Application access security control methods, systems and computer-readable storage media

Abstract

This application proposes an application access security control method, system, and computer-readable storage medium. The method includes: responding to an application access request from a client, allocating a target proxy server to the client from a set of available proxy servers based on a predetermined server allocation policy; sending the application access request to an application resource server via the target proxy server and a zero-trust gateway connected to the target proxy server, and feeding back the response data from the application resource server to the application access request to the client via the zero-trust gateway and the target proxy server; when it is detected that the target proxy server does not have client access traffic, updating the IP address of the target proxy server according to a predetermined address dynamic update policy, and re-adding the target proxy server with the updated IP address to the set of available proxy servers. This solution improves network security by dynamically allocating proxy servers with dynamically updatable addresses to the client.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an application access security control method and system and a computer-readable storage medium. Background Technology

[0002] With the increasing complexity and frequency of cyberattacks, the exposure of application server and zero-trust gateway IP addresses has become a serious security vulnerability. Attackers can launch continuous probing and attacks against obtained fixed addresses, such as distributed denial-of-service attacks or intrusions based on known vulnerabilities. Although traditional security architectures can hide the real addresses of backend applications, their entry point, the zero-trust gateway itself, remains a static exposure point. Attackers can pinpoint this gateway address through traffic analysis or long-term monitoring and launch attacks, putting security defenses at risk of being breached.

[0003] Therefore, how to avoid exposing the static IP address of the zero-trust gateway, so that attackers cannot track and lock the access point, thereby effectively improving the proactive defense capability and concealment of the application access security management system, has become an urgent technical problem to be solved. Summary of the Invention

[0004] This application provides an application access security control method and system, as well as a computer-readable storage medium, which aims to solve the technical problem in related technologies that zero-trust gateways are easily identified, tracked, and attacked by attackers due to the use of static IP addresses, thereby causing the entire security defense line to face the risk of being penetrated.

[0005] In a first aspect, embodiments of this application provide an application access security control method, including:

[0006] In response to an application access request from a client, a target proxy server is assigned to the client from the set of available proxy servers based on a predetermined server allocation strategy;

[0007] The application access request is sent to the application resource server through the target proxy server and the zero-trust gateway connected to the target proxy server, and the response data of the application resource server to the application access request is fed back to the client through the zero-trust gateway and the target proxy server.

[0008] When it is detected that the target proxy server does not have client access traffic, the IP address of the target proxy server is updated according to a predetermined address dynamic update strategy, and the target proxy server with the updated IP address is added back to the set of available proxy servers.

[0009] In one embodiment of this application, optionally, the step of allocating a target proxy server for the client from the set of available proxy servers based on a predetermined server allocation strategy includes:

[0010] Based on the client's IP address, user identifier, requested application, and request time, determine the access summary information;

[0011] The proxy server that matches the access digest information is determined from the set of available proxy servers and is assigned as the target proxy server to the client.

[0012] In one embodiment of this application, optionally, the step of allocating a target proxy server for the client from the set of available proxy servers based on a predetermined server allocation strategy includes:

[0013] Based on the client's IP address, user identifier, requested application and request time, historical risk information of the requested application, and historical allocation information of the proxy server to which the client was assigned, the association degree between each proxy server in the set of available proxy servers and the client is determined.

[0014] The proxy server with the lowest correlation to the client is determined as the target proxy server assigned to the client.

[0015] In one embodiment of this application, optionally, the historical allocation information of the proxy server assigned to the client includes: the number of times each proxy server in the set of available proxy servers has been assigned, the total number of times the client has been assigned to a proxy server and the average allocation interval, the last proxy server assigned to the client, the duration from the last time the client was assigned to a proxy server to the current time, and the allocation time distribution information of the proxy servers assigned to the client.

[0016] In one embodiment of this application, optionally, determining the association degree between each proxy server in the set of available proxy servers and the client based on the client's IP address, user identifier, requested application and request time, historical risk information of the requested application, and historical allocation information of the proxy server to which the client was assigned, includes:

[0017] The client's IP address, user ID, requested application and request time, as well as the historical risk information of the requested application, are used as input information for the client tower in the pre-trained dual-tower model, and the first multi-dimensional feature vector is output through the client tower.

[0018] The historical allocation information of the proxy server assigned to the client is used as the input information of the proxy tower in the dual-tower model, and the proxy tower outputs a second multi-dimensional feature vector.

[0019] Determine the cosine similarity between the first multidimensional feature vector and the second multidimensional feature vector;

[0020] Based on the historical allocation information of the proxy server assigned to the client, a historical allocation record sequence is determined for the client, wherein the nth element in the historical allocation record sequence is the embedding vector of the nth proxy server in the set of available proxy servers;

[0021] The historical allocation record sequence is used as the input to a pre-trained recurrent neural network. The recurrent neural network determines the allocation history context vector corresponding to the client. The allocation history context vector is concatenated with the embedding vector of each proxy server and then input into the fully connected layer of the recurrent neural network. The recurrent neural network outputs the temporal correlation between each proxy server and the client.

[0022] For each proxy server, the weight of the proxy server is updated based on the cosine similarity, and the product of the temporal relevance between the proxy server and the client and the updated weight is determined as the correlation between the proxy server and the client.

[0023] In one embodiment of this application, optionally, sending the application access request to the application resource server through the target proxy server and a zero-trust gateway connected to the target proxy server includes:

[0024] Based on the client's predetermined security policy, the connection port is opened for the client in the target proxy server;

[0025] The application access request from the client is obtained through the connection port, and the application access request is transmitted through an encrypted tunnel to the zero-trust gateway connected to the target proxy server, and then transmitted by the zero-trust gateway to the application resource server;

[0026] The step of feeding back the response data of the application resource server to the application access request to the client through the zero-trust gateway and the target proxy server includes:

[0027] The response data of the application resource server to the application access request is transmitted to the target proxy server through the zero-trust gateway and the encrypted tunnel, and then the target proxy server feeds back the response data to the client.

[0028] In one embodiment of this application, optionally, updating the IP address of the target proxy server according to a predetermined address dynamic update strategy includes:

[0029] Obtain the time-series correlation between each of the multiple clients, including the client mentioned above, and the target proxy server;

[0030] Based on the temporal correlation between each of the multiple clients and the target proxy server, and the security coefficient of each of the multiple clients, the first client affinity of the target proxy server is determined;

[0031] The target value range to which the first client affinity belongs is determined from a predetermined range of values, and the IP address of the target proxy server is updated with a predetermined time period corresponding to the target value range as the IP address update cycle.

[0032] In one embodiment of this application, optionally, updating the IP address of the target proxy server according to a predetermined address dynamic update strategy includes:

[0033] Obtain the temporal correlation and association degree between each of the multiple clients, including the client mentioned above, and the target proxy server;

[0034] Based on the temporal correlation and association between each of the multiple clients and the target proxy server, as well as the security coefficient of each of the multiple clients, the second client affinity of the target proxy server is determined;

[0035] The target value range to which the second client affinity of the target proxy server belongs is determined from a predetermined number of value ranges, and the IP address of the target proxy server is updated with a predetermined time period corresponding to the target value range as the IP address update cycle.

[0036] Secondly, embodiments of this application provide an application access security control system for executing the application access security control method described in any one of the first aspects, comprising a zero-trust server, a set of available proxy servers, and a zero-trust gateway, wherein...

[0037] In response to an application access request from a client, the zero-trust server allocates a target proxy server to the client from the set of available proxy servers based on a predetermined server allocation strategy.

[0038] The target proxy server opens a connection port for the client based on the client's predetermined security policy, obtains application access requests from the client through the connection port, and transmits the application access requests to the zero-trust gateway through an encrypted tunnel;

[0039] The zero-trust gateway transmits the application access request to the application resource server, obtains the response data of the application resource server in response to the application access request, and feeds back the response data to the zero-trust gateway.

[0040] The zero-trust gateway transmits the response data to the target proxy server via the encrypted tunnel;

[0041] The target proxy server sends the response data back to the client.

[0042] When the target proxy server detects that it does not have client access traffic, it updates its IP address according to a predetermined address dynamic update strategy, and re-registers with the available proxy server set based on the updated IP address.

[0043] Thirdly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions for performing the method described in the first aspect above.

[0044] The above technical solution addresses the technical problem in related technologies where zero-trust gateways, due to their use of static IP addresses, are easily identified, tracked, and attacked by attackers, thus leading to the risk of the entire security defense being penetrated. By dynamically allocating proxy servers with dynamically updatable addresses through zero-trust servers, an encrypted access chain from the client to application resources is constructed. This achieves a dynamic security protection system that integrates identity authentication, traffic relay, and address concealment. This ensures that client access behavior always passes through changing proxy nodes and encrypted tunnels, thereby completely hiding the real network address of core service facilities. At the same time, through intelligent allocation and timed update mechanisms, the association between the client and the fixed entry point is effectively severed, and the attacker's tracking perspective is continuously disrupted. This simultaneously improves the system's proactive defense capabilities from three levels: access entry point, relay link, and infrastructure, ultimately achieving high concealment, high security, and attack resistance throughout the entire business access process. Attached Figure Description

[0045] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 A flowchart of an application access security control method according to an embodiment of this application is shown;

[0047] Figure 2A flowchart of an application access security control method according to another embodiment of this application is shown;

[0048] Figure 3 An architecture diagram of an application access security control system according to an embodiment of this application is shown;

[0049] Figure 4 A block diagram of a computer device according to one embodiment of this application is shown;

[0050] Figure 5 A block diagram of a computer device according to another embodiment of this application is shown. Detailed Implementation

[0051] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0052] Figure 1 A flowchart of an application access security control method according to an embodiment of this application is shown.

[0053] like Figure 1 As shown, an application access security control method according to an embodiment of this application includes:

[0054] Step 102: In response to the application access request from the client, a target proxy server is assigned to the client from the set of available proxy servers based on a predetermined server allocation strategy.

[0055] The main entity implementing this technical solution is the application access security management system, which includes a zero-trust server, a set of available proxy servers, and a zero-trust gateway. The zero-trust server, as the controller, interacts with the set of available proxy servers and the zero-trust gateway.

[0056] In one possible design, all actions in this technical solution are implemented by the zero-trust server itself, or by controlling the available proxy server set and the zero-trust gateway, or by the proxy servers and the zero-trust gateway in the proxy server set actively implementing them based on a predetermined policy.

[0057] Specifically, when a client requests access to an application resource server, it must first send the application access request to the zero-trust server, which then assigns a proxy server to the client. The zero-trust server, acting as the system's control center, is responsible for receiving and processing client access requests and executing security decisions. It can use a set of proxy servers as a dynamic resource pool, providing multiple allocable proxy servers for the zero-trust server to select the appropriate target proxy server for the client.

[0058] The predetermined server allocation strategy reflects the system's requirements for the security and dynamic concealment of this client access. Through an intelligent proxy selection mechanism, a different access IP address is provided to the client each time it accesses the application resource server. This ensures that each allocation effectively severs the association between the client and the fixed entry point, building the first dynamic line of defense against network attacks. In other words, the predetermined server allocation strategy can intelligently select the most suitable proxy node for the client. Thus, through the centralized management of zero-trust servers and the dynamic resource coordination of the proxy pool, a suitable target proxy server can be assigned to each access request, effectively dispersing access traffic and confusing attackers' tracking, thereby improving the concealment and defense performance of the entire system from the source.

[0059] Step 104: The application access request is sent to the application resource server through the target proxy server and the zero-trust gateway connected to the target proxy server, and the response data of the application resource server to the application access request is fed back to the client through the zero-trust gateway and the target proxy server.

[0060] Specifically, based on the client's predetermined security policy, a connection port is opened for the client in the target proxy server; an application access request from the client is obtained through the connection port, and the application access request is transmitted through an encrypted tunnel to a zero-trust gateway connected to the target proxy server, and then transmitted by the zero-trust gateway to the application resource server; the response data of the application resource server to the application access request is transmitted through the zero-trust gateway and the encrypted tunnel to the target proxy server, and then the target proxy server feeds back the response data to the client.

[0061] By opening policy-controlled ports on the target proxy server and establishing an encrypted tunnel connection to the zero-trust gateway, an end-to-end secure transmission chain is constructed from the client to the proxy server, then through the zero-trust gateway, and finally to the application service. This ensures that all access traffic is encrypted and relayed through the controlled nodes selected by the zero-trust server each time, thereby completely hiding the real network addresses of the zero-trust gateway and the backend application resource server. This effectively blocks the possibility of attackers directly probing or attacking critical infrastructure, thus achieving high security and high concealment in the business access process.

[0062] Step 106: When it is detected that the target proxy server does not have client access traffic, the IP address of the target proxy server is updated according to the predetermined address dynamic update strategy, and the target proxy server with the updated IP address is added back to the set of available proxy servers.

[0063] Proxy server IP address updates are a security update function designed to counter network attacks. The trigger condition for the address update is the absence of client access traffic to the target proxy server. This accurately identifies idle nodes suitable for security updates, allowing the proxy server to promptly change its IP address after completing the current application access relay. This prevents external attackers from exploiting IP addresses exposed during previous application access relays. Updating the target proxy server's IP address is the core operation, breaking the binding relationship between proxy nodes and fixed addresses. The updated target proxy server acts as a regenerated resource, retaining its original configuration but possessing a new address. This enables the anonymous rebirth of the proxy identity, making it appear from an external attacker's perspective that each client access to the application accesses a different address, thus preventing the attacker from identifying client access patterns and actual targets. Finally, the available proxy server set can be used as a dynamic resource pool to receive and integrate updated proxy nodes.

[0064] In short, by detecting traffic status and triggering policy-based address updates, the proxy server can automatically change its network identity and return to the resource pool during idle periods. This avoids the interference of forced updates on active sessions and ensures the continuous change of the proxy pool address composition. As a result, it effectively blocks attackers' long-term tracking and penetration attempts on specific proxy nodes, and greatly improves the dynamic defense capability of the proxy layer and the overall security resilience of the system.

[0065] In summary, this technical solution constructs an encrypted access chain from the client to application resources by dynamically allocating proxy servers with dynamically updatable addresses through zero-trust servers. It realizes a dynamic security protection system that integrates identity authentication, traffic relay, and address concealment, ensuring that client access behavior always passes through changing proxy nodes and encrypted tunnels, thereby completely hiding the real network address of core service facilities. At the same time, through intelligent allocation and timed update mechanisms, it effectively severs the association between the client and the fixed entry point and continuously disrupts the attacker's tracking perspective. Thus, it simultaneously improves the system's proactive defense capabilities from three levels: access entry point, relay link, and infrastructure, ultimately achieving high concealment, high security, and attack resistance throughout the entire business access process.

[0066] In one possible design, step 102 includes: determining access digest information based on the client's IP address, user identifier, requested application, and requested access time; and determining a proxy server from the set of available proxy servers that matches the access digest information as the target proxy server assigned to the client.

[0067] The client's IP address serves as a network location identifier, distinguishing access requests from different sources. This IP address can be a public or private network address. The user identifier serves as an authentication credential, uniquely identifying the visitor; for example, it can be a username or a digital certificate. The requesting application serves as a target resource identifier, clearly identifying the specific service being accessed; for example, the requesting application can be represented by an application ID or service name. The request access time serves as a timestamp, recording the moment the access occurred. These elements collectively constitute the basic input for generating access digest information, comprehensively characterizing the contextual features of the access request. Access digest information, as a fusion of these multi-dimensional features, transforms complex access characteristics into a concise and unique feature for subsequent matching. Optionally, a hash operation is performed based on the client's IP address, user identifier, requesting application, and request access time to calculate a hash value as access digest information.

[0068] During the proxy server matching process, consistent hashing or similarity calculation can be used to determine the degree of matching between the access digest information and the digest information of each proxy server. This allows for the allocation of the most suitable target proxy server to the client, improving the access experience for legitimate users while maintaining the system's dynamic anonymity. Furthermore, this hash value comparison method further enhances the system's resilience against external attacks.

[0069] In another possible design, step 102 includes: determining the correlation between each proxy server in the set of available proxy servers and the client, based on the client's IP address, user identifier, requested application and request time, historical risk information of the requested application, and historical allocation information of the proxy server to which the client is assigned; and determining the proxy server with the lowest correlation with the client as the target proxy server assigned to the client.

[0070] The client's IP address, user identifier, requested application, and request time are real-time access elements that collectively reflect the uniqueness, real-time nature, and contextual characteristics of this access request. The historical risk information of the requested application reflects the likelihood and severity of security threats suffered by that application. The historical allocation information of the proxy server assigned to the client reflects the client's past behavior patterns and regularities in using proxy servers. These elements reflect the potential security level of this access from three dimensions: real-time contextual characteristics, application security posture, and historical behavioral patterns. In other words, these elements collectively reflect the overall security profile and historical behavioral preferences of the client's current access behavior.

[0071] The higher the correlation between a client and a proxy server, the greater the likelihood of being traced by external attackers. This leads to a greater security risk for the client using the proxy server as a relay. Therefore, the essence of correlation is to quantify the degree of mismatch between the current and historical states of the proxy server and the client. Based on the above factors, precise calculation criteria are provided from three dimensions: real-time context features, application security posture, and historical behavioral patterns. The client's real-time access elements define the uniqueness and security requirements of this session; historical risk information of the application reveals potential threats, thus influencing the risk-avoidance tendency of proxy selection; and historical allocation information predicts the compatibility of the client with different proxies through behavioral patterns. Therefore, through the above technical solution, real-time context features, application security posture, and historical behavioral patterns can be integrated to construct a dynamic evaluation model that can respond to immediate security needs and conform to long-term behavioral patterns. This makes correlation calculation no longer a simple static matching, but an intelligent decision-making process with risk perception and behavioral prediction capabilities.

[0072] The historical allocation information of the proxy server assigned to the client includes: the number of times each proxy server in the set of available proxy servers has been assigned, the total number of times the client has been assigned a proxy server and the average allocation interval, the last proxy server assigned to the client, the time elapsed from the last time the client was assigned a proxy server to the current time, and the allocation time distribution information of the proxy servers assigned to the client.

[0073] The number of times each proxy server in the available proxy server set is assigned reflects the global load and popularity of the proxy node. The total number of times a client is assigned a proxy server, i.e., the client's overall proxy usage, reflects the client's activity and dependence on proxy nodes. The average assignment interval, as the time average between two proxy assignments, reveals the client's access patterns and session characteristics. The last proxy server assigned to the client, as the most recently used proxy node, provides recent association reference information. The time difference between the last time the client was assigned a proxy server and the current time, as the time difference from the last use, measures the freshness of the proxy node's use. The allocation time distribution information, as a historical pattern example of proxy usage time periods, can characterize behavioral preferences over time. These elements together constitute a complete historical behavioral profile of the client's use of proxy servers. Based on this, through the fusion analysis of multi-dimensional historical data, the spatiotemporal correlation characteristics between the client and the proxy server can be accurately quantified, providing data support with temporal patterns and behavioral prediction capabilities for dynamic allocation strategies, thereby improving the adaptability and security of proxy allocation strategies.

[0074] In addition to common metrics such as the number of vulnerabilities and the number of attacks, historical risk information for applications can also include the following: 1. The residual rate of hidden code defects during application version iterations, reflecting potential threats left over from in-depth development; 2. The supply chain attack history of third-party dependency libraries, reflecting the risk of contamination from external components; 3. The topology propagation pattern of abnormal traffic during the canary release phase, revealing vulnerabilities in the internal testing phase; 4. The frequency of historical events of data isolation failure in multi-tenant environments, characterizing the tendency for cross-user data leakage; 5. The degradation of encryption protocols when the application is accessed in specific geographical areas, showing regional security adaptation defects; 6. The entropy fluctuation pattern of historical session tokens, reflecting the anti-predictability capability of the authentication mechanism; 7. The correlation statistics between the application and abnormal domain name resolution requests, which can expose potential covert channel characteristics; 8. The abnormal offset distribution of memory operation instruction sequences, indicating the stability risks of the underlying runtime; 9. Connection attempt records of non-standard protocol ports in the application logs, which can reflect the existence of unconventional attack surfaces; 10. The time cycle pattern of recurrence of similar problems after historical vulnerability fixes, which can reflect the persistent defects in security maintenance. These dimensions construct the characteristics of an application risk profile from in-depth perspectives such as code governance, supply chain, and runtime environment.

[0075] Based on the above technical solutions, Figure 2 A flowchart of an application access security control method according to another embodiment of this application is shown.

[0076] like Figure 2 As shown, the method includes:

[0077] Step 202: Using the client's IP address, user identifier, requested application and request time, as well as the historical risk information of the requested application, as input information to the client tower in the pre-trained dual-tower model, the client tower outputs the first multi-dimensional feature vector.

[0078] The client's IP address, user identifier, requested application, and request time serve as real-time access features to characterize the current request's context. Historical risk information of the requested application serves as a security background to assess the target application's threat level. In the pre-trained dual-tower model, the client tower acts as a feature extractor, fusing and encoding multi-dimensional input information. The resulting first multi-dimensional feature vector serves as a dense representation of the client's current state and security posture, representing a dense encoding of the client's global security posture and behavioral intent for the current access request. By non-linearly fusing real-time access features with historical application risk information, it forms a composite feature representation characterizing the uniqueness, risk level, and security requirements of this request. In short, this first multi-dimensional feature vector not only reflects the immediate state of the access context but also implicitly contains security bias judgments based on historical risks, providing a deep feature basis that combines real-time performance and security for subsequent intelligent proxy server matching. Therefore, by deeply fusing real-time features and historical risk information, a feature vector characterizing the client's global state is generated, providing an accurate input foundation for subsequent intelligent proxy allocation.

[0079] Step 204: Using the historical allocation information of the proxy server assigned to the client as the input information of the proxy tower in the dual-tower model, the proxy tower outputs a second multi-dimensional feature vector.

[0080] The client's historical proxy server assignment information is used as behavioral pattern data to reflect the client's proxy usage patterns. In the pre-trained dual-tower model, the proxy tower acts as a proxy behavior analyzer to parse the client's historical assignment patterns. The second multi-dimensional feature vector serves as a dense embedding of the proxy assignment history features, reflecting the client's long-term behavioral preferences. Therefore, by extracting deep patterns from historical assignment information, a second multi-dimensional feature vector representing the client's proxy usage habits can be generated, providing data support for evaluating proxy compatibility.

[0081] Step 206: Determine the cosine similarity between the first multidimensional feature vector and the second multidimensional feature vector.

[0082] The first and second multidimensional feature vectors describe the client's state from different perspectives, while the cosine similarity quantifies the degree of consistency between the real-time state and historical behavior. In short, by calculating the spatial similarity of the two feature vectors, the matching degree between the client's real-time needs and historical behavior patterns is assessed, providing a basis for agent weight adjustment.

[0083] Step 208: Based on the historical allocation information of the proxy server assigned to the client, determine the historical allocation record sequence for the client, wherein the nth element in the historical allocation record sequence is the embedding vector of the nth proxy server in the set of available proxy servers.

[0084] The client is assigned historical proxy server allocation information as temporal behavioral data, used to record the order and pattern of proxy usage, forming a structured temporal set of historical allocation record sequences. This historical allocation record sequence is used to organize proxy usage records along a timeline. The embedding vector of the nth proxy server in the proxy server set can be used as the feature representation of the proxy node, mapping each proxy to a dense numerical vector. Thus, by transforming historical allocation information into a temporal sequence with embedding vectors as elements, a machine-readable data structure is constructed that preserves proxy node features while reflecting temporal order. This provides a high-dimensional input with semantic information and temporal features for subsequent recurrent neural networks to capture long-term temporal dependencies, thereby facilitating the intelligent conversion from raw historical records to features that deep learning models can process.

[0085] Step 210: Using the historical allocation record sequence as input to a pre-trained recurrent neural network, the recurrent neural network determines the allocation history context vector corresponding to the client, and concatenates the allocation history context vector with the embedding vector of each proxy server and inputs it into the fully connected layer of the recurrent neural network. The recurrent neural network outputs the temporal correlation between each proxy server and the client.

[0086] Historical allocation record sequences, as temporal behavioral data, are used to reflect the historical patterns and order of client use of the agent. Pre-trained recurrent neural networks, as temporal pattern extraction tools, can capture long-term dependencies in the sequence.

[0087] Historical context vectors are assigned as a condensed representation of sequence information to encode the complete proxy usage history features of the client, while the proxy server's embedding vector serves as a static identity feature, preserving the inherent attributes of each proxy node. Concatenating these two vectors achieves a combination of historical context and proxy static features. Fully connected layers, acting as non-linear transformers, learn the complex mapping relationship between fused features and temporal relevance. Temporal relevance, as the output, quantifies the degree of matching between each proxy server and the client's historical behavior in the time dimension. Thus, by extracting deep temporal patterns from historical behavior sequences through recurrent neural networks and combining them with proxy static features to calculate the association strength between each proxy and the client's historical behavior, accurate quantification of proxy matching based on time patterns is achieved.

[0088] Step 212: For each proxy server, update the weight of the proxy server based on the cosine similarity, and determine the correlation between the proxy server and the client by multiplying the temporal correlation between the proxy server and the client by the updated weight.

[0089] Cosine similarity, as a scalar indicator of the matching degree between real-time features and historical behaviors, reflects the degree of consistency between the current request and the long-term pattern. The weight of the proxy server, on the other hand, serves as a dynamically adjusted parameter to regulate the importance of the proxy based on the real-time matching situation.

[0090] Optionally, the cosine similarity is used as a correction coefficient for the weight of the proxy server, and the product of the cosine similarity and the weight of the proxy server is determined as the updated weight of the proxy server.

[0091] Cosine similarity, as a quantitative indicator of the matching degree between real-time features and historical behavior, measures the consistency between the current state and long-term patterns. As a weighting adjustment coefficient, it dynamically adjusts the importance of proxy servers based on the matching degree. The updated weights, as the adjustment result, reflect the proxy importance score after real-time matching degree calibration. Thus, by directly adjusting weights using cosine similarity as a correction coefficient, the weight values ​​of proxy servers can respond in real-time to the matching degree between the client's current access features and historical behavior patterns, thereby achieving dynamic adaptability and context awareness in weight allocation and improving the accuracy of proxy selection strategies.

[0092] Optionally, the variance of the weights of each proxy server in the available proxy server set is calculated, and the variance is normalized by the cosine similarity to obtain a double correction coefficient. First, the difference between the proxy server's weight and the normalized variance is determined, and then this difference is multiplied by the normalized cosine similarity to obtain the updated weight of the proxy server.

[0093] The weights of each proxy server in the proxy server set can be used as importance distribution data to reflect the global usage preference of proxy nodes. Variance, as an indicator of dispersion, is used to quantify the uniformity and variability of the weight distribution. Normalization, as a data standardization method, can eliminate the influence of dimensions and scale different indicators to a comparable range. Cosine similarity and variance are used as dual correction coefficients, integrating weight distribution characteristics and real-time matching information. Difference calculation, as an initial adjustment, can eliminate the impact of weight distribution bias on individual proxies. The multiplication of the difference with the normalized cosine similarity serves as a secondary correction, introducing the adjustment effect of real-time matching, so that the updated weights are the final output, taking into account both global distribution balance and individual real-time matching. Thus, through the dual correction mechanism of variance and cosine similarity, while ensuring the real-time adaptability of individual proxy weights, the load balancing and security distribution of the entire proxy pool are taken into account, avoiding the pattern solidification problem caused by excessive weight allocation bias towards certain features, thereby enhancing the robustness and anti-attack capability of the proxy selection system.

[0094] The above steps dynamically adjust the weight of the proxy server using cosine similarity and calculate the comprehensive correlation by combining temporal relevance. This achieves a balanced assessment of real-time security requirements and historical behavior patterns, generating intelligent proxy selection criteria that are both immediate and continuous.

[0095] Step 214: The proxy server with the lowest correlation to the client is determined as the target proxy server to be assigned to the client.

[0096] The lower the correlation between the proxy server and the client, the lower the likelihood that the proxy server will be identified by external attackers as an access relay object for the client. In other words, the proxy server with the lowest correlation is the optimal choice, maximizing the unpredictability and security of proxy allocation. The target proxy server, as the final allocation object, undertakes the relay task for this access request. Thus, by selecting the proxy node with the lowest correlation, the regularity and traceability of client access patterns are effectively broken, enhancing the randomness and anti-attack capability of proxy allocation, thereby constructing a dynamically changing access entry point defense system.

[0097] Step 216: Send the application access request to the application resource server through the target proxy server and the zero-trust gateway connected to the target proxy server, and feed back the response data of the application resource server to the application access request to the client through the zero-trust gateway and the target proxy server;

[0098] Step 218: When it is detected that the target proxy server does not have client access traffic, the IP address of the target proxy server is updated according to the predetermined address dynamic update strategy, and the target proxy server with the updated IP address is added back to the set of available proxy servers.

[0099] The above technical solution extracts real-time and historical behavioral features of the client using a dual-tower model and calculates cosine similarity. Simultaneously, it utilizes recurrent neural network deep learning to identify temporal pattern features in the client's historical allocation sequence, generating a proxy correlation assessment that integrates temporal patterns. Combined with a dynamic weight adjustment mechanism, it achieves intelligent selection and secure relay of proxy servers, and finally, proxy identity regeneration is completed through an address update strategy. Thus, a comprehensive security control system is constructed that can accurately capture behavioral temporal patterns and dynamically optimize proxy allocation accordingly. This ensures that proxy selection not only considers real-time security requirements but also deeply aligns with the client's historical behavioral patterns. This further enhances the unpredictability and anti-analysis capabilities of the access link while concealing core service facilities, effectively resisting network attacks based on behavioral pattern recognition and improving the overall dynamic defense effectiveness and security resilience of the system.

[0100] In one possible design, updating the IP address of the target proxy server includes: obtaining the temporal relevance of each of the multiple clients, including the client, to the target proxy server; determining a first client affinity of the target proxy server based on the temporal relevance of each of the multiple clients to the target proxy server and the security coefficient of each of the multiple clients; determining a target value range to which the first client affinity belongs from a predetermined range of values, and updating the IP address of the target proxy server with a predetermined duration corresponding to the target value range as the IP address update cycle.

[0101] The temporal correlation between multiple clients and the target proxy server serves as a historical behavior correlation indicator, reflecting the degree of temporal pattern matching between different clients and the proxy. The security coefficient, as a security level score for each client, measures the security and reliability of each client. Together, the temporal correlation between multiple clients and the target proxy server, along with the security coefficients of each client, reflect the overall association strength and security trustworthiness of the target proxy server and the client group. This can be quantified as the "first client affinity," reflecting the overall affinity between the proxy server and all clients.

[0102] Optionally, the first client affinity is obtained by weighting the temporal correlation between each client and the target proxy server using the security coefficients of each client as weights.

[0103] Multiple predetermined numerical ranges are used as policy partitions to map the first client affinity to different update policy intervals. The target numerical range is the matching result of the first client affinity within these ranges, with a specific update cycle range, i.e., a predetermined duration. The predetermined duration serves as the IP address update cycle, guiding the frequency of address changes. Thus, by comprehensively calculating temporal correlation and security coefficients, an overall affinity evaluation of the proxy server can be generated. Based on this, the IP address update cycle is dynamically adjusted, allowing proxies with high affinity to use longer update cycles to maintain service stability, and proxies with low affinity to use shorter update cycles to enhance stealth, thereby achieving a balanced optimization of security and availability.

[0104] In another possible design, updating the IP address of the target proxy server includes: obtaining the temporal relevance and association degree between each of the multiple clients, including the client, and the target proxy server; determining a second client affinity degree for the target proxy server based on the temporal relevance and association degree between each of the multiple clients and the target proxy server, as well as the security coefficient of each of the multiple clients; determining a target value range to which the second client affinity degree of the target proxy server belongs within a predetermined range of values, and updating the IP address of the target proxy server with a predetermined duration corresponding to the target value range as the IP address update cycle.

[0105] The temporal relevance and correlation between multiple clients and the target proxy server are used as dual behavioral characteristics. The association strength between the client and the proxy is evaluated from both a time dimension and a comprehensive dimension combining time and historical performance. The security coefficient, as a security level score for each client, is used to measure the security and reliability of each client. A second client affinity metric, an enhanced evaluation indicator, is used to integrate the dual characteristics of temporal behavior and comprehensive correlation. It hits the target value range within multiple predetermined value ranges to determine the specific interval of the update cycle, i.e., the predetermined duration.

[0106] Optionally, the average of the temporal relevance between each client and the target proxy server is weighted using the security coefficients of each client as weights, and this average is used as the first feature value. Then, the variance of the weighted relevance between each client and the target proxy server is calculated using the security coefficients of each client as weights, resulting in a second feature value. The difference between the first feature value and the second feature value is determined as the second client affinity.

[0107] The first eigenvalue, obtained by weighted averaging of temporal relevance, reflects the average temporal pattern matching degree between the proxy server and the client group. The variance obtained after weighted relevance is used as the second eigenvalue to measure the dispersion of the association strength between the proxy server and the client group. The difference between the first and second eigenvalues ​​is used as a proximity synthesis method to integrate the dual indicators of central tendency and dispersion. The second client proximity is the final output value, comprehensively characterizing the overall association tightness and stability between the proxy server and the client group. Thus, the weighted mean captures the overall association strength between the proxy server and the client group, the weighted variance assesses the association consistency, and the difference operation transforms centralization and dispersion into a single evaluation index. This ensures that the second client proximity reflects both the average proximity between the proxy server and the clients and the stability and reliability of this relationship, providing a decision-making basis for address update strategies that is both accurate and robust.

[0108] In summary, by using multi-dimensional fusion calculations of temporal relevance, correlation, and security coefficient, a more accurate proxy server affinity assessment result can be generated. Based on this, a differentiated update strategy can be formulated, so that the proxy server address update can reflect the comprehensive behavior pattern of the client while taking into account security risk control, thereby improving the accuracy and adaptability of the address update strategy.

[0109] Figure 3 An architecture diagram of an application access security management system according to an embodiment of this application is shown.

[0110] like Figure 3 As shown, the process of the application access security management system hiding IP (Internet Protocol Address) based on the dynamic proxy pool consists of four processes: first, the registration process of the zero-trust gateway; second, the registration process of the proxy server; third, the access process of the client; and fourth, the address update process of the proxy server.

[0111] First, the gateway registration process.

[0112] A Zero Trust Gateway (NHP AC) typically consists of one or more components. In this solution, the Zero Trust Gateway registers with the Security Center (NHP Server, i.e., the Zero Trust Server) upon gateway startup. The registration process is as follows:

[0113] (1) When the Zero Trust Gateway starts, the Agent deployed on the gateway sends an SPA (Single Packet Authorization) containing the gateway IP address to the Zero Trust Security Center. After successful authentication, the access port is opened to the gateway IP address.

[0114] (2) The zero-trust gateway connects to the port opened by the security center and maintains heartbeat monitoring between the zero-trust gateway and the security center;

[0115] (3) The security center sends the list of IPs corresponding to the registered dynamic proxy pool (i.e., the set of available proxy servers) to the zero trust gateway through the connection between the two. The zero trust gateway opens the data port for all IPs in the IP list.

[0116] (4) If the security center detects that the IP corresponding to the dynamic proxy pool has changed, it also needs to send the list of IPs corresponding to the proxy pool to the zero trust gateway for policy update.

[0117] Second, the proxy server registration process.

[0118] A dynamic proxy pool consists of a group of available proxy servers. Each proxy server deploys the same proxy service and performs the same function; the only difference is the server address. When a proxy server starts, it automatically registers with the security center. The registration process is as follows:

[0119] (1) When the proxy server starts, the Agent deployed on the proxy server sends an SPA containing the proxy server IP to the security center. After the SPA is authenticated, the security center opens the connection port for the proxy server IP.

[0120] (2) The proxy server connects to the open port of the security center to realize heartbeat monitoring between the security center and the proxy server, as well as the proxy server reporting and receiving the security center's policies.

[0121] Third, the client access process.

[0122] When a client accesses a target application, it must first be authenticated by the security center. The security center then dynamically assigns a proxy server to the client and sends a security policy to the assigned proxy server. The client then accesses the target application through the proxy server. The specific access process is as follows:

[0123] (1) When a client accesses a target application, the deployed Agent first sends an SPA containing the client's IP address, user identifier, etc. to the security center;

[0124] (2) After the security center verifies the SPA, it calculates a digital digest based on information such as the client IP, user ID, application requested and time, and selects a proxy server from the proxy pool based on a portion of the digital digest data;

[0125] (3) The security center sends the security policy for the client to the assigned proxy server and opens the connection port for the corresponding client IP and user identifier;

[0126] (4) The proxy server opens access ports for the corresponding IP and user identifier of the client according to the policy issued by the security center, and returns the policy execution result;

[0127] (5) The security center returns the IP address and access port of the assigned proxy server to the client proxy;

[0128] (6) If the client proxy is configured to support encrypted tunnels, it will establish a virtual encrypted tunnel connection with the assigned proxy server and send the application access request to the proxy server through the encrypted tunnel; if it is configured to access via unencrypted tunnels, it will send the application access request to the proxy server in plaintext.

[0129] (7) The proxy server forwards the client's application access request to the zero-trust gateway through the encrypted tunnel between the proxy server and the zero-trust gateway;

[0130] (8) The zero-trust gateway forwards the client's application access request to the corresponding application resource server;

[0131] (9) The application access response data is returned to the zero-trust gateway;

[0132] (10) The zero-trust gateway returns the application access response data to the proxy server through an encrypted tunnel;

[0133] (11) The proxy server forwards the application access response data to the client proxy and displays it to the visitor.

[0134] Fourth, the proxy server address was updated.

[0135] The proxy server addresses in the dynamic proxy pool are dynamically changed. They are updated according to scheduled policies or policies issued by the security center, and the updated proxy server information is reported to the security center for central management of the dynamic proxy pool. The proxy server address update process is as follows:

[0136] (1) When the proxy server needs to update its address according to the timed policy or when it receives the address update policy issued by the security policy, it first sends an address update request to the security center proxy pool management program. The security center proxy pool management program then changes the status of this proxy server to "unavailable".

[0137] (2) The proxy server checks whether there is still client access traffic to the server. The authorized open port for zero trust is open for a limited time, and re-authentication is required before the time expires. When the authorization time has expired, there is no access traffic. At this time, the program starts and modifies the server's IP address according to the policy.

[0138] (3) After the proxy server address is updated, the registration process of the proxy server with the security center is started, the status of the proxy server in the proxy pool is updated, and the new security policy is sent to the zero trust gateway to update the gateway's policy so that it can receive the new address of the proxy server to forward data.

[0139] In summary, this solution constructs a dynamic proxy security system based on the zero-trust principle, effectively ensuring system security through multi-layered protection mechanisms. Before accessing the application, clients must be authenticated by the security center. After successful authentication, the security center allocates a proxy server from the dynamic proxy pool based on an intelligent algorithm. Crucially, each time a client accesses the application, even when accessing the same application, the system assigns a different proxy server address. This dynamic allocation mechanism makes it difficult for attackers to pinpoint attack targets based on historical records.

[0140] The proxy server employs a default denial policy, temporarily opening ports only to authenticated clients according to the principle of least privilege. This effectively prevents malware scanning and keeps the proxy server itself invisible to attackers. Simultaneously, the proxy server's IP address is periodically updated according to a predetermined policy, maintaining a continuous and dynamic change in address resources, further increasing the difficulty for attackers.

[0141] While the real addresses of the application resource server and the zero-trust gateway remain fixed, they are hidden behind a dynamic proxy layer and completely invisible to the outside world. Attackers cannot directly probe or access these core resources. The system follows the principle of "never trust, continuous verification," meaning each access permission granted has an expiration date and requires re-authentication after expiration. During re-authentication, a new proxy server is reassigned, thus achieving dynamic updates of the proxy server address without interrupting business access, ensuring continuous refresh of the attack surface and maintaining service continuity.

[0142] One embodiment of this application also provides an application access security management system, including a zero-trust server, a set of available proxy servers, and a zero-trust gateway. In response to an application access request from a client, the zero-trust server allocates a target proxy server to the client from the set of available proxy servers based on a predetermined server allocation policy. The target proxy server opens a connection port for the client based on a predetermined security policy of the client, obtains the application access request from the client through the connection port, and transmits the application access request to the zero-trust gateway through an encrypted tunnel. The zero-trust gateway transmits the application access request to an application resource server, obtains the response data from the application resource server in response to the application access request, and feeds back the response data to the zero-trust gateway. The zero-trust gateway transmits the response data to the target proxy server through the encrypted tunnel. The target proxy server feeds back the response data to the client. When the target proxy server detects that it does not have client access traffic, it updates its IP address according to a predetermined address dynamic update policy and re-registers with the set of available proxy servers based on the updated IP address.

[0143] The application access security control system can execute the solution described in any one of the above embodiments, and therefore has all the above technical effects, which will not be repeated here.

[0144] In another embodiment, this application provides a computer device, which may be a server, and its internal structure diagram may be as follows. Figure 4 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface is used to communicate with external clients via a network connection. When the computer program is executed by the processor, it can implement the methods described in any of the above embodiments.

[0145] In one embodiment, this application also provides a computer device, which can be a client, and its internal structure diagram can be as follows: Figure 5As shown, the computer device includes a processor, memory, network interface, display screen, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface is used to communicate with an external server via a network connection. When the computer program is executed by the processor, it can implement the methods described in any of the above embodiments.

[0146] Any of the computer devices described in the embodiments of this application exist in various forms, including but not limited to:

[0147] (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and primarily aim to provide voice and data communication. These terminals include: smartphones (e.g., iPhones), multimedia phones, feature phones, and low-end phones, etc.

[0148] (2) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, possessing computing and processing capabilities, and generally also have mobile internet access features. These terminals include PDAs, MIDs, and UMPCs, such as the iPad.

[0149] (3) Portable entertainment devices: These devices can display and play multimedia content. This category includes: audio and video players (such as iPods), handheld game consoles, e-books, as well as smart toys, wearable devices, and portable car navigation devices.

[0150] (4) Server: A device that provides computing services. The components of a server include a processor, hard disk, memory, system bus, etc. Servers are similar to general computer architectures, but because they need to provide highly reliable services, they have higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0151] (5) Other electronic devices with data interaction functions.

[0152] Additionally, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which are used to perform the following steps:

[0153] In response to an application access request from a client, a target proxy server is assigned to the client from the set of available proxy servers based on a predetermined server allocation strategy;

[0154] The application access request is sent to the application resource server through the target proxy server and the zero-trust gateway connected to the target proxy server, and the response data of the application resource server to the application access request is fed back to the client through the zero-trust gateway and the target proxy server.

[0155] When it is detected that the target proxy server does not have client access traffic, the IP address of the target proxy server is updated according to a predetermined address dynamic update strategy, and the target proxy server with the updated IP address is added back to the set of available proxy servers.

[0156] It should be noted that the functions or steps that can be implemented by the computer-readable storage medium or computer device described above can be referred to the relevant descriptions in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.

[0157] The technical solution of this application has been described in detail above with reference to the accompanying drawings. The technical solution of this application constructs an encrypted access chain from the client to application resources by dynamically allocating a proxy server with a dynamically updatable address through a zero-trust server. This realizes a dynamic security protection system that integrates identity authentication, traffic relay, and address concealment. This ensures that the client's access behavior is always conducted through changing proxy nodes and encrypted tunnels, thereby completely hiding the real network address of the core service facilities. At the same time, through intelligent allocation and timed update mechanisms, the association between the client and the fixed entry point is effectively severed, and the attacker's tracking perspective is continuously disrupted. This simultaneously improves the system's proactive defense capabilities from three levels: access entry point, relay link, and infrastructure, ultimately achieving high concealment, high security, and anti-attack resilience throughout the entire business access process.

[0158] It should be understood that although the terms "first," "second," etc., may be used to describe client affinity in the embodiments of this application, these client affinity should not be limited to these terms. These terms are only used to distinguish client affinity from one another. For example, without departing from the scope of the embodiments of this application, first client affinity may also be referred to as second client affinity, and similarly, second client affinity may also be referred to as first client affinity.

[0159] Depending on the context, the word "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."

[0160] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. The singular forms “a,” “the,” and “the” used in the embodiments of this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0161] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0162] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in a combination of hardware and software functional units.

[0163] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0164] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. An application access security control method, characterized in that, include: In response to an application access request from a client, a target proxy server is assigned to the client from the set of available proxy servers based on a predetermined server allocation strategy; The application access request is sent to the application resource server through the target proxy server and the zero-trust gateway connected to the target proxy server, and the response data of the application resource server to the application access request is fed back to the client through the zero-trust gateway and the target proxy server. When it is detected that the target proxy server has no client access traffic, the IP address of the target proxy server is updated according to a predetermined address dynamic update strategy, and the target proxy server with the updated IP address is added back to the set of available proxy servers. in: The method of allocating a target proxy server to the client from the set of available proxy servers based on a predetermined server allocation strategy includes: determining the correlation between each proxy server in the set of available proxy servers and the client based on the client's IP address, user identifier, requested application and request time, historical risk information of the requested application, and historical allocation information of proxy servers to which the client has been assigned; and determining the proxy server with the lowest correlation with the client as the target proxy server allocated to the client. The historical allocation information of the proxy server assigned to the client includes: the number of times each proxy server in the available proxy server set has been assigned, the total number of times the client has been assigned a proxy server and the average allocation interval, the last proxy server assigned to the client, the time elapsed from the last time the client was assigned a proxy server to the current time, and the allocation time distribution information of the proxy servers assigned to the client. The determination of the association degree between each proxy server in the available proxy server set and the client, based on the client's IP address, user identifier, requested application and request time, historical risk information of the requested application, and historical allocation information of the proxy server to which the client was assigned, includes: The client's IP address, user ID, requested application and request time, as well as the historical risk information of the requested application, are used as input information for the client tower in the pre-trained dual-tower model, and the first multi-dimensional feature vector is output through the client tower. The historical allocation information of the proxy server assigned to the client is used as the input information of the proxy tower in the dual-tower model, and the proxy tower outputs a second multi-dimensional feature vector. Determine the cosine similarity between the first multidimensional feature vector and the second multidimensional feature vector; Based on the historical allocation information of the proxy server assigned to the client, a historical allocation record sequence is determined for the client, wherein the nth element in the historical allocation record sequence is the embedding vector of the nth proxy server in the set of available proxy servers; The historical allocation record sequence is used as the input to a pre-trained recurrent neural network. The recurrent neural network determines the allocation history context vector corresponding to the client. The allocation history context vector is concatenated with the embedding vector of each proxy server and then input into the fully connected layer of the recurrent neural network. The recurrent neural network outputs the temporal correlation between each proxy server and the client. For each proxy server, the weight of the proxy server is updated based on the cosine similarity, and the product of the temporal relevance between the proxy server and the client and the updated weight is determined as the correlation between the proxy server and the client.

2. The method according to claim 1, characterized in that, The method of allocating a target proxy server for the client from the set of available proxy servers based on a predetermined server allocation strategy includes: Based on the client's IP address, user identifier, requested application, and request time, determine the access summary information; The proxy server that matches the access digest information is determined from the set of available proxy servers and is assigned as the target proxy server to the client.

3. The method according to claim 1 or 2, characterized in that, Sending the application access request to the application resource server through the target proxy server and the zero-trust gateway connected to the target proxy server includes: Based on the client's predetermined security policy, the connection port is opened for the client in the target proxy server; The application access request from the client is obtained through the connection port, and the application access request is transmitted through an encrypted tunnel to the zero-trust gateway connected to the target proxy server, and then transmitted by the zero-trust gateway to the application resource server; The step of feeding back the response data of the application resource server to the application access request to the client through the zero-trust gateway and the target proxy server includes: The response data of the application resource server to the application access request is transmitted to the target proxy server through the zero-trust gateway and the encrypted tunnel, and then the target proxy server feeds back the response data to the client.

4. The method according to claim 1, characterized in that, The step of updating the IP address of the target proxy server according to a predetermined address dynamic update strategy includes: Obtain the time-series correlation between each of the multiple clients, including the client mentioned above, and the target proxy server; Based on the temporal correlation between each of the multiple clients and the target proxy server, and the security coefficient of each of the multiple clients, the first client affinity of the target proxy server is determined; The target value range to which the first client affinity belongs is determined from a predetermined range of values, and the IP address of the target proxy server is updated with a predetermined time period corresponding to the target value range as the IP address update cycle.

5. The method according to claim 1, characterized in that, The step of updating the IP address of the target proxy server according to a predetermined address dynamic update strategy includes: Obtain the temporal correlation and association degree between each of the multiple clients, including the client mentioned above, and the target proxy server; Based on the temporal correlation and association between each of the multiple clients and the target proxy server, as well as the security coefficient of each of the multiple clients, the second client affinity of the target proxy server is determined; The target value range to which the second client affinity of the target proxy server belongs is determined from a predetermined number of value ranges, and the IP address of the target proxy server is updated with a predetermined time period corresponding to the target value range as the IP address update cycle.

6. An application access security control system, characterized in that, The method for implementing application access security control as described in any one of claims 1 to 5 includes a zero-trust server, a set of available proxy servers, and a zero-trust gateway, wherein... In response to an application access request from a client, the zero-trust server allocates a target proxy server to the client from the set of available proxy servers based on a predetermined server allocation strategy. The target proxy server opens a connection port for the client based on the client's predetermined security policy, obtains application access requests from the client through the connection port, and transmits the application access requests to the zero-trust gateway through an encrypted tunnel; The zero-trust gateway transmits the application access request to the application resource server, obtains the response data of the application resource server in response to the application access request, and feeds back the response data to the zero-trust gateway. The zero-trust gateway transmits the response data to the target proxy server via the encrypted tunnel; The target proxy server sends the response data back to the client. When the target proxy server detects that it does not have client access traffic, it updates its IP address according to a predetermined address dynamic update strategy, and re-registers with the available proxy server set based on the updated IP address.

7. A computer-readable storage medium, characterized in that, The device stores computer-executable instructions configured to perform the method as described in any one of claims 1 to 5.

Images