Multi-tenant zero-trust security system based on micro segmentation

Abstract

The invention relates to the technical field of communication, in particular to a micro-segmentation-based multi-tenant zero-trust security system, which comprises a tenant network topology sensing module for acquiring network structures and service dependencies of tenants and generating a tenant-level network topology graph and a communication graph; a strategy rule automatic generation module generates a micro-segment access control strategy; the context-aware risk assessment module collects a user identity, an equipment state and a behavior track, and generates an access risk score; the strategy dynamic adjustment and application module updates the access control strategy; and the tenant isolation and zero-trust interaction module deploys a security sandbox to complete trust verification and isolation protection of cross-tenant requests. According to the method, the micro-segmentation strategy is generated by automatically identifying the service dependency boundary, the access control rule is dynamically adjusted based on the context, and refined isolation and risk-driven defense in a multi-tenant environment are realized in combination with the security sandbox and the zero-trust mechanism, so that the security and controllability of the system are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of communication technologies, and in particular to a multi-tenant zero-trust security system based on micro-segmentation. Background Art

[0002] With the widespread application of cloud computing and containerized architecture, multi-tenant systems have become the mainstream architectural form for resource sharing and service delivery. In such environments, different tenants share the underlying physical resources, but logically require strong isolation and independent management. Especially in terms of network access control, security policy deployment and cross-tenant data protection, it is necessary to ensure that each tenant's data and services are not accessed or interfered with by other tenants. At the same time, to meet the security and elastic scaling requirements of dynamic business scenarios, the security control system must have the ability to perceive context, respond in real time and dynamically adjust policies. Therefore, building a fine-grained, dynamic, least-privilege-oriented security access control mechanism in a multi-tenant environment has become a core direction of research and engineering implementation.

[0003] However, existing multi-tenant security protection solutions generally have the following shortcomings: First, most policy configurations are based on static rules and cannot automatically divide security boundaries according to business dependencies and communication behaviors. The policy granularity is coarse and the configuration is complex, making it difficult to adapt to changes in dynamic tenant topology. Second, there is a lack of real-time perception of contextual information such as user identity, device status and behavioral characteristics during the access control process, making it difficult to dynamically assess the risks and respond to access requests in a graded manner. Third, tenants usually rely on basic firewalls or logical partitions for isolation, and lack fine-grained verification and authorization mechanisms for cross-tenant requests, which can easily form lateral attack channels and pose serious risks of data leakage and abuse of rights. Summary of the Invention

[0004] The present invention provides a multi-tenant zero-trust security system based on micro-segmentation. By constructing a tenant-level network topology diagram and application communication diagram, it automatically identifies the call dependencies and deployment relationships between business units, generates a structured micro-segmentation access control policy, and combines a context-aware risk assessment module with a dynamic policy adjustment mechanism to achieve risk-driven response and real-time policy optimization for access requests. It deploys an independent security sandbox in each tenant environment and combines a zero-trust interaction mechanism to perform trusted verification and authorization for cross-tenant access requests, thereby comprehensively improving the isolation, dynamic defense capabilities and policy adaptability in a multi-tenant environment, and meeting the future-oriented cloud platform security management needs.

[0005] A multi-tenant zero-trust security system based on micro-segmentation includes a tenant network topology perception module, a policy rule automatic generation module, a context-aware risk assessment module, a policy dynamic adjustment and application module, and a tenant isolation execution and zero-trust interaction module, wherein; The tenant network topology perception module collects network structure information and business process dependencies of each tenant in the multi-tenant system, and generates a tenant-level network topology map and an application communication map; The policy rule automatic generation module analyzes the dependency boundaries and traffic characteristics between different business units based on the tenant-level network topology diagram and application communication diagram, and automatically generates tenant-oriented micro-segmentation access control policies in combination with tenant security policy templates; The context-aware risk assessment module collects user identity information, terminal device status, and historical behavior trajectory of access requests in real time, and dynamically scores each access request based on a risk discrimination model; The policy dynamic adjustment and application module dynamically adjusts and updates the corresponding micro-segment access control policy based on the risk scoring result of the access request; The tenant isolation execution and zero-trust interaction module deploys an independent security sandbox in each tenant environment to isolate tenant applications and data, and implements authorization and trusted verification of cross-tenant access requests based on micro-segmentation access control policies.

[0006] Optionally, the tenant network topology awareness module includes: Network data collection: In a multi-tenant environment, network resource information configured by each tenant in the virtual private network (VPC) is collected, including subnet structure, virtual switch connection relationship, virtual machine deployment location, and network access control list (ACL); Traffic log analysis: Extract the communication logs of the tenant in the past cycle from the virtual switch or border router, record the source address, destination address, transmission protocol, port number and timestamp, and build the communication relationship matrix within the tenant based on the interaction frequency between communication entities ; Business call path extraction: By deploying lightweight probes in the virtual machine, the module dependency sequence in each business service call chain is collected, and a business dependency graph is generated based on the service name, process ID, and request time sequence. ; Network topology construction: Use graph structure modeling to build tenant network topology ; Integration of communication diagram and business diagram: network topology diagram and business dependency graph Corresponding integration, building a tenant-level application communication diagram .

[0007] Optionally, the policy rule automatic generation module includes: Dependency boundary identification and traffic feature extraction: Based on the tenant-level network topology diagram and application communication diagram, the call relationship, deployment location, and data flow path between business units are identified. The communication frequency, protocol type, port number, and communication direction are extracted. Based on the interaction intensity and deployment adjacency between business units, business units with dense communication, adjacent deployment, and functional collaboration are divided into the same security domain. Business units with low communication frequency, large security level differences, or cross-regional deployment are divided into different security domains, thus forming preliminary micro-segmentation boundaries. Policy template matching and rule generation: Based on the preliminary micro-segmentation boundaries, the built-in security policy template library is called to match the access control model according to the access characteristics and security requirements corresponding to different boundaries. The template matching results are used to automatically generate micro-segmentation access control policies. The generated policy rules include the identification of the source business unit and the target business unit, the allowed or restricted communication protocols and port ranges, and the communication direction, forming a structured policy set for tenants.

[0008] Optionally, the dependency boundary identification and traffic feature extraction include: Identify call relationships and deployment locations: Based on the tenant-level application communication graph, identify the directed edge sets of service call relationships between all business units, extract the deployment location of each business unit (such as its virtual machine, subnet, region number, etc.), and construct a business deployment mapping table, which is expressed as: ; in, For the Business unit ID, is the corresponding deployment location identifier; Communication feature extraction: Extract multi-dimensional communication features between business units from communication logs and construct a communication feature matrix ; Boundary strength calculation and normalization: Comprehensively quantify the interaction strength between business units and calculate the interaction strength index ; Security domain division: based on interaction strength index , set the threshold ,when When the business unit and In the same security domain, When dividing into different security domains, generating a micro-segmentation boundary set .

[0009] Optionally, the policy template matching and rule generation includes: Boundary access feature extraction: for the initially divided micro-segment boundary set , for each pair of business units Extract its boundary access characteristics, including average communication intensity , Protocol Type , port number set And the communication direction type , construct access feature vector , expressed as: ; Strategy template matching: For each access feature vector , in the security policy template library Perform similarity matching in the , and select the access control model that best meets the characteristics, which is expressed as: ; in, To match the successful policy template, For the policy templates, For policy templates The eigenvector of is a multidimensional distance function (weighted Euclidean distance); Access control policy generation: Based on the matching policy template , combined with business unit identification information, automatically generates structured micro-segmentation access control rules , and generate a collection of all structured micro-segmentation access control rules , expressed as: ; in, 、 Identifies the source and target business units. To allow or restrict communication protocols, For the port range to allow or restrict, is the communication direction constraint, For access operations; .

[0010] Optionally, the context-aware risk assessment module includes: Access context information collection: extract context information related to the current user from the access request in real time, including user identity information, terminal device status, historical behavior trajectory, and construct multiple feature vectors, including user identity vector , device state vector , behavior trajectory vector ; Context vector fusion: Multiple feature vectors are input into the attention mechanism model as independent channels, and the importance of each feature dimension is assigned through the channel attention weight mechanism to obtain the fused context evaluation vector ; Risk score output: The fused context evaluation vector Input into the risk identification model to generate a risk score for the access request .

[0011] Optionally, the policy dynamic adjustment and application module includes: Risk level mapping: based on the risk score output by the context-aware risk assessment module , and maps the risk score to a discrete risk level , expressed as: ; in, 、 The risk threshold to be set; Dynamic strategy adjustment: based on risk level , select different levels of micro-segment access control policies, and dynamically enhance, demote or freeze structured micro-segment access control rules.

[0012] Optionally, the dynamic policy adjustment includes: Policy level selection: based on the risk level of the access request , select the corresponding level of micro-segmentation access control policy, including: when When using the least privileged interconnection policy template, retain the original rules; when When using the post-authentication access policy template, add authentication requirements or frequency limits; when When using the Strict Isolation policy template, set the access permission to Deny or Audit Priority mode; Dynamic adjustment of structured access control rules: structured micro-segmented access control rules matching the current access request Perform dynamic adjustment, expressed as: ; in, For the adjusted structured micro-segmentation access control rules, Adjust the function for the policy.

[0013] Optionally, the tenant isolation execution and zero trust interaction module includes: Secure sandbox deployment and tenant resource isolation: Independent secure sandbox instances are deployed in each tenant environment. Built on virtual machines, the secure sandbox features resource isolation, process isolation, and storage space isolation. The tenant's application logic, operating services, and data storage are all encapsulated in the corresponding sandbox, and network channels are isolated through virtual network namespaces or virtual switches. Micro-segment access policy issuance and enforcement: Based on the policy rule automatic generation module, the structured micro-segment access control rules are automatically generated and issued to the corresponding security sandbox control agent by tenant dimension. The policy execution component is deployed at the sandbox boundary to implement access control of resources within the tenant and cross-tenant access paths. Only network traffic that meets the current policy rules is allowed to pass, and access requests that do not match the rules are intercepted or recorded. Cross-tenant request trusted verification and authorization decision: When a cross-tenant access request occurs, a zero-trust verification process is inserted into the request path to verify the identity credentials, terminal integrity, and risk score of the access initiator, and a dynamic authorization decision is made based on the current risk level. After authorization is passed, the target tenant sandbox accepts the request and records the trusted identifier. If authorization fails, access is directly denied or transferred to audit processing.

[0014] Beneficial effects of the present invention: The present invention, by constructing a tenant network topology diagram and an application communication diagram, and combining lightweight probe data collection and communication relationship modeling, can realize automatic identification of the call relationship and deployment boundary between business units in a multi-tenant environment, thereby automatically generating fine-grained micro-segmentation access control strategies. This strategy intelligently divides security domains based on multi-dimensional information such as communication frequency, protocol type, port number and deployment location, avoids manual configuration errors, improves policy generation efficiency, and significantly enhances the controllability and manageability of the multi-tenant network.

[0015] The present invention introduces a context-aware risk assessment and policy dynamic adjustment mechanism. The system can collect the user identity, device status and historical behavior trajectory of access requests in real time, and use the attention mechanism fusion model to dynamically score the access risk. Combined with the risk level, the system can automatically select the appropriate policy template and dynamically adjust the micro-segmentation access control rules to achieve the rejection or restriction of high-risk access, and the policy enhancement or rapid release of medium and low-risk access, meeting the core security requirements of minimum privilege + dynamic defense in the zero-trust architecture.

[0016] This invention achieves strong isolation of tenant applications and data by deploying independent security sandboxes in each tenant environment and executing micro-segmentation access control policies. At the same time, it introduces trusted identity authentication, device integrity detection, and dynamic risk authorization mechanisms in cross-tenant access scenarios, building a complete zero-trust interaction process to ensure that all cross-domain access cannot access target resources before obtaining verification authorization, fundamentally blocking lateral penetration paths, effectively preventing data leakage, and improving the overall security level and trust control capabilities of the multi-tenant system. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only for the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 Schematic diagram of system function modules according to an embodiment of the present invention; Figure 2 This is a schematic diagram of a tenant network topology awareness module according to an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. Those skilled in the art may also adopt other alternatives to implement some known technologies; and the accompanying drawings are only for more specific description of the embodiments and are not intended to specifically limit the present invention.

[0020] like Figure 1-Figure 2 As shown, a multi-tenant zero-trust security system based on micro-segmentation includes a tenant network topology perception module, a policy rule automatic generation module, a context-aware risk assessment module, a policy dynamic adjustment and application module, and a tenant isolation execution and zero-trust interaction module, wherein; The tenant network topology awareness module collects network structure information and business process dependencies of each tenant in the multi-tenant system, and generates tenant-level network topology diagrams and application communication diagrams; The policy rule automatic generation module analyzes the dependency boundaries and traffic characteristics between different business units based on the tenant-level network topology diagram and application communication diagram. It then combines the tenant security policy template to automatically generate micro-segmentation access control policies for tenants. The context-aware risk assessment module collects user identity information, terminal device status, and historical behavior traces of access requests in real time, and dynamically scores each access request based on a risk discrimination model. The policy dynamic adjustment and application module dynamically adjusts and updates the corresponding micro-segment access control policy based on the risk score results of the access request, ensuring that high-risk requests are restricted and low-risk requests are allowed to pass within the minimum permission range; The tenant isolation execution and zero-trust interaction module deploys an independent security sandbox in each tenant environment to isolate tenant applications and data, and implements authorization and trusted verification of cross-tenant access requests based on micro-segmentation access control policies to prevent data leakage and lateral attacks between tenants.

[0021] The tenant network topology awareness module includes: Network data collection: In a multi-tenant environment, network resource information configured by each tenant in the virtual private network (VPC) is collected, including subnet structure, virtual switch connection relationship, virtual machine deployment location, and network access control list (ACL); Traffic log analysis: Extract the communication logs of the tenant in the past cycle from the virtual switch or border router, record the source address, destination address, transmission protocol, port number and timestamp, and build the communication relationship matrix within the tenant based on the interaction frequency between communication entities , expressed as: ; ; in, Entity per unit time To the entity The frequency of the communication initiated, Indicates that there is no communication record between the two entities. For log analysis cycle Internal, Entity To the entity The total number of communications sent, The length of the log analysis cycle; Business call path extraction: By deploying lightweight probes in the virtual machine, the module dependency sequence in each business service call chain is collected, and a business dependency graph is generated based on the service name, process ID, and request time sequence. , specifically including: (1) Lightweight probe deployment: A lightweight probe based on system call interception is deployed in each virtual machine. The probe runs in user mode or kernel mode and intercepts the following information through eBPF or LD_PRELOAD technology: 1) The current service module name (extracted from the service registration information or container metadata); 2) The unique identifier (PID) of the calling process; 3) A unique identifier for the request context (e.g., TraceID, SpanID); 4) Communication timestamp between sender and receiver.

[0022] Each call record is encapsulated as a structured log entry, represented as: ; in, For the service call records, For the The service name of the call initiator of the record, For the The target service name of the record. For the The records correspond to process IDs. is the unique identifier of the request chain, To send a timestamp, The receiving timestamp; (2) Call chain splicing: With TraceID as the primary key, aggregate and sort the call records collected by all probes to obtain a complete request chain, which is expressed as: ; in, For the A complete request call chain, including dependent records, each record is Arrange in ascending order to ensure the traceability of dependency order; (3) Build a business dependency graph: All call chains Merge and extract dependency edges between service modules to form a business dependency graph , expressed as: ; in, is a set of nodes, is a set of all observed service module names, Represent call dependencies for each edge; Network topology construction: Use graph structure modeling to build tenant network topology , specifically including: (1) Network node set construction: Based on the collected network resource information, all basic components involved in communication in the tenant network are extracted to form a network node set. ,include: 1) Virtual Machine Node (VM); 2) Virtual router node (vRouter); 3) Virtual switch node (vSwitch); 4) Subnet gateway node (SubnetGW); 5) NAT nodes (such as egress gateways and edge devices); make: ; in, A specific device or logical entity in the network; (2) Topological connection edge construction: Use the configured connection relationship (such as the virtual switch connection table) and the calculated communication relationship matrix , generating a set of connecting edges between nodes , each edge indicates that there is a physical / virtual connection relationship between two nodes or that network communication actually occurred, which can be expressed as: ; in, For network nodes and There is a valid connection between The weight of the edge is taken from the element value of the communication relationship matrix , indicating the communication frequency, if there is a connection at the topological level but , can still be added as a potential channel edge, setting a default lower weight ,Right now ; (3) Network topology generation: Merge the node set and edge set to construct the tenant network topology graph, which is expressed as: ; Integration of communication diagram and business diagram: network topology diagram and business dependency graph Corresponding integration, building a tenant-level application communication diagram , expressed as: ; in, Represents structural alignment and semantic fusion operations.

[0023] The policy rule automatic generation module includes: Dependency boundary identification and traffic feature extraction: Based on the tenant-level network topology diagram and application communication diagram, the call relationship, deployment location, and data flow path between business units are identified. The communication frequency, protocol type, port number, and communication direction are extracted. Based on the interaction intensity and deployment adjacency between business units, business units with dense communication, adjacent deployment, and functional collaboration are divided into the same security domain. Business units with low communication frequency, large security level differences, or cross-regional deployment are divided into different security domains, thus forming preliminary micro-segmentation boundaries. Policy template matching and rule generation: Based on the preliminary micro-segmentation boundaries, the built-in security policy template library is called to match the access control model according to the access characteristics and security requirements corresponding to different boundaries. The template matching results are used to automatically generate micro-segmentation access control policies. The generated policy rules include the identification of the source business unit and the target business unit, the allowed or restricted communication protocols and port ranges, and the communication direction, forming a structured policy set for tenants.

[0024] Dependency boundary identification and traffic feature extraction include: Identify call relationships and deployment locations: Based on the tenant-level application communication graph, identify the directed edge sets of service call relationships between all business units, extract the deployment location of each business unit (such as its virtual machine, subnet, region number, etc.), and construct a business deployment mapping table, which is expressed as: ; in, For the Business unit ID, The corresponding deployment location identifier, such as a subnet ID or edge / core node ID; Communication feature extraction: Extract multi-dimensional communication features between business units from communication logs and construct a communication feature matrix , expressed as: ; ; in, Business unit per unit time and The frequency of communication between Main transport protocol (such as TCP, UDP), is the set of port numbers used, The direction of communication (e.g., one-way, two-way, or request-reply mode); Boundary strength calculation and normalization: Comprehensively quantify the interaction strength between business units and calculate the interaction strength index , expressed as: ; in, is the maximum value among all communication frequencies, If the business unit and If they are deployed in the same location, the value is 1, otherwise it is 0. 、 is the weight coefficient; Security domain division: based on interaction strength index , set the threshold ,when When the business unit and In the same security domain, When dividing into different security domains, generating a micro-segmentation boundary set , expressed as: ; Threshold Dynamic quantile thresholds based on statistical distribution are set, including: (1) Calculate the interaction strength set of all business unit pairs: All interaction strength indices constitute a set, expressed as: ; (2) Setting the target quantile ratio: Setting the quantile ratio , set to 0.6, indicating that the communication strength is selected before The business unit pairs are used as the same domain standard; (3) Calculate the threshold for - Quantile: ; in, Representing a collection After sorting the values ​​from small to large, the Percentile value.

[0025] Policy template matching and rule generation include: Boundary access feature extraction: for the initially divided micro-segment boundary set , for each pair of business units Extract its boundary access characteristics, including average communication intensity , Protocol Type , port number set And the communication direction type , construct access feature vector , expressed as: ; Strategy template matching: For each access feature vector , in the security policy template library Perform similarity matching in the , and select the access control model that best meets the characteristics, which is expressed as: ; in, To match the successful policy template, For the A policy template, including attribute vectors , For policy templates The eigenvector of is a multidimensional distance function (weighted Euclidean distance); Access control policy generation: Based on the matching policy template , combined with business unit identification information, automatically generates structured micro-segmentation access control rules , and generate a collection of all structured micro-segmentation access control rules , expressed as: ; in, 、 Identifies the source and target business units. To allow or restrict communication protocols, For the port range to allow or restrict, is the communication direction constraint, For access operations, allow / deny / rate limit, etc. ; Security policy template library include: template : Strict isolation strategy: Applicable conditions: No historical communication records or the communication intensity is far below the set threshold; Communication protocol: reject all; Port range: deny all; Communication direction: Bidirectional rejection; Behavior control: deny access, deny connection initialization; Typical scenarios: low-correlation modules, test environments, and communication between components in different tenants; template : One-way request strategy: Applicable conditions: The communication is a one-way request type, the target business unit is an interface service or read-only service, and there is no reverse call behavior; Communication protocols: HTTP / HTTPS, gRPC, RPC, etc. Port range: predefined service ports (such as 80 / 443 / 50051, etc.); Communication direction: Only from the source Initiate to target ; Behavior control: reject reverse connections or active communications; Typical scenario: front-end service → API gateway, data collector → data receiving module; template : Least privilege intercommunication strategy: Applicable conditions: Frequent two-way communication, but with clear complementary functional responsibilities and different service authority levels; Communication protocol: TCP / UDP, with port restrictions; Port range: limited to the business-defined range (e.g. Redis: 6379, MySQL: 3306); Communication direction: bidirectional, with frequency limit or rate control; Behavior control: supports connections but prohibits unauthorized commands / protocol extensions; Typical scenarios: application services and databases, primary and secondary nodes; template : Trusted cluster strategy: Applicable conditions: Frequent communication, adjacent deployment, belonging to the same tenant subset, and having service redundancy / load balancing features; Communication protocol: All protocols are allowed (limited to the tenant domain); Port range: configure port whitelist; Communication direction: two-way fully open (limited to the internal domain); Behavior control: trust intra-cluster communication and disable external domain communication; Typical scenarios: container replica groups, internal communication within a service grid, and K8s Pods belonging to the same Deployment / Service. template : Pass-through strategy after authentication: Applicable conditions: Communication is a sensitive operation or a prerequisite for resource access, and there is a need for risk identification; Communication protocols: HTTP+Token, mTLS, LDAP+SASL and other authentication mechanisms; Port range: Dynamically updated within a policy template (e.g., API Token Gateway); Communication direction: one-way or two-way, requires successful identity verification; Behavior control: Access requires dynamic identity authentication, device verification, and behavior auditing; Typical scenarios: users access sensitive microservices and tenants request cross-domain data.

[0026] The context-aware risk assessment module includes: Access context information collection: extract context information related to the current user from the access request in real time, including user identity information, terminal device status, historical behavior trajectory, and construct multiple feature vectors, including user identity vector , device state vector , behavior trajectory vector , expressed as: User identity vector: ; in, A unique identifier for the user. For user role labels, The duration of the login token. It is the identity authentication method; Device state vector: ; in, is the terminal device type, is the operating system version number, The time since the last security patch update. The geographical distance between the current location and the commonly logged-in location; Behavior trajectory vector: ; in, is the login frequency, is the historical access path entropy, The percentage of historical abnormal behaviors; Context vector fusion: Multiple feature vectors are input into the attention mechanism model as independent channels, and the importance of each feature dimension is assigned through the channel attention weight mechanism to obtain the fused context evaluation vector , expressed as: ; in, 、 、 are the adaptively calculated channel attention weights; Risk score output: The fused context evaluation vector Input into the risk identification model to generate a risk score for the access request , expressed as: ; in, is the weight matrix of the risk discrimination model, is the bias term, is the Sigmoid activation function.

[0027] The policy dynamic adjustment and application modules include: Risk level mapping: based on the risk score output by the context-aware risk assessment module , and maps the risk score to a discrete risk level , expressed as: ; in, 、 The risk threshold to be set; Dynamic strategy adjustment: based on risk level , select different levels of micro-segment access control policies, and dynamically enhance, demote or freeze structured micro-segment access control rules.

[0028] Dynamic policy adjustments include: Policy level selection: based on the risk level of the access request , select the corresponding level of micro-segmentation access control policy, including: when When using the least privileged interconnection policy template, retain the original rules; when When using the post-authentication access policy template, add authentication requirements or frequency limits; when When using the Strict Isolation policy template, set the access permission to Deny or Audit Priority mode; Dynamic adjustment of structured access control rules: structured micro-segmented access control rules matching the current access request Perform dynamic adjustment, expressed as: ; in, For the adjusted structured micro-segmentation access control rules, Adjust the function for the policy; Policy adjustment function The processing logic includes: like Low, then ; like In the case of a connection error, enhance the authentication field or add an access frequency limit policy (such as the maximum number of connections per minute); like If the value is high, the field action = "deny" or "quarantine" is set to temporarily freeze or audit the access to the target business unit.

[0029] Tenant isolation enforcement and zero trust interaction modules include: Secure sandbox deployment and tenant resource isolation: Independent secure sandbox instances are deployed in each tenant environment. Built on virtual machines, the secure sandbox features resource isolation, process isolation, and storage space isolation. The tenant's application logic, operating services, and data storage are all encapsulated in the corresponding sandbox, and network channels are isolated through virtual network namespaces or virtual switches. Micro-segment access policy issuance and enforcement: Based on the policy rule automatic generation module, the structured micro-segment access control rules are automatically generated and issued to the corresponding security sandbox control agent by tenant dimension. The policy execution component is deployed at the sandbox boundary to implement access control of resources within the tenant and cross-tenant access paths. Only network traffic that meets the current policy rules is allowed to pass, and access requests that do not match the rules are intercepted or recorded. Cross-tenant request trusted verification and authorization decision: When a cross-tenant access request occurs, a zero-trust verification process is inserted into the request path to verify the identity credentials, terminal integrity, and risk score of the access initiator, and a dynamic authorization decision is made based on the current risk level. After authorization is passed, the target tenant sandbox accepts the request and records the trusted identifier. If authorization fails, access is directly denied or transferred to audit processing.

[0030] The present invention encompasses any alternatives, modifications, equivalents, and solutions that fall within the spirit and scope of the present invention. To provide a thorough understanding of the present invention, specific details are described in detail below in connection with the preferred embodiments of the present invention, but those skilled in the art will be able to fully understand the present invention without these detailed descriptions. Furthermore, to avoid unnecessary confusion regarding the essence of the present invention, well-known methods, processes, procedures, components, and circuits have not been described in detail.

[0031] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A multi-tenant zero-trust security system based on micro-segmentation, characterized by: It includes tenant network topology awareness module, policy rule automatic generation module, context-aware risk assessment module, policy dynamic adjustment and application module, and tenant isolation execution and zero-trust interaction module, among which; The tenant network topology perception module collects network structure information and business process dependencies of each tenant in the multi-tenant system, and generates a tenant-level network topology map and an application communication map; The policy rule automatic generation module analyzes the dependency boundaries and traffic characteristics between different business units based on the tenant-level network topology diagram and application communication diagram, and automatically generates tenant-oriented micro-segmentation access control policies in combination with tenant security policy templates; The context-aware risk assessment module collects user identity information, terminal device status, and historical behavior trajectory of access requests in real time, and dynamically scores each access request based on a risk discrimination model; The policy dynamic adjustment and application module dynamically adjusts and updates the corresponding micro-segment access control policy based on the risk scoring result of the access request; The tenant isolation execution and zero-trust interaction module deploys an independent security sandbox in each tenant environment to isolate tenant applications and data, and implements authorization and trusted verification of cross-tenant access requests based on micro-segmentation access control policies.

2. A multi-tenant zero-trust security system based on micro-segmentation according to claim 1, characterized in that: The tenant network topology perception module includes: Network data collection: In a multi-tenant environment, collect network resource information configured by each tenant in the virtual private network, including subnet structure, virtual switch connection relationship, virtual machine deployment location, and network access control list; Traffic log analysis: Extract the communication logs of the tenant in the past cycle from the virtual switch or border router, record the source address, destination address, transmission protocol, port number and timestamp, and build the communication relationship matrix within the tenant based on the interaction frequency between communication entities ; Business call path extraction: By deploying lightweight probes in the virtual machine, the module dependency sequence in each business service call chain is collected, and a business dependency graph is generated based on the service name, process ID, and request time sequence. ; Integration of communication diagram and business diagram: network topology diagram and business dependency graph Corresponding integration, building a tenant-level application communication diagram .

3. A multi-tenant zero-trust security system based on micro-segmentation according to claim 1, characterized in that: The policy rule automatic generation module includes: Dependency boundary identification and traffic feature extraction: Based on the tenant-level network topology diagram and application communication diagram, the call relationship, deployment location, and data flow path between business units are identified. The communication frequency, protocol type, port number, and communication direction are extracted. Based on the interaction intensity and deployment adjacency between business units, business units with dense communication, adjacent deployment, and functional collaboration are divided into the same security domain. Business units with low communication frequency, large security level differences, or cross-regional deployment are divided into different security domains, thus forming preliminary micro-segmentation boundaries. Policy template matching and rule generation: Based on the preliminary micro-segmentation boundaries, the built-in security policy template library is called to match the access control model according to the access characteristics and security requirements corresponding to different boundaries. The template matching results are used to automatically generate micro-segmentation access control policies. The generated policy rules include the identification of the source business unit and the target business unit, the allowed or restricted communication protocols and port ranges, and the communication direction, forming a structured policy set for tenants.

4. A multi-tenant zero-trust security system based on micro-segmentation according to claim 3, characterized in that: The dependency boundary identification and traffic feature extraction include: Call relationship and deployment location identification: Based on the tenant-level application communication graph, identify the directed edge set of service call relationships between all business units, extract the deployment location of each business unit, and build a business deployment mapping table, which is expressed as: ； in, For the Business unit ID, is the corresponding deployment location identifier; Communication feature extraction: Extract multi-dimensional communication features between business units from communication logs and construct a communication feature matrix ; Boundary strength calculation and normalization: Comprehensively quantify the interaction strength between business units and calculate the interaction strength index ; Security domain division: based on interaction strength index , set the threshold ,when When the business unit and In the same security domain, When dividing into different security domains, generating a micro-segmentation boundary set .

5. A multi-tenant zero-trust security system based on micro-segmentation according to claim 4, characterized in that: The policy template matching and rule generation include: Boundary access feature extraction: for the initially divided micro-segment boundary set , for each pair of business units Extract its boundary access characteristics, including average communication intensity , Protocol Type , port number set And the communication direction type , construct access feature vector , expressed as: ； Strategy template matching: For each access feature vector , in the security policy template library Perform similarity matching in the , and select the access control model that best meets the characteristics, which is expressed as: ； in, To match the successful policy template, For the policy templates, For policy templates The eigenvector of is a multidimensional distance function; Access control policy generation: Based on the matching policy template , combined with business unit identification information, automatically generates structured micro-segmentation access control rules , and generate a collection of all structured micro-segmentation access control rules , expressed as: ； in, 、 Identifies the source and target business units. To allow or restrict communication protocols, For the port range to allow or restrict, is the communication direction constraint, For access operations; 。 6. A multi-tenant zero-trust security system based on micro-segmentation according to claim 1, characterized in that: The context-aware risk assessment module includes: Access context information collection: extract context information related to the current user from the access request in real time, including user identity information, terminal device status, historical behavior trajectory, and construct multiple feature vectors, including user identity vector , device state vector , behavior trajectory vector ; Context vector fusion: Multiple feature vectors are input into the attention mechanism model as independent channels, and the importance of each feature dimension is assigned through the channel attention weight mechanism to obtain the fused context evaluation vector ; Risk score output: The fused context evaluation vector Input into the risk identification model to generate a risk score for the access request .

7. A micro-segmentation-based multi-tenant zero-trust security system according to claim 6, characterized in that: The strategy dynamic adjustment and application module includes: Risk level mapping: based on the risk score output by the context-aware risk assessment module , and maps the risk score to a discrete risk level , expressed as: ； in, 、 The risk threshold to be set; Dynamic strategy adjustment: based on risk level , select different levels of micro-segment access control policies, and dynamically enhance, demote or freeze structured micro-segment access control rules.

8. A multi-tenant zero-trust security system based on micro-segmentation according to claim 7, characterized in that: The dynamic policy adjustment includes: Policy level selection: based on the risk level of the access request , select the corresponding level of micro-segmentation access control policy, including: when When using the least privileged interconnection policy template, retain the original rules; when When using the post-authentication access policy template, add authentication requirements or frequency limits; when When using the Strict Isolation policy template, set the access permission to Deny or Audit Priority mode; Dynamic adjustment of structured access control rules: structured micro-segmented access control rules matching the current access request Perform dynamic adjustment, expressed as: ； in, For the adjusted structured micro-segmentation access control rules, Adjust the function for the policy.

9. A multi-tenant zero-trust security system based on micro-segmentation according to claim 1, characterized in that: The tenant isolation execution and zero trust interaction module includes: Secure sandbox deployment and tenant resource isolation: Independent secure sandbox instances are deployed in each tenant environment. Built on virtual machines, the secure sandbox features resource isolation, process isolation, and storage space isolation. The tenant's application logic, operating services, and data storage are all encapsulated in the corresponding sandbox, and network channels are isolated through virtual network namespaces or virtual switches. Micro-segment access policy issuance and enforcement: Based on the policy rule automatic generation module, the structured micro-segment access control rules are automatically generated and issued to the corresponding security sandbox control agent by tenant dimension. The policy execution component is deployed at the sandbox boundary to implement access control of resources within the tenant and cross-tenant access paths. Only network traffic that meets the current policy rules is allowed to pass, and access requests that do not match the rules are intercepted or recorded. Cross-tenant request trusted verification and authorization decision: When a cross-tenant access request occurs, a zero-trust verification process is inserted into the request path to verify the identity credentials, terminal integrity, and risk score of the access initiator, and a dynamic authorization decision is made based on the current risk level. After authorization is passed, the target tenant sandbox accepts the request and records the trusted identifier. If authorization fails, access is directly denied or transferred to audit processing.

Images