Flow-aware zero-trust dynamic encryption routing method, device and equipment

Abstract

The application provides a flow-aware-based zero-trust dynamic encryption routing method, device and equipment. The method comprises the following steps: when a first to-be-processed packet is received through a zero-trust security tunnel in a data plane, determining identity features and behavior features corresponding to the first to-be-processed packet; performing decryption operation on the first to-be-processed packet through target key information corresponding to the zero-trust security tunnel to obtain a second to-be-processed packet after decryption operation; if there is a first forwarding strategy matching the identity features in the data plane, determining a routing action of the second to-be-processed packet based on the first forwarding strategy; performing operation on the second to-be-processed packet based on the routing action; when the identity features and the behavior features are received through a control plane, determining a second forwarding strategy matching the identity features based on the behavior features, and updating the second forwarding strategy to the data plane. Through the application scheme, the amount of data mirrored to the control plane and the CPU load are reduced under the premise of maintaining zero trust.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a traffic-aware zero-trust dynamic encrypted routing method, apparatus, and device. Background Technology

[0002] Cybersecurity refers to the protection of a network system's hardware, software, and data from accidental or malicious damage, alteration, or disclosure, ensuring the continuous, reliable, and uninterrupted operation of the network and uninterrupted network services. Cybersecurity is based on physical boundary defense using firewalls, treating the network inside the firewall as an internal network. All enterprise office equipment and data resources reside on this internal network, which is considered completely trustworthy, meaning that communication between devices within the internal network is secure. With the rise of emerging technologies such as cloud computing, big data, and the Internet of Things (IoT), enterprise IT architecture is shifting from "bounded" to "boundaryless," gradually dismantling traditional security boundaries. Furthermore, the ongoing development of new infrastructure represented by 5G and the Industrial Internet will further accelerate this "boundaryless" evolution.

[0003] Zero-trust security is gradually becoming a new concept and architecture for solving cybersecurity problems in the new era. Representing a new generation of cybersecurity protection, its key lies in breaking the default "trust," namely "continuous verification, never trust." It distrusts by default any person, device, or system inside or outside the enterprise network, rebuilding the trust foundation of access control based on identity authentication and authorization to ensure trustworthy identities, devices, applications, and links. Zero-trust can guarantee endpoint security, link security, and access control security. However, how to effectively manage zero-trust access remains a challenge in relevant technologies. Summary of the Invention

[0004] This application provides a traffic-aware, zero-trust dynamic encrypted routing method applied to an electronic device, the electronic device including a data plane and a control plane, the method comprising:

[0005] When the data plane receives the first message to be processed through the zero-trust security tunnel, it determines the identity features and behavioral features corresponding to the first message to be processed. The behavioral features include static behavioral features and dynamic behavioral features. The static behavioral features include unencrypted information in the first message to be processed, and the dynamic behavioral features include statistical features of the data stream corresponding to the identity features.

[0006] The first message to be processed is decrypted using the target key information corresponding to the zero-trust security tunnel to obtain the second message to be processed after decryption.

[0007] If the data plane has a first forwarding policy that matches the identity feature, then the routing action for the second packet to be processed is determined based on the first forwarding policy; if the data plane does not have a first forwarding policy that matches the identity feature, then the routing action for the second packet to be processed is determined based on the behavioral feature; and the second packet to be processed is operated on based on the routing action.

[0008] When the control plane receives the identity features and behavioral features sent by the data plane, a second forwarding strategy matching the identity features is determined based on the behavioral features. The second forwarding strategy is then updated to the data plane so that the data plane can determine the routing action for subsequent packets based on the second forwarding strategy. The second forwarding strategy is determined based on a fingerprint trust score and / or a model-predicted trust score. The fingerprint trust score is the score corresponding to the behavioral features in the fingerprint database, and the predicted trust score is the score obtained by inputting the behavioral features into a network model.

[0009] This application provides a traffic-aware, zero-trust dynamic encrypted routing device for use in electronic devices, the electronic devices including a data plane and a control plane, the device comprising:

[0010] The data plane management module is used to determine the identity features and behavioral features corresponding to the first message to be processed when the data plane receives the first message to be processed through the zero-trust security tunnel. The behavioral features include static behavioral features and dynamic behavioral features. The static behavioral features include unencrypted information in the first message to be processed, and the dynamic behavioral features include statistical features of the data stream corresponding to the identity features. The module then decrypts the first message to be processed using the target key information corresponding to the zero-trust security tunnel to obtain a second message to be processed after decryption.

[0011] The data plane management module is used to determine the routing action of the second packet to be processed based on the first forwarding policy if the data plane has a first forwarding policy that matches the identity feature; if the data plane does not have a first forwarding policy that matches the identity feature, determine the routing action of the second packet to be processed based on the behavior feature; and operate on the second packet to be processed based on the routing action.

[0012] The control plane management module is used to, upon receiving identity features and behavioral features sent by the data plane through the control plane, determine a second forwarding strategy matching the identity features based on the behavioral features, update the second forwarding strategy to the data plane, and then determine the routing action for subsequent packets to be processed based on the second forwarding strategy through the data plane; wherein, the second forwarding strategy is determined based on a fingerprint trust score and / or a model-predicted trust score, the fingerprint trust score being the score corresponding to the behavioral features in a fingerprint database, and the predicted trust score being the score obtained by inputting the behavioral features into a network model.

[0013] This application provides an electronic device, including: a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor; the processor is used to execute the machine-executable instructions to implement the above-described traffic-aware zero-trust dynamic encrypted routing method.

[0014] This application provides a computer program product, including a computer program that, when executed by a processor, implements the above-described traffic-aware zero-trust dynamic encrypted routing method.

[0015] This application provides a machine-readable storage medium storing machine-executable instructions that can be executed by a processor; wherein the processor is used to execute the machine-executable instructions to implement the traffic-aware zero-trust dynamic encrypted routing method described above.

[0016] As can be seen from the above technical solutions, in this embodiment, dynamic behavioral characteristics are maintained for each data stream in the data plane. When a message to be processed is received, the static and dynamic behavioral characteristics corresponding to the message are obtained. If the data plane does not have a first forwarding policy that matches the identity characteristics, the routing action is determined based on the static and dynamic behavioral characteristics, thereby performing lightweight trust scoring and dynamic routing (such as blocking, security isolation, and forwarding) on ​​the data path. The data plane uploads the static and dynamic behavioral characteristics to the control plane (without uploading the message to be processed). The control plane determines a second forwarding policy through fingerprint trust scores and / or model-predicted trust scores, and updates the second forwarding policy to the data plane. The data plane then determines the routing action for subsequent messages to be processed based on the second forwarding policy, realizing a closed loop of forwarding policy decision-making and control. While maintaining zero trust, the analysis latency of most normal traffic is controlled at a low level, while reducing the amount of data mirrored to the control plane and the CPU load.

[0017] By forming a behavioral fingerprint of the data flow through static and dynamic behavioral features, the control plane determines the fingerprint trust score and the model-predicted trust score based on the behavioral fingerprint, and issues forwarding and encryption policies based on the behavioral fingerprint. Thus, dynamic routing, micro-segmentation and dynamic encryption are unified under trust control based on the behavioral fingerprint, realizing adaptive secure routing and encryption level control based on behavioral fingerprint.

[0018] By employing a layered verification strategy, rapid initial assessment is performed in the data plane to minimize latency, while in-depth analysis is conducted in the control plane for continuous security detection. This design ensures that normal traffic passes transparently in most scenarios, while abnormal traffic is quickly detected and isolated. A comprehensive zero-trust system is adopted, involving continuous detection and analysis for trust assessment, continuous strong authentication and traffic fingerprint authentication to build a dynamic authentication system, dynamic secure tunnel encryption to protect data confidentiality, and micro-segmentation to separate normal, suspicious, and dangerous traffic. Low-latency forwarding of normal traffic is ensured, while continuous verification is achieved through concurrent rapid analysis. Upon detecting abnormal behavior, an updated policy is sent to the data plane before subsequent packets arrive, blocking or redirecting them. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating the traffic-aware zero-trust dynamic encrypted routing method in this application.

[0020] Figure 2 This is a schematic diagram of a traffic-aware dynamic routing process in one embodiment of this application;

[0021] Figure 3 This is a schematic diagram of a traffic-aware zero-trust process in one embodiment of this application;

[0022] Figure 4 This is a schematic diagram of the dynamic routing process and zero-trust process in one embodiment of this application;

[0023] Figure 5 This is a schematic diagram of a dynamic encryption process in one embodiment of this application;

[0024] Figure 6 This is a schematic diagram of the traffic-aware zero-trust dynamic encrypted routing device in this application;

[0025] Figure 7 This is a hardware structure diagram of an electronic device according to one embodiment of this application. Detailed Implementation

[0026] This application proposes a traffic-aware, zero-trust dynamic encrypted routing method that can be applied to electronic devices. These devices may include a data plane (also known as a forwarding plane) and a control plane. See also... Figure 1 The diagram shown is a flowchart of the method, which may include:

[0027] Step 101: When the first message to be processed is received in the data plane through the zero-trust security tunnel, the identity features and behavioral features corresponding to the first message to be processed are determined. The behavioral features may include static behavioral features and dynamic behavioral features. The static behavioral features may include unencrypted information in the first message to be processed, and the dynamic behavioral features may include the statistical features of the data stream corresponding to the identity features.

[0028] Step 102: Decrypt the first message to be processed using the target key information corresponding to the zero-trust security tunnel to obtain the second message to be processed after decryption.

[0029] Step 103: If a first forwarding policy matching the identity features exists in the data plane, then the routing action for the second packet to be processed is determined based on the first forwarding policy; if no first forwarding policy matching the identity features exists in the data plane, then the routing action for the second packet to be processed is determined based on the behavioral features.

[0030] Step 104: Perform operations on the second message to be processed based on the routing action.

[0031] Step 105: When the identity features and behavioral features sent by the data plane are received through the control plane, a second forwarding policy matching the identity features is determined based on the behavioral features, and the second forwarding policy is updated to the data plane so that the routing action of subsequent packets to be processed can be determined by the data plane based on the second forwarding policy.

[0032] For example, the second forwarding strategy can be determined based on a fingerprint trust score and / or a model-predicted trust score. For instance, the fingerprint trust score could be the score corresponding to the behavioral features in a fingerprint database, and the predicted trust score could be the score obtained by inputting the behavioral features into a network model.

[0033] For example, determining the routing action for the second message to be processed based on behavioral characteristics may include, but is not limited to: determining whether the second message to be processed is an abnormal message based on behavioral characteristics. If so, the routing action is determined to be a blocking action or a security isolation action. If not, a first trust score is assigned to the second message to be processed, an adjustment score is determined based on the behavioral characteristics, and the first trust score is adjusted based on the adjustment score to obtain a second trust score; the action corresponding to the second trust score is determined as the routing action; wherein, if the behavioral characteristics match the acquired scoring strategy, the score to be adjusted is increased; if the behavioral characteristics match the acquired deduction strategy, the score to be adjusted is decreased.

[0034] The fingerprint database can include the correspondence between behavioral features and fingerprint trust scores. Behavioral features with fingerprint trust scores greater than a first threshold can be used to obtain scoring strategies, while behavioral features with fingerprint trust scores less than a second threshold can be used to obtain scoring strategies. The second threshold is less than the first threshold.

[0035] For example, determining whether a second pending message is an abnormal message based on behavioral characteristics may include, but is not limited to: if the behavioral characteristics include a flag bit and the flow state of the FSM, then the first state of the data stream is determined based on the flow state of the FSM, and the second state of the second pending message is determined based on the flag bit; wherein, the flow state of the FSM may represent the state of the last pending message corresponding to the data stream, and the flag bit may represent the state of the second pending message. Based on this, the expected transition state can be determined based on the first state; if the second state is the expected transition state, then the second pending message is determined not to be an abnormal message; if the second state is not the expected transition state, then the second pending message is determined to be an abnormal message. Regarding the expected transition state, the expected transition state may be the first state, and / or, the flow states of the FSM may be pre-defined, such as states A, B, C, and D in sequence. In this case, the expected transition state may be the state following and immediately after the first state. For example, if the first state is state B, the expected transition state is state C, not state D, and certainly not state A preceding state B.

[0036] For example, the process of determining the second forwarding strategy based on fingerprint trust scores and / or model-predicted trust scores may include, but is not limited to: if the fingerprint database includes fingerprint trust scores corresponding to behavioral features, then determining the target trust score based on the fingerprint trust scores; or, determining the target trust score based on the fingerprint trust scores and predicted trust scores; or, determining the target trust score based on the fingerprint trust scores, predicted trust scores, and acquired authentication trust scores. Furthermore, if the fingerprint database does not include fingerprint trust scores corresponding to behavioral features, then determining the target trust score based on the predicted trust scores; or, determining the target trust score based on the predicted trust scores and authentication trust scores. Further, the forwarding strategy corresponding to the target trust score is determined as the second forwarding strategy, which indicates that the routing action is a blocking action, a security isolation action, or a forwarding action. Wherein, if the second message to be processed includes encrypted and integrity-protected verification information, the authentication trust score can be determined based on the verification information; wherein, if the verification information indicates that the security of the second message to be processed is higher, the authentication trust score is larger.

[0037] For example, the network model may include a basic temporal anomaly detection model, a deep temporal anomaly detection model, and an entity interaction topology analysis model. The process of obtaining the predicted trust score may include: if a second message to be processed is received from the data plane via the control plane, the second message to be processed is input into the basic temporal anomaly detection model to obtain a basic temporal trust score; wherein, if the routing action of the second message to be processed is a blocking action or a security isolation action, the data plane sends the second message to the control plane. Behavioral features are input into the deep temporal anomaly detection model to obtain a deep temporal trust score. Behavioral features and associated behavioral features are input into the entity interaction topology analysis model to obtain an entity interaction trust score, where associated behavioral features are the behavioral features of associated data flows. A weighted operation is performed on the basic temporal trust score, the deep temporal trust score, and the entity interaction trust score to obtain a predicted trust score; or, a weighted operation is performed on the deep temporal trust score and the entity interaction trust score to obtain a predicted trust score.

[0038] For example, after obtaining the target trust score, the key information to be updated corresponding to the zero-trust secure tunnel can be determined based on the target trust score. Specifically, if the target trust score is less than a third threshold, the key information to be updated is the first key information, and the encryption level of the first key information is greater than the encryption level of the target key information. If the target trust score is greater than a fourth threshold, the key information to be updated is the second key information, and the encryption level of the second key information is less than the encryption level of the target key information. The fourth threshold is greater than the third threshold. The first key information or the second key information is then sent to the data plane to update the target key information of the zero-trust secure tunnel.

[0039] For example, after obtaining the target trust score, it can be updated to the fingerprint trust score corresponding to the behavioral characteristics. A data item (i.e., a record in the fingerprint database) is added to the fingerprint database. This data item records the correspondence between the behavioral characteristics and the fingerprint trust score, and an expiration time is configured for this data item. Based on this, it is determined whether the data item has expired based on the expiration time; if the data item is determined to have expired based on the expiration time, it is deleted from the fingerprint database.

[0040] As can be seen from the above technical solutions, in this embodiment, dynamic behavioral characteristics are maintained for each data stream in the data plane. When a message to be processed is received, the static and dynamic behavioral characteristics corresponding to the message are obtained. If the data plane does not have a first forwarding policy that matches the identity characteristics, the routing action is determined based on the static and dynamic behavioral characteristics, thereby performing lightweight trust scoring and dynamic routing (such as blocking, security isolation, and forwarding) on ​​the data path. The data plane uploads the static and dynamic behavioral characteristics to the control plane (without uploading the message to be processed). The control plane determines a second forwarding policy through fingerprint trust scores and / or model-predicted trust scores, and updates the second forwarding policy to the data plane. The data plane then determines the routing action for subsequent messages to be processed based on the second forwarding policy, realizing a closed loop of forwarding policy decision-making and control. While maintaining zero trust, the analysis latency of most normal traffic is controlled at a low level, while reducing the amount of data mirrored to the control plane and the CPU load.

[0041] By forming a behavioral fingerprint of the data flow through static and dynamic behavioral features, the control plane determines the fingerprint trust score and the model-predicted trust score based on the behavioral fingerprint, and issues forwarding and encryption policies based on the behavioral fingerprint. Thus, dynamic routing, micro-segmentation and dynamic encryption are unified under trust control based on the behavioral fingerprint, realizing adaptive secure routing and encryption level control based on behavioral fingerprint.

[0042] By employing a layered verification strategy, rapid initial assessment is performed in the data plane to minimize latency, while in-depth analysis is conducted in the control plane for continuous security detection. This design ensures that normal traffic passes transparently in most scenarios, while abnormal traffic is quickly detected and isolated. A comprehensive zero-trust system is adopted, involving continuous detection and analysis for trust assessment, continuous strong authentication and traffic fingerprint authentication to build a dynamic authentication system, dynamic secure tunnel encryption to protect data confidentiality, and micro-segmentation to separate normal, suspicious, and dangerous traffic. Low-latency forwarding of normal traffic is ensured, while continuous verification is achieved through concurrent rapid analysis. Upon detecting abnormal behavior, an updated policy is sent to the data plane before subsequent packets arrive, blocking or redirecting them.

[0043] The technical solutions described above in the embodiments of this application will be explained below in conjunction with specific application scenarios.

[0044] This application proposes a traffic-aware, zero-trust dynamic encrypted routing method that achieves traffic awareness, dynamic encryption, dynamic routing, and zero trust. Zero-trust security is gradually becoming a new concept and architecture for solving network security problems in the new era. Zero-trust security represents a new generation of network security protection concepts, defaulting to distrust of any person, device, or system inside or outside the enterprise network. It reconstructs the trust foundation of access control based on identity authentication and authorization, ensuring identity trustworthiness, device trustworthiness, application trustworthiness, and link trustworthiness, thereby protecting terminal security, link security, and access control security.

[0045] Dynamic routing refers to dynamically adjusting the routing actions corresponding to pending packets. These actions may include blocking, security isolation, and forwarding. For example, for different pending packets in a data stream with the same identity characteristics, the routing action for the first pending packet might be blocking, the routing action for the second pending packet might be security isolation, and the routing action for the third pending packet might be forwarding. This allows for dynamic adjustment of the routing actions corresponding to different pending packets.

[0046] For example, dynamic routing is a technology that automatically builds and adjusts routing tables by exchanging routing information and selects the optimal path based on network conditions, as opposed to static routing. Dynamic routing relies on the switching mechanism and algorithm calculation of routing protocols to select paths by comprehensively considering parameters such as hop count and bandwidth. Routing protocols include RIP (Routing Information Protocol), OSPF (Open Shortest Path First), and BGP (Border Gateway Protocol).

[0047] Dynamic encryption refers to determining the key information for a message to be processed and decrypting it based on that key information. For example, dynamic encryption can also refer to dynamically adjusting the key information of a message to be processed; this key information could be high-level, medium-level, or low-level encryption. For instance, for different messages to be processed from a data stream with the same identity characteristics, the first message might correspond to a high-level encryption key, which would then be used for decryption; the second message might correspond to a medium-level encryption key, which would also be used; and the third message might correspond to a low-level encryption key, which would also be used. This allows for dynamic adjustment of the encryption level for different messages, achieving dynamic encryption of the data stream.

[0048] Traffic awareness refers to sensing the static and dynamic behavioral characteristics of packets to be processed, and then implementing dynamic encryption, dynamic routing, and zero trust based on these characteristics.

[0049] For example, a traffic-aware, zero-trust dynamic encrypted routing method can be applied to electronic devices, such as network devices (gateway devices) capable of implementing zero trust, like routers, switches, firewalls, and security devices. For instance, the electronic device can include a data plane (also called a forwarding plane) and a control plane. The control plane is responsible for decision-making and path calculation, generating and maintaining routing tables through routing protocols to determine the optimal forwarding path for data. The data plane handles packet processing, quickly performing operations such as receiving, decapsulating, looking up, and forwarding packets based on the forwarding table generated by the control plane. The control plane and data plane collaborate synchronously through table entries; the control plane calculates paths and updates the forwarding table, while the data plane makes local forwarding decisions based on these entries.

[0050] For example, in order to achieve traffic awareness, dynamic encryption, dynamic routing, and zero trust, a traffic-aware dynamic routing process, a traffic-aware zero trust process, and a traffic-aware dynamic encryption process are involved. The dynamic routing process, the zero trust process, and the dynamic encryption process are described below.

[0051] First, regarding traffic-aware dynamic routing processes. See also... Figure 2 The diagram illustrates a traffic-aware dynamic routing process, which may include the following steps:

[0052] Step 201: The data plane receives the first message to be processed through the zero-trust security tunnel.

[0053] A network device can receive multiple pending messages from a data stream targeting the same identity feature; that is, the data stream includes multiple pending messages. Before the network device and the terminal device establish a secure tunnel (since the network device supports zero trust, this secure tunnel is referred to as a zero-trust secure tunnel), the pending messages of this data stream can be protocol messages (used to establish the zero-trust secure tunnel). After the network device and the terminal device establish a zero-trust secure tunnel, the pending messages of this data stream can be either protocol messages or data packets.

[0054] For ease of distinction, these pending messages in the data stream can be designated as the first pending message. For example, before the network device and the terminal device establish a zero-trust secure tunnel, the data plane can receive one or more first pending messages; after the network device and the terminal device establish a zero-trust secure tunnel, the data plane can receive multiple first pending messages through the zero-trust secure tunnel. For instance, the data plane sequentially receives pending message 1, pending message 2, ..., and so on.

[0055] Step 202: When the first message to be processed is received in the data plane through the zero-trust security tunnel, determine the identity and behavioral characteristics corresponding to the first message to be processed. Before establishing the zero-trust security tunnel, when the first message to be processed is received in the data plane, determine the identity and behavioral characteristics corresponding to the first message to be processed.

[0056] For example, the identity feature corresponding to the first message to be processed can be a 5-tuple feature or a 3-tuple feature of the first message to be processed. The 5-tuple feature may include the source IP address, destination IP address, source port, destination port, and protocol; the 3-tuple feature may include the source IP address, destination IP address, and protocol. For instance, the header information of the first message to be processed, such as the MAC address, IP address, TCP port, or UDP port, can be extracted and parsed to obtain the identity feature corresponding to the first message to be processed.

[0057] For example, the behavioral characteristics corresponding to the first message to be processed may include static behavioral characteristics and dynamic behavioral characteristics. Static behavioral characteristics may include non-encrypted information in the first message to be processed, excluding identity characteristics. For instance, static behavioral characteristics may include, but are not limited to, at least one of the following: flag bits (such as TCP flag bits), target server domain name, application layer protocol negotiation information, and TLS fingerprint information.

[0058] For example, flags can indicate the current state of the first pending message. Taking TCP flags as an example, TCP flags are used to indicate specific states during a TCP session and can be used for troubleshooting or controlling the processing of specific connections. TCP flags can include URG (Urgent), ACK (Acknowledgment), PSH (Push), RST (Reset), SYN (Synchronization), FIN (Finish), etc.

[0059] For example, the target server domain name can be an SNI (Server Name Indication). SNI is an SSL / TLS extension designed to solve the problem of a server using multiple domain names and certificates. The working principle of SNI is that before the client connects to the server to establish an SSL connection, the client first sends the domain name of the site to be accessed. In this way, the server can return the appropriate certificate based on the domain name.

[0060] For example, application layer protocol negotiation information can be ALPN (Application-Layer Protocol Negotiation). ALPN is an extension of TLS that allows the client and server to negotiate the application layer protocol to use, such as HTTP / 1.1 or HTTP / 2, during the establishment of a TLS connection. By embedding protocol negotiation information during the TLS handshake, ALPN enables the client and server to quickly determine which protocol to use for communication without additional round-trip communication.

[0061] For example, TLS (Transport Layer Security) fingerprint information can be a TLS fingerprint (JA3 fingerprint). A JA3 fingerprint is a unique identifier used to identify TLS / SSL clients, generated by analyzing the Client Hello packet during the TLS handshake process. A JA3 fingerprint can be constructed by concatenating decimal values ​​of fields such as SSL / TLS version, a list of cipher suites (sorted by priority), a list of extensions, elliptic curves (if supported), and elliptic curve dot format (if supported).

[0062] In one possible implementation, static behavioral characteristics refer to inherent attribute information extracted directly from packet headers, handshake phase interaction information, or specific fields without performing packet payload content or flow behavior analysis. For example, static behavioral characteristics may include network layer and transport layer characteristics: such as TTL values, IP identifiers, TCP window size, TCP options (MSS, SACK, etc.), packet length, ToS / DSCP, etc.; static behavioral characteristics may include payload statistical characteristics: such as the entropy of payload data, byte frequency distribution, etc.; static behavioral characteristics may include fingerprint information: such as JA3 / JA3S fingerprints, HTTP header fingerprints, QUIC protocol connection ID characteristics, etc.

[0063] For example, the dynamic behavior characteristics corresponding to the first pending message may include the statistical characteristics of the data stream corresponding to the identity characteristics. Dynamic behavior characteristics (statistical characteristics) are maintained for each identity characteristic, and when a first pending message of a certain identity characteristic is received, the dynamic behavior characteristics corresponding to that identity characteristic can be updated. For example, dynamic behavior characteristics may include, but are not limited to, at least one of the following: the size of each pending message in the data stream, the total number of packets, the total number of bytes, the total number of uplink pending messages, the total number of downlink pending messages, the arrival time and arrival interval of each pending message, and the flow state of the FSM. For example, a state table can be maintained for each data stream using finite state registers, and this state table stores the dynamic behavior characteristics corresponding to the identity characteristics, indexed by the data stream's identity characteristics (such as quintuple characteristics).

[0064] Regarding the size of each pending message in the data stream: Assuming the data stream corresponds to 10 pending messages (including the currently received pending message), the dynamic behavior characteristics include the message size (i.e. message length) of these pending messages, indicating how many bytes of data each pending message contains.

[0065] Total number of packets for the data stream: This indicates the total number of pending messages corresponding to the data stream, such as 10.

[0066] Total number of bytes in the data stream: This indicates how many bytes of data the data stream contains. For example, how many bytes of data are in total for 10 pending messages, which is the sum of the sizes of all pending messages.

[0067] Total number of uplink pending packets for the data stream: This indicates the total number of uplink pending packets in the data stream, such as 4 packets.

[0068] Total number of downlink pending packets for the data stream: This indicates the total number of downlink pending packets corresponding to the data stream, such as 6 packets.

[0069] Arrival time for each pending message in the data stream: This indicates the arrival time of each pending message in the data stream. The arrival time represents the moment the pending message was received (receive timestamp).

[0070] Arrival interval for each pending message in the data stream: This refers to the arrival interval of each pending message in the data stream, that is, the interval between the reception time of the pending message and the reception time of the previous pending message.

[0071] Regarding the flow state (also known as flow behavior state) of an FSM (Finite State Machine): An FSM, also called a finite state automaton or simply a state machine, is a mathematical model representing a finite number of states and the transitions and actions between these states. The flow state of an FSM can represent the state of the last pending message in the data flow. For example, if the data flow has four states, when a pending message corresponding to state 1 is received, the flow state of the corresponding FSM is state 1; when a pending message corresponding to state 2 is received, the flow state of the corresponding FSM is state 2, and so on. For instance, the flow state of an FSM (based on the flow behavior state of an FSM) can be represented by a number. Taking a TCP flow as an example, a TCP flow has states such as recording, handshaking, and connection establishment. Therefore, the recording state, handshaking state, and connection establishment state can be represented by numbers 0, 1, and 2, respectively.

[0072] Of course, the flow state of FSM is an extensible concept and is not limited to TCP flow state. It can also be UDP (User Datagram Protocol) flow state and ESP (Encapsulating Security Payload) flow state, etc. That is, state detection can also be performed on UDP flow or ESP flow to obtain the flow state of UDP flow FSM or ESP flow FSM.

[0073] In summary, upon receiving the first packet to be processed through the data plane, the identity characteristics, static behavioral characteristics, and dynamic behavioral characteristics corresponding to the first packet to be processed can be determined. For example, the data plane can be implemented using a P4 component, which then determines these characteristics. Alternatively, the data plane can be implemented using a DPDK component, which also determines these characteristics. Or, the data plane can be implemented using other high-speed network repeaters, which then determine these characteristics.

[0074] For example, P4 is a domain-specific programming language for network devices used to specify how the data plane processes packets. It allows developers to flexibly define packet processing behavior to adapt to different network requirements. DPDK (Data Plane Development Kit) is a high-performance network driver component designed to provide efficient and fast packet processing solutions for data plane applications. By bypassing the kernel network protocol stack and processing packets directly in user space, it significantly improves network performance.

[0075] Step 203: Decrypt the first message to be processed using the target key information corresponding to the zero-trust secure tunnel to obtain the decrypted second message to be processed. When the first message to be processed is received in the data plane through the zero-trust secure tunnel, the first message to be processed is decrypted using the target key information corresponding to the zero-trust secure tunnel to obtain the second message to be processed. Before establishing the zero-trust secure tunnel, when the first message to be processed is received in the data plane, the first message to be processed is used as the second message to be processed.

[0076] For example, when establishing a zero-trust secure tunnel between a network device (control plane) and a terminal device, the control plane can determine the target key information corresponding to the zero-trust secure tunnel and send the target key information to the data plane. This target key information can also be dynamically updated. Thus, when the data plane receives the first message to be processed through the zero-trust secure tunnel, it can decrypt the first message to be processed using the target key information corresponding to the zero-trust secure tunnel. This process can be seen in subsequent embodiments.

[0077] Step 204: Determine whether there is a first forwarding strategy in the data plane that matches the identity feature.

[0078] If yes, that is, there is a first forwarding strategy in the data plane that matches the identity features, then proceed to step 205; if no, that is, there is no first forwarding strategy in the data plane that matches the identity features, then proceed to step 206.

[0079] For example, the data plane may include a policy table, which records the correspondence between identity features and forwarding policies. Based on this, for the first few pending packets of a data stream, the data plane may not have a first forwarding policy for that data stream; for subsequent pending packets of the data stream, the data plane does have a first forwarding policy for that data stream (generated and distributed by the control plane). This first forwarding policy may also change, i.e., the forwarding policy is constantly updated. The method for obtaining the forwarding policy is described in subsequent embodiments.

[0080] Step 205: Determine the routing action for the second packet to be processed based on the first forwarding policy.

[0081] For example, since the policy table includes a first forwarding policy that matches the identity feature, the first forwarding policy can be obtained from the policy table, and the routing action for the second packet to be processed can be determined based on the first forwarding policy. The routing action can be a blocking action, a security isolation action, or a forwarding action.

[0082] Step 206: Determine the routing action for the second message to be processed based on behavioral characteristics. For example, the routing action for the second message to be processed can be determined based on static and dynamic behavioral characteristics.

[0083] For example, if the policy table does not include a first forwarding policy matching the identity feature, a lightweight trust decision process can be used to determine the routing action for the second packet to be processed. Clearly, the priority of the forwarding policy issued to the data plane is higher than the priority of the lightweight trust decision process; the lightweight trust decision process will only be executed if the first forwarding policy does not exist. When using the lightweight trust decision process, the routing action for the second packet to be processed is determined based on static and dynamic behavioral characteristics.

[0084] For example, regarding a zero-trust request flow, which is a request flow used to establish a zero-trust secure tunnel (i.e., a zero-trust secure tunnel has not yet been established), upon receiving the first pending message from the zero-trust request flow, no decryption process is involved. The first pending message is treated as the second pending message, and the routing action for the second pending message is determined based on static and dynamic behavioral characteristics.

[0085] For data flows protected by a zero-trust security tunnel (i.e., a zero-trust security tunnel has been established), upon receiving the first pending message of this data flow, the second pending message is obtained by decrypting the first pending message. If no first forwarding policy matches the identity characteristics of the second pending message, the routing action for the second pending message is determined based on static and dynamic behavioral characteristics.

[0086] For example, the process of determining the routing action for the second message to be processed in step 206 may include:

[0087] Step 2061: Determine whether the second message to be processed is an abnormal message based on behavioral characteristics (static behavioral characteristics and dynamic behavioral characteristics). If yes, proceed to step 2062; otherwise, proceed to step 2063.

[0088] For example, the behavioral characteristics can be analyzed to determine if there are any abnormal behaviors, such as abnormal total number of packets in the data stream, abnormal total number of bytes in the data stream, abnormal arrival time of the pending message, or abnormal arrival interval of the pending message. This embodiment does not restrict these abnormal behaviors and can be configured according to actual needs. If abnormal behaviors are found in the behavioral characteristics, it indicates that the second pending message is an abnormal message.

[0089] In one possible implementation, the determination of whether the second pending message is an abnormal message can be made as follows: If the behavioral characteristics include flag bits (such as TCP flag bits) and the flow state of the FSM, then the first state of the data flow is determined based on the flow state of the FSM, and the second state of the second pending message is determined based on the flag bits. Here, the flow state of the FSM can represent the state of the last pending message corresponding to the data flow (i.e., the last pending message before the current pending message), and the flag bits can represent the state of the second pending message. Based on this, the expected transition state is determined based on the first state; if the second state is the expected transition state, then the second pending message is determined not to be an abnormal message; if the second state is not the expected transition state, then the second pending message is determined to be an abnormal message. Specifically, the expected transition state can be the first state, and / or the flow states of the FSM can be predetermined, such as state A, state B, state C and state D in sequence. In this case, the expected transition state can be the state that follows the first state. For example, if the first state is state B, the expected transition state is state C, not state D, and certainly not state A that precedes state B.

[0090] For example, if the first state of the data stream is determined to be an established connection based on the FSM's flow state, and the second state of the second pending message is determined to be a SYN state based on the flag bits, then clearly, the second state precedes the first state. In an established connection state, a second pending message in a SYN state would not be received. Therefore, the second pending message can be determined to be an abnormal message. Of course, the above is just one example of determining whether the second pending message is an abnormal message, and it is not a limitation.

[0091] Step 2062: Determine whether the routing action is a blocking action or a security isolation action.

[0092] For example, a routing action could be a blocking action, which means blocking or discarding the second packet to be processed, and not sending the second packet to the next hop. Alternatively, a routing action could be a security isolation action, such as routing the second packet to a honeypot or sandbox for security isolation.

[0093] Step 2063: Assign a first trust score to the second message to be processed. The first trust score can be an initial value or can be configured according to actual needs, such as 50 points.

[0094] Step 2064: Determine the score to be adjusted based on behavioral characteristics (static and dynamic behavioral characteristics). Specifically, if the behavioral characteristics match an acquired scoring strategy, the score to be adjusted is increased; if the behavioral characteristics match an acquired deduction strategy, the score to be adjusted is decreased.

[0095] For example, scoring and deduction policies can be pre-configured. Both policies can be customized according to actual needs. For instance, a scoring policy could be "the message type is a UDP SDP message," which corresponds to "+10 points," and a deduction policy could be "the message was received on an unknown port," which corresponds to "-10 points." Of course, the above are just examples of scoring and deduction policies, and no restrictions are imposed.

[0096] Behavioral characteristics can include multiple feature values, such as flag bits, target server domain names, application layer protocol negotiation information, TLS fingerprint information, etc., all of which represent feature values ​​of the behavioral characteristics. The size of each pending message in the data stream, the total number of packets, the total number of bytes, the total number of uplink pending messages, the total number of downlink pending messages, the arrival time and interval of each pending message, and the flow state of the FSM, all represent feature values ​​of the behavioral characteristics. Based on this, if any feature value of the behavioral characteristic matches the scoring strategy (e.g., the feature value is the same as the scoring strategy, the feature value belongs to a subset of the scoring strategy, etc.), the score to be adjusted is increased. If any feature value of the behavioral characteristic matches the deduction strategy, the score to be adjusted is decreased.

[0097] For example, the initial value of the score to be adjusted is 0. If the feature value 1 of the behavioral feature matches the scoring strategy, the score to be adjusted is updated to 10; if the feature value 2 of the behavioral feature matches the scoring strategy, the score to be adjusted is updated to 20; if the feature value 3 of the behavioral feature matches the scoring strategy, the score to be adjusted is updated to 30; if the feature value 4 of the behavioral feature matches the scoring strategy, the score to be adjusted is updated to 20, and so on, until the final score to be adjusted is obtained.

[0098] For example, the fingerprint database may include a correspondence between behavioral features and fingerprint trust scores; the content of the fingerprint database is described in subsequent embodiments. Behavioral features with fingerprint trust scores greater than a first threshold can be used to obtain a scoring strategy, while behavioral features with fingerprint trust scores less than a second threshold can be used to obtain a deduction strategy, where the second threshold is less than the first threshold. For instance, if the fingerprint trust score corresponding to a certain behavioral feature is greater than the first threshold, that behavioral feature can be used as a scoring strategy, or a portion of the feature values ​​of that behavioral feature can be used as a scoring strategy (i.e., multiple feature values ​​as multiple scoring strategies), or all the feature values ​​of that behavioral feature can be used as a scoring strategy. Similarly, if the fingerprint trust score corresponding to a certain behavioral feature is less than the second threshold, that behavioral feature can be used as a deduction strategy, or a portion of the feature values ​​of that behavioral feature can be used as a deduction strategy, or all the feature values ​​of that behavioral feature can be used as a deduction strategy.

[0099] For example, the control plane may include an SDP (Software Defined Perimeter) controller. The SDP controller is used to obtain the scoring strategy and the deduction strategy, and then sends the scoring strategy and the deduction strategy to the data plane. The data plane determines the score to be adjusted based on the scoring strategy and the deduction strategy.

[0100] SDP is a network security model based on the zero-trust concept. It aims to hide application resources through logical access boundaries and authorize access only after dynamically verifying the visitor's identity, context, and policy compliance, thus adapting to the security needs of borderless scenarios such as cloud computing and mobile internet. The SDP controller achieves dynamic security verification by separating the control plane and the data plane. The processing procedure of the SDP controller is described in subsequent embodiments.

[0101] Step 2065: Adjust the first trust score based on the score to be adjusted to obtain the second trust score. For example, the sum of the score to be adjusted and the first trust score can be used as the second trust score.

[0102] Step 2066: Determine the action corresponding to the second trust score as the routing action.

[0103] For example, the mapping between score intervals and actions can be pre-configured, such as score interval 1 corresponding to blocking actions, score interval 2 corresponding to security isolation actions, and score interval 3 corresponding to forwarding actions. Score interval 1 is less than score interval 2, and score interval 2 is less than score interval 3. Based on this, if the second trust score is in score interval 1, the blocking action corresponding to the second trust score is used as a routing action; if the second trust score is in score interval 2, the security isolation action corresponding to the second trust score is used as a routing action; and if the second trust score is in score interval 3, the forwarding action corresponding to the second trust score is used as a routing action. In summary, a trust score is ultimately determined, and then the routing action is obtained.

[0104] For example, if the second trust score is high, it is directly routed to the next node. Therefore, the forwarding action corresponding to the second trust score is used as the routing action. In this case, the second pending packet is initially assessed as low-risk. The data plane uploads the identity and behavioral characteristics of the second pending packet to the control plane in real time for analysis and routes the second pending packet to the next node. This design is based on performance considerations, ensuring low-latency forwarding of normal traffic. At the same time, it achieves continuous verification through concurrent and rapid analysis. The control plane quickly completes the analysis, detects abnormal behavior, and issues forwarding policies to the data plane before the arrival of a small number of subsequent data packets in the data stream, taking measures such as blocking or security isolation of subsequent packets.

[0105] For example, if the second trust score is average, further review is required, and the second pending message is routed to the next node. Therefore, the forwarding action corresponding to the second trust score is used as a routing action. In this case, the data plane uploads the identity and behavioral characteristics of the second pending message to the control plane for analysis in real time. Alternatively, the data plane uploads the identity and behavioral characteristics of the second pending message to the control plane for analysis in real time.

[0106] For example, if the second trust score is low, the second message to be processed is deemed to be suspected of being an attack and needs to be routed to a cloud-based security stack such as a sandbox or honeypot for security isolation. The security isolation action corresponding to the second trust score serves as the routing action. In this case, the data plane uploads the identity and behavioral characteristics of the second message to be processed to the control plane in real time for analysis, and also uploads the second message to the control plane in real time for analysis to prevent misjudgments.

[0107] For example, if the second trust score is 0 or negative, the second pending message is directly blocked, and the blocking action corresponding to the second trust score is used as a routing action. In this case, the data plane uploads the identity and behavioral characteristics of the second pending message to the control plane for analysis in real time, and also uploads the second pending message to the control plane for analysis in real time to prevent misjudgment.

[0108] Step 207: Perform operations on the second packet to be processed based on routing actions. For example, routing actions may include blocking actions, security isolation actions, or forwarding actions. Based on this, the second packet to be processed can be blocked based on routing actions, or the second packet to be processed can be security isolated based on routing actions, or the second packet to be processed can be operated on based on routing actions.

[0109] Step 208: The data plane sends the identity and behavioral characteristics corresponding to the second message to be processed to the control plane. In some cases, the data plane may also send the second message to be processed to the control plane.

[0110] For example, if the routing action of the second message to be processed is a forwarding action, the data plane sends the identity and behavioral characteristics to the control plane. If the routing action of the second message to be processed is a security isolation or blocking operation, the data plane sends the identity, behavioral characteristics, and the second message to be processed to the control plane.

[0111] Step 209: Upon receiving identity and behavioral characteristics from the data plane via the control plane, determine a second forwarding strategy matching the identity characteristics based on the behavioral characteristics. Alternatively, upon receiving identity, behavioral characteristics, and a second pending message from the data plane via the control plane, determine a second forwarding strategy matching the identity characteristics based on the behavioral characteristics and the second pending message. For details on how to determine the second forwarding strategy, please refer to the subsequent traffic-aware zero-trust process; it will not be elaborated upon here.

[0112] Step 210: Update the second forwarding policy to the data plane through the control plane, so that the data plane can determine the routing action of subsequent packets to be processed based on the second forwarding policy.

[0113] For example, the second forwarding policy and identity characteristics are distributed to the policy table of the data plane, and the correspondence between the identity characteristics and the second forwarding policy is recorded in the policy table of the data plane. When the data plane receives the second packet to be processed from the data flow again, it can query the policy table to find the first forwarding policy that matches the identity characteristics (i.e., the second forwarding policy is used as the first forwarding policy), determine the routing action for the second packet to be processed based on the first forwarding policy, and so on, continuously updating the forwarding policy of the data plane.

[0114] Second, regarding traffic-aware zero-trust processes. In zero-trust processes, dynamic trust assessment and identity authentication are required, with access control based on the authentication results. See [link / reference] Figure 3 The diagram illustrates a traffic-aware zero-trust process, which may include the following steps:

[0115] Step 301: Receive identity and behavioral characteristics sent by the data plane through the control plane.

[0116] For example, before establishing a zero-trust secure tunnel, the data plane can send the identity and behavioral characteristics corresponding to the second pending message to the control plane. Furthermore, when the data plane operates on the second pending message based on a routing action, if the routing action is a forwarding action (forwarding the second pending message to the next hop), and the second pending message is used to establish a zero-trust secure tunnel, then the next hop can be the control plane; that is, the data plane sends the second pending message to the control plane. In summary, the control plane can receive the identity characteristics, behavioral characteristics, and the second pending message sent by the data plane. Based on this, when establishing a zero-trust secure tunnel, the control plane can receive the second pending message. Thus, for a zero-trust request flow, the second pending message of the zero-trust request flow is uploaded to the control plane.

[0117] For example, after establishing a zero-trust secure tunnel, the data plane can send the identity and behavioral characteristics corresponding to the second message to be processed to the control plane. Alternatively, the data plane can send the second message to be processed, along with its corresponding identity and behavioral characteristics, to the control plane. Based on this, the control plane can receive the identity and behavioral characteristics when establishing the zero-trust secure tunnel. Thus, for data flows protected based on the zero-trust secure tunnel, according to the zero-trust principle of "never trusting," the identity and behavioral characteristics can be sent to the control plane to allow it to reconsider its decision.

[0118] Step 302: Determine whether a second pending message for establishing a zero-trust secure tunnel has been received.

[0119] If yes, then proceed to step 303; if no, then proceed to step 305.

[0120] Step 303: Perform verification based on the second message to be processed. If the verification fails, the connection is rejected, and the establishment of a zero-trust secure tunnel between the network device and the terminal device is prohibited. If the verification passes, proceed to step 304.

[0121] For example, when establishing a zero-trust secure tunnel, when the control plane (such as the SDP controller or SPA controller of the control plane) receives a second message to be processed, the second message to be processed may be an SPA data packet, and the second message to be processed may include encrypted and integrity-protected verification information.

[0122] For example, SPA (Single Packet Authorization) is a network security protocol that completes authentication and access requests through a single data packet, achieving stealth protection for network services. SPA controllers follow a zero-trust security model, requiring device and user identities to be verified before opening network connections.

[0123] For example, regarding encryption and integrity protection, when a terminal device sends a message to be processed to a network device, to ensure the security of the verification information, the verification information is encrypted asymmetricly or symmetricly using a pre-shared key or client certificate before transmission, and a message digest is calculated using algorithms such as hash message authentication codes to ensure its confidentiality and integrity. Based on this, the SDP controller or SPA controller can use symmetric / asymmetric algorithms to protect the confidentiality of the verification information and integrity algorithms to protect the integrity of the information.

[0124] The SDP controller or SPA controller can parse the verification information from the second message to be processed and perform verification on the second message to be processed based on the verification information. The verification information includes at least one of the following: identity identifier: such as username, device ID, etc.; time-sensitive credentials: such as scrambled random number (Nonce) and high-precision timestamp, used to prevent replay attacks; network environment information: such as source IP address, source port, etc.

[0125] Based on the above verification information, the second message to be processed can be verified; if the verification fails, the establishment of a zero-trust secure tunnel is prohibited; if the verification passes, the establishment of a zero-trust secure tunnel is allowed.

[0126] Step 304: Establish a zero-trust security tunnel between the network device and the terminal device, determine the target key information corresponding to the zero-trust security tunnel, and send the target key information to the data plane so that the data plane can decrypt the first message to be processed through the target key information to obtain the second message to be processed.

[0127] For example, if the verification passes, a zero-trust secure tunnel can be established between the network device and the terminal device. This zero-trust secure tunnel provides basic channel security for subsequent data transmission and can be any type of secure tunnel; the establishment process is not restricted. After the zero-trust secure tunnel is established, the data plane can receive packets to be processed through it.

[0128] For example, when establishing a zero-trust secure tunnel, the target key information corresponding to the zero-trust secure tunnel can also be determined. That is, the parameters required for encryption and decryption negotiated between the network device and the terminal device are used as the target key information. The target key information may include, but is not limited to, at least one of the following: encryption algorithm, key length, cipher suite, session key, and parameter expiration time. There are no restrictions on the target key information.

[0129] For example, after determining the target key information corresponding to the zero-trust secure tunnel, the target key information can be sent to the data plane for the data plane to perform fast decryption based on the target key information.

[0130] For example, if the second message to be processed includes encrypted and integrity-protected verification information, an authentication trust score can be determined based on the verification information. The higher the security level of the second message to be processed indicated by the verification information, the higher the authentication trust score. For instance, if the verification is deemed successful based on the verification information, it means the terminal device's identity is initially trustworthy, and an authentication trust score can be generated. This authentication trust score can be a relatively high preset fixed value (e.g., 0.9). Alternatively, if the verification is deemed successful based on the verification information, an authentication trust score can be generated according to the strength of the authentication method. For example, a "password + certificate" authentication method corresponds to a higher authentication trust score, such as 0.9, while a "password only" authentication method corresponds to a lower authentication trust score, such as 0.6, and so on. Therefore, the higher the security level of the second message to be processed indicated by the verification information, the higher the authentication trust score.

[0131] It's important to note that the authentication trust score is applied to a single data stream. When the second pending message is an SPA packet (SPA authentication packet), the SPA packet requests the opening of a zero-trust security tunnel X. Zero-trust security tunnel X is a new data stream, and the authentication trust score for this data stream is determined by this SPA packet. For example, this authentication trust score can be used in subsequent calculations for the current second pending message. Similarly, subsequent second pending messages in the data stream (i.e., any later received second pending messages) are also processed based on this authentication trust score.

[0132] Step 305: Determine whether the fingerprint database includes fingerprint trust scores corresponding to behavioral characteristics.

[0133] For example, if a second pending message for establishing a zero-trust secure tunnel is received, after the zero-trust secure tunnel is established, it can be determined whether the fingerprint database includes the fingerprint trust score corresponding to the behavioral characteristics received by the control plane. Alternatively, even if the second pending message for establishing a zero-trust secure tunnel is not received, it can still be determined whether the fingerprint database includes the fingerprint trust score corresponding to the behavioral characteristics received by the control plane.

[0134] For example, the control plane can maintain a fingerprint database, which may include the correspondence between behavioral features and fingerprint trust scores. Based on this, the fingerprint database can be queried using the received behavioral features (i.e., the behavioral features corresponding to the second message to be processed) to determine whether the fingerprint database includes the fingerprint trust score corresponding to the behavioral feature. If yes, step 306 can be executed, and after step 306, step 307 can be executed. If no, step 307 can be executed directly.

[0135] Step 306: Query the fingerprint trust score corresponding to the behavioral feature from the fingerprint database. That is, the fingerprint trust score can be the score corresponding to the behavioral feature in the fingerprint database.

[0136] For example, the behavioral characteristics can include static and dynamic characteristics. Static characteristics include SNI domain names, JA3 hash values, and ALPN extensions (such as HTTP 1.1 / HTTP 2), while dynamic characteristics include packet size sequences and distributions, packet interval distributions, session duration, and uplink / downlink traffic ratios. Based on this, a rapid matching can be performed in a fingerprint database to obtain the corresponding fingerprint trust score. For instance, the fingerprint database may contain a correspondence between feature fingerprints and fingerprint trust scores. Thus, operations (such as hash operations) can be performed on the static and dynamic behavioral characteristics to obtain the target feature fingerprint, and the corresponding fingerprint trust score can be retrieved from the fingerprint database.

[0137] For example, fingerprint databases pre-store a large number of behavioral characteristics (feature fingerprints) of known applications, known threats, and historical normal behavior, along with their associated fingerprint trust scores (i.e., trust levels). The control plane can efficiently match real-time generated behavioral characteristics (target feature fingerprints) with the fingerprint database.

[0138] For high-trust behavioral characteristics (feature fingerprints), such as the behavioral characteristics of high-trust applications (e.g., accessing internal OA systems, accessing DNS services), the fingerprint database can include the correspondence between the behavioral characteristics (feature fingerprints) and fingerprint trust scores (e.g., 100 points, representing the highest trust level).

[0139] For the behavioral characteristics (feature fingerprints) of medium trust, the fingerprint database can include the correspondence between the behavioral characteristics (feature fingerprints) and the fingerprint trust score (e.g., 80 points, indicating a higher trust level).

[0140] For low-suspicion behavioral features (feature fingerprints), the fingerprint database can include the correspondence between the behavioral feature (feature fingerprint) and the fingerprint trust score (e.g., 50 points, representing an intermediate trust level).

[0141] For highly suspicious behavioral characteristics (feature fingerprints), the fingerprint database can include the correspondence between the behavioral characteristic (feature fingerprint) and the fingerprint trust score (e.g., 20 points, indicating a low trust level). Based on this, if the behavioral characteristic (feature fingerprint) matches a known suspicious behavioral pattern (e.g., a JA3 fingerprint matches known malware), a lower fingerprint trust score will be output, and traffic will be redirected to the security stack.

[0142] For dangerous behavioral characteristics (feature fingerprints), the fingerprint database can include the correspondence between the behavioral characteristic (feature fingerprint) and the fingerprint trust score (e.g., 0 points, representing the lowest trust level). Based on this, if a behavioral characteristic (feature fingerprint) matches a high-risk threat, it is immediately blocked, and a blocking rule is generated.

[0143] Step 307: Input the behavioral features into the network model to obtain the predicted trust score. That is, the predicted trust score can be the score obtained by inputting the behavioral features (static behavioral features and dynamic behavioral features) into the network model.

[0144] For example, the control plane of a network device may include a network model, and the network model may include a basic temporal anomaly detection model, a deep temporal anomaly detection model, and an entity interaction topology analysis model.

[0145] The basic timing anomaly detection model is a timing analysis model. It is a lightweight model, meaning it has fewer parameters and lower computational cost. This model is used to detect abnormal behavior in a second message to be processed. The input data for the basic timing anomaly detection model can be the second message to be processed, used to quickly identify abrupt changes in the basic timing pattern of the second message.

[0146] Deep temporal anomaly detection models are a type of temporal analysis model, specifically a large-scale model with numerous parameters and high computational cost. Examples of deep temporal anomaly detection models include LSTM (Long Short-Term Memory) networks and Transformers. These models are used to detect anomalous behavior in a second packet to be processed. The input data for a deep temporal anomaly detection model can be the behavioral features corresponding to the second packet to be processed. By deeply analyzing these behavioral features, anomalies in the second packet to be processed are discovered. Deep temporal anomaly detection models learn the temporal dependencies of normal behavioral patterns to identify complex covert channels, tunneling attacks, or slow-moving attacks.

[0147] In some cases, a single pending message or a single data stream cannot reveal abnormal behavior. Therefore, it is necessary to establish an entity topology, using network entities (such as user accounts, terminal devices, server IPs, domain names, etc.) as nodes and network sessions between entities as edges. The attributes of the edges represent the behavioral features extracted from the sessions (i.e., the behavioral features of each data stream), forming a dynamic entity interaction graph. Based on this, an entity interaction topology analysis model can be obtained. This model can then be used to learn from the dynamic entity interaction graph, thereby aggregating information from neighboring nodes and discovering abnormal behaviors that are not apparent from a single entity (such as a high-trust-score user node suddenly starting to connect to a large number of low-trust-score IP nodes).

[0148] Entity interaction topology analysis models are a type of topology behavior analysis model. These models can be GNNs (Graph Neural Networks), such as GCNs (Graph Convolutional Networks) or GATs (Graph Attention Networks). Entity interaction topology analysis models are used to detect whether a second message to be processed exhibits abnormal behavior. The input data for these models can be the behavioral features and associated behavioral features corresponding to the second message to be processed. The output data is a topology trust component, which reflects whether the behavior of the entity / session within its social network (topology graph) is trustworthy, i.e., whether the second message to be processed exhibits abnormal behavior.

[0149] For example, if a second message to be processed is received through the control plane, the second message to be processed is input into the basic temporal anomaly detection model to obtain a basic temporal trust score; the behavioral features corresponding to the second message to be processed are input into the deep temporal anomaly detection model to obtain a deep temporal trust score; and the behavioral features corresponding to the second message to be processed and the associated behavioral features are input into the entity interaction topology analysis model to obtain an entity interaction trust score. If the second message to be processed is not received, the behavioral features corresponding to the second message to be processed are input into the deep temporal anomaly detection model to obtain a deep temporal trust score; and the behavioral features corresponding to the second message to be processed and the associated behavioral features are input into the entity interaction topology analysis model to obtain an entity interaction trust score.

[0150] For example, in the data plane, if the routing action of the second pending message is a blocking action or a security isolation action, the data plane can send the second pending message to the control plane. Furthermore, if the second pending message is a message used to establish a zero-trust secure tunnel, and the routing action of the second pending message is a forwarding action, then the next hop of the forwarding action is the control plane; therefore, the data plane can send the second pending message to the control plane. In both of these cases, the control plane can receive the second pending message.

[0151] For example, the associated behavior characteristics are the behavior characteristics of the associated data streams. Suppose that the second message to be processed corresponds to data stream 1, then the associated data streams can be the K data streams preceding data stream 1, or K data streams can be randomly selected from all data streams as associated data streams, or K data streams that are associated with data stream 1 (such as having the same source IP address, or the same destination IP address, or the same source port, or the same destination port) can be used as associated data streams, without any restrictions.

[0152] For the basic timing anomaly detection model, after inputting the second message to be processed into the model, the model can detect whether the second message exhibits abnormal behavior and output a timing trust component. This timing trust component is used to determine the basic timing trust score. For example, the higher the probability (confidence) of abnormal behavior reflected by the timing trust component, the lower the basic timing trust score; conversely, the lower the probability (confidence) of abnormal behavior reflected by the timing trust component, the higher the basic timing trust score, meaning the greater the credibility of the second message to be processed.

[0153] For the deep temporal anomaly detection model, after inputting behavioral features into the deep temporal anomaly detection model, the deep temporal anomaly detection model can detect whether there is abnormal behavior in the second message to be processed based on the behavioral features, and output a temporal trust component. This temporal trust component is used to determine the deep temporal trust score.

[0154] For the entity interaction topology analysis model, after inputting behavioral features and associated behavioral features, the model can detect whether the second message to be processed exhibits abnormal behavior based on these features and output a topology trust component. This topology trust component is used to determine the entity interaction trust score. For example, the higher the probability of abnormal behavior reflected by the topology trust component, the lower the entity interaction trust score; conversely, the lower the probability of abnormal behavior reflected by the topology trust component, the higher the entity interaction trust score, meaning the greater the credibility of the second message to be processed.

[0155] For example, if a base time-series trust score exists, the base time-series trust score, deep time-series trust score, and entity interaction trust score are weighted to obtain the predicted trust score. For instance, the weighting coefficients for the base time-series trust score, deep time-series trust score, and entity interaction trust score are configured according to actual needs. Alternatively, if a base time-series trust score does not exist, the deep time-series trust score and entity interaction trust score are weighted to obtain the predicted trust score, with the weighting coefficients for both scores configured according to actual needs.

[0156] Step 308: Determine the target trust score based on at least one of the authentication trust score, fingerprint trust score, and predicted trust score. For example, if authentication trust score, fingerprint trust score, and predicted trust score exist, then determine the target trust score based on the authentication trust score, fingerprint trust score, and predicted trust score.

[0157] For example, if the second message to be processed is used to establish a zero-trust secure tunnel, then there is an authentication trust score; if the second message to be processed is not used to establish a zero-trust secure tunnel, then there is no authentication trust score.

[0158] For example, in some cases, behavioral features can be matched based on a fingerprint database. Therefore, based on the matching results of behavioral features, if the fingerprint database includes a fingerprint trust score corresponding to the behavioral feature, then a fingerprint trust score exists; if the fingerprint database does not include a fingerprint trust score corresponding to the behavioral feature, then a fingerprint trust score does not exist. In some cases, the matching process using a fingerprint database can be bypassed, and behavioral features can be matched without using a fingerprint database, i.e., no fingerprint trust score exists.

[0159] For example, in some cases (such as when a fingerprint trust score is not obtained), deep analysis can be performed based on a network model, using a more complex network model to uncover potential anomalous behavior from different dimensions, thus allowing for a predicted trust score. In other cases (such as when a fingerprint trust score has already been obtained), the deep analysis process using a network model can be bypassed, meaning a predicted trust score is not available.

[0160] In summary, if a fingerprint trust score exists, the target trust score can be determined based on the fingerprint trust score; or, the target trust score can be determined based on the fingerprint trust score and the predicted trust score; or, the target trust score can be determined based on the fingerprint trust score and the authentication trust score; or, the target trust score can be determined based on the fingerprint trust score, the predicted trust score, and the obtained authentication trust score.

[0161] In addition, if no fingerprint trust score exists, the target trust score can be determined based on the predicted trust score; or, the target trust score can be determined based on the predicted trust score and the authentication trust score.

[0162] In one possible implementation, the target trust score can be determined using the following formula: F = W1 × F1 + W2 × F2 + W3 × F3. Where F represents the target trust score, F1 represents the fingerprint trust score, F2 represents the predicted trust score, and F3 represents the authentication trust score. W1, W2, and W3 represent weighting coefficients, and the sum of these weighting coefficients can be 1. W1, W2, and W3 can be statically configured according to the security policy or dynamically adjusted according to the context; there are no restrictions on this. Besides the aforementioned trust score, the target trust score can also be related to other components; there are no restrictions on how the target trust score is obtained.

[0163] Step 309: Determine the forwarding policy corresponding to the target trust score as the second forwarding policy. The second forwarding policy is used to indicate whether the routing action is a blocking action, a security isolation action, or a forwarding action.

[0164] For example, the mapping between score intervals and forwarding policies can be pre-configured, such as the mapping between score interval 1 and blocking actions (forwarding policies are used to indicate that the routing action is a blocking action), the mapping between score interval 2 and security isolation actions, and the mapping between score interval 3 and forwarding actions. Score interval 1 can be smaller than score interval 2, and score interval 2 can be smaller than score interval 3.

[0165] Based on this, if the target trust score is in score range 1, the forwarding policy corresponding to the target trust score is used to indicate that the routing action is a blocking action; if the target trust score is in score range 2, the forwarding policy corresponding to the target trust score is used to indicate that the routing action is a security isolation action; if the target trust score is in score range 3, the forwarding policy corresponding to the target trust score is used to indicate that the routing action is a forwarding action.

[0166] Step 310: Update the correspondence between identity features and the second forwarding policy to the data plane through the control plane, so as to determine the routing action of subsequent packets to be processed based on the second forwarding policy through the data plane.

[0167] Step 311: Update the target trust score to the fingerprint trust score corresponding to the behavioral feature, add a data item to the fingerprint database, and record the correspondence between the behavioral feature and the fingerprint trust score through the data item.

[0168] For example, after obtaining the target trust score, it can be determined whether a data item corresponding to this behavioral feature exists in the fingerprint database (i.e., whether a fingerprint trust score corresponding to this behavioral feature already exists). If so, this data item can be deleted, and a new data item can be added, recording the correspondence between the behavioral feature and the updated fingerprint trust score (i.e., the target trust score as the updated fingerprint trust score). If not, a new data item can be added directly, recording the correspondence between the behavioral feature and the updated fingerprint trust score. In this way, the fingerprint database can be dynamically refreshed.

[0169] For example, an expiration time can also be configured for the data item (such as the sum of the current time and a preset interval value as the expiration time). Based on this, it can be determined whether the data item has expired based on the expiration time; if it is determined that the data item has expired based on the expiration time, the data item is deleted from the fingerprint database.

[0170] Clearly, the target trust score and its associated behavioral characteristics are recorded or updated in the fingerprint database, completing the computational loop. If an unknown behavioral characteristic is confirmed as high-trust after deep analysis, a new high-trust entry can be created for it in the fingerprint database. If an unknown behavioral characteristic is confirmed as malicious after deep analysis, a new dangerous entry can be created for it in the fingerprint database. In the future, when similar behavioral characteristics are encountered, they can be directly matched in the fingerprint database without further deep analysis. It is important to note that to ensure the system's dynamism and security, an expiration time is set for data items in the fingerprint database (never trusting is the principle). The fingerprint database is not only used for matching but also to provide default, normalized scoring strategies for lightweight decision-making, which are then distributed to the data plane.

[0171] For example, see Figure 4The diagram illustrates the dynamic routing and zero-trust processes. In the data plane, the first packet to be processed (external traffic) enters the ingress module, which forwards it to the parser module. The parser module extracts identity features (such as L2-L4 layer header information, including MAC, IP, TCP, and UDP ports) and static behavioral features (such as the unencrypted portion of L7 layer TLS, including SNI, ALPN, JA3, and related fields) from the first packet. It records the static behavioral features in a metadata table indexed by the identity features (such as 5-tuple features). The parser module updates the dynamic behavioral features corresponding to the identity features and updates the statistics register accordingly. For example, the dynamic behavioral features might include the FSM flow state, which is recorded in the ingress as a state table containing the FSM flow state. Based on the identity features, the current state of the FSM flow state is read from the state table, and an FSM state transition is performed based on the TCP flags.

[0172] The parsing module decrypts the first packet to be processed using the target key information corresponding to the zero-trust security tunnel to obtain the second packet to be processed. If a first forwarding policy matching the identity feature exists in the policy table, the routing action for the second packet to be processed is determined based on the first forwarding policy, such as blocking, security isolation, or forwarding. If no first forwarding policy matching the identity feature exists in the policy table, for a lightweight trust decision process, the routing action for the second packet to be processed is determined based on behavioral characteristics. For example, it checks whether the FSM state is abnormal; if so, the data flow is marked as a "suspicious flow," and the next hop is modified to a security stack or honeypot port; if the FSM state is normal, routing is performed according to the risk level field in the metadata: for low risk levels, the normal routing path is used to maintain low latency; for high risk levels, the data flow is mirrored to the security stack and the routing is adjusted to the relevant path; for the highest risk level, the data is discarded directly.

[0173] In the control plane, identity and behavioral features sent from the data plane are received. The SDP or SPA controller in the control plane performs rapid matching in the fingerprint database to obtain fingerprint trust scores corresponding to the behavioral features. The SDP or SPA controller then performs deep analysis of the behavioral features based on network models (basic temporal anomaly detection model, deep temporal anomaly detection model, and entity interaction topology analysis model) to obtain predicted trust scores. Finally, a target trust score is calculated based on the fingerprint trust score and the predicted trust score, and a second forwarding policy is generated based on this target trust score. The correspondence between identity features and the second forwarding policy is then updated in the data plane.

[0174] Third, regarding the dynamic encryption process based on traffic awareness.

[0175] In the control plane, after obtaining the target trust score, the key information to be updated for the zero-trust secure tunnel can be determined based on the target trust score. For example, if the target trust score is less than a third threshold, the key information to be updated is the first key information, and the encryption level of the first key information is greater than the encryption level of the target key information; if the target trust score is greater than a fourth threshold, the key information to be updated is the second key information, and the encryption level of the second key information is less than the encryption level of the target key information; where the fourth threshold is greater than the third threshold. Based on this, the first key information can be sent to the data plane to update the target key information of the zero-trust secure tunnel. Thus, when the data plane decrypts the first message to be processed based on the target key information, it uses the first key information to decrypt the first message to be processed. Alternatively, the second key information can be sent to the data plane to update the target key information of the zero-trust secure tunnel. Thus, the data plane uses the second key information to decrypt the first message to be processed.

[0176] In summary, based on traffic awareness results, the tunnel encryption algorithm (i.e., the key information includes the tunnel encryption algorithm) can be dynamically adjusted, and the current tunnel can be dynamically switched to a tunnel using a stronger encryption algorithm and more frequent key rotation. For example, for latency-sensitive data streams, when the target trust score is greater than the fourth threshold, the tunnel encryption algorithm can be downgraded from a block cipher (such as AES / SM4) to a stream cipher (such as ChaCha20-Poly1305 / ZUC) without interruption; for file transfers requiring high throughput, when the target trust score is less than the third threshold, it can be upgraded to a block cipher that supports hardware acceleration.

[0177] In one possible implementation, see Figure 5 The diagram illustrates the dynamic encryption process. Phase 1 is the initial tunnel establishment process, where the tunnel is a zero-trust secure tunnel. The terminal device sends an SPA authentication request (the message to be processed) to the data plane, and the data plane sends an SPA authentication request to the control plane. Based on the SPA authentication request, the control plane determines that the verification is successful, generates an initial policy, negotiates an initial algorithm (such as AES-GCM) with the terminal device, and sends the target key information (such as the initial session key) to the data plane. The terminal device then transmits the encrypted data stream (the message to be processed) to the data plane.

[0178] Phase 2 is the dynamic sensing and adjustment process. The data plane sends behavioral characteristics (such as static and dynamic behavioral characteristics) to the control plane. After determining the target trust score based on the behavioral characteristics, the control plane determines the key information to be updated (such as first or second key information) corresponding to the zero-trust secure tunnel based on the target trust score. The control plane can send a key update command to the terminal device, causing the terminal device to update the target key information to the key information to be updated (such as first or second key information). The control plane can also send the key information to be updated to the data plane, causing the data plane to update the target key information to the key information to be updated (such as first or second key information).

[0179] Phase 3 is the smooth handover (coexistence of old and new keys) process. The terminal device sends a message to be processed to the data plane. The message can be encrypted using the target key information or the key information to be updated (such as the first key information or the second key information). Furthermore, the data plane can decrypt the message using the target key information, or it can decrypt the message using the key information to be updated (such as the first key information or the second key information).

[0180] Phase 4 is the transition termination process. The control plane notifies the data plane to delete the target key information, and the control plane notifies the terminal device to close the old tunnel. The terminal device sends a pending message to the data plane, which is encrypted using the key information to be updated (such as the first key information or the second key information). The data plane decrypts the pending message using the key information to be updated (such as the first key information or the second key information).

[0181] In the above process, the control plane can use an SDP controller to perform relevant operations. The SDP controller dynamically adjusts information such as the encryption algorithm, key length, and encryption channel of the zero-trust session based on the real-time computing level. Based on the uploaded behavior characteristics in traffic awareness, the SDP controller determines the type of traffic that needs encryption. If it is low-latency traffic, the distribution strategy uses streaming encryption and fast path forwarding to reduce forwarding latency. If it is large-volume, high-throughput traffic, a stronger but slightly more time-consuming block encryption algorithm is used, and aggregation processing is performed to leverage hardware acceleration to improve processing efficiency, thereby maximizing throughput.

[0182] For example, assuming a zero-trust security tunnel is an IPSec tunnel, an initial algorithm and key length are negotiated during the initial tunnel establishment. The control plane sends a key update control message to the tunnel peer (terminal device) when the encryption level needs to be upgraded / downgraded based on the target trust score. The control plane negotiates a new algorithm and key by establishing a new SA. For a period of time, the old and new tunnels coexist, and the data plane distinguishes between using the old key or the new key based on the SPI. After the transition period, the old tunnel is closed, completing a smooth switch.

[0183] As can be seen from the above technical solutions, in this embodiment, a closed-loop zero-trust routing architecture is achieved based on the preliminary analysis of "finite state machine and lightweight trust scoring" in the data plane and the in-depth analysis in the control plane. While maintaining the "never trust" principle of zero trust, the analysis latency of most normal traffic is controlled at a low level, while reducing the amount of data mirrored to the control plane and the CPU load. In the data plane, FSM state and packet / flow characteristics (packet size sequence, interval, number of bytes, etc.) are maintained for each flow, and lightweight trust scoring and dynamic routing (such as blocking, security isolation, and forwarding) are performed directly on the data path. The data plane uploads the behavioral characteristics to the control plane, which performs a secondary trust assessment through the network model and outputs a trust score and forwarding policy. The control plane promptly distributes the forwarding policy to the policy table, achieving a closed loop of decision-making and control.

[0184] Using behavioral characteristics as input, unified trust control is achieved based on dynamic routing, micro-segmentation, and dynamic encryption. This avoids the problems of separate configuration and lack of coordination between routing policies, access control, and encryption policies, enabling behavior-based adaptive secure routing and encryption level control. For example, behavioral fingerprints of data flows or entities are formed through static and dynamic behavioral characteristics. The control plane issues routing and encryption policies based on the behavioral fingerprints (i.e., behavioral characteristics) and the trust score output by the model. The trust score not only determines "allow / block" but also directly determines the security tunnel level and algorithm selection, forming a unified security decision-making center.

[0185] The dynamic encryption algorithm / channel adjustment mechanism, based on hardware cryptographic acceleration, migrates the encryption computation load to the most suitable algorithm and hardware resources according to the trust level, optimizing latency and throughput, and ensuring uninterrupted sessions when dynamically adjusting session security levels. For example, for an established zero-trust secure tunnel, the encryption algorithm and key length are dynamically adjusted based on trust score and traffic characteristics (low latency / high throughput): for low-latency interactive traffic, a lower-latency algorithm or shorter key is selected to reduce the frequency of renegotiation; for high-throughput batch traffic, a block cipher suitable for batch processing / hardware acceleration is selected, and batch encryption is performed through a hardware cryptographic card; through a transitional dual-channel approach, the session is guaranteed not to be interrupted when dynamically adjusting the encryption algorithm / channel.

[0186] A layered verification strategy can be adopted: the data plane performs a rapid initial assessment to minimize latency, while the control plane conducts in-depth analysis to achieve continuous security detection. In most scenarios, normal traffic passes through transparently, while abnormal traffic can be quickly detected and isolated. A comprehensive zero-trust system is employed, which involves continuous detection and analysis to complete trust assessment, building a dynamic identity authentication system through continuous strong identity authentication and traffic fingerprint authentication, protecting data confidentiality through dynamic secure tunnel encryption (secure tunnels can be such as SSL / IPSec tunnels), and separating normal, suspicious, and dangerous traffic through micro-segmentation.

[0187] Based on the same concept as the methods described above, this application proposes a traffic-aware, zero-trust dynamic encrypted routing device that can be applied to electronic devices, which include a data plane and a control plane. (See [link to relevant documentation]). Figure 6 The diagram shown is a structural schematic of the device, which includes:

[0188] The data plane management module 61 is used to determine the identity features and behavioral features corresponding to the first message to be processed when the data plane receives the first message to be processed through the zero-trust security tunnel. The behavioral features include static behavioral features and dynamic behavioral features. The static behavioral features include unencrypted information in the first message to be processed, and the dynamic behavioral features include statistical features of the data stream corresponding to the identity features. The module then decrypts the first message to be processed using the target key information corresponding to the zero-trust security tunnel to obtain a second message to be processed after decryption.

[0189] The data plane management module 61 is configured to: if the data plane has a first forwarding policy that matches the identity feature, determine the routing action of the second packet to be processed based on the first forwarding policy; if the data plane does not have a first forwarding policy that matches the identity feature, determine the routing action of the second packet to be processed based on the behavior feature; and operate on the second packet to be processed based on the routing action.

[0190] The control plane management module 62 is used to, when receiving identity features and behavioral features sent by the data plane through the control plane, determine a second forwarding strategy matching the identity features based on the behavioral features, update the second forwarding strategy to the data plane, and determine the routing action of subsequent packets to be processed through the data plane based on the second forwarding strategy; wherein, the second forwarding strategy is determined based on fingerprint trust score and / or model predicted trust score, the fingerprint trust score is the score corresponding to the behavioral features in the fingerprint database, and the predicted trust score is the score obtained by inputting the behavioral features into the network model.

[0191] For example, when the data plane management module 61 determines the routing action of the second message to be processed based on the behavioral characteristics, it specifically performs the following: determining whether the second message to be processed is an abnormal message based on the behavioral characteristics; if so, determining the routing action as a blocking action or a security isolation action; if not, allocating a first trust score to the second message to be processed, determining an adjustment score based on the behavioral characteristics, adjusting the first trust score based on the adjustment score to obtain a second trust score; determining the action corresponding to the second trust score as the routing action; wherein, if the behavioral characteristics match a scoring strategy, increasing the adjustment score, and if the behavioral characteristics match a deduction strategy, decreasing the adjustment score; the fingerprint database includes a correspondence between behavioral characteristics and fingerprint trust scores, behavioral characteristics with fingerprint trust scores greater than a first threshold are used to obtain scoring strategies, and behavioral characteristics with fingerprint trust scores less than a second threshold are used to obtain deduction strategies, where the second threshold is less than the first threshold.

[0192] For example, when the data plane management module 61 determines whether the second message to be processed is an abnormal message based on the behavioral characteristics, it is specifically used to: if the behavioral characteristics include a flag bit and the flow state of the FSM, then determine the first state of the data stream based on the flow state of the FSM, and determine the second state of the second message to be processed based on the flag bit; wherein, the flow state of the FSM represents the state of the last message to be processed corresponding to the data stream, and the flag bit represents the state of the second message to be processed; determine the expected transition state based on the first state; if the second state is the expected transition state, then determine that the second message to be processed is not an abnormal message; if the second state is not the expected transition state, then determine that the second message to be processed is an abnormal message.

[0193] For example, when the control plane management module 62 determines the second forwarding strategy based on the fingerprint trust score and / or the model predicted trust score, it specifically performs the following: if the fingerprint database includes the fingerprint trust score corresponding to the behavioral feature, then determine the target trust score based on the fingerprint trust score; or, determine the target trust score based on the fingerprint trust score and the predicted trust score; or, determine the target trust score based on the fingerprint trust score, the predicted trust score, and the acquired authentication trust score; if the fingerprint database does not include the fingerprint trust score corresponding to the behavioral feature, then determine the target trust score based on the predicted trust score; or, determine the target trust score based on the predicted trust score and the authentication trust score; determine the forwarding strategy corresponding to the target trust score as the second forwarding strategy, the second forwarding strategy being used to indicate that the routing action is a blocking action, a security isolation action, or a forwarding action; wherein, if the second message to be processed includes encrypted and integrity-protected verification information, then determine the authentication trust score based on the verification information; wherein, if the verification information indicates that the security of the second message to be processed is higher, then the authentication trust score is larger.

[0194] For example, the network model includes a basic temporal anomaly detection model, a deep temporal anomaly detection model, and an entity interaction topology analysis model. When the control plane management module 62 obtains the predicted trust score, it specifically performs the following: if a second pending message is received from the data plane via the control plane, the second pending message is input into the basic temporal anomaly detection model to obtain a basic temporal trust score; wherein, if the routing action of the second pending message is a blocking action or a security isolation action, the data plane sends the second pending message to the control plane; the behavioral features are input into the deep temporal anomaly detection model to obtain a deep temporal trust score; the behavioral features and associated behavioral features are input into the entity interaction topology analysis model to obtain an entity interaction trust score, where the associated behavioral features are the behavioral features of the associated data streams of the data streams; a weighted operation is performed on the basic temporal trust score, the deep temporal trust score, and the entity interaction trust score to obtain the predicted trust score; or, a weighted operation is performed on the deep temporal trust score and the entity interaction trust score to obtain the predicted trust score.

[0195] For example, the control plane management module 62 is further configured to, after obtaining the target trust score, determine the key information to be updated corresponding to the zero-trust secure tunnel based on the target trust score; if the target trust score is less than a third threshold, the key information to be updated is a first key information, the encryption level of the first key information is greater than the encryption level of the target key information; if the target trust score is greater than a fourth threshold, the key information to be updated is a second key information, and the encryption level of the second key information is less than the encryption level of the target key information; the fourth threshold is greater than the third threshold; and send the first key information or the second key information to the data plane to update the target key information of the zero-trust secure tunnel through the first key information or the second key information.

[0196] For example, the control plane management module 62 is further configured to, after obtaining the target trust score, update the target trust score to the fingerprint trust score corresponding to the behavioral feature, add a data item to the fingerprint database, record the correspondence between the behavioral feature and the fingerprint trust score through the data item, configure an expiration time for the data item, and delete the data item from the fingerprint database when the data item is determined to be expired based on the expiration time.

[0197] Based on the same concept as the above method, this application proposes an electronic device, see [link to previous application]. Figure 7 As shown, the electronic device includes a processor 71 and a machine-readable storage medium 72, the machine-readable storage medium 72 storing machine-executable instructions that can be executed by the processor 71; the processor 71 is used to execute the machine-executable instructions to implement the traffic-aware zero-trust dynamic encrypted routing method of the example above.

[0198] Based on the same application concept as the above method, this application embodiment also provides a machine-readable storage medium storing a plurality of computer instructions, which, when executed by a processor, can implement the traffic-aware zero-trust dynamic encrypted routing method of the above example.

[0199] The aforementioned machine-readable storage medium can be any electronic, magnetic, optical, or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, machine-readable storage media can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard disk drives), solid-state drives, any type of storage disk (such as optical discs, DVDs, etc.), or similar storage media, or combinations thereof.

[0200] Based on the same application concept as the above method, this application embodiment also provides a computer program product, which may include a computer program that, when executed by a processor, implements the traffic-aware zero-trust dynamic encrypted routing method disclosed in the above examples of this application.

[0201] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0202] The above description is merely an embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of this application should be included within the scope of the claims of this application.

Claims

1. A traffic-aware, zero-trust dynamic encrypted routing method, characterized in that, Applied to an electronic device, the electronic device including a data plane and a control plane, the method includes: When the data plane receives the first message to be processed through the zero-trust security tunnel, it determines the identity features and behavioral features corresponding to the first message to be processed. The behavioral features include static behavioral features and dynamic behavioral features. The static behavioral features include unencrypted information in the first message to be processed, and the dynamic behavioral features include statistical features of the data stream corresponding to the identity features. The first message to be processed is decrypted using the target key information corresponding to the zero-trust security tunnel to obtain the second message to be processed after decryption, and the identity features and behavioral features are sent to the control plane. If the data plane has a first forwarding policy that matches the identity feature, then the routing action for the second packet to be processed is determined based on the first forwarding policy; if the data plane does not have a first forwarding policy that matches the identity feature, then the routing action for the second packet to be processed is determined based on the behavioral feature; and the second packet to be processed is operated on based on the routing action. When the control plane receives the identity features and behavioral features sent by the data plane, a second forwarding strategy matching the identity features is determined based on the behavioral features. The second forwarding strategy is then updated to the data plane so that the data plane can determine the routing action for subsequent packets based on the second forwarding strategy. The second forwarding strategy is determined based on a fingerprint trust score and / or a model-predicted trust score. The fingerprint trust score is the score corresponding to the behavioral features in the fingerprint database, and the predicted trust score is the score obtained by inputting the behavioral features into a network model.

2. The method according to claim 1, characterized in that, The step of determining the routing action for the second message to be processed based on the behavioral characteristics includes: Based on the behavioral characteristics, determine whether the second message to be processed is an abnormal message; If so, then the routing action is determined to be a blocking action or a security isolation action; If not, then a first trust score is assigned to the second message to be processed, an adjustment score is determined based on the behavioral characteristics, and the first trust score is adjusted based on the adjustment score to obtain a second trust score; the action corresponding to the second trust score is determined as the routing action; If the behavioral feature matches the acquired scoring strategy, the score to be adjusted is increased; if the behavioral feature matches the acquired deduction strategy, the score to be adjusted is decreased. The fingerprint database includes a correspondence between behavioral features and fingerprint trust scores. Behavioral features with fingerprint trust scores greater than a first threshold are used to obtain a scoring strategy, while behavioral features with fingerprint trust scores less than a second threshold are used to obtain a scoring strategy. The second threshold is less than the first threshold.

3. The method according to claim 2, characterized in that, The step of determining whether the second message to be processed is an abnormal message based on the behavioral characteristics includes: If the behavioral characteristics include a flag bit and the flow state of the FSM, then the first state of the data stream is determined based on the flow state of the FSM, and the second state of the second message to be processed is determined based on the flag bit; wherein, the flow state of the FSM represents the state of the last message to be processed corresponding to the data stream, and the flag bit represents the state of the second message to be processed. Based on the first state, the expected transfer state is determined; if the second state is the expected transfer state, then the second message to be processed is determined not to be an abnormal message; if the second state is not the expected transfer state, then the second message to be processed is determined to be an abnormal message.

4. The method according to claim 1, characterized in that, The process of determining the second forwarding strategy based on fingerprint trust scores and / or model-predicted trust scores specifically includes: If the fingerprint database includes a fingerprint trust score corresponding to the behavioral feature, then a target trust score is determined based on the fingerprint trust score; or, the target trust score is determined based on the fingerprint trust score and the predicted trust score; or, the target trust score is determined based on the fingerprint trust score, the predicted trust score, and the acquired authentication trust score. If the fingerprint database does not include a fingerprint trust score corresponding to the behavioral feature, then the target trust score is determined based on the predicted trust score; or, the target trust score is determined based on the predicted trust score and the authentication trust score. The forwarding policy corresponding to the target trust score is determined as the second forwarding policy, which is used to indicate whether the routing action is a blocking action, a security isolation action, or a forwarding action. If the second message to be processed includes encrypted and integrity-protected verification information, the authentication trust score is determined based on the verification information; if the verification information indicates that the security of the second message to be processed is higher, the authentication trust score is greater.

5. The method according to claim 1 or 4, characterized in that, The network model includes a basic temporal anomaly detection model, a deep temporal anomaly detection model, and an entity interaction topology analysis model. The process of obtaining the predicted trust score specifically includes: If the control plane receives the second message to be processed sent by the data plane, the second message to be processed is input into the basic timing anomaly detection model to obtain a basic timing trust score; wherein, if the routing action of the second message to be processed is a blocking action or a security isolation action, the data plane sends the second message to be processed to the control plane. The behavioral features are input into the deep temporal anomaly detection model to obtain the deep temporal trust score; The behavioral features and associated behavioral features are input into the entity interaction topology analysis model to obtain the entity interaction trust score, where the associated behavioral features are the behavioral features of the associated data streams of the data streams. The predicted trust score is obtained by weighting the base temporal trust score, the deep temporal trust score, and the entity interaction trust score; or, the predicted trust score is obtained by weighting the deep temporal trust score and the entity interaction trust score.

6. The method according to claim 4, characterized in that, The method further includes: After obtaining the target trust score, the key information to be updated corresponding to the zero-trust security tunnel is determined based on the target trust score; wherein, if the target trust score is less than a third threshold, the key information to be updated is a first key information, and the encryption level of the first key information is greater than the encryption level of the target key information; if the target trust score is greater than a fourth threshold, the key information to be updated is a second key information, and the encryption level of the second key information is less than the encryption level of the target key information; wherein, the fourth threshold is greater than the third threshold; The first key information or the second key information is sent to the data plane to update the target key information of the zero-trust security tunnel.

7. The method according to claim 4, characterized in that, The method further includes: After obtaining the target trust score, the target trust score is updated to the fingerprint trust score corresponding to the behavioral feature. A data item is added to the fingerprint database, and the correspondence between the behavioral feature and the fingerprint trust score is recorded through the data item. An expiration time is configured for the data item. The data item is determined to have expired based on the expiration time; if the data item is determined to have expired based on the expiration time, the data item is deleted from the fingerprint database.

8. A traffic-aware, zero-trust dynamic encrypted routing device, characterized in that, Applied to an electronic device, the electronic device including a data plane and a control plane, the device includes: The data plane management module is used to determine the identity features and behavioral features corresponding to the first message to be processed when the data plane receives the first message to be processed through the zero-trust security tunnel. The behavioral features include static behavioral features and dynamic behavioral features. The static behavioral features include unencrypted information in the first message to be processed, and the dynamic behavioral features include statistical features of the data stream corresponding to the identity features. The module decrypts the first message to be processed using the target key information corresponding to the zero-trust security tunnel to obtain a second message to be processed after decryption, and sends the identity features and behavioral features to the control plane. The data plane management module is used to determine the routing action of the second packet to be processed based on the first forwarding policy if the data plane has a first forwarding policy that matches the identity feature; if the data plane does not have a first forwarding policy that matches the identity feature, determine the routing action of the second packet to be processed based on the behavior feature; and operate on the second packet to be processed based on the routing action. The control plane management module is used to, upon receiving identity features and behavioral features sent by the data plane through the control plane, determine a second forwarding strategy matching the identity features based on the behavioral features, update the second forwarding strategy to the data plane, and then determine the routing action for subsequent packets to be processed based on the second forwarding strategy through the data plane; wherein, the second forwarding strategy is determined based on a fingerprint trust score and / or a model-predicted trust score, the fingerprint trust score being the score corresponding to the behavioral features in a fingerprint database, and the predicted trust score being the score obtained by inputting the behavioral features into a network model.

9. The apparatus according to claim 8, characterized in that, When the data plane management module determines the routing action for the second packet to be processed based on the behavioral characteristics, it specifically performs the following: determining whether the second packet to be processed is an abnormal packet based on the behavioral characteristics; if so, determining the routing action as a blocking action or a security isolation action; if not, allocating a first trust score to the second packet to be processed, determining an adjustment score based on the behavioral characteristics, adjusting the first trust score based on the adjustment score to obtain a second trust score; and determining the action corresponding to the second trust score as the routing action; wherein, if the behavioral characteristics match a scoring strategy, the adjustment score is increased, and if the behavioral characteristics match a deduction strategy, the adjustment score is decreased; the fingerprint database includes a correspondence between behavioral characteristics and fingerprint trust scores, behavioral characteristics with fingerprint trust scores greater than a first threshold are used to obtain scoring strategies, and behavioral characteristics with fingerprint trust scores less than a second threshold are used to obtain deduction strategies, where the second threshold is less than the first threshold; Alternatively, when the data plane management module determines whether the second message to be processed is an abnormal message based on the behavioral characteristics, it is specifically used to: if the behavioral characteristics include a flag bit and the flow state of the FSM, then determine the first state of the data stream based on the flow state of the FSM, and determine the second state of the second message to be processed based on the flag bit; wherein, the flow state of the FSM represents the state of the last message to be processed corresponding to the data stream, and the flag bit represents the state of the second message to be processed; Based on the first state, the expected transfer state is determined; if the second state is the expected transfer state, then the second message to be processed is determined not to be an abnormal message; if the second state is not the expected transfer state, then the second message to be processed is determined to be an abnormal message. Alternatively, when the control plane management module determines the second forwarding strategy based on the fingerprint trust score and / or the model-predicted trust score, it specifically performs the following: if the fingerprint database includes the fingerprint trust score corresponding to the behavioral feature, then determine the target trust score based on the fingerprint trust score; or, determine the target trust score based on the fingerprint trust score and the predicted trust score; or, determine the target trust score based on the fingerprint trust score, the predicted trust score, and the acquired authentication trust score; if the fingerprint database does not include the fingerprint trust score corresponding to the behavioral feature, then determine the target trust score based on the predicted trust score; or, determine the target trust score based on the predicted trust score and the authentication trust score; determine the forwarding strategy corresponding to the target trust score as the second forwarding strategy, the second forwarding strategy being used to indicate that the routing action is a blocking action, a security isolation action, or a forwarding action; wherein, if the second packet to be processed includes encrypted and integrity-protected verification information, then determine the authentication trust score based on the verification information; wherein, if the verification information indicates that the security of the second packet to be processed is higher, then the authentication trust score is larger; Alternatively, the network model includes a basic temporal anomaly detection model, a deep temporal anomaly detection model, and an entity interaction topology analysis model. When the control plane management module obtains the predicted trust score, it specifically performs the following: if a second pending message is received from the data plane via the control plane, the second pending message is input into the basic temporal anomaly detection model to obtain a basic temporal trust score; wherein, if the routing action of the second pending message is a blocking action or a security isolation action, the data plane sends the second pending message to the control plane; the behavioral features are input into the deep temporal anomaly detection model to obtain a deep temporal trust score; the behavioral features and associated behavioral features are input into the entity interaction topology analysis model to obtain an entity interaction trust score, wherein the associated behavioral features are the behavioral features of the associated data streams of the data streams; a weighted operation is performed on the basic temporal trust score, the deep temporal trust score, and the entity interaction trust score to obtain the predicted trust score; or, a weighted operation is performed on the deep temporal trust score and the entity interaction trust score to obtain the predicted trust score. Alternatively, the control plane management module is further configured to, after obtaining the target trust score, determine the key information to be updated corresponding to the zero-trust secure tunnel based on the target trust score; wherein, if the target trust score is less than a third threshold, the key information to be updated is first key information, and the encryption level of the first key information is greater than the encryption level of the target key information; if the target trust score is greater than a fourth threshold, the key information to be updated is second key information, and the encryption level of the second key information is less than the encryption level of the target key information; the fourth threshold is greater than the third threshold; and the first key information or the second key information is sent to the data plane to update the target key information of the zero-trust secure tunnel through the first key information or the second key information; Alternatively, the control plane management module is further configured to, after obtaining the target trust score, update the target trust score to the fingerprint trust score corresponding to the behavioral feature, add a data item to the fingerprint database, record the correspondence between the behavioral feature and the fingerprint trust score through the data item, configure an expiration time for the data item, and delete the data item from the fingerprint database when the data item is determined to be expired based on the expiration time.

10. An electronic device, characterized in that, include: A processor and a machine-readable storage medium, the machine-readable storage medium storing machine-executable instructions that can be executed by the processor; The processor is configured to execute machine-executable instructions to implement the method of any one of claims 1-7.

Images