice gateway, and establishes a basis for identity authentication as a function that the microservice gateway must provide. The SDP controller is combined with the microservice gateway and runs independently outside the gateway. It can achieve continuously evolving security protection through unlimited expansion, providing more security support for systems under the microservice architecture. As a key part of the microservice architecture, the microservice gateway plays a vital role in the process of program interaction. Using the concept of the software-defined boundary (SDP) architecture to strengthen the microservice gateway not only ensures that the system developed with the microservice architecture has good security from the beginning, but also provides natural support for organizations and enterprises to deploy systems in a zero-trust network.

[0106] Corresponding to the above method, the present invention also provides an apparatus / system, which includes a computer device, the computer device includes a processor and a memory, the memory stores computer instructions, and the processor is used to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the apparatus / system implements the steps of the method described above.

[0107] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the aforementioned edge computing server deployment method. The computer-readable storage medium may be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the art.

[0108] To sum up, the data access method and device based on software-defined boundaries described in the present invention combine the software-defined boundary controller with the microservice gateway, and run independently outside the gateway. It can achieve continuously evolving security protection through infinite expansion and provide more security support for systems under the microservice architecture.

[0109] Furthermore, through the establishment of blacklist and whitelist verification, device authentication, user identity authentication, and user permission authentication, we ensure at multiple levels that only legitimate devices and users can access resources. After verification, access requests are throttled to prevent network congestion and resource abuse caused by excessive requests.

[0110] Furthermore, a comparison engine compares access signature data with behavioral signature data to promptly detect and prevent potential attacks and risky operations. A pre-trained risk assessment model calculates the risk level of access requests, intercepting and recording high-risk access flows to effectively control potential threats.

[0111] Furthermore, upon receiving a client's access request, the entire method rapidly performs verification, authentication, pre-processing, comparison, and risk assessment, ensuring timely processing. If the risk assessment passes, the access flow is quickly forwarded to the server via the distribution layer, ensuring smooth business operations.

[0112] It should be understood by those skilled in the art that the various exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is specifically performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present invention are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0113] It should be understood that the present invention is not limited to the specific configurations and processes described above and illustrated in the figures. For the sake of brevity, a detailed description of known methods is omitted. In the above embodiments, several specific steps are described and illustrated as examples. However, the method of the present invention is not limited to the specific steps described and illustrated. Those skilled in the art may make various changes, modifications, and additions, or change the order of the steps after understanding the spirit of the present invention.

[0114] In the present invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or replace features of other embodiments.

[0115] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations to the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A data access method based on software-defined boundaries, characterized in that: The method is used to run on a software-defined border gateway, the software-defined border gateway including a software-defined border controller and a microservice gateway, the software-defined border gateway connecting a client and a server, and the method includes the following steps: The microservice gateway serves as an access layer to receive access requests sent by the client, wherein the access requests are marked with the client's device information and user information; the device information includes the IP address, device identifier, and device space information; the user information includes the user identity identifier and permission information; The access layer performs a blacklist and whitelist check on the device information and the user information, and performs flow control and audit management on the access request if the check passes; The software-defined boundary controller acts as a control layer to perform authentication management on the device information and the user information, including device authentication, user identity authentication, and user authority authentication. If the authentication is successful, the access flow corresponding to the access request is preprocessed, access feature data and behavior feature data are divided, and data serialization and vectorization are performed; the access feature data and the behavior feature data are handed over to the comparison engine, and the access feature data is compared with the data in the preset local network attack feature library for similarity to check for abnormal access with attack behavior, and the behavior feature data is compared with the data in the preset local personal behavior portrait library for similarity to check for abnormal access with risky operations; if there is no abnormal access, the access flow is handed over to the pre-trained risk assessment model to calculate the risk level, and the access flow belonging to high risk is intercepted and marked as accessible and recorded in the log. Otherwise, the microservice gateway acts as the distribution layer to forward it to the server.

2. The data access method based on software-defined boundaries according to claim 1, characterized in that: The flow control includes: counting the access requests, rejecting or queuing the access flows that exceed the set threshold, limiting the number of requests and smoothing the flow; the audit management includes: collecting external logs and obtaining the analysis engine.

3. The data access method based on software-defined boundaries according to claim 1, characterized in that: The method further comprises: Obtaining the latest standard network attack signature database based on the first preset link, and updating the local network attack signature database according to the first preset time node; Obtaining the latest standard personal behavior portrait library based on the second preset link, and updating the local personal behavior portrait library according to the second preset time node; Furthermore, the comparison engine uses cosine similarity or Euclidean distance for similarity comparison.

4. The data access method based on software-defined boundaries according to claim 1, characterized in that: The training steps of the risk assessment model include: Obtaining a training sample set, the training sample set including multiple sample access flows and annotating risk levels, the risk levels including normal, low risk, medium risk, and high risk; Performing data cleaning on the sample access stream to fill in missing values and remove outliers; An initial neural network model is obtained, the initial neural network model is trained using the training sample set, and a cross entropy loss is constructed to update the model parameters to obtain the risk assessment model; the initial neural network model includes: a decision tree, a random forest, a support vector machine or a convolutional neural network.

5. The data access method based on software-defined boundaries according to claim 4, characterized in that: The method also includes: storing the access flows and their corresponding risk levels generated during the operation process in a local database, and incorporating the access flows and risk levels in the local database as samples into the training sample set at preset time intervals, and using the merged training sample set to train and update the risk assessment model.

6. The data access method based on software-defined boundaries according to claim 1, characterized in that: The method further comprises: The distribution layer performs load balancing to balance requests distributed to backend services; The distribution layer performs routing management and distributes data along the preferred path; The distribution layer performs circuit breaker management to limit the access flow when the backend service fails or is under high load; The distribution layer performs cache management to store and reuse frequently accessed data, reducing the load and response time of backend services.

7. The data access method based on software-defined boundaries according to claim 1, characterized in that: The method performs data serialization and vectorization, including: JSON serialization or Pickle serialization is performed on the data, and one-hot encoding or word embedding encoding is performed on the data.

8. A data access gateway based on software-defined boundaries, comprising a software-defined boundary controller and a microservice gateway, characterized in that: The software-defined border controller and the microservice gateway are used to store and execute computer programs / instructions. When the computer programs / instructions are executed, the gateway implements the steps of the method according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images