Access control methods and related equipment for microservice systems

Abstract

This application provides a microservice system access control method and related equipment. When it is necessary to configure access control rules for a microservice system, the method provided in this application can dynamically analyze the request patterns of data packets generated during the runtime of the microservice application, accurately extract all legal access rules of the microservice system, and resolve ambiguities. It can analyze multiple request patterns without relying on the source code corresponding to the microservice system to analyze and configure the access control rules of the microservice system. It can efficiently solve the configuration of access control rules corresponding to each service of the microservice system, effectively solve the problem of updating access control rules due to version updates of various services of the microservice system, and execute access control rules in front of the kernel network protocol stack of the worker node, which can effectively reduce system overhead and improve system stability and performance.

Description

Technical Field

[0001] This application relates to the field of system control technology, and in particular to a microservice system access control method and related equipment. Background Technology

[0002] With the iterative development of computer software architecture, microservice architecture, as a system architecture that breaks down a large, monolithic application module into multiple functionally specialized application modules, has emerged. In practical applications, these decomposed application modules are also called services. Breaking down a large, monolithic application module into multiple functionally specialized services allows each service to be developed, deployed, maintained, and horizontally scaled independently. In the current era of cloud services, microservice architecture, one of the core technologies of cloud-native computing, is widely used. However, after breaking down the entire application into multiple independent services, each service needs to use message communication to collaborate and access the functions of other services. Common message communication protocols in microservice architecture are HTTP and gRPC. This reliance on message communication provides attackers with new attack methods. By exploiting publicly accessible services or intruding into vulnerable services, attackers can bypass commonly used authentication mechanisms in the field of computer security and access private data that other services do not publicly disclose, using the identity of the hijacked service.

[0003] Traditional methods involve administrators manually configuring access control rules between services, relying on firewalls or access control mechanisms provided by cloud service mesh tools like Istio to restrict requests from one service to another, thereby limiting attackers' access to private data by exploiting vulnerable services within a microservice system. However, due to the characteristics of microservice architectures, the rapid and numerous version iterations of various services, and the ever-changing and complex collaboration relationships between services, manually maintaining and configuring access control rules requires administrators to have a clear understanding of the service request topology and to match the configuration speed with service version updates. These requirements make the cost extremely high in a large microservice system environment. Furthermore, traditional access restriction methods, such as setting up firewalls or service mesh mechanisms like Istio, require processing through the kernel network protocol stack, which wastes system resources if the request is illegal. Therefore, how to restrict access requests without going through the network protocol stack, and how to automatically analyze and configure corresponding access rules based on the request relationships between services and service version updates, is a widely recognized concern. Summary of the Invention

[0004] This application aims to at least address one of the aforementioned technical deficiencies. In view of this, this application provides a microservice system access control method and related equipment to address the technical deficiency in the prior art that makes it difficult to automatically analyze and configure the corresponding access rules based on the request relationships between services and the updates of service versions.

[0005] A microservice system access control method is provided, applied to a microservice system including a control node and at least one worker node. The method includes:

[0006] The working node collects the data to be processed and forwards the data to be processed to the control node.

[0007] The control node receives the data to be processed transmitted by the worker node, creates access control rules for the microservice system based on the data to be processed, and sends the target dictionary corresponding to the created access control rules for the microservice system to the worker node.

[0008] After the working node receives the target dictionary from the control node, it determines the mapping relationship between the target dictionary and its kernel-mode access control program.

[0009] Using the worker node, based on the target dictionary, it is analyzed whether the message data transmitted from other services of the microservice system to the worker node meets the access control rules corresponding to the target dictionary;

[0010] If the message data transmitted by other services of the microservice system to the worker node satisfies the access control rules corresponding to the target dictionary, then other services of the microservice system are allowed to access the worker node.

[0011] If the message data transmitted by other services of the microservice system to the worker node does not meet the access control rules corresponding to the target dictionary, then other services of the microservice system are denied access to the worker node;

[0012] Determine whether the versions of each service in the microservice system have been updated;

[0013] If the microservice system has a service with a version update, the target data corresponding to the version update service is transmitted to the control node through the worker node, and the access control rules corresponding to the version update service are updated through the control node.

[0014] Preferably, the step of collecting data to be processed through the working node and forwarding the data to be processed to the control node includes:

[0015] The target kernel mode data capture program corresponding to the working node is used to mount the target fast data path;

[0016] Analyze whether the application layer messages of the working node contain preset message information;

[0017] If there is a target worker node in the microservice system whose application layer message includes the preset message information, then the target message information sent by other services of the microservice system to the target worker node is captured from the corresponding application layer message of the worker node.

[0018] On the user-space program of the target working node, the target seven-tuple data is extracted from the target message information, and the extracted target seven-tuple data is transmitted to the control node as data to be processed.

[0019] Preferably, the step of receiving the data to be processed transmitted by the worker node through the control node and creating access control rules for the microservice system based on the data to be processed includes:

[0020] The control node receives the target seven-tuple data transmitted by the target working node and maps the target seven-tuple data to the source service name and destination service name corresponding to the target seven-tuple data.

[0021] Based on the target seven-tuple data and the corresponding source service name and destination service name, map the target seven-tuple data and the corresponding source service name and destination service name into target five-tuple data;

[0022] A multi-way tree corresponding to the target quintuple data is constructed through the control node;

[0023] By using the control node, all paths of the multi-way tree corresponding to the target quintuple data are traversed to determine the access control rules corresponding to the target quintuple data as the access control rules of the microservice system.

[0024] Preferably, if the service is deployed on a container orchestration platform, the step of receiving the target 7-tuple data transmitted by the target worker node through the control node and mapping the target 7-tuple data to the source service name and destination service name corresponding to the target 7-tuple data includes:

[0025] The container orchestration platform determines the service IP and port information corresponding to the microservice system.

[0026] The service name dictionary is constructed by using the service IP and port information corresponding to the microservice system as the keys and the service name corresponding to the microservice system as the values.

[0027] Based on the service name dictionary, the source IP, source port, destination IP, and destination port in the target seven-tuple data are mapped to the source service name and destination service name corresponding to the target seven-tuple data.

[0028] Preferably, the step of constructing a multi-way tree corresponding to the target quintuple data through the control node based on the target 7-tuple data and the corresponding source service name and destination service name includes:

[0029] Through the control node, traverse all web page addresses corresponding to the application programming interfaces provided by each service in the microservice system;

[0030] Each webpage address corresponding to the application programming interface provided by each service in the microservice system is split into multiple tokens;

[0031] Based on each token derived from each webpage address corresponding to each service's application programming interface in the microservice system, and other data of the target quintuple data, a multi-branch tree corresponding to the target quintuple data is constructed.

[0032] Preferably, the rules for constructing the multi-way tree corresponding to the target quintuple data include:

[0033] Set the root node of the multi-way tree corresponding to the target quintuple data as a sentinel node;

[0034] Based on the characteristics of the microservice system architecture, the value of the second-level node of the multi-way tree corresponding to the target quintuple data is set as the target service name;

[0035] The third-level node of the multi-way tree corresponding to the target quintuple data is set to the HTTP version;

[0036] Set the fourth-level node of the multi-way tree corresponding to the target quintuple data to the HTTP method;

[0037] The fifth-level node of the multi-way tree corresponding to the target quintuple data and thereafter are constructed according to the order in which the tokens extracted from each web address appear.

[0038] Check if the value of the child node of the current node in the multi-way tree corresponding to the target quintuple data is the same as the value of the current token;

[0039] If the value of a child node of the current node in the multi-way tree corresponding to the target quintuple data is the same as the value of the current token, then update the current node of the multi-way tree corresponding to the target quintuple data to that child node, and update the current token of the multi-way tree corresponding to the target quintuple data to the next token.

[0040] If the value of the child node of the current node in the multi-way tree corresponding to the target quintuple data does not have a node with the same value as the current token, then create a node with the same value as the current token and add the newly created node as a child node of the current node, until the last token split from each web address corresponding to the application programming interface provided by each service in the microservice system is processed.

[0041] After processing the last token derived from each webpage address corresponding to the application programming interface provided by each service in the microservice system, a target URI termination node is created and added to the child node of the node corresponding to the last token. A node with the same value as the source service name is also created and added to the child node of the target URI termination node.

[0042] Preferably, the step of transmitting the target data corresponding to the version-updated service to the control node through the working node, and updating the access control rules corresponding to the version-updated service through the control node, includes:

[0043] The target data corresponding to the version update service is transmitted to the control node through the working node;

[0044] The control node receives the target data transmitted by the working node and updates the target multi-way tree corresponding to the version update service based on the target data.

[0045] The control node updates the access control rules corresponding to the target multi-way tree and deletes the access control rules of the target multi-way tree before the update.

[0046] A microservice system access control device is applied in a microservice system, the microservice system including a control node and at least one worker node, the device comprising:

[0047] The data collection unit is used to collect data to be processed through the working node and forward the data to be processed to the control node;

[0048] The rule creation unit is used to receive the data to be processed transmitted by the worker node through the control node, create access control rules for the microservice system based on the data to be processed, and send the target dictionary corresponding to the created access control rules for the microservice system to the worker node.

[0049] The mapping unit is used to determine the mapping relationship between the target dictionary and its kernel-mode access control program through the working node after the working node receives the target dictionary sent by the control node;

[0050] The first judgment unit is used to analyze, through the working node, whether the message data transmitted by other services of the microservice system to the working node meets the access control rules corresponding to the target dictionary;

[0051] An access permission unit is configured to allow other services of the microservice system to access the worker node when the execution result of the first judgment unit is that the message data transmitted by other services of the microservice system to the worker node satisfies the access control rules corresponding to the target dictionary.

[0052] The denial unit is used to deny other services of the microservice system from accessing the worker node when the execution result of the first judgment unit is that the message data transmitted by other services of the microservice system to the worker node does not meet the access control rules corresponding to the target dictionary;

[0053] The second judgment unit is used to determine whether the versions of each service in the microservice system have been updated;

[0054] The update unit is used to transmit the target data corresponding to the version-updated service to the control node through the worker node when the execution result of the second judgment unit is that there is a version-updated service in the microservice system, and to update the access control rules corresponding to the version-updated service through the control node.

[0055] A microservice system access control device includes: one or more processors, and memory;

[0056] The memory stores computer-readable instructions that, when executed by the one or more processors, implement the steps of the microservice system access control method as described above.

[0057] A readable storage medium storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of any of the microservice system access control methods described above.

[0058] As can be seen from the technical solutions described above, when it is necessary to analyze and configure access control rules for a microservice system, this application embodiment can provide a microservice system access control method, which can be applied to a microservice system. The microservice system can include a control node and at least one worker node. The method provided in this application embodiment can collect data to be processed through the worker node. This data can provide feedback on access to the microservice system. Therefore, after collecting the data to be processed, it can be forwarded to the control node. The control node can then receive the data transmitted from the worker node and create access control rules for the microservice system based on the data. Generally, creating access control rules for a microservice system involves creating a lookup dictionary for the rules. Therefore, after creating the access rules for the microservice system, the control node can further send the target dictionary corresponding to the created access control rules to the worker node for lookup. After receiving the target dictionary from the control node, the worker node can further determine the mapping relationship between the target dictionary and its kernel-mode access control program. This allows the work to be performed by the worker node... Based on the target dictionary, the method analyzes whether the message data transmitted by other services of the microservice system to the worker node meets the access control rules corresponding to the target dictionary. If the message data transmitted by other services of the microservice system to the worker node meets the access control rules corresponding to the target dictionary, it indicates that the service has the access permission, and other services of the microservice system can be allowed to access the worker node of the microservice system. If the message data transmitted by other services of the microservice system to the worker node does not meet the access control rules corresponding to the target dictionary, it indicates that the service does not have the permission to access the worker node, and other services of the microservice system can be denied access to the worker node of the microservice system. Furthermore, in practical applications, the version of a service may be updated due to application scenarios or user needs, and the corresponding access control rules also need to be updated in a timely manner. Therefore, the method provided in this application embodiment can also determine whether the versions of each service of the microservice system have been updated. If there are services with updated versions in the microservice system, it indicates that the access control rules corresponding to the updated services need to be updated. The target data corresponding to the updated services can be transmitted from the worker node to the control node, and the access control rules corresponding to the updated services can be updated through the control node.

[0059] As described above, when configuring access control rules for a microservice system, the method provided in this application can dynamically analyze the request patterns of data packets generated during the runtime of the microservice application, accurately extract all legal access rules of the microservice system, and resolve ambiguities in the natural language description of access control rules. It can analyze multiple request patterns without relying on the source code corresponding to the microservice system to analyze and configure its access control rules. This method efficiently solves the configuration of access control rules for each service within the microservice system and effectively addresses the issue of updating access control rules due to version updates of various services within the microservice system. Furthermore, since the method provided in this application does not rely on the source code corresponding to each service of the microservice system to analyze its access control rules, but only needs to analyze the underlying communication protocol used by the microservice system, it can execute access control rules before the kernel network protocol stack of the worker node, effectively reducing system overhead and improving system stability and performance. Attached Figure Description

[0060] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0061] Figure 1 A schematic diagram of an architecture for implementing access control in a microservice system, provided as an embodiment of this application;

[0062] Figure 2 A flowchart illustrating an implementation method for access control in a microservice system, provided as an embodiment of this application;

[0063] Figure 3 This application provides a schematic diagram of a control node processing data.

[0064] Figure 4 A schematic diagram of quintuple data provided in an embodiment of this application;

[0065] Figure 5 A schematic diagram of a microservice system architecture environment provided in this application embodiment;

[0066] Figure 6 This is a schematic diagram illustrating the structure of a microservice system access control device, as exemplified in an embodiment of this application.

[0067] Figure 7 This is a hardware structure block diagram of a microservice system access control device disclosed in an embodiment of this application. Detailed Implementation

[0068] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0069] In practical applications, existing technologies for access rule control mainly consist of two parts: access rule analysis and generation, and access restrictions.

[0070] Access rule analysis and generation techniques can be mainly divided into four categories: document-based rule generation methods, historical data-based rule generation methods, model-based rule generation methods, and source code-based rule generation methods.

[0071] (1) Document-based rule generation methods primarily use natural language processing (NLP) techniques to analyze application documents and generate access control rules based on the analysis results. The Text2Policy method uses shallow syntactic analysis techniques from NLP to identify all phrases in each sentence of the document. Then, it matches each sentence using a template matching method composed of phrases to find all sentences in the document that describe access rules. Based on the corpus dictionary and the identification of whether the sentences contain words related to accepting or denying access, it generates access control annotations. Subsequently, a series of access control rules are generated based on these annotations. Its average recall rate is 89.4%.

[0072] However, the drawbacks of document generation rule-based methods are that the document generation specifications are not unique, and the documents are described in natural language, which may lead to some ambiguity or inaccurate description of the application's behavior. Furthermore, the use of natural language processing techniques to analyze documents is also limited by technology and cannot fully and accurately extract the semantics of the documents.

[0073] (2) Methods based on historical data mainly generate access control rules by analyzing historical access log data or network traffic data. The P-DIFF method generates a rule table in the form of a time-varying decision tree based on historical access log data. Its biggest feature is that because each leaf node of the time-varying decision tree retains past access logs in chronological order, it can capture changes in the permissions for accessing a resource, thereby notifying the administrator to determine whether to configure an appropriate access policy. Its average accuracy is 89%. Methods based on network flow data mainly analyze and generate rules using information such as IP and port, and cannot be applied to dynamic IP and HTTP-level request patterns in microservice architectures.

[0074] However, methods based on historical data to generate rules have drawbacks: they require the application to generate access service logs and cannot be applied to microservice architectures. For example, P-DIFF requires the application to provide access logs, but in a microservice scenario, not every service may have an implementation that provides access logs, thus requiring service code modifications to add access log generation. Methods based on network stream data cannot extract HTTP request patterns.

[0075] (3) The model-based rule generation method mainly generates access control rules by modeling application behavior. In the OpenPMF SCaaS method, experts need to build a security model for the security requirements of the application, and then use automated conversion tools to transform the behavior described by the model into a series of access control rules.

[0076] However, the drawback of model-based rule generation methods is that they require experts to model based on the application's behavior, which means they need to understand all the behaviors of the entire application. Furthermore, when facing a microservice architecture with a large number of services and rapid service version updates, maintaining a security model consistent with the behavior of the entire system is costly and error-prone. Therefore, such methods are difficult to deal with microservice scenarios.

[0077] (4) The source code-based rule generation method is mainly based on static analysis technology. It analyzes the behavior of the application at the code level to extract all legal request patterns of the system, thereby generating access control rules. AUTOARMOR extracts the behavior of service requests by using static analysis of microservice code and taint tracing and code snippets related to service requests. It then uses the access control mechanism provided by the container orchestration tool Kubernetes or the service mesh Istio to restrict service requests.

[0078] However, the drawback of source code-based rule generation methods is that they require the service's source code, which third-party service providers may not always provide. Furthermore, static analysis cannot analyze request patterns not explicitly stated in the code. For example, AutoARMor is limited by the URLs returned by services directly accessing other services, preventing it from extracting all service request patterns. Additionally, due to the multi-language development nature of microservices, even if the underlying communication protocols are HTTP or gRPC, analysis code still needs to be written for each programming language and its various communication libraries.

[0079] Furthermore, access restriction technology primarily restricts access at the user-space level and the kernel network protocol stack level.

[0080] For example, access control technology can be implemented through the following methods.

[0081] (1) User-space-based restriction methods mainly restrict data packets accessing a user-space program based on proxy technology, such as the access mechanism provided by Istio. However, the disadvantage of user-space-based restrictions is that access requests need to go through the processing overhead of the kernel network stack, which may waste system resources.

[0082] (2) Methods based on kernel network protocol stack level restrictions are mainly implemented in the kernel network protocol stack, such as the netfilter firewall framework provided in the Linux system and the Network Policy mechanism in Kubernetes.

[0083] Currently, the main alternative to analyzing and generating access control rules in microservices is based on source code analysis of microservice request patterns. This method mainly analyzes the source code of each service in the microservice, using taint tracing technology to extract the service request patterns, and then generates a series of rules. The disadvantage of this method is that it requires source code support and cannot extract request patterns that are not presented in the code.

[0084] Furthermore, alternatives to access control restrictions for microservice systems include using the Linux-based netfilter framework to perform access restrictions in the kernel network protocol stack, using the NetworkPolicy mechanism provided by Kubernetes, and using the access restriction mechanism provided by Istio.

[0085] Given that most current microservice system access control schemes struggle to adapt to complex and ever-changing business needs, this application proposes a microservice system access control scheme. When configuring access control rules for a microservice system, the method provided in this application can dynamically analyze the request patterns of data packets generated during the microservice application's runtime, accurately extract all legal access rules of the microservice system, and resolve ambiguities in natural language descriptions of access control rules. It can analyze multiple request patterns without relying on the source code of the microservice system to analyze and configure its access control rules. This efficiently solves the configuration of access control rules for each service within the microservice system and effectively addresses the issue of updating access control rules due to version updates of various services. Furthermore, since the method provided in this application does not rely on the source code of each service within the microservice system to analyze its access control rules, but only needs to analyze the underlying communication protocol used by the microservice system, it can execute access control rules before the kernel network protocol stack of the worker node, effectively reducing system overhead and improving system stability and performance.

[0086] The methods provided in this application can be used in a variety of general-purpose or special-purpose computing device environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor devices, distributed computing environments including any of the above devices, etc.

[0087] This application provides a microservice system access control method, which can be applied to various microservice management systems, as well as to various computer terminals or smart terminals. The executing entity can be the processor or server of the computer terminal or smart terminal.

[0088] The following is combined with Figure 1 This application introduces an optional system architecture for implementing access control in a microservice system, as provided in its embodiments. Figure 1 As shown, the system architecture may include a control node and several worker nodes.

[0089] In practical applications, based on the assumption that developers will conduct deployment tests when updating service versions, the service will issue all requests that conform to the developer's intentions during the deployment test phase. That is, the messages issued during the deployment test phase are all legal. The request patterns of these messages are regarded as rules, and the roles are divided into two categories: worker nodes and control nodes. Worker nodes are responsible for monitoring and capturing data, that is, all computing resources running the service. Control nodes are responsible for processing data.

[0090] Therefore, worker nodes can collect data to be processed and forward it to control nodes; the data to be processed can be access data of various services in the microservice system.

[0091] The control node can receive data to be processed transmitted by the worker nodes, and can create access control rules for the microservice system based on the data to be processed. It can also send the target dictionary corresponding to the access control rules of the microservice system to the worker nodes.

[0092] After receiving the target dictionary from the control node, the worker node can determine the mapping relationship between the target dictionary and its kernel-mode access control program. Based on the target dictionary, it can analyze whether the message data transmitted to the worker node by other services of the microservice system meets the access control rules corresponding to the target dictionary. If it is determined that the message data transmitted to the worker node by other services of the microservice system meets the access control rules corresponding to the target dictionary, then other services of the microservice system can be allowed to access the worker node. If the message data transmitted to the worker node by other services of the microservice system does not meet the access control rules corresponding to the target dictionary, then other services of the microservice system can be denied access to the worker node.

[0093] When the versions of various services in a microservice system are updated, the worker nodes can also transmit the target data corresponding to the updated service to the control node, which can then update the access control rules corresponding to the updated service based on the target data.

[0094] The following is combined with Figure 2 This application describes the flow of a microservice system access control method according to embodiments thereof. This method can be applied to microservice systems, which may include a control node and at least one worker node, such as... Figure 2 As shown, the process may include the following steps:

[0095] Step S101: Collect the data to be processed through the working node and forward the data to be processed to the control node.

[0096] Specifically, in practical applications, the control node in a microservice system needs a comprehensive understanding of the entire system's operational status, including the resource usage and performance metrics of each worker node, in order to perform effective resource allocation and scheduling. Therefore, data on each worker node is needed to analyze its resource usage and performance metrics, enabling centralized decision-making based on the data collected from each worker node. For example, the control node can make critical decisions regarding service deployment, expansion, and fault tolerance based on the data collected from worker nodes, ensuring the efficient and stable operation of the microservice system, promptly detecting anomalies or failures in worker nodes, and taking corresponding recovery measures to guarantee the reliability of the microservice system. Furthermore, by analyzing and summarizing the data collected by worker nodes, the control node can identify bottlenecks and optimization points in the microservice system, thereby guiding its improvement and upgrade. Worker nodes collecting data and sending it to the control node allows for a centralized presentation of the entire microservice system's status and information, facilitating management and maintenance by operations personnel and development teams.

[0097] Therefore, when it is necessary to set access control rules for a microservice system, the worker nodes can collect the data to be processed and forward it to the control node, so that the control node can analyze the data to configure the access control rules for the microservice system.

[0098] The data to be processed can reflect the access status of the worker nodes. The data to be processed can include data related to the request mode in the HTTP message corresponding to each service. For example, it can include 7-tuple data, which can include the source IP, source port of the service, and the destination IP, destination port, HTTP request method, HTTP URL, and HTTP version to be accessed.

[0099] Step S102: The control node receives the data to be processed transmitted by the worker node, creates access control rules for the microservice system based on the data to be processed, and sends the target dictionary corresponding to the created access control rules for the microservice system to the worker node.

[0100] Specifically, as described above, the method provided in this application embodiment can collect data to be processed by the working nodes and forward the data to be processed to the control node. The control node can then make centralized decisions based on the data sent by the working nodes. For example, it can centrally configure and decide on the resources and access status of each working node based on the data to be processed sent by the working nodes.

[0101] For example, in practical applications, the status, load, and business characteristics of different worker nodes may vary. By analyzing the data collected by the worker nodes, the control node can precisely tailor appropriate access control rules for each worker node, ensuring reasonable resource allocation and secure access.

[0102] Furthermore, the data collected by worker nodes can reflect their current operational status and needs. Therefore, control nodes can restrict worker node access based on the data collected and transmitted by the worker nodes.

[0103] For example, the control node can limit access traffic based on the resource usage of the worker nodes to prevent a worker node from failing due to overload and to ensure the stability of the microservice system.

[0104] Furthermore, the control node can flexibly adjust access rules based on actual business scenarios and dynamic changes. As the status of worker nodes changes, the control node can update access control rules in real time to adapt to different situations.

[0105] In particular, creating corresponding access control rules based on the data to be processed transmitted by worker nodes helps improve the security of microservice systems, identify potential security risks and set appropriate restrictions in a timely manner to prevent unauthorized access or abnormal behavior.

[0106] To better coordinate and manage the entire microservice system, making access and interaction between different worker nodes more orderly and efficient, and ensuring the optimization of overall system performance.

[0107] Therefore, after the worker nodes collect the data to be processed and forward it to the control node, the control node can further receive the data to be processed transmitted by the worker nodes and create access control rules for the microservice system based on the data to be processed.

[0108] In practical applications, in order to facilitate faster querying and application of access control rules by each working node, and also to facilitate the management and maintenance of the created access control rules, the control node can simultaneously determine the target dictionary corresponding to the created access control rule and transmit it to the working node while creating the access control rule.

[0109] The target dictionary may include information corresponding to the access control rules created by the control node.

[0110] In practical applications, after determining the target dictionary, querying it allows for the rapid location and retrieval of rule information related to specific work nodes, improving processing efficiency and facilitating the management and maintenance of created access control rules. The structure of the target dictionary clearly organizes and categorizes the created access control rules, simplifying subsequent updates, adjustments, and deletions.

[0111] The target dictionary also enables efficient retrieval and matching of created access control rules. For example, when it is necessary to verify the access request of a worker node, the worker node can quickly find the corresponding access control rule from the target dictionary and make a judgment, ensuring the timeliness and accuracy of access control.

[0112] In practical applications, as the number of worker nodes and access control rules increases, the query target dictionary can adapt well to this change, maintaining the performance and flexibility of the microservice system in terms of access control.

[0113] Furthermore, to facilitate better interaction and collaboration with other system components or services, the target dictionary can more easily provide access control rule information to other relevant parts, promoting the overall collaborative operation of the microservice system.

[0114] For example, Figure 3 This example illustrates a flowchart of a control node processing data.

[0115] Step S103: After the working node receives the target dictionary sent by the control node, the working node determines the mapping relationship between the target dictionary and its kernel-mode access control program.

[0116] Specifically, as described above, the method provided in this application embodiment can synchronously transmit the target dictionary corresponding to the created access control rule to the working node through the control node, and the target dictionary can provide feedback on the specific information of the created access control rule.

[0117] Generally, the kernel mode of a worker node contains an access control program. When it is necessary to configure the access control rules corresponding to the worker node, a mapping relationship can be established between the target dictionary and its kernel mode access control program.

[0118] By establishing a mapping between the target dictionary and the kernel-mode access control program of the worker node, the kernel-mode access control program of the worker node can quickly query and apply the corresponding access control rules. When there is an access request, there is no need to search the entire query dictionary; instead, the corresponding rule is found directly through the mapping relationship, thus improving the efficiency of access control.

[0119] Furthermore, when the access control rules of the control node change, the updated rules can be promptly transmitted to the kernel-mode access control program of the worker node through the mapping relationship between the target dictionary and the kernel-mode access control program of the worker node. This ensures that the worker node always uses the latest access control rules, guaranteeing the security and consistency of the microservice system.

[0120] In practical applications, the kernel-mode access control program of the worker node typically runs directly in kernel mode, offering higher execution efficiency and privileges. By establishing a mapping relationship between the target dictionary and the kernel-mode access control program of the worker node, the kernel-mode access control program of the worker node can directly access and execute access control rules related to the worker node, providing faster and more reliable access control.

[0121] In practical applications, in microservice systems, worker nodes and control nodes may be distributed in different physical or logical locations. Establishing a mapping between the target dictionary and the kernel-mode access control program of the worker nodes helps to achieve unified management and coordination of access control rules in a distributed environment, ensuring that each worker node can correctly execute access control policies.

[0122] The mapping between the target dictionary and the kernel-mode access control program of the worker nodes can be a flexible mechanism that allows access control rules to be dynamically adjusted according to actual needs. It also facilitates the application of access control rules to new worker nodes when the microservice system is expanded or new worker nodes are added.

[0123] In summary, establishing a mapping relationship between the target dictionary and the kernel-mode access control program of the worker node can improve the efficiency, real-time performance, and consistency of access control, while enhancing the flexibility and scalability of the microservice system and helping to ensure the secure and stable operation of the microservice system.

[0124] Therefore, in practical applications, after the working node receives the target dictionary from the control node, the mapping relationship between the target dictionary and its kernel-mode access control program can be determined through the working node.

[0125] For example, if a worker node collects seven-tuple data, the source IP, source port, destination IP, and destination port can be mapped to service names.

[0126] In practical applications, microservices can be deployed on Kubernetes. Kubernetes is a container orchestration platform designed to simplify the deployment, scaling, and management of containerized applications. It automatically manages containerized applications across multiple hosts, providing powerful automation, fault tolerance, and scalability, making it easier to run and manage large-scale containerized applications. Therefore, Kubernetes is well-suited for microservice architectures as a technology for horizontal scaling and fault tolerance management.

[0127] If microservices are deployed on Kubernetes, worker nodes need to confirm and obtain relevant mapping information from the Kubernetes control center API Server when determining the mapping relationship between the target dictionary and its kernel-mode access control program.

[0128] In practical applications, the Kubernetes control center API Server has access to the service IPs and port information of the microservice system. Therefore, the service IP and service port can be concatenated as the key in the service dictionary, and the service name can be used as the value of the key to build a service name dictionary.

[0129] In practical applications, with a service name dictionary, the source IP, source port, destination IP, and destination port in the seven-tuple sent by the worker node can be mapped to the source service name and destination service name. The constructed service name dictionary will then be sent to the worker node for access control restrictions.

[0130] Step S104: Using the working node, based on the target dictionary, analyze whether the message data transmitted to the working node by other services of the microservice system meets the access control rules corresponding to the target dictionary.

[0131] Specifically, as described above, the method provided in this application embodiment can further determine the mapping relationship between the target dictionary and its kernel-mode access control program after the working node receives the target dictionary sent by the control node.

[0132] Therefore, in practical applications, after determining the mapping relationship between the target dictionary and its kernel-mode access control program through the worker node, the worker node can analyze whether the message data transmitted to the worker node by other services of the microservice system meets the access control rules corresponding to the target dictionary. If the message data transmitted to the worker node by other services of the microservice system meets the access control rules corresponding to the target dictionary, step S105 can be executed. If the message data transmitted to the worker node by other services of the microservice system does not meet the access control rules corresponding to the target dictionary, step S106 can be executed.

[0133] Step S105: Allow other services of the microservice system to access the worker node.

[0134] Specifically, in practical applications, the access control rules of a microservice system are implemented based on the kernel-mode access control program of the worker node. When message data transmitted by other services to the worker node meets the access control rules corresponding to the target dictionary, the kernel-mode access control program will allow these message data to pass through, thereby enabling access to the worker node.

[0135] This approach ensures that only data messages conforming to access control rules can access worker nodes, thereby improving the security and reliability of the microservice system. Furthermore, by combining access control rules with the kernel-level access control program of the worker nodes, more efficient access control can be achieved, reducing unnecessary performance overhead. Therefore, if data messages transmitted to the worker nodes by other services in the microservice system satisfy the access control rules corresponding to the target dictionary, it indicates that those other services have permission to access the worker nodes, and thus, access to the worker nodes by other services in the microservice system can be permitted.

[0136] Step S106: Deny other services of the microservice system access to the worker node.

[0137] Specifically, as described above, the access control rules of a microservice system are implemented based on the kernel-mode access control program of the worker node.

[0138] In practical applications, to ensure the security and stability of microservice systems, if message data transmitted from other services to worker nodes does not meet the access control rules corresponding to the target dictionary, this message data may pose a security threat to the worker nodes, or cause them to malfunction or malfunction.

[0139] By setting access control rules, only messages that meet specific conditions can access worker nodes, thereby reducing the risk of system attacks or malfunctions. This ensures that worker nodes only process legitimate and authorized data, improving the overall security and reliability of the system.

[0140] Furthermore, access control rules can help implement permission management and resource isolation in microservice systems. Different worker nodes may have different functions and permissions. Access control rules can restrict each worker node to only accessing and processing its authorized data, preventing unauthorized access and operations.

[0141] Therefore, in order to protect the security and stable operation of the microservice system, if the message data transmitted by other services of the microservice system to the worker node does not meet the access control rules corresponding to the target dictionary, it means that other services do not have the permission to access the worker node, and therefore other services of the microservice system are not allowed to access the worker node.

[0142] Step S107: Determine whether the versions of each service in the microservice system have been updated.

[0143] Specifically, in practical applications, the services of a microservice system may be updated. The main reasons for these service version updates are as follows:

[0144] (1) Function improvement and expansion: In order to meet the ever-changing business needs, new functions need to be added or existing functions need to be optimized, which requires version updates.

[0145] (2) Fix defects and vulnerabilities: When problems or security risks are found in the service, these problems are solved by updating the version to ensure the stability and security of the system.

[0146] (3) Technology upgrade and optimization: With the development of technology, new technical architectures and programming language features are adopted to improve the service and enhance its performance, thereby updating the version.

[0147] (4) Adapt to environmental changes: such as operating system upgrades, changes in underlying infrastructure, etc., services need to be updated accordingly to maintain compatibility.

[0148] (5) Business strategy adjustment: Changes in business rules, processes, etc. require adjustments to the implementation of services, which leads to version updates.

[0149] (6) Performance optimization: In order to improve the service response speed, processing capacity and other performance indicators, targeted updates will be made.

[0150] Therefore, in order to ensure the security and stability of the microservice system, it can be further determined whether the versions of each service in the microservice system have been updated. If there are services with updated versions in the microservice system, then step S108 can be executed.

[0151] Step S108: The target data corresponding to the version update service is transmitted to the control node through the working node, and the access control rules corresponding to the version update service are updated through the control node.

[0152] Specifically, as described above, the method provided in this application embodiment can determine whether a microservice system has a version update service. If it is determined that a microservice system has a version update service, it means that the access data of the worker node has been updated. In order to ensure the security and stability of the microservice system, the corresponding access control rules also need to be updated. The target data corresponding to the version update service can be transmitted from the worker node to the control node, and the access control rules corresponding to the version update service can be updated through the control node.

[0153] As can be seen from the above-described technical solutions, when it is necessary to configure access control rules for a microservice system, the method provided in this application embodiment can dynamically analyze the request patterns of data packets generated during the runtime of the microservice application, accurately extract all legal access rules of the microservice system, and resolve ambiguities. It can analyze multiple request patterns without relying on the source code corresponding to the microservice system to analyze and configure the access control rules of the microservice system. It can efficiently solve the configuration of access control rules corresponding to each service of the microservice system, and can also effectively solve the problem of updating access control rules due to version updates of each service of the microservice system. Furthermore, since the method provided in this application embodiment does not rely on the source code corresponding to each service of the microservice system to analyze its access control rules, it only needs to analyze the communication protocol used at the underlying level of the microservice system. It can execute access control rules in front of the kernel network protocol stack of the worker node, which can effectively reduce system overhead and improve system stability and performance.

[0154] As described above, the method provided in this application embodiment can collect data to be processed through the working node and forward the data to be processed to the control node. The process will be described below, and it may include:

[0155] Step S201: Capture the data program in the target kernel state corresponding to the working node and mount it to the target fast data path.

[0156] Specifically, in order to achieve high-speed processing and analysis of network packets, a data capture program can be obtained by capturing data in the target kernel mode corresponding to the working node and mounting it to the target fast data path.

[0157] In practical applications, XDP (eXpress Data Path) is an eBPF hook in the Linux kernel that can be dynamically mounted, enabling eBPF programs to perform targeted high-speed processing on data packets before they reach the network driver layer. By mounting the eBPF kernel-mode data capture program to XDP, worker nodes can monitor and process data packets before they enter the kernel protocol stack, thereby achieving the following goals:

[0158] (1) High-performance packet processing: XDP is located in the network driver layer and can process packets before they reach the kernel protocol stack, avoiding the complex processing of the kernel protocol stack, thus achieving very high performance.

[0159] (2) Programmability and flexibility: eBPF provides a programmable way to process data packets, allowing users to write custom data packet processing logic according to their own needs. By mounting eBPF programs onto XDP, worker nodes can implement various functions, such as packet filtering, flow control, protocol parsing, etc.

[0160] (3) Real-time monitoring and analysis: All received packets can be monitored from the kernel-mode XDP, allowing for real-time acquisition, analysis, and processing of network data packet information. This is extremely useful for applications such as network monitoring, security detection, and traffic analysis.

[0161] In this way, worker nodes can efficiently process and analyze network packets, improving system performance and security. At the same time, eBPF's programmability provides users with greater flexibility and customization, enabling the implementation of various complex network functions according to specific needs.

[0162] For example, such as Figure 3 As shown, during service deployment testing, the eBPF kernel-mode data capture program can be mounted onto the XDP through the worker node, and all received packets can be monitored from the kernel-mode XDP.

[0163] By analyzing the application layer messages through the worker node, it is possible to detect whether HTTP methods such as GET and POST, as well as HTTP version information, exist. If it is determined that the application layer messages contain HTTP methods such as GET and POST, as well as HTTP version information, then all HTTP request messages sent to this node by other services, along with their source IP, source port, destination IP, and destination port, can be captured and forwarded to the eBPF user-space data capture program.

[0164] Meanwhile, the eBPF user-space data program extracts data related to the request mode from each HTTP message, called a seven-tuple (source IP, source port, destination IP, destination port, HTTP request method, HTTP URL, HTTP version), and forwards these seven-tuples to the control node over the network.

[0165] In practical applications, eBPF (Extended Berkeley Packet Filter) is a filter that allows developers to dynamically extend functionality to the operating system kernel in a programmable manner. eBPF uses an eBPF runtime virtual machine that exists in the kernel, which provides an environment for executing eBPF programs and a series of eBPF APIs. It also has an eBPF verifier to verify the security of eBPF programs, allowing developers to extend custom functionality to the kernel. This enables the dynamic loading or unloading of eBPF programs without compiling the kernel. Furthermore, due to the existence of the eBPF verifier, the system will not crash due to writing insecure kernel modules.

[0166] Since eBPF programs can run in kernel mode by attaching to kernel-provided hook points such as kprobe and LSM, they can be used to filter or disable certain behaviors in advance in the kernel, prevent some useless data from being copied multiple times or processed by other kernel functions, and reduce the overhead of switching between kernel mode and user mode.

[0167] Currently, eBPF is widely used in various scenarios, including but not limited to network processing, system observability, kernel behavior tracing and localization, and security control.

[0168] XDP is a kernel bypass technology in the Linux kernel. The XDP tool is a hook located at a lower level than the Linux kernel network protocol stack.

[0169] By using the XDP tool in conjunction with eBPF technology, data packets can be processed before entering the kernel network protocol stack, and can be directly transmitted to user-space programs for processing. This avoids the overhead of kernel network protocol stack processing and greatly improves system performance.

[0170] Step S202: Analyze whether the application layer messages of the working node contain preset message information.

[0171] Specifically, in practical applications, HTTP is a widely used application layer protocol for web browsing, API calls, and so on. HTTP messages may contain malicious content, such as SQL injection and cross-site scripting attacks. Analyzing HTTP messages can help detect and prevent these security threats.

[0172] Therefore, in order to understand the application status of worker nodes, we can analyze whether there are preset message information in the application layer messages of worker nodes. The preset message information can be information that represents HTTP messages.

[0173] By detecting whether the application-layer messages of worker nodes contain HTTP messages, the type of application the worker node is currently running can be determined. Furthermore, the HTTP traffic patterns and characteristics of the worker node can be understood, enabling traffic analysis and optimization. For example, popular websites or services can be identified for resource allocation and performance optimization.

[0174] Furthermore, if a worker node encounters a problem, analyzing HTTP messages can provide information about requests and responses, helping to troubleshoot the cause of the failure.

[0175] If there is a target worker node in the microservice system whose application layer message includes the preset message information, then step S203 can be executed;

[0176] Step S203: Capture the target message information of other services of the microservice system sent to the target worker node from the corresponding application layer message of the worker node.

[0177] Specifically, as described above, the method provided in this application embodiment can determine whether the application layer message of the working node contains HTTP message information.

[0178] In practical applications, the various services in a microservice system typically need to communicate and collaborate with each other. If the application layer messages of a worker node contain HTTP message information, in order to better achieve inter-service communication, the worker node can capture the target message information sent by other services in the microservice system to the target worker node from its corresponding application layer messages.

[0179] By capturing target message information from other services in the microservice system sent to the target worker node from its corresponding application layer messages, the requests and responses of other services can be understood, thereby enabling interaction and data sharing between services.

[0180] In practical applications, worker nodes may need to execute corresponding service functions based on received target message information. For example, processing requests, providing data, and performing calculations. Capturing target message information from other services in the microservice system sent to the target worker node within its corresponding application layer messages can help the worker node perform security detection and protection. It can identify potential security threats, such as malicious requests and attack behaviors, and take appropriate measures to protect the system's security.

[0181] By capturing target message information from other services in the microservice system sent to the target worker node from its corresponding application layer messages, the worker node can understand the traffic and characteristics of the target messages, which can help the worker node perform traffic control and optimization. It can adjust resource allocation and processing strategies based on message priority, frequency, and other information, thereby improving system performance and efficiency.

[0182] By capturing target message information from other services in the microservice system sent to the target worker node from its corresponding application layer messages, the worker node can better understand and process communication from other services, realize the overall function of the microservice system, and ensure the system's security, performance, and compliance.

[0183] Step S204: Extract target 7-tuple data from the target message information on the user-space program of the target working node, and transmit the extracted target 7-tuple data as data to be processed to the control node.

[0184] Specifically, in practical applications, capturing target message information from other services of the microservice system sent to the target worker node from application layer messages may include seven-tuple data. This seven-tuple data typically contains information such as source IP address, source port, destination IP address, destination port, protocol type, TCP flags, and sequence number. By extracting the seven-tuple, the worker node can identify different connections and track their status and activity.

[0185] In load balancing scenarios, worker nodes need to determine how to distribute requests to backend servers based on the seven-tuple data. By analyzing information in the seven-tuple data, such as the source IP address and destination IP address, worker nodes can make decisions to allocate requests to appropriate servers to achieve load balancing and improve system performance.

[0186] Furthermore, the information in the seven-tuple data can be used for security detection and protection. For example, worker nodes can use the seven-tuple to identify and block potential attack traffic, or implement access control policies to allow only specific connections to pass through.

[0187] Extracting 7-tuple data can provide detailed information about network traffic, helping network administrators with monitoring and troubleshooting. By analyzing 7-tuples, administrators can understand which connections are using network resources and whether there are abnormal traffic patterns or connection behaviors.

[0188] In practical applications, some applications may require in-depth analysis and processing of messages from specific protocols. The 7-tuple data can provide information about the protocol type and related fields, helping worker nodes to correctly parse and process messages.

[0189] In summary, extracting the 7-tuple can provide crucial information about the message, enabling worker nodes to better manage and process network traffic, achieving functions such as load balancing, security protection, and network management. The specific reasons may vary depending on the specific application scenario and requirements.

[0190] Therefore, after capturing the target message information sent by other services of the microservice system to the target worker node from the corresponding application layer message of the worker node, the target seven-tuple data can be further extracted from the target message information in the user-space program of the target worker node, and the extracted target seven-tuple data is transmitted to the control node as the data to be processed.

[0191] As can be seen from the technical solutions described above, the method provided in this application embodiment can collect data to be processed through the working node and forward the data to be processed to the control node, so that the control node can analyze the data to be processed and create access control rules based on the data to be processed.

[0192] As described above, the method provided in this application embodiment can receive data to be processed transmitted by worker nodes through a control node, and create access control rules for the microservice system based on the data to be processed. The process will be described below, and may include the following:

[0193] Step S301: The control node receives the target seven-tuple data transmitted by the target working node, and maps the target seven-tuple data to the source service name and destination service name corresponding to the target seven-tuple data.

[0194] Specifically, in practical applications, the seven-tuples collected by worker nodes are usually composed of numbers or identifiers, and directly understanding the meaning of this data can be difficult. To make the data more semantic and easier for people to understand and interpret, we can consider mapping the source IP, source port, destination IP, and destination port in the seven-tuple data to source service names and destination service names. This improves the readability and understandability of the seven-tuple data. Furthermore, using service names makes data management and maintenance more convenient. Through service names, related data can be identified and associated more intuitively, facilitating data classification, filtering, and processing.

[0195] For example, in complex systems, different seven-tuples may represent different services or entities. Mapping seven-tuples to service names establishes relationships between data, facilitating data integration and analysis. In practical applications, service names are typically associated with specific business functions or services. Mapping some data from a seven-tuple to its corresponding service name allows for better integration of data with business logic, supporting data-driven business decisions and process control.

[0196] Therefore, in order to better analyze the target seven-tuple data collected by the working node, the method provided in this application embodiment can receive the target seven-tuple data transmitted by the target working node through the control node, and map the source IP, source port, destination IP, and destination port in the target seven-tuple data to the source service name and destination service name corresponding to the target seven-tuple data, so as to improve the analysis efficiency of the target seven-tuple data.

[0197] By mapping the source IP, source port, destination IP, and destination port in the target seven-tuple data to the source service name and destination service name, the availability, manageability, and business value of the data can be improved, enabling the data to better serve business needs and decision-making. Specific mapping methods and rules can be determined based on specific application scenarios and requirements.

[0198] In practical applications, services can be deployed on a container orchestration platform. If a service is deployed on a container orchestration platform, the process of receiving target 7-tuple data transmitted by the target worker node through the control node and mapping the target 7-tuple data to a service name corresponding to the target 7-tuple data can include the following:

[0199] (1) Determine the service IP and port information corresponding to the microservice system through the container orchestration platform.

[0200] (2) After concatenating the service IP and port information corresponding to the microservice system, construct a service name dictionary based on the concatenated service IP and port information.

[0201] (3) Map the target 7-tuple data to the service name corresponding to the target 7-tuple data according to the service name dictionary.

[0202] For example, if you are deploying microservices on Kubernetes, you need to query the Kubernetes Control Center API Server to obtain relevant mapping information. The Kubernetes Control Center API Server has the service IP and port information of the microservice system. Therefore, the service IP and service port are concatenated as the key in the service dictionary, and the service name is used as the value of the key to build the service name dictionary. With the service name dictionary, the source IP, source port, destination IP and destination port in the seven-tuple sent by the worker node can be mapped to the source service name and destination service name. This service name dictionary will then be sent to the worker node for access control restrictions.

[0203] Step S302: Based on the target seven-tuple data and the corresponding source service name and destination service name, map the target seven-tuple data and the corresponding source service name and destination service name into target five-tuple data, and construct a multi-branch tree corresponding to the target five-tuple data through the control node.

[0204] Specifically, in practical applications, multi-way trees are an efficient data structure that allows for quick data searching, insertion, and deletion, thus improving data processing efficiency.

[0205] Therefore, in order to better manage the target seven-tuple and its corresponding service name, and thus better manage access control rules, after determining the source service name and destination service name corresponding to the target seven-tuple data, the target seven-tuple data and its corresponding source service name and destination service name can be mapped to the target five-tuple data, and a multi-branch tree corresponding to the target five-tuple data can be constructed through the control node.

[0206] Constructing a multi-branch tree corresponding to the target quintuple data can achieve data classification and aggregation. The service name can be used as the basis for classification, and quintuple data with the same service name can be aggregated into the same subtree, which facilitates data classification and statistical analysis.

[0207] Constructing a multi-way tree corresponding to the target quintuple data can also support complex business logic. By constructing a multi-way tree corresponding to the target quintuple data, different hierarchical structures and node relationships can be defined according to business needs, thereby supporting complex business logic and data processing flows.

[0208] Constructing a multi-way tree corresponding to the target quintuple data can also facilitate data visualization and display. The structure of the multi-way tree can intuitively show the hierarchical relationship and classification between data, which facilitates data visualization and display and helps to better understand and analyze the data.

[0209] In summary, constructing a multi-branch tree based on the target quintuple data can improve data processing efficiency, enable data classification and aggregation, support complex business logic, and facilitate data visualization and presentation. This allows for better management and processing of large amounts of septuplet data, providing support for business decision-making.

[0210] The process of constructing a multi-way tree corresponding to the target quintuple data can include the following:

[0211] (1) By controlling the node, traverse all web page addresses corresponding to the application programming interfaces provided by each service in the microservice system.

[0212] (2) Split each web address corresponding to the application programming interface provided by each service in the microservice system into multiple tokens.

[0213] (3) Construct a multi-branch tree corresponding to the target seven-tuple data by splitting each token into each web page address corresponding to each application programming interface provided by each service in the microservice system and other data of the target five-tuple.

[0214] Step S303: Through the control node, traverse all paths of the multi-way tree corresponding to the target quintuple data to determine the access control rule corresponding to the target quintuple data as the access control rule of the microservice system.

[0215] Specifically, in practical applications, the seven-tuple data contains key information for access control. The seven-tuple data usually includes information such as source address, destination address, source port, destination port, protocol type, and access time. This information is very important for determining access control rules.

[0216] A service name can represent a specific application or service. By associating a seven-tuple of data with the service name, access control rules can be defined based on the service's requirements and security policies.

[0217] Multi-way tree structures can represent complex rule relationships. A multi-way tree is a hierarchical data structure that can organize different seven-tuple data and their corresponding service names into a hierarchical rule structure. Since there is a mapping relationship between the target five-tuple data and the target seven-tuple data, by traversing all paths in the multi-way tree, all possible combinations of seven-tuples and service names can be obtained, thus yielding the corresponding access control rules.

[0218] Therefore, after determining the multi-way tree corresponding to the target quintuple data, the access control rules corresponding to the target quintuple data can be determined by traversing all paths of the multi-way tree through the control node, and then used as the access control rules for the microservice system.

[0219] In practical applications, traversing all paths in a multi-way tree ensures that no access control rules are missed. Each path represents a specific combination of a seven-tuple and a service name; by traversing all paths, all possible rule configurations can be obtained.

[0220] Building access control rules into a multi-branch tree structure facilitates rule management and querying. Based on specific conditions or requirements, the corresponding rule path can be quickly located, and the relevant access control rules can be retrieved.

[0221] In summary, traversing all paths of the multi-way tree constructed from 5-tuple data and their service names can comprehensively and accurately obtain all access control rules, which helps to achieve effective access control and security policy management. This allows for flexible control and authorization of different access requests based on specific needs and scenarios.

[0222] in,

[0223] The rules for constructing a multi-way tree corresponding to the target quintuple data can include the following:

[0224] (1) Set the root node of the multi-way tree corresponding to the target quintuple data as a sentinel node;

[0225] (2) Based on the characteristics of the microservice system architecture, the value of the second-level node of the multi-way tree corresponding to the target quintuple data can be set as the target service name;

[0226] (3) Set the third-level node of the multi-way tree corresponding to the target quintuple data to the HTTP version;

[0227] (4) Set the fourth-level node of the multi-way tree corresponding to the target quintuple data to the HTTP method;

[0228] (5) Construct nodes for the fifth level of the multi-way tree corresponding to the target quintuple data and thereafter according to the order in which the tokens split from each web page address appear;

[0229] (6) Check if the value of the child node of the current node of the multi-way tree corresponding to the target quintuple data is the same as the value of the current token; if the value of the child node of the current node of the multi-way tree corresponding to the target quintuple data is the same as the value of the current token, then update the current node of the multi-way tree corresponding to the target quintuple data to the child node, and update the current token of the multi-way tree corresponding to the target quintuple data to the next token; if the value of the child node of the current node of the multi-way tree corresponding to the target quintuple data is not the same as the value of the current token, then create a node with the same value as the current token, and add the newly created node as the child node of the current node, until the last token split from each web address corresponding to the application programming interface provided by each service in the microservice system is processed;

[0230] After processing the last token derived from each webpage address corresponding to the application programming interface provided by each service in the microservice system, a target URI termination node is created and added to the child node of the node corresponding to the last token. Additionally, a node with the same value as the source service name is created and added to the child node of the target URI termination node.

[0231] For example, in practical applications, each service provides a series of APIs for other services to access. These APIs consist of HTTP request methods, HTTP URLs, and HTTP versions.

[0232] For example, GET catalogue / {id} HTTP / 1.1:

[0233] As can be seen, HTTP URLs contain both constants and variables, meaning that when capturing HTTP messages, only data such as catalogue / 1, catalogue / 2, and catalogue / 3 can be obtained. Therefore, these URLs need to be recognized as being in the form / catalogue / {id}.

[0234] In practical applications, this application analyzes HTTP messages sent by the service and configures access control rules by capturing them. However, it lacks the ability to accurately distinguish and identify API types, as is possible with static source code analysis. Therefore, to address the matching rule issue, in the process of identifying constants and variables in the URL, prior knowledge of constants and variables in the URL is used to identify other tokens.

[0235] In practical applications, a token is the unit of word segmentation. By using the segmentation words " / ", "?", "=", and "&", a URL can be split into multiple tokens.

[0236] For example,

[0237] catalog / 2?id=123&password=456;

[0238] After splitting, it can be {catalogue,2,id,123,password,456}, and we know that in the URL, id and password after the question mark and before the equals sign are constants, while those after the question mark and after the equals sign are variables.

[0239] With some prior knowledge, we can begin processing the 7-tuple data collected by the working nodes.

[0240] Specifically, it can be as follows:

[0241] Iterate through all URLs once, split each URL into multiple tokens, and then add the source service name and destination service name to build a multi-branch tree. The purpose of building the multi-branch tree is to compress duplicate tokens to save space consumption.

[0242] The rules for constructing a multi-way tree can be as follows:

[0243] (1) The root node is a sentinel node.

[0244] (2) Based on the characteristics of microservice architecture, the APIs provided by each service should be decoupled. Therefore, the tokens in the APIs provided by the same service are likely to be duplicated. When the rule of a certain service version is deleted during version update, the tree of that node can be deleted directly. Therefore, the value of the second-level node of the tree is the destination service name.

[0245] (3) The third-level nodes of the tree are HTTP versions, such as HTTP / 1.1, HTTP / 2.0, etc.

[0246] (4) The fourth level node of the tree is an HTTP method, such as GET, POST, DELETE, PUT, etc.

[0247] (5) Construct nodes for the fifth level of the tree and thereafter according to the order in which the tokens split from the URL appear. Check if the value of the child node of the current node is the same as the value of the current token. If they are the same, update the current node to the child node and update the current token to the next token. If they are different, create a node with the same value as the current token and add the new node as the child node of the current node. Repeat this step until the last token has been processed.

[0248] (6) After processing the last token, create and add a URL termination node to the child node of the node corresponding to the last token, and create a node with the same value as the source service name and add it to the child node of the URL termination node.

[0249] After the above processing, the values ​​of all nodes on the path from the root node to the leaf node of the multi-way tree can be a set of values ​​such as... Figure 4 The example has a 5-tuple (source service name, destination service name, HTTP method, HTTP URL, HTTP version); therefore, all rules can be obtained by traversing all paths of the entire multi-way tree.

[0250] Furthermore, during the construction of the multi-way tree, tokens that are variables can be stored in the variable dictionary simultaneously. Then, each node in the multi-way tree is traversed once to check its token value against the variable dictionary to confirm if it is a variable. If it is, the token's value is replaced with the variable "*". At this point, the rule representing / catalogue / {id} in the API is represented as / catalogue / * and exists in the multi-way tree's path. Thus, the multi-way tree stores all access control rules for identified URL variables. Then, the multi-way tree is traversed again, storing all constants in the constant dictionary and all paths from the root node to the leaf node (i.e., all 5-tuple information) in the rule dictionary. The rule dictionary is used to check whether a message conforms to the rules when enforcing access control restrictions.

[0251] After the aforementioned processing, the control node obtains the service name dictionary, constant dictionary, and rule dictionary, and then sends the data from these dictionaries to all worker nodes for their use.

[0252] As can be seen from the technical solutions described above, the method provided in this application embodiment can receive data to be processed transmitted by worker nodes through the control node, and create access control rules for the microservice system based on the data to be processed, so as to realize the control and management of worker nodes.

[0253] As described above, the method provided in this application embodiment can transmit the target data corresponding to the version-updated service to the control node through the worker node, and update the access control rules corresponding to the version-updated service through the control node. The process will be described below, and may include the following:

[0254] Step S401: The target data corresponding to the version update service is transmitted to the control node through the working node.

[0255] Specifically, as described above, the access control rules of a microservice system are created based on the seven-tuple data collected by the worker nodes. Therefore, when a service in a microservice system is updated, the target data corresponding to the updated service can be transmitted to the control node through the worker nodes, so that the control node can update its corresponding access control rules.

[0256] Step S402: The control node receives the target data transmitted by the working node and updates the target multi-branch tree corresponding to the version update service based on the target data.

[0257] Specifically, as described above, the method provided in this application constructs access control rules by building a multi-way tree corresponding to the seven-tuple data collected by the worker nodes. Therefore, after the target data corresponding to the version-updated service is transmitted to the control node through the worker nodes, the control node can receive the target data transmitted by the worker nodes and update the corresponding access control rules based on the target data and the target multi-way tree corresponding to the version-updated service.

[0258] Step S403: Update the access control rules corresponding to the target multi-way tree through the control node, and delete the access control rules of the target multi-way tree before the update.

[0259] Specifically, as described above, the solution provided in this application embodiment can receive the target data transmitted by the working node through the control node, and update the target multi-branch tree corresponding to the version update service based on the target data. Therefore, after updating the target multi-branch tree corresponding to the version update service, the access control rules corresponding to the target multi-branch tree can be updated through the control node, and the access control rules of the target multi-branch tree before the update can be deleted.

[0260] For example, when a service version is updated, the worker node can transmit the seven-tuple data corresponding to the updated service to the control node. The control node can then update the corresponding multi-way tree. Furthermore, the control node can query the API Server to determine which old version of the rule needs to be deleted. To delete a rule, simply find the corresponding node at the second level of the multi-way tree and delete its subtree.

[0261] As can be seen from the technical solutions described above, the method provided in this application embodiment can transmit the target data corresponding to the version-updated service to the control node through the worker node, and update the access control rules corresponding to the version-updated service through the control node, so as to dynamically configure the access control rules of the microservice system.

[0262] For example, such as Figure 5 As shown, in practical applications, during service deployment testing, worker nodes mount the eBPF kernel-mode data capture program to XDP. XDP monitors all received packets from the kernel, analyzing application-layer packets for HTTP methods such as GET and POST, as well as HTTP version information—information characteristic of HTTP packets. It captures all HTTP request packets from other services destined for this node, along with their source and destination IPs and ports, and forwards them to the eBPF user-mode data capture program. The eBPF user-mode program extracts data related to the request pattern from each HTTP packet, termed a seven-tuple (source IP, source port, destination IP, destination port, HTTP request method, HTTP URL, HTTP version), and forwards these seven-tuples over the network to the control node.

[0263] Next, the control node needs to receive the seven-tuple data transmitted by the worker nodes and create access control rules:

[0264] For example, first map the source IP, source port, destination IP, and destination port to service names. If deploying microservices on Kubernetes, you need to query the Kubernetes API Server to obtain the relevant mapping information. The Kubernetes API Server has the service IP and port information of the microservice system. Therefore, the service IP and service port are concatenated as the key in the service dictionary, and the service name is used as the value of the key to build the service name dictionary. With the service name dictionary, the source IP, source port, destination IP, and destination port in the seven-tuple sent by the worker node can be mapped to the source service name and destination service name. This service name dictionary will then be sent to the worker node for access control restrictions.

[0265] For example, in practical applications, each service provides a series of APIs for other services to access. These APIs consist of HTTP request methods, HTTP URLs, and HTTP versions.

[0266] For example, `GET catalogue / {id} HTTP / 1.1`: It can be seen that constants and variables are presented in the HTTP URL, meaning that when the HTTP message is captured, only data such as `catalogue / 1`, `catalogue / 2`, and `catalogue / 3` can be obtained. Therefore, these URLs need to be recognized as being in the form ` / catalogue / {id}`.

[0267] In practical applications, this application analyzes HTTP messages sent by the service and configures access control rules by capturing them. However, it lacks the ability to accurately distinguish and identify API types, as is possible with static source code analysis. Therefore, to address the matching rule issue, in the process of identifying constants and variables in the URL, prior knowledge of constants and variables in the URL is used to identify other tokens.

[0268] In practical applications, a token is the unit of word segmentation. By using the segmentation words " / ", "?", "=", and "&", a URL can be split into multiple tokens.

[0269] For example,

[0270] catalog / 2?id=123&password=456;

[0271] After splitting, it can be {catalogue,2,id,123,password,456}, and we know that in the URL, id and password after the question mark and before the equals sign are constants, while those after the question mark and after the equals sign are variables.

[0272] With some prior knowledge, we can begin processing the 7-tuple data collected by the working nodes.

[0273] Specifically, it can be as follows:

[0274] Iterate through all URLs once, split each URL into multiple tokens, and then add the source service name and destination service name to build a multi-branch tree. The purpose of building the multi-branch tree is to compress duplicate tokens to save space consumption.

[0275] The rules for constructing a multi-way tree can be as follows:

[0276] (1) The root node is a sentinel node.

[0277] (2) Based on the characteristics of microservice architecture, the APIs provided by each service should be decoupled. Therefore, the tokens in the APIs provided by the same service are likely to be duplicated. When the rule of a certain service version is deleted during version update, the tree of that node can be deleted directly. Therefore, the value of the second-level node of the tree is the destination service name.

[0278] (3) The third-level nodes of the tree are HTTP versions, such as HTTP / 1.1, HTTP / 2.0, etc.

[0279] (4) The fourth level node of the tree is an HTTP method, such as GET, POST, DELETE, PUT, etc.

[0280] (5) Construct nodes for the fifth level of the tree and thereafter according to the order in which the tokens split from the URL appear. Check if the value of the child node of the current node is the same as the value of the current token. If they are the same, update the current node to the child node and update the current token to the next token. If they are different, create a node with the same value as the current token and add the new node as the child node of the current node. Repeat this step until the last token has been processed.

[0281] (6) After processing the last token, create and add a URL termination node to the child node of the node corresponding to the last token, and create a node with the same value as the source service name and add it to the child node of the URL termination node.

[0282] After the above processing, the values ​​of all nodes on the path from the root node to the leaf node of the multi-way tree can be a set of values ​​such as... Figure 4 The example has a 5-tuple (source service name, destination service name, HTTP method, HTTP URL, HTTP version); therefore, all rules can be obtained by traversing all paths of the entire multi-way tree.

[0283] Furthermore, during the construction of the multi-way tree, tokens that are variables can be stored in the variable dictionary simultaneously. Then, each node in the multi-way tree is traversed once to check its token value against the variable dictionary to confirm if it is a variable. If it is, the token's value is replaced with the variable "*". At this point, the rule representing / catalogue / {id} in the API is represented as / catalogue / * and exists in the multi-way tree's path. Thus, the multi-way tree stores all access control rules for identified URL variables. Then, the multi-way tree is traversed again, storing all constants in the constant dictionary and all paths from the root node to the leaf node (i.e., all 5-tuple information) in the rule dictionary. The rule dictionary is used to check whether a message conforms to the rules when enforcing access control restrictions.

[0284] After the aforementioned processing, the control node obtains the service name dictionary, constant dictionary, and rule dictionary, and then sends the data from these dictionaries to all worker nodes for their use.

[0285] After receiving dictionary data from the control node, the worker node's eBPF user-space program maps this data to the eBPF kernel-space access control program and mounts it onto XDP. In the system kernel space, whenever a worker node receives a data packet, the eBPF kernel-space program analyzes it. If the data packet is an HTTP packet, it analyzes the packet's seven-tuple. After obtaining the information from the seven-tuple, it uses the service name dictionary to convert the source IP, source port, destination IP, and destination port into the source service name and destination service name. It divides the HTTP URL into multiple tokens and queries the constant dictionary for each token. If a value exists, the token is retained; otherwise, it represents a variable and is replaced with "*". This yields a five-tuple, which is then used to query the rule dictionary. If a value exists, access is allowed; otherwise, access is denied.

[0286] When the service version is updated, the worker node sends the seven-tuple data to the control node. At this time, the control node can update the multi-way tree. The control node also queries the API Server to determine which old version of the rule needs to be deleted. To delete a rule, simply find the corresponding node on the second level of the multi-way tree and delete its subtree.

[0287] As described above, the method provided in this application embodiment can utilize dynamic analysis technology to analyze the request patterns of data packets generated during the runtime of microservice applications, accurately extract all legal access rules to resolve ambiguities, without requiring source code, and can extract request patterns that cannot be analyzed using source code. Furthermore, since the data source analyzed in this application is data packets, there is no need to modify application code to generate appropriate data. Only the underlying communication protocol used by the microservice, such as the HTTP protocol, needs to be analyzed; analysis code for each programming language is not required. Using eBPF combined with XDP technology to perform access control restrictions before the kernel network protocol stack can also reduce system overhead. Using a multi-way tree to store all rules saves space consumption, and using the destination service name as the second-level node of the tree allows for the addition or deletion of all rules corresponding to version updates.

[0288] The microservice system access control device provided in the embodiments of this application is described below. The microservice system access control device described below can be referred to in correspondence with the microservice system access control method described above.

[0289] See Figure 6 , Figure 6 This is a schematic diagram of the structure of a microservice system access control device disclosed in an embodiment of this application.

[0290] like Figure 6 As shown, this access control device can be applied to a microservice system, which may include a control node and at least one worker node. The access control device may include:

[0291] Data collection unit 101 is used to collect data to be processed through the working node and forward the data to be processed to the control node;

[0292] The rule creation unit 102 is used to receive the data to be processed transmitted by the worker node through the control node, create access control rules for the microservice system based on the data to be processed, and send the target dictionary corresponding to the created access control rules for the microservice system to the worker node.

[0293] The mapping unit 103 is used to determine the mapping relationship between the target dictionary and its kernel-mode access control program through the working node after the working node receives the target dictionary sent by the control node.

[0294] The first judgment unit 104 is used to analyze, through the working node, whether the message data transmitted by other services of the microservice system to the working node meets the access control rules corresponding to the target dictionary;

[0295] The access permission unit 105 is configured to allow other services of the microservice system to access the worker node when the execution result of the first judgment unit 104 is that the message data transmitted by other services of the microservice system to the worker node satisfies the access control rules corresponding to the target dictionary.

[0296] The rejection unit 106 is configured to reject access to the worker node by other services of the microservice system when the execution result of the first judgment unit 104 is that the message data transmitted by other services of the microservice system to the worker node does not meet the access control rules corresponding to the target dictionary.

[0297] The second judgment unit 107 is used to determine whether the versions of each service of the microservice system have been updated.

[0298] The update unit 108 is used to transmit the target data corresponding to the version-updated service to the control node through the worker node when the execution result of the second judgment unit 107 is that there is a version-updated service in the microservice system, and update the access control rules corresponding to the version-updated service through the control node.

[0299] As can be seen from the above-described technical solutions, when it is necessary to configure access control rules for a microservice system, the apparatus provided in this application embodiment can dynamically analyze the request patterns of data packets generated during the runtime of the microservice application, accurately extract all legal access rules of the microservice system, and resolve ambiguities. It can analyze multiple request patterns without relying on the source code corresponding to the microservice system to analyze and configure the access control rules of the microservice system. It can efficiently solve the configuration of access control rules corresponding to each service of the microservice system, and can also effectively solve the problem of updating access control rules due to version updates of each service of the microservice system. Furthermore, since the apparatus provided in this application embodiment does not need to rely on the source code corresponding to each service of the microservice system to analyze its access control rules, but only needs to analyze the communication protocol used at the underlying level of the microservice system, it can execute access control rules in front of the kernel network protocol stack of the worker node, which can effectively reduce system overhead and improve system stability and performance.

[0300] The specific processing flow of each unit included in the aforementioned microservice system access control device can be found in the previous section on microservice system access control methods, and will not be repeated here.

[0301] The microservice system access control device provided in this application embodiment can be applied to microservice system access control devices, such as terminals: mobile phones, computers, etc. Optionally, Figure 7 The hardware structure block diagram of the access control device for a microservice system is shown below. Figure 7The hardware structure of a microservice system access control device may include: at least one processor 1, at least one communication interface 2, at least one memory 3, and at least one communication bus 4.

[0302] In this embodiment, the number of processor 1, communication interface 2, memory 3, and communication bus 4 is at least one, and processor 1, communication interface 2, and memory 3 communicate with each other through communication bus 4.

[0303] Processor 1 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.

[0304] Memory 3 may include high-speed RAM, and may also include non-volatile memory, such as at least one disk storage device;

[0305] The memory stores a program, which the processor can call. The program is used to implement the various processing flows in the aforementioned terminal microservice system access control scheme.

[0306] This application embodiment also provides a readable storage medium that can store a program suitable for processor execution, the program being used to: implement the various processing flows of the aforementioned terminal in the microservice system access control scheme.

[0307] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0308] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0309] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Various embodiments can be combined with each other. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A microservice system access control method, characterized in that, Applied to a microservice system, the microservice system including a control node and at least one worker node, the method includes: The working node collects the data to be processed and forwards the data to be processed to the control node. The control node receives the data to be processed transmitted by the worker node, creates access control rules for the microservice system based on the data to be processed, and sends the target dictionary corresponding to the created access control rules for the microservice system to the worker node. After the working node receives the target dictionary from the control node, it determines the mapping relationship between the target dictionary and its kernel-mode access control program. Using the worker node, based on the target dictionary, it is analyzed whether the message data transmitted from other services of the microservice system to the worker node meets the access control rules corresponding to the target dictionary; If the message data transmitted by other services of the microservice system to the worker node satisfies the access control rules corresponding to the target dictionary, then other services of the microservice system are allowed to access the worker node. If the message data transmitted by other services of the microservice system to the worker node does not meet the access control rules corresponding to the target dictionary, then other services of the microservice system are denied access to the worker node; Determine whether the versions of each service in the microservice system have been updated; If the microservice system has a service with a version update, the target data corresponding to the version update service is transmitted to the control node through the worker node, and the access control rules corresponding to the version update service are updated through the control node. The step of receiving the data to be processed transmitted by the worker node through the control node and creating access control rules for the microservice system based on the data to be processed includes: The control node receives the target seven-tuple data transmitted by the target worker node and maps the target seven-tuple data into the source service name and destination service name corresponding to the target seven-tuple data. Based on the target seven-tuple data and the corresponding source service name and destination service name, map the target seven-tuple data and the corresponding source service name and destination service name into target five-tuple data; A multi-way tree corresponding to the target quintuple data is constructed through the control node; By using the control node, all paths of the multi-way tree corresponding to the target quintuple data are traversed to determine the access control rules corresponding to the target quintuple data as the access control rules of the microservice system.

2. The method according to claim 1, characterized in that, The step of collecting data to be processed through the working node and forwarding the data to be processed to the control node includes: The target kernel mode data capture program corresponding to the working node is used to mount the target fast data path; Analyze whether the application layer messages of the working node contain preset message information; If there is a target worker node in the microservice system whose application layer message includes the preset message information, then the target message information sent by other services of the microservice system to the target worker node is captured from the corresponding application layer message of the worker node. On the user-space program of the target working node, the target seven-tuple data is extracted from the target message information, and the extracted target seven-tuple data is transmitted to the control node as data to be processed.

3. The method according to claim 1, characterized in that, If the service is deployed on a container orchestration platform, the step of receiving the target seven-tuple data transmitted by the target worker node through the control node and mapping the target seven-tuple data to the source service name and destination service name corresponding to the target seven-tuple data includes: The container orchestration platform determines the service IP and port information corresponding to the microservice system, as well as the service name corresponding to the microservice system. The service name dictionary is constructed by using the service IP and port information corresponding to the microservice system as the keys and the service name corresponding to the microservice system as the values. Based on the service name dictionary, the source IP, source port, destination IP, and destination port in the target seven-tuple data are mapped to the source service name and destination service name corresponding to the target seven-tuple data.

4. The method according to claim 1, characterized in that, The step of constructing a multi-way tree corresponding to the target quintuple data through the control node based on the target 7-tuple data and the corresponding source service name and destination service name includes: Through the control node, traverse all web page addresses corresponding to the application programming interfaces provided by each service in the microservice system; Each webpage address corresponding to the application programming interface provided by each service in the microservice system is split into multiple tokens; Based on each token derived from each webpage address corresponding to the application programming interface provided by each service in the microservice system, and other data of the target quintuple data, a multi-branch tree corresponding to the target septuplet data is constructed.

5. The method according to claim 4, characterized in that, The rules for constructing a multi-way tree corresponding to the target quintuple data include: Set the root node of the multi-way tree corresponding to the target quintuple data as a sentinel node; Based on the characteristics of the microservice system architecture, the value of the second-level node of the multi-way tree corresponding to the target quintuple data is set as the target service name; The third-level node of the multi-way tree corresponding to the target quintuple data is set to the HTTP version; Set the fourth-level node of the multi-way tree corresponding to the target quintuple data to the HTTP method; The fifth-level node of the multi-way tree corresponding to the target quintuple data and thereafter are constructed according to the order in which the tokens extracted from each web address appear. Check if the value of the child node of the current node in the multi-way tree corresponding to the target quintuple data is the same as the value of the current token; If the value of a child node of the current node in the multi-way tree corresponding to the target quintuple data is the same as the value of the current token, then update the current node of the multi-way tree corresponding to the target quintuple data to that child node, and update the current token of the multi-way tree corresponding to the target quintuple data to the next token. If the value of the child node of the current node in the multi-way tree corresponding to the target quintuple data does not have a node with the same value as the current token, then create a node with the same value as the current token and add the newly created node as a child node of the current node, until the last token split from each web address corresponding to the application programming interface provided by each service in the microservice system is processed. After processing the last token derived from each webpage address corresponding to the application programming interface provided by each service in the microservice system, a target URI termination node is created and added to the child node of the node corresponding to the last token. A node with the same value as the source service name is also created and added to the child node of the target URI termination node.

6. The method according to claim 4, characterized in that, The step of transmitting the target data corresponding to the version-updated service to the control node through the working node, and updating the access control rules corresponding to the version-updated service through the control node, includes: The target data corresponding to the version update service is transmitted to the control node through the working node; The control node receives the target data transmitted by the working node and updates the target multi-way tree corresponding to the version update service based on the target data. The control node updates the access control rules corresponding to the target multi-way tree based on the target data, and deletes the access control rules of the target multi-way tree before the update.

7. A microservice system access control device, characterized in that, In a microservice system comprising a control node and at least one worker node, the device includes: The data collection unit is used to collect data to be processed through the working node and forward the data to be processed to the control node; The rule creation unit is used to receive the data to be processed transmitted by the worker node through the control node, create access control rules for the microservice system based on the data to be processed, and send the target dictionary corresponding to the created access control rules for the microservice system to the worker node. The mapping unit is used to determine the mapping relationship between the target dictionary and its kernel-mode access control program through the working node after the working node receives the target dictionary sent by the control node; The first judgment unit is used to analyze, through the working node, whether the message data transmitted by other services of the microservice system to the working node meets the access control rules corresponding to the target dictionary; An access permission unit is configured to allow other services of the microservice system to access the worker node when the execution result of the first judgment unit is that the message data transmitted by other services of the microservice system to the worker node satisfies the access control rules corresponding to the target dictionary. The denial unit is used to deny other services of the microservice system from accessing the worker node when the execution result of the first judgment unit is that the message data transmitted by other services of the microservice system to the worker node does not meet the access control rules corresponding to the target dictionary; The second judgment unit is used to determine whether the versions of each service in the microservice system have been updated; The update unit is used to transmit the target data corresponding to the version-updated service to the control node through the worker node when the execution result of the second judgment unit is that there is a version-updated service in the microservice system, and update the access control rules corresponding to the version-updated service through the control node. The step of receiving the data to be processed transmitted by the worker node through the control node and creating access control rules for the microservice system based on the data to be processed includes: The control node receives the target seven-tuple data transmitted by the target worker node and maps the target seven-tuple data into the source service name and destination service name corresponding to the target seven-tuple data. Based on the target seven-tuple data and the corresponding source service name and destination service name, map the target seven-tuple data and the corresponding source service name and destination service name into target five-tuple data; A multi-way tree corresponding to the target quintuple data is constructed through the control node; By using the control node, all paths of the multi-way tree corresponding to the target quintuple data are traversed to determine the access control rules corresponding to the target quintuple data as the access control rules of the microservice system.

8. A microservice system access control device, characterized in that, include: One or more processors, and memory; The memory stores computer-readable instructions that, when executed by the one or more processors, implement the steps of the microservice system access control method as described in any one of claims 1 to 6.

9. A readable storage medium, characterized in that: The readable storage medium stores computer-readable instructions that, when executed by one or more processors, cause the one or more processors to implement the steps of the microservice system access control method as described in any one of claims 1 to 6.

Images