Dynamic access control method based on zero trust and continuous behavior assessment

Abstract

The application relates to the technical field of network security and access control, and discloses a dynamic access control method based on zero trust and continuous behavior assessment, which comprises the following steps: a control surface module collects network flow logs to calculate interface transition probabilities and generate a state transition probability matrix; an authentication module issues an initial access token carrying a zero trust behavior context to a client; a proxy module intercepts network request messages, analyzes the zero trust behavior context, generates verification decoy data, and after determining that the input parameters do not contain the verification decoy data, queries an effective transition probability in the state transition probability matrix in combination with a concurrent state vector, calculates degraded credit points, triggers hierarchical routing control according to the degraded credit points, generates new zero trust behavior context, injects the new zero trust behavior context into a response message, and issues the response message; and the client receives the message, performs state merging, calculates a final merged behavior context, and solves the centralized state maintenance bottleneck and evaluation delay problem.

Description

Technical Field

[0001] This invention relates to the field of network security and access control technology, specifically a dynamic access control method based on zero trust and continuous behavior assessment. Background Technology

[0002] Existing access control methods typically rely on static token verification mechanisms. After the client obtains an access token, the server-side verification mainly focuses on the token's structural validity and expiration date, lacking continuous monitoring of the client's subsequent API call history. This approach makes it impossible for the system to track and identify abnormal API redirection behavior after token issuance, hindering continuous verification of the legitimacy of API access paths.

[0003] To achieve continuous behavior evaluation, some systems adopt a centralized behavior analysis architecture, with a centralized server responsible for recording and analyzing the context state of all network requests. However, in high-concurrency network environments, this approach requires the server to maintain global state data, creating a state maintenance bottleneck. Centralized data processing and state storage incur high communication and computational overhead, resulting in behavior evaluation latency and impacting the efficiency of the request chain.

[0004] Furthermore, existing defenses against automated crawling and abnormal API traversal behaviors are mostly based on fixed request frequency limits or static rules for interception. Due to the lack of dynamic decoy injection mechanisms and reputation degradation handling logic, the system cannot proactively identify probing behaviors by comparing request parameters, nor can it implement hierarchical routing interception interventions such as shadow field injection into response messages, resulting in insufficient dynamic blocking capabilities. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a dynamic access control method based on zero trust and continuous behavior evaluation. This method solves the problems of traditional access control methods, such as difficulty in identifying abnormal interface call trajectories in real time after token issuance, and the bottlenecks in evaluation delay and state maintenance in centralized behavior analysis.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a dynamic access control method based on zero trust and continuous behavior assessment, comprising the following steps: The control plane module collects historical network traffic logs, calculates interface transition probabilities, and generates a state transition probability matrix compressed into a hash table structure. The authentication module issues an initial access token to the client carrying a zero-trust behavior context; The client sends a network request message to the target microservice node carrying the initial access token; The proxy module intercepts the network request message, parses the zero-trust behavior context, and then generates verification decoy data; After determining that the input parameters of the network request message do not contain the verification decoy data, the proxy module queries the state transition probability matrix in conjunction with the concurrent state vector to obtain the effective transition probability. The agent module calculates the corresponding non-linear penalty deduction based on the effective transfer probability to dynamically decay the credit score value and calculate the downgraded credit score. The proxy module triggers hierarchical routing control based on the downgraded reputation score to implement dynamic access control and generates a new zero-trust behavior context; The proxy module injects the new zero-trust behavior context into the business response message to perform the distribution operation; The client's interceptor receives a response message containing the new zero-trust behavior context and performs a state merging calculation to derive the final merged behavior context for the next network access call.

[0007] Preferably, the step of the control plane module collecting historical network traffic logs to calculate interface transition probabilities and generating a state transition probability matrix compressed into a hash table structure specifically includes: The control plane module extracts the interface Uniform Resource Identifier from the historical network traffic logs and uses a non-cryptographic hash function to map the interface Uniform Resource Identifier to a fixed-length interface hash digest. The control plane module sorts the interface hash digests within the same network session in ascending order based on timestamps to generate an interface call sequence chain within a single session; The control plane module counts the transition frequency between different interface hash digests in all the interface call time chains, and calculates the corresponding interface transition probability through a statistical algorithm that estimates the transition probability based on the frequency. The control plane module compresses the state transition probability matrix, which contains all interface transition probabilities, into a two-dimensional hash table structure.

[0008] Preferably, the step of the authentication module issuing an initial access token carrying a zero-trust behavior context to the client specifically includes: After the authentication module verifies the client, it constructs the zero-trust behavior context in memory, which consists of four data fields: behavior reputation score, concurrent state vector, decoy context, and monotonic timestamp. The authentication module uses a standardized data exchange format to serialize and encode the zero-trust behavior context, generating an encoded data string. The authentication module injects the encoded data string into the extended payload area of ​​the standard JSON Web Token and uses the private key to encrypt the entire token content to generate a digital signature. The authentication module uses the digital signature to complete the assembly and independently issues the initial access token to the client, carrying the zero-trust behavior context.

[0009] Preferably, the step of the client sending a network request message to the target microservice node carrying the initial access token specifically includes: The client responds to the user's business operation command on the front-end interface and retrieves the initial access token stored locally; The client's interceptor fully loads the initial access token into a custom extension header of the Hypertext Transfer Protocol; After the client completes the dynamic assembly and filling of the header data, it uses the custom extended header containing the initial access token to carry and send the network request message.

[0010] Preferably, the steps of the proxy module intercepting the network request message, parsing the zero-trust behavior context, and generating verification decoy data specifically include: The proxy module intercepts the network request message, extracts the zero-trust behavior context contained in the network request message, and parses out the monotonic timestamp; The proxy module obtains the local current time and calculates the request time difference between the local current time and the monotonic timestamp to complete the anti-replay verification. After completing the anti-replay verification, the proxy module decrypts and extracts the pseudo-random seed from the zero-trust behavior context; The proxy module combines the pseudo-random seed with the hash digest of the target microservice node and uses the verification decoy generation formula to calculate and generate the verification decoy data.

[0011] Preferably, the step of the proxy module determining that the input parameters of the network request message do not contain the verification decoy data, and querying the state transition probability matrix in conjunction with the concurrent state vector to obtain the effective transition probability specifically includes: The proxy module performs a traversal scan of the data body and general query parameters of the network request message, and performs a string pattern comparison between the data body and general query parameters and the verification decoy data; After determining that the input parameters of the network request message do not contain the verification decoy data, the proxy module iterates through and extracts each historical microservice interface summary in the concurrent state vector, and combines the historical microservice interface summary with the current target interface summary to form an address key. The proxy module uses the address key to search the state transition probability matrix and obtain the corresponding basic transition probability; The proxy module uses the weighted effective transition probability calculation formula to derive and calculate the effective transition probability based on the basic transition probability.

[0012] Preferably, the step of the agent module calculating the corresponding nonlinear penalty deduction based on the effective transfer probability to dynamically decay the credit score value, and calculating the downgraded credit score specifically includes: The agent module extracts the current behavior reputation score from the zero-trust behavior context; The agent module combines the effective transfer probability and the behavioral reputation score into the reputation score downgrade formula to obtain the nonlinear reputation deduction amount; The agent module uses the nonlinear reputation deduction amount to introduce a maximum value function and the absolute zero threshold of the reputation score to truncate the lower limit, and calculates the downgraded reputation score.

[0013] Preferably, the step of the proxy module triggering hierarchical routing control to implement dynamic access control based on the downgraded reputation score and generating a new zero-trust behavior context specifically includes: The proxy module compares the downgraded reputation score with the multi-level security threshold range maintained internally by the system, triggering the hierarchical routing control. When the hierarchical routing control is triggered and the degradation conditions are met, the proxy module silently injects a shadow field into the node of the service response message. After the proxy module completes the injection of the shadow field, it generates a pseudo-random seed for a new period, executes the encryption process in the symmetric encryption algorithm, and encapsulates the updated decoy context. The proxy module structurally concatenates the downgraded reputation score, the concurrent state vector processed by the time window elimination mechanism, the updated decoy context, and the monotonic timestamp representing the current server physical time to generate the new zero-trust behavior context. The multi-level security threshold range includes a physical blocking threshold and a degradation observation threshold, which are used to implement intervention strategies of different granularities for the current network request during numerical comparison.

[0014] Preferably, the step of the proxy module injecting the new zero-trust behavior context into the service response message to perform the delivery operation specifically includes: The proxy module performs hash message authentication code calculation on the overall byte stream of the newly generated zero-trust behavior context to generate an anti-tampering identifier; The proxy module appends the anti-tampering identifier to the end of the data of the new zero-trust behavior context to generate a new zero-trust behavior context carrying an anti-tampering signature; The proxy module uses the Base64Url secure encoding format to encode the new zero-trust behavior context carrying the tamper-proof signature, injects the converted payload into the custom hypertext transfer protocol extension header of the reconstructed business response message, and performs the distribution operation.

[0015] Preferably, the step of the client's interceptor receiving a response message containing the new zero-trust behavior context and performing state merging calculations to derive the final merged behavior context for the next network access call specifically includes: The client's interceptor receives the response message, parses the custom extended header fields, performs reverse decoding and deserialization parsing, and restores the byte stream to the structured new zero-trust behavior context. The interceptor extracts the old zero-trust behavior context from the local cache and the new zero-trust behavior context as joint input parameters, and performs state merging calculation to obtain the results of the calculation output of each dimension; The interceptor repackages the results calculated for each dimension, generating a fully structured final merging context for the next network access call.

[0016] This invention provides a dynamic access control method based on zero trust and continuous behavior evaluation. It has the following beneficial effects: 1. This invention extracts the interface call sequence chain by collecting historical network traffic logs through the control plane module, generates a state transition probability matrix compressed into a hash table structure, and retrieves the transition probability in the proxy module using the address key of the combination of historical and target interface digests, thereby realizing continuous verification of the client interface access link. This technical feature solves the problem that traditional methods cannot track the call trajectory after token issuance, and improves the accuracy of identifying abnormal interface jump behavior.

[0017] 2. This invention encapsulates the zero-trust behavior context, which includes fields such as concurrent state vectors, into the initial access token through the authentication module. Combined with the state merging calculation of the client interceptor and the local parsing calculation of the proxy module, a stateless context transmission mechanism is established. This technical feature allows the behavior evaluation calculation to be distributed in the request proxy chain, avoiding the global state storage of the centralized server and overcoming the state maintenance bottleneck and evaluation delay problems caused by centralized behavior analysis.

[0018] 3. This invention generates verification decoy data through a proxy module and compares it with network request input parameters. Combined with the downgraded reputation score calculated by the transition probability, it triggers hierarchical routing control and injects a shadow field into the response message to implement interception intervention. This technical feature provides a decoy injection and reputation downgrade processing logic, which improves the system's ability to dynamically block automated detection crawling and abnormal interface traversal behavior. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the operating environment and system architecture of one embodiment of the present invention; Figure 2 This is a general flowchart of an embodiment of the present invention; Figure 3 This is a dynamic decay curve of behavioral reputation score according to an embodiment of the present invention; Figure 4 This is a line graph showing the difference between system processing latency and concurrency in one embodiment of the present invention.

[0020] Among them, 100 is the client; 101 is the interceptor; 200 is the authentication module; 300 is the control plane module; 400 is the microservice node; and 500 is the proxy module. Detailed Implementation

[0021] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] To facilitate understanding of the technical solutions of this invention, the following unified definitions are provided for some proprietary technical terms used herein: A concurrent state vector is a data queue built based on a specific time window. It is specifically used to record the summary of historical microservice interfaces successfully called by the client within the specified time window and their call timestamps, serving as the basic input features for deriving the effective transition probability in multi-stream concurrent scenarios.

[0023] The decoy context refers to the core field in the zero-trust behavior context used to store pseudo-random seeds that have undergone symmetric encryption, aiming to provide dynamic verification credentials with anti-forgery and one-time characteristics for the current network session.

[0024] Shadow fields refer to hidden key-value pairs that are silently injected into the normal business response message data payload by the proxy module when a degradation intervention is triggered. They contain dynamically generated verification bait data, which is not destructive to legitimate front-end components, but can be used to accurately identify automated probing and indiscriminate crawling behaviors.

[0025] See attached document Figure 1 The present invention provides a dynamic access control method based on zero trust and continuous behavior assessment. The system architecture on which the method depends may include: client 100, authentication module 200, control plane module 300 and several microservice nodes 400 with proxy modules 500.

[0026] Client 100 is used to initiate Hypertext Transfer Protocol (HTTP) requests. Client 100 has an embedded interceptor 101, which is used to intercept and process network response messages.

[0027] The authentication module 200 communicates with the client 100 and is used to authenticate the client 100 and issue access tokens. The control plane module 300 is used to collect historical network traffic logs, calculate and generate a state transition probability matrix, and distribute the state transition probability matrix to each agent module 500.

[0028] Microservice node 400 carries the specific business logic code and provides interface services to the outside world. Proxy module 500 is deployed at the network boundary of microservice node 400 to intercept network requests flowing into microservice node 400 and execute access control logic and message modification operations in local memory.

[0029] The method provided by this invention implements state transitions by modifying the extended payload of a standard access token. The access token carries a zero-trust behavioral context. The zero-trust behavioral context contains four core data fields: behavioral reputation score, concurrent state vector, decoy context, and monotonic timestamp.

[0030] Behavioral reputation score is used to record the numerical trust score of the current network session. Concurrent state vector is a data queue built based on time windows, used to record the historical interface summaries and call times of client 100 successfully called within a preset time window.

[0031] The decoy context is used to store a pseudo-random seed that has been symmetrically encrypted. A monotonic timestamp records the server's physical time when the zero-trust behavior context is generated. The zero-trust behavior context is initialized by the authentication module 200 and flows between the client 100 and the proxy module 500 via a custom extended header in the Hypertext Transfer Protocol, ensuring the server operates statelessly.

[0032] See attached document Figure 2 This invention provides a dynamic access control method based on zero trust and continuous behavior assessment, comprising the following steps: S1, the control plane module 300 collects historical network traffic logs, calculates interface transition probabilities, and generates a state transition probability matrix compressed into a hash table structure; S2, the proxy module 500 receives and stores the state transition probability matrix; the authentication module 200 independently issues an initial access token carrying a zero-trust behavior context to the authenticated client 100. S3, Client 100 sends a network request message to the target microservice node 400 carrying the initial access token; S4, the proxy module 500 intercepts the network request message and parses the monotonic timestamp to complete the anti-replay verification. Then, it decrypts the decoy context to extract the pseudo-random seed and generates the verification decoy data. S5, after the proxy module 500 determines that the input parameters of the network request message do not contain the verification decoy data, it combines the concurrent state vector to query the state transition probability matrix to obtain the effective transition probability. S6, the agent module 500 calculates the corresponding non-linear penalty deduction based on the effective transfer probability to dynamically decay the credit score value and calculate the downgraded credit score. S7, the proxy module 500 triggers hierarchical routing control based on the downgraded reputation score, and adds a shadow field to the service response message when the downgrade conditions are met; S8, after completing the operation of appending the shadow field, the proxy module 500 encapsulates the updated decoy context and generates a new zero-trust behavior context, injects it into the response message header and returns it to the client 100; S9, the interceptor 101 of the client 100 receives a response message containing the new zero-trust behavior context for concurrency, and performs state merging calculation to derive the final merged behavior context for the next network access call.

[0033] The following section will provide a detailed explanation of the implementation details and system working mechanism of each of the above steps, taking into account specific application scenarios.

[0034] Regarding the specific implementation mechanism of the control plane module 300 collecting historical network traffic logs and calculating the interface transfer probability in the aforementioned step S1, this embodiment refines it into the following sub-steps with a logically progressive relationship.

[0035] In this process, as the foundation for building the behavioral baseline, in step S101, the control plane module 300 extracts the interface unified resource identifier and network session identifier from the historical network traffic logs. To define meaningful behavioral context, the control plane module 300 segments the continuous historical network traffic logs based on a preset silent timeout threshold or received explicit login / logout events, thereby establishing the effective time boundary for each independent network session. Through the above preprocessing operations, the extracted interface unified resource identifier can accurately map to the specific business function nodes of the microservice node 400, while the network session identifier is used to isolate concurrent requests from different clients 100, ensuring the causal correlation of the behavioral sequence. Considering the potential performance loss caused by long strings in subsequent high-frequency table lookup calculations, the control plane module 300 uses a non-cryptographic hash function to map the interface unified resource identifier to a fixed-length interface hash digest. For the specific engineering implementation of network traffic log collection and non-cryptographic hash function, those skilled in the art can combine existing service mesh monitoring components and use mechanisms such as the MurmurHash algorithm, which are well-known technologies in the field and will not be elaborated here. Based on the mapped lightweight data, the control plane module 300 timestamps the multi-source heterogeneous logs according to the network session identifier, and sorts the interface hash digests within the same network session in ascending order based on the timestamp, generating an interface call sequence chain within a single session.

[0036] After constructing the aforementioned single-session interface call sequence chain (i.e., basic sequence data), the system needs to establish a mathematical model that can objectively reflect the business flow pattern. As a preferred approach, the control plane module 300 establishes a behavioral state transition model based on the Markov chain's assumption of no aftereffect, that is, it assumes that the call probability of the current interface depends only on the preceding interface call state. Based on this general principle, in S102, the control plane module 300 counts the transition frequency between different interface hash digests in all interface call sequence chains, and calculates the corresponding interface transition probability using a statistical algorithm that estimates the transition probability based on frequency. Specifically, for any specified source interface hash digest and target interface hash digest, the numerical value of its interface transition probability is equal to the actual observation frequency of the transition from the source interface hash digest to the target interface hash digest, divided by the sum of the observation frequencies of the transition from the source interface hash digest to all adjacent interface hash digests.

[0037] To avoid division errors where the denominator approaches or equals zero when a specific interface acts as a session termination node, the control plane module 300 performs a non-zero check on the sum of observation frequencies of the source interface hash digest transitions to all adjacent interface hash digests before performing the calculation. If the sum of these observation frequencies is zero, the transition probability of the source interface hash digest to any target interface hash digest is directly assigned a minimum penalty constant.

[0038] Furthermore, considering that rare legitimate requests or malicious unauthorized probes may exist in real network environments but are not covered by logs, the control plane module 300 needs to smooth and compensate the matrix data obtained from the preliminary statistics. If no transfer record from the source interface hash digest to a specific target interface hash digest is observed in the historical network traffic logs, the control plane module 300 also assigns the interface transfer probability of that specific unknown transfer to a minimum penalty constant. The specific value of the minimum penalty constant is set to be less than the minimum interface transfer probability that occurs in normal business logic. In this embodiment, its preferred value range is limited to 0.0001 to 0.001. The technical purpose of introducing this constant is to ensure that the weight assigned by the system when facing unknown call links is strictly lower than that of any known extremely low-frequency legitimate links, thereby triggering severe integral degradation in subsequent evaluations and achieving convergent security protection.

[0039] After completing the calculation and smoothing compensation of the full probability data, the key to system implementation lies in efficiently distributing this massive baseline data and applying it to real-time interception. To this end, in step S103, the control plane module 300 compresses the state transition probability matrix containing all interface transition probabilities into a two-dimensional hash table structure. The control plane module 300 uses a combined key composed of the source interface hash digest and the target interface hash digest as the addressing key of this two-dimensional hash table, and uses the corresponding interface transition probability or minimum penalty constant as the data value of the two-dimensional hash table. Subsequently, the control plane module 300 pushes the state transition probability matrix, compressed into a two-dimensional hash table structure, to all agent modules 500 for local memory persistence via an asynchronous communication channel. This hash table structure enables the agent modules 500 to perform memory read operations with constant time complexity, avoiding the storage waste and multiple loop addressing delays caused by sparse matrices in traditional matrix operations. This allows the system to efficiently complete online session table lookups without incurring external network input / output overhead.

[0040] Regarding the specific implementation mechanism of the initialization of the zero-trust behavior context and the preparation of in-band flow in the aforementioned steps S2 and S3, this embodiment refines it into the following sub-steps with a logically progressive relationship.

[0041] In this embodiment, after completing the baseline data construction, the system needs to transform the static defense rules into dynamic running states. S201, the proxy module 500 receives the state transition probability matrix, compressed into a two-dimensional hash table structure, pushed by the control plane. To avoid external network input / output overhead when handling high-concurrency business traffic, the proxy module 500 allocates an independent data resident area in the memory space of its local process. Based on read-write locks or lock-free concurrency control mechanisms, the proxy module 500 receives and stores the state transition probability matrix in this resident area. The technical purpose of introducing lock-free concurrency control mechanisms is to ensure that, in high-throughput, high-concurrency microservice request scenarios, multiple worker threads can safely and non-blockingly read the probability data, preventing request queuing delays caused by lock contention. For the specific engineering implementation of local memory resident and concurrent read / write, those skilled in the art can combine existing inter-process communication or shared memory mechanisms, which are well-known technologies in the field and will not be elaborated here. This localized loading method, which pushes centralized decision data down to edge nodes, effectively avoids the network latency caused by initiating remote procedure calls to the control plane module 300 every time a business call is made, thus laying the architectural foundation for sub-millisecond access control within the microservice mesh.

[0042] Based on the establishment of the aforementioned localized defense foundation, when a user device initiates a login or identity verification request, the system needs to establish a trust anchor point that accompanies the entire session lifecycle. S202, the authentication module 200 performs routine credential verification on the client 100. After successful verification, to support the stateless continuous behavior evaluation of subsequent proxy nodes, the authentication module 200 begins constructing a zero-trust behavior context in memory. In this embodiment, this context serves as the core data carrier, specifically consisting of four data fields: behavior reputation score, concurrent state vector, decoy context, and monotonic timestamp. The physical reason for selecting these four data fields as input parameters is as follows: the behavior reputation score is used to quantify the current trust state; the concurrent state vector is used to track historical call trajectories within a short time window as input features for behavior state transitions; the decoy context is used to construct deterministic anti-forgery traps against automated detection tools; and the monotonic timestamp serves as an objective physical benchmark for timing alignment and replay attack prevention.

[0043] As a preferred initialization method, the authentication module 200 assigns a preset system maximum score to the behavioral reputation score. In this embodiment, the maximum score is preferably set to 100, serving as the baseline pool for subsequent score decay, and establishing the highest trust state in the initial stage of the session using a list-based session signature. For the concurrent state vector, considering that no actual business interface calls have occurred yet, the authentication module 200 initializes it as an empty data queue containing no elements. For the decoy context, the system calls a cryptographically secure pseudo-random number generator to generate an initial pseudo-random seed, encrypts it using a system-preset symmetric encryption key, and stores it in this field. The physical causality of this initialization assignment is to ensure that the first network request, upon reaching the proxy module 500, can successfully pass the subsequent decryption verification process, thereby ensuring that the anti-forgery security baseline is not lost in the initial stage of the session. Meanwhile, considering the common physical node clock drift problem in distributed microservice architectures, the authentication module 200 obtains high-precision physical time by calling a high-precision clock interface based on a precise time protocol for cluster synchronization, instead of using a regular wall clock. This high-precision physical time is used as the initial value for a monotonic timestamp, which is a globally uniformly aligned microsecond or nanosecond value. This timestamp will serve as an objective comparison benchmark to prevent client-side replay attacks using old tokens, ensuring the strict monotonically increasing nature of the time series and avoiding false interceptions in subsequent verifications due to network node time synchronization errors.

[0044] After assigning the core fields to memory, the authentication module 200 serializes and encodes the zero-trust behavior context using a standardized data exchange format. Then, the authentication module 200 injects the encoded data string into the extended payload area of ​​the standard JSONWeb Token. To prevent malicious tampering of the baseline behavior data by the client locally, the authentication module 200 generates a digital signature for the entire token content, including the extended payload, using the private key of an asymmetric encryption algorithm. After assembly, the authentication module 200 independently issues an initial access token carrying the zero-trust behavior context to the authenticated client 100.

[0045] After obtaining the session credentials containing the aforementioned multi-dimensional security states, regular data interaction on the business side officially begins. S301, after receiving and securely persisting the initial access token, client 100 responds to user business operation instructions from the front-end interface and prepares to send request data to the network side. Before actually initiating the network call, the interceptor 101 running internally on client 100 performs low-level interception operations on the native Hypertext Transfer Protocol request.

[0046] In the intercepted state, interceptor 101 extracts the initial access token from local storage and fully loads it into the custom extension header of the Hypertext Transfer Protocol. The underlying network implementation for appending request header data can be accomplished by those skilled in the art using existing network request library native interceptor interface mechanisms; this is well-known technology in the field and will not be elaborated upon here.

[0047] After completing the dynamic assembly and filling of the header data, client 100 sends a network request message to the target microservice node 400 carrying the initial access token. Based on the above steps, the system transfers the session behavior state, which should have been centrally stored on the server, to the client, thereby ensuring continuous behavior tracking capabilities while eliminating the strong dependence of the microservice cluster on state storage components such as distributed caches, and realizing closed-loop preparation for stateless dynamic access control.

[0048] Regarding the specific implementation mechanism of anti-replay verification and decoy reconstruction based on local caching in step S4 mentioned above, this embodiment refines it into the following sub-steps with a logically progressive relationship.

[0049] In this embodiment, when a network request message arrives at the server, the proxy module 500 needs to perform critical authentication and state interception operations. S401, the proxy module 500 listens to the corresponding network port and intercepts the network request message, which is sent from the client 100 to the target microservice node 400. Based on the parsing of the Hypertext Transfer Protocol (HTTP) message header, the proxy module 500 extracts the zero-trust behavior context contained therein and parses out the monotonic timestamp. The purpose of introducing the monotonic timestamp is that its value is strictly based on the monotonically increasing high-precision timer of the underlying hardware, unaffected by time calibration by the operating system through the network time protocol or manual rewinding of the clock time, thereby ensuring the objectivity and tamper-proof nature of time sequence verification among distributed nodes. The specific engineering implementation of the HTTP message header parsing and data deserialization can be completed by those skilled in the art using existing network proxy frameworks; it is a well-known technology in the field and will not be elaborated upon here.

[0050] To ensure the system can withstand network attacks that intercept and resend legitimate requests, the system employs a two-dimensional anti-replay judgment logic based on time and space, using a general defense principle that combines time-series windows and state records. As a preferred method, in step S402, the proxy module 500 obtains the local current monotonic time using a local high-precision synchronized clock and calculates the request time difference between it and the monotonic timestamp. Considering that the aforementioned monotonic timestamp uses microsecond or nanosecond precision, the proxy module 500 needs to perform unit conversion on the request time difference after calculation, uniformly converting it to a value in seconds. The physical meaning of the above time difference calculation is to quantify the absolute physical time span experienced by the message from the generation of the client 100 to its interception by the proxy module 500.

[0051] Furthermore, considering the potential for minor timing errors or client time anomalies in a distributed system, if the converted request time difference is less than zero, the system determines it to be an abnormal future timestamp and directly intercepts it. If the request time difference is greater than or equal to zero, the proxy module 500 compares it with a global anti-replay time window threshold. The specific value range of the global anti-replay time window threshold is preferably set between 3 and 10 seconds. This value is determined primarily based on considerations of normal end-to-end network transmission latency in a mobile network environment and the processing jitter of the microservice gateway. If the request time difference is greater than the global anti-replay time window threshold, it indicates that the packet has been delayed in the network link for too long or is a maliciously collected old packet being retransmitted; the proxy module 500 directly blocks and discards the request.

[0052] A single time-dimensional check cannot prevent dense concurrent retransmissions within the effective time window. Therefore, in addition to satisfying the time window check, the proxy module 500 introduces a local cache table built based on the Least Recently Used (LRU) algorithm for spatial dimension check. The proxy module 500 extracts the digital signature carried by the current request as a unique feature value and searches it in the local LRU cache table. If the search matches, it means that the exact same request has been received within the time window, and the proxy module 500 determines it as a replay attack and intercepts it. If it does not match, the proxy module 500 writes the digital signature feature value into the cache table for subsequent requests to check for duplicates. Through dual time and spatial checks, the proxy module 500 completes the anti-replay verification. The LRU local cache table mechanism avoids the network communication overhead and single point of failure risk of using a centralized caching component, and also ensures the boundedness of memory usage by eliminating expired feature values, preventing the proxy module 500 from experiencing memory overflow.

[0053] After completing the anti-replay verification, the system enters the decoy data reconstruction phase for automated probing behavior. This phase is based on the salted hash principle in cryptography and aims to generate dynamic verification data for the current session. In step S403, the proxy module 500 extracts the encrypted decoy context from the zero-trust behavior context. Using the same symmetric encryption key pre-installed in the memory of each node during system initialization, the proxy module 500 then decrypts the decoy context and extracts the pseudo-random seed. If the decryption process throws an exception or a checksum error, it indicates that the client 100 is attempting to tamper with the decoy payload, and the proxy module 500 will directly terminate the current session.

[0054] Based on the extracted underlying pseudo-random factor, the system needs to generate a verification defense adapted to the current interface. The pseudo-random seed and the hash digest of the target microservice node are chosen as input parameters because the former provides the dynamic random entropy at the current session level, while the latter limits the specific spatial range of the current request; their combination enables precise behavior binding. The proxy module 500 extracts the hash digest of the most recent historical microservice node (i.e., the target node of the previous network request) recorded in the concurrent state vector; if the concurrent state vector is empty (i.e., the current request is the initial access request of a network session), the system's preset global gateway default hash digest is extracted as a substitute. Subsequently, the proxy module 500 uses the verification decoy generation formula to calculate and generate verification decoy data. The verification decoy generation formula is: ; in, This indicates the verification of decoy data; Represents a one-way cryptographic hash function; Indicates a pseudo-random seed; This represents the string concatenation operator; This represents the hash digest of the most recent historical microservice node. By hash-binding a dynamically circulating pseudo-random seed with the static hash digest of the historical microservice node, verification decoy data is generated, ensuring that each decoy value is valid within a specific request context and a specific microservice node. This multi-dimensional cryptographic combination limits the possibility of attackers reusing decoys across interfaces, giving the verification decoy data a dynamic defense characteristic of being strongly bound to the interface once, providing a deterministic verification benchmark for subsequent security scanning of request parameters.

[0055] Regarding the specific implementation mechanism of deterministic overreach determination and state validity query in step S5 mentioned above, this embodiment refines it into the following sub-steps with a logically progressive relationship.

[0056] In this embodiment, after completing the anti-replay verification and decoy reconstruction operations, the system needs to perform a deep scan of the application-level parameter payload. S501, the proxy module 500 performs a traversal scan of the data body and general query parameters of the network request message, comparing them with the locally calculated verification decoy data using string patterns. Based on normal business processing logic, legitimate front-end applications, lacking extraction code for specific underlying extended fields, will not carry such hidden decoy data in subsequent requests when parsing and processing business responses. If the system finds the same verification decoy data in the current parameter payload, it proves that the current client 100 is in an automated execution sequence of blindly capturing and replaying all parameters.

[0057] Faced with the aforementioned abnormal operating conditions, in response to S502, the proxy module 500 triggers a blocking mechanism, forcibly severing the current Transmission Control Protocol (TCP) connection and discarding related network request packets. Through this decision-making logic, the proxy module 500 directly intercepts probe traffic initiated by the automated vulnerability scanner at the gateway edge, effectively reducing the unnecessary computational load on the target microservice node 400.

[0058] After filtering deterministic abnormal traffic, the proxy module 500 determines that the input parameters of the network request packet do not contain verification decoy data. It then uses the concurrent state vector to query the state transition probability matrix to derive the effective transition probability. S503, considering that modern front-end applications commonly employ component-based asynchronous resource acquisition mechanisms, the calls initiated by client 100 exhibit a multi-stream concurrent pattern on the timeline. Relying solely on a single, recent call record as the evaluation benchmark could easily lead to biased evaluation results and misjudgments. The physical reason for choosing all elements of the concurrent state vector as input parameters is that any historical interface within a specific concurrent time window may, objectively, have a reasonable business flow correlation with the current target interface.

[0059] To avoid data omissions in multidimensional state evaluation, as a preferred approach, the proxy module 500 first determines whether the concurrent state vector is empty. If empty, it indicates a valid initial call, and the effective transition probability is directly assigned a value of 1. If not empty, the proxy module 500 iterates through and extracts the summary of each historical microservice interface in the concurrent state vector, combines it with the current target interface summary to form an address key, and searches for it sequentially in the locally resident state transition probability matrix. Considering the inherent sparsity of discrete state transition data, if a specific address key is not found in the matrix, the proxy module 500 assigns a preset minimum value to the corresponding basic transition probability. In this embodiment, the minimum value is preferably limited to 0.001, to represent a weak transition probability that has not been collected but has theoretical feasibility, thereby ensuring the completeness of the subsequent weighted calculation matrix data.

[0060] Through the aforementioned retrieval and fallback mechanisms, the agent module 500 obtains a set of discrete basic transition probabilities. Based on the technical principle that closer temporal distances indicate higher correlation, the system introduces a time-dimensional smoothing weighted algorithm. The agent module 500 uses the weighted effective transition probability calculation formula to derive a judgment index with a global perspective. The weighted effective transition probability calculation formula is as follows: ; in, Indicates the effective transition probability; Represents the total number of elements in the concurrent state vector; This represents the summation operator, used to indicate the summation from the index. Traverse to total The terms are summed mathematically. Indicates the corresponding first One basic transition probability; Indicates the first The time decay weight is specifically calculated using the natural constant as the base and the negative exponent of the product of the difference between the current system time and the time the record was generated and the system's preset decay constant. Indicates the first The basic transition probability and the first A weighted product of time decay weights; This represents the sum of weighted products derived from all historical records; This represents the sum of time decay weights derived from all historical records; This represents the local minimum smoothing factor.

[0061] To ensure the integrity of the underlying computational logic, in the aforementioned division operation structure, extremely small time differences in a concurrent environment may cause all weighted calculation results to underflow to zero in the computer's floating-point representation. Therefore, a minimum smoothing factor is introduced into the denominator, preferably limited to a range of 0.0001 to 0.001. This threshold is determined because it effectively compensates for the gap caused by floating-point precision truncation, avoiding division crashes caused by the denominator approaching or being zero at the code execution level. The physical meaning of the above computational logic is that it projects discrete and parallel asynchronous concurrent requests onto the time profile of the current request, and through time-weighted fusion of the statistical support of multiple potentially legitimate business flows, outputs a more robust mathematical expectation value.

[0062] Based on the completion of multi-dimensional verification of network request packets and extraction of effective transition probabilities in step S6 above, the system then enters the dynamic update phase of session-level trust state. This embodiment is based on the core defense principles of continuous verification and dynamic degradation, aiming to adjust the historically accumulated trust level in real time according to the probabilistic characteristics of a single request.

[0063] In this embodiment, the agent module 500 extracts the behavioral reputation score from the zero-trust behavior context. This score, as a key quantitative indicator, directly records the numerical trust score of the current network session since its establishment. The selection of effective transition probability and behavioral reputation score as joint evaluation input parameters is based on the following causal relationship: the former accurately measures the statistical expectation of the legitimacy of a single network action, while the latter carries a long-term historical behavioral baseline. The combination of the two effectively avoids drastic fluctuations in trust values ​​caused by single network delays or harmless operations, thereby achieving a smooth dynamic reputation assessment with long-term memory characteristics.

[0064] To avoid penalty distortion caused by relying solely on a single linear ratio in multidimensional state assessment, the system introduces an asymmetric decay mathematical model. As a preferred approach, in step S601, the agent module 500 calculates the downgraded reputation score by reducing the behavioral reputation score value based on the effective transition probability. To avoid over-penalizing high-probability legitimate requests while ensuring fast non-linear degradation for low-probability anomaly detections, the agent module 500 uses a reputation score degradation formula for calculation. The reputation score degradation formula is as follows: ; in, This indicates a downgrade in credit score; This function represents the maximum value and is used to return the larger of the two values ​​within the parentheses. This indicates an absolute zero threshold for credit scores; Indicates behavioral reputation score; Indicates the base penalty coefficient; This represents the effective transition probability derived in the preceding stage. Indicates the nonlinear amplification index; This represents the degree of abnormal deviation calculated by inverting the probability. This represents the non-linear reputation deduction that is ultimately applied to the current request.

[0065] For the preset control parameters in the above calculation model, the specific value range of the basic penalty coefficient is preferably limited to a constant between 10 and 50. This value is determined primarily by considering the system's tolerance limit for a single extremely high-risk behavior, combined with the proportional relationship of the overall initial reputation quota for the session. The specific value range of the nonlinear amplification index is preferably limited to an integer between 2 and 4, thereby constructing a clear parabolic penalty boundary in mathematical space.

[0066] To ensure the completeness of the algorithm logic during low-level computation, and considering the potential for minor precision errors introduced by the pre-calculation of floating-point weighted numbers, the proxy module 500 performs interval truncation on the effective transition probability before substituting it into the formula. Specifically, the system employs a branchless nested boundary extremum function, which first calculates the smaller value between the given value and 1, then calculates the larger value between the result and 0, thus forcibly normalizing it to a closed interval between 0 and 1. This detailed operation effectively prevents negative bases for abnormal deviations and avoids low-level errors caused by exponential operations. Simultaneously, by introducing a maximum value function and a reputation score absolute zero threshold for lower-level truncation, the system avoids negative scores due to continuous non-linear deductions at the code execution level, thereby preventing memory overflow and other logical crashes caused by the propagation of negative scores downstream.

[0067] The physical meaning of the aforementioned nonlinear degradation logic is that when the effective transfer probability approaches 1, it indicates that the current interface call highly conforms to the historical baseline. At this point, the calculated abnormal deviation approaches 0, causing the nonlinear reputation deduction to shrink exponentially, meaning that normal business processes will hardly damage session reputation. Conversely, when the effective transfer probability approaches 0, the penalty term is exponentially amplified, causing the degradation reputation score to decay more rapidly. This asymmetric dynamic decay mechanism accurately maps the objective physical law of slow trust accumulation and sensitive risk penalties in real-world cybersecurity scenarios.

[0068] S602, after completing the above mathematical derivation and numerical overflow prevention verification, the agent module 500 temporarily stores the output downgraded reputation score in the local cache. This value will directly replace the old score status and serve as the unique deterministic quantification benchmark for the agent module 500 to trigger hierarchical routing control in subsequent stages, and to add a shadow field to the service response message when the downgrade conditions are met.

[0069] Based on the dynamic update of the trust state in step S7, the system enters the access control execution and response reconstruction phase. This embodiment is based on the defense principle of multi-level security thresholds, aiming to implement intervention strategies of different granularities for the current network request according to the quantified trust indicators.

[0070] S701, in this embodiment, the agent module 500 extracts the calculated downgraded reputation score and compares it with the multi-level security threshold range maintained internally by the system, thereby triggering the corresponding hierarchical routing control. When the downgraded reputation score falls below the preset physical blocking threshold, the agent module 500 immediately cuts off the current connection at the network layer; when the score is within the normal baseline range, the system will maintain the communication link connection and transmit service data normally. In the intermediate state where the downgraded reputation score is lower than the preset downgrade observation threshold but still higher than the physical blocking threshold, the agent module 500 triggers hierarchical routing control based on the downgraded reputation score, and adds a shadow field to the service response message when the downgrade conditions are met. At this time, the system neither directly blocks communication nor provides a fully transparent normal response, but directs the control flow to the induced observation branch. For the above security thresholds, the physical blocking threshold is preferably limited to 30 to 40 points, and the downgrade observation threshold is preferably limited to 70 to 80 points. The determination of this value range is based on a comprehensive consideration of the high-frequency probing characteristics of common vulnerability scanners and the probability distribution of occasional retries by normal clients due to network fluctuations.

[0071] S702, upon confirming that the degradation conditions are met, the proxy module 500 first allows the current network request packet to pass and forwards it to the target microservice node 400. After receiving the business response packet returned by the target microservice node 400, to ensure that the append operation does not structurally damage the existing business logic of the front-end application, as a preferred approach, the proxy module 500 performs structured parsing on the data payload of the business response packet. Based on the parsed hierarchical structure, the proxy module 500 assigns key-name identifiers with conventional business deception in the root node or outer object set of the payload. Combining the newly generated pseudo-random seed with the hash digest of the current target microservice node, the proxy module 500 uses the aforementioned verification decoy generation formula to calculate high-information-entropy verification decoy data as the data value, and silently injects it into the node in the form of key-value pairs. This non-destructive append structure causes the legitimate client 100 to automatically ignore and discard the shadow field when performing object-oriented data deserialization because the data model lacks the corresponding attribute definition. Conversely, automated detection programs lacking structure awareness typically employ a strategy of indiscriminate full extraction and direct reuse, thereby transmitting the data back in subsequent network sessions and triggering feature verification mechanisms. The physical reason for choosing this high-entropy appending strategy is that by embedding dynamic security detection identifiers into legitimate business payloads, an unforgeable physical comparison benchmark can be provided for the deterministic determination of unauthorized access in subsequent network requests. Regarding the underlying generation logic of pseudo-random strings, those skilled in the art can implement it using a standard cryptographically secure pseudo-random number generator combined with a time factor; the acquisition of randomness is a well-known technique in the field and will not be elaborated upon here.

[0072] Regarding the specific implementation mechanism of the proxy module 500 encapsulating and updating the decoy context, generating a new zero-trust behavior context, and injecting it into the response message in step S8, this embodiment refines it into the following logically progressive sub-steps. In this embodiment, after the proxy module 500 completes the multi-dimensional access control intervention and response payload modification, it must comprehensively refresh and reorganize the security state parameters of the current network session to maintain the continuous behavior flow closed loop under the stateless architecture.

[0073] S801, after completing the preliminary hierarchical routing control and possible shadow field appending operations, the proxy module 500 encapsulates the updated decoy context and generates a new zero-trust behavior context. To support the secure continuity under the stateless architecture of the server, the proxy module 500 initiates the context packaging and rewriting process. Specifically, the proxy module 500 generates a pseudo-random seed for the new cycle (if the shadow field appending operation is triggered in the preliminary steps, the core key material relied upon when generating the verification decoy data is directly reused; if the downgrade appending is not triggered, a random number generator is independently called to generate entirely new key material), and uses the system's resident master key to perform the encryption process in the symmetric encryption algorithm on the pseudo-random seed for the new cycle, thereby encapsulating the updated decoy context. This logical completeness patch ensures that the session's decoy anti-forgery data can achieve normal dynamic rotation under any security trust level. For the specific application of the symmetric encryption mechanism, those skilled in the art can use Advanced Encryption Standard (AES), whose data encryption operations are well-known technologies in the field and will not be elaborated here.

[0074] In step S802, to ensure the timeliness of context data, the proxy module 500 executes time alignment and eviction logic for multi-source concurrent data. The proxy module 500 iterates through the concurrent state vector, subtracting the timestamp of each historical record in the queue from the latest monotonic timestamp. If the time difference exceeds a preset concurrent time window threshold (preferably limited to 3000 to 5000 milliseconds, determined based on the typical asynchronous loading timeout boundary of modern front-end components), the expired record is removed from the head of the queue. After completing time alignment, the proxy module 500 appends the summary of the current target interface and the current timestamp as a new record to the tail of the queue. The technical purpose of this eviction mechanism is to strictly control the byte size of context data and prevent memory overflow due to the unlimited accumulation of historical records.

[0075] S803, after completing the aforementioned state regularization, the agent module 500 extracts the core state variables from the current memory and structurally concatenates the downgraded reputation score (serving as the reputation benchmark), the concurrent state vector processed by the aforementioned time window elimination mechanism, the previously encapsulated and updated decoy context, and the monotonic timestamp representing the current server's physical time. Through the integration of these four core data fields, the agent module 500 generates a new zero-trust behavior context. This context fully records the trust level of the current network session, the trajectory of multi-concurrent behavior, and the anti-replay scale.

[0076] S804. Considering that the new zero-trust behavior context needs to be transmitted in an open network channel, there is a security risk of it being maliciously tampered with to achieve privilege escalation. As a preferred method, the proxy module 500 uses its built-in signature private key to perform hash message authentication code calculation on the concatenated core state variable byte stream, and appends the generated fixed-length hash signature as an anti-tampering identifier to the end of the new zero-trust behavior context data.

[0077] In step S805, after completing the signature calculation, the proxy module 500 uses the Base64Url secure encoding format to encode the new zero-trust behavior context carrying the tamper-proof signature, injecting it into the custom Hypertext Transfer Protocol (HTTP) extension header of the reconstructed business response message in a compliant text format. Finally, the proxy module 500 returns the modified business response message to the client 100. Based on this response message header state rewriting and return mechanism, the system leverages the stateless nature of the HTTP protocol to achieve end-to-end closed-loop flow of session trust data without consuming persistent storage resources on the microservice node 400.

[0078] Based on the response message reconstruction and distribution mechanism completed on the server side in step S9 above, the system then returns control of the zero-trust behavior flow to the client 100. This embodiment, based on the closed-loop maintenance principle of the client state machine, aims to solve the security state conflict problem caused by multiple concurrent response messages in an asynchronous network environment, thereby ensuring the global consistency of the session trust dimension.

[0079] When client 100 receives a network response from the server, due to the asynchronous, non-blocking concurrent communication mode typically used in modern front-end applications, response messages corresponding to multiple network requests are prone to arriving out of order. Based on this complex concurrent network condition, in S901, client 100's interceptor 101 receives the response message containing the concurrent new zero-trust behavior context and performs underlying data stripping and extraction operations. As a preferred approach, interceptor 101 intercepts the underlying Hypertext Transfer Protocol (HTTP) data stream and locates the custom extended header field. For string payloads using the Base64Url secure encoding format, interceptor 101 performs reverse decoding and deserialization parsing, thereby restoring the byte stream into a structured new zero-trust behavior context. Through non-intrusive interception at the network layer edge, the system obtains the latest trust measurement data without the business layer code being aware of it.

[0080] After extracting multiple concurrent security data sets, if the system uses a simple memory overwrite logic, the later-arriving old response data will directly erase the earlier-arriving new response data, causing the client's anti-replay timeline to regress or the loss of the recently triggered score downgrade state. To avoid the security state gap caused by the above-mentioned single overwrite mechanism, in S902, the interceptor 101 of the client 100 performs a state merging calculation to obtain the final merged behavior context for the next network access call. For conflict reconciliation of multi-source concurrent data, the interceptor 101 constructs a transaction lock in local memory and extracts the currently cached old context and the newly received zero-trust behavior context as joint input parameters. The physical reason for choosing these two as input parameters is that the client 100 must comprehensively consider the locally established security baseline and the latest evaluation results issued by the server in order to obtain a true and reliable current security posture.

[0081] To achieve precise alignment between the trust level and the time-based replay prevention baseline, interceptor 101 uses a state merging formula for calculation. The state merging formula is as follows: ; ; in, Indicates the credit score for merger behavior; This represents the minimum value function, used to return the smaller of the two values ​​within the parentheses; This indicates that the reputation score is cached locally. This represents the received reputation score carried in the context of the new zero-trust behavior; This indicates the merging of monotonic timestamps; This function represents the maximum value and is used to return the larger of the two values ​​within the parentheses. Indicates the local cache timestamp; This indicates the receiving timestamp carried in the context of the new zero-trust behavior.

[0082] The physical meaning and technical purpose of the aforementioned state merging logic are to establish a strict pessimistic degradation and absolute time increment strategy. For the reputation score dimension, the system introduces a minimum value function. Within the concurrent cycle, if any request triggers the degradation penalty of the proxy module 500, the client 100 will forcibly adopt the lowest security trust level, thereby avoiding the security risk of high-latency normal responses overwriting low-latency degradation responses. For the time-based replay prevention dimension, the system uses a maximum value function to ensure that the anti-replay time baseline always monotonically advances, avoiding time backtracking caused by network out-of-order delivery.

[0083] After verifying the logical completeness of the numerical and temporal dimensions, interceptor 101 further performs structured reconciliation of the concurrent state vectors of the two. Interceptor 101 stacks the two vector data into a temporary set, sorts them in ascending order according to the call timestamp carried by each element, and performs deduplication. To prevent the queue length from expanding indefinitely due to the merging operation, interceptor 101 introduces a preset concurrent time window truncation rule to actively remove expired interface records that exceed the time threshold. This time threshold is preferably limited to 3000 to 5000 milliseconds, and its setting is mainly based on covering the default cross-domain request timeout period of modern mainstream web browsers.

[0084] Combining the merged monotonic timestamps from the aforementioned outputs, interceptor 101 extracts the decoy context associated with the latest time as the sole valid credential for the current period. Considering potential clock precision collisions under extremely high concurrency conditions, if the local cache and the newly received context have identical monotonic timestamps but carry different decoy contexts, interceptor 101 introduces deterministic winning logic. That is, interceptor 101 compares the lexicographical order of the byte streams corresponding to the two decoy contexts and forcibly selects the value with the larger lexicographical order as the final anti-tampering credential. This underlying comparison logic fills in the blind spots of edge cases during concurrent merging of multi-source data, effectively preventing state splitting of memory data.

[0085] In step S903, after the multi-dimensional concurrent state reconciliation algorithm is executed, interceptor 101 repackages the results of the calculations for each dimension to generate a structurally complete final merging behavior context, which is then persistently stored in the local sandbox of client 100. To avoid overwrite pollution caused by simultaneous writes across tabs or multiple threads, interceptor 101 introduces an atomic transaction isolation mechanism based on the local browser's underlying database during the persistent write phase, thereby ensuring the absolute consistency of the context on disk. When client 100 initiates the next network access call, interceptor 101 reads the final merging behavior context from the sandbox, formats and loads it, and injects it into the extended header of the upcoming Hypertext Transfer Protocol request. Based on this closed-loop loading mechanism, the system constructs a continuously circulating and highly self-consistent stateless zero-trust evaluation link without increasing the storage burden on microservice node 400 and control plane module 300.

[0086] To aid in understanding the dynamic access control method based on zero trust and continuous behavior assessment provided by this invention, the following section provides a detailed discussion of the full-process implementation mechanism and formula calculation process, using a specific application scenario of a financial microservice system as an example.

[0087] During the system deployment phase, S1, the control plane module 300, collects historical network traffic logs from the financial gateway over the past 30 days, extracting the business transaction trajectories of all legitimate users. By calculating interface transition probabilities, the control plane module 300 generates a state transition probability matrix compressed into a two-dimensional hash table structure. For example, the observed transition probability from the "account login interface" to the "balance query interface" is 0.85, while the probability of transitioning to the "high-privilege internal settlement interface" is 0. The control plane module 300 uniformly assigns a minimum penalty constant of 0.001 to unknown transition links.

[0088] S2, the proxy module 500 starts up and establishes a persistent memory area, receiving and storing the state transition probability matrix. When client 100 completes authentication, authentication module 200 constructs a zero-trust behavior context, initializes the behavior reputation score to 100, initializes the concurrent state vector to empty, generates a pseudo-random seed encrypted based on Advanced Encryption Standard as a decoy context, and obtains the current monotonic timestamp. This context is encoded and injected into the initial access token issuance.

[0089] S3, a user on client 100 attempts to bypass the normal business process and directly send a network request message to microservice node 400 for the "high-privilege internal settlement interface". The underlying interceptor 101 of client 100 automatically loads the initial access token into the request header and sends it.

[0090] S4, the proxy module 500 deployed at the network boundary intercepts the network request packet. The proxy module 500 extracts the monotonic timestamp and calculates the request time difference, determining that the time consumption is within the global anti-replay time window threshold and that the feature value is not matched in the least recently used cache table, thus completing the anti-replay verification. Subsequently, the proxy module 500 decrypts the decoy context, extracts the pseudo-random seed, and combines it with the hash digest of the preceding node to generate verification decoy data.

[0091] S5, Proxy module 500 scans the input parameters and confirms that no verification decoy data is carried. Proxy module 500 searches the state transition probability matrix in conjunction with the concurrent state vector. Since the current request is an unauthorized probe, it hits the minimum penalty constant. The effective transition probability is calculated according to the weighted effective transition probability calculation formula. .

[0092] S6, the agent module 500 reduces the behavioral reputation score based on the effective transfer probability. A base penalty coefficient is set. Nonlinear amplification Large Index Substituting into the credit score downgrade formula, calculate: Downgrade credit score The calculated non-linear credit deduction is approximately 39.92, and the downgraded credit score is updated to 60.08.

[0093] S7, the proxy module 500 extracts the calculated downgrade reputation score of 60.08 and compares it with the multi-level security threshold range maintained internally by the system (physical blocking threshold 40, downgrade observation threshold 80). Since 60.08 is in the intermediate range, the proxy module 500 triggers hierarchical routing control, allows the current request, and appends verification decoy data as a shadow field to the root node of the business response message.

[0094] S8, the agent module 500 encapsulates a decoy context containing a new pseudo-random seed, reassembles the integral 60.08, the current monotonic timestamp, and the updated concurrent state vector into a new zero-trust behavior context, calculates the hash signature, injects it into the response message header, and returns.

[0095] S9, due to multiple concurrent requests from client 100, interceptor 101 simultaneously receives a new response containing a reputation score of 60.08 and another response containing a reputation score of 95 (generated by a normal parallel request). Interceptor 101 performs a state merging calculation and substitutes the values ​​into the formula. The minimum security trust level is forcibly maintained. The final merge behavior context after merging is persisted locally. If the client 100 uses an automated tool to replay the payload containing the shadow field, or continues to perform abnormal transfers causing the score to drop below 40, the proxy module 500 will directly cut off the Transmission Control Protocol connection in subsequent requests.

[0096] To further verify the effectiveness and performance of the method proposed in this embodiment, experimental verification was conducted in a controlled testing environment, and it was compared with traditional access control methods based on centralized Redis caching. The experimental test traffic included 10,000 normal business sessions and 2,000 privilege escalation detection sessions generated by an automated vulnerability scanner.

[0097] See attached document Figure 3 As shown in the experimental data in the figure, the test sample of the normal business call chain maintained a stable behavioral reputation score above 95 points after 15 consecutive network requests. This proves that the interface transition probability model based on the Markov chain no-aftereffect assumption can effectively fit the normal operation baseline and will not falsely penalize legitimate users. In stark contrast, the abnormal privilege escalation detection chain triggered a low-probability table lookup on the second request, and the non-linear penalty mechanism caused its score to plummet to 60.1 in a single instance. On the third request, its score further dropped to 20.2, directly breaking through the set physical blocking threshold of 40 points, forcing the proxy module 500 to disconnect. This comparative result confirms the fault tolerance of this system during the trust accumulation phase and its sensitive degradation capability when facing risk probing.

[0098] See attached document Figure 4 When the concurrent throughput is relatively low at 1000 times / second, the average processing latency difference between the stateless verification architecture of this invention and the traditional centralized verification is not significant. However, as the system concurrency increases to a high load of 10000 times / second, the traditional centralized architecture, limited by external network input / output overhead and distributed lock contention, experiences a sharp deterioration in average latency per request to 45.2 milliseconds. The method provided by this invention eliminates the strong dependence on external storage by distributing the state transition probability matrix, compressed into a hash table structure, to the proxy module 500 for local persistence and relying on the network response packet header to achieve closed-loop state transition. The data in the figure shows that the processing latency of this invention only slightly increases to 2.3 milliseconds under tens of thousands of concurrent connections, maintaining sub-millisecond table lookup efficiency and demonstrating extremely high architectural elasticity and concurrent processing capabilities. The system utilizes the client interceptor 101 to perform state reconciliation and merging, resolving data overwrite conflicts in high-concurrency scenarios and achieving dynamic zero-trust access control with long-term context memory under the constraint of zero external network overhead.

Claims

1. A dynamic access control method based on zero trust and continuous behavior evaluation, characterized in that, Includes the following steps: The control plane module (300) collects historical network traffic logs, calculates interface transition probabilities, and generates a state transition probability matrix compressed into a hash table structure. The authentication module (200) issues an initial access token carrying a zero-trust behavior context to the client (100); The client (100) sends a network request message to the target microservice node (400) carrying the initial access token; The proxy module (500) intercepts the network request message, parses the zero-trust behavior context, and then generates verification decoy data; After determining that the input parameters of the network request message do not contain the verification decoy data, the proxy module (500) queries the state transition probability matrix in conjunction with the concurrent state vector to obtain the effective transition probability. The agent module (500) calculates the corresponding non-linear penalty deduction amount to dynamically decay the credit score value, and calculates the downgraded credit score; The proxy module (500) triggers hierarchical routing control based on the downgraded reputation score to implement dynamic access control and generates a new zero-trust behavior context; The proxy module (500) injects the new zero-trust behavior context into the business response message to perform the distribution operation; The interceptor (101) of the client (100) receives a response message containing the new zero-trust behavior context and performs a state merging calculation to derive a final merged behavior context for the next network access call.

2. The dynamic access control method based on zero trust and continuous behavior evaluation according to claim 1, characterized in that, The steps of the control plane module (300) collecting historical network traffic logs to calculate interface transition probabilities and generating a state transition probability matrix compressed into a hash table structure specifically include: The control plane module (300) extracts the interface Uniform Resource Identifier from the historical network traffic log and maps the interface Uniform Resource Identifier to a fixed-length interface hash digest using a non-cryptographic hash function; The control plane module (300) sorts the interface hash digests within the same network session in ascending order based on timestamps to generate an interface call sequence chain within a single session; The control plane module (300) counts the transition frequency between different interface hash digests in all the interface call time chains, and calculates the corresponding interface transition probability through a statistical algorithm that estimates the transition probability by frequency. The control plane module (300) compresses the state transition probability matrix, which contains all interface transition probabilities, into a two-dimensional hash table structure.

3. The dynamic access control method based on zero trust and continuous behavior evaluation according to claim 1, characterized in that, The specific steps of the authentication module (200) issuing an initial access token carrying a zero-trust behavior context to the client (100) include: After the authentication module (200) verifies the client (100), it constructs the zero-trust behavior context in memory, which consists of four data fields: behavior reputation score, concurrent state vector, decoy context and monotonic timestamp. The authentication module (200) uses a standardized data exchange format to serialize and encode the zero-trust behavior context, generating an encoded data string; The authentication module (200) injects the encoded data string into the extended payload area of ​​the standard JSON Web Token and uses the private key to encrypt the entire token content to generate a digital signature; The authentication module (200) uses the digital signature to complete the assembly and independently issues the initial access token to the client (100) carrying the zero-trust behavior context.

4. The dynamic access control method based on zero trust and continuous behavior evaluation according to claim 1, characterized in that, The steps of the client (100) sending a network request message to the target microservice node (400) carrying the initial access token specifically include: The client (100) responds to the user's business operation instructions on the front-end interface and retrieves the initial access token stored locally; The interceptor (101) of the client (100) fully loads the initial access token into a custom extension header of the Hypertext Transfer Protocol; After completing the dynamic assembly and filling of the header data, the client (100) uses the custom extended header containing the initial access token to carry and send the network request message.

5. The dynamic access control method based on zero trust and continuous behavior evaluation according to claim 1, characterized in that, The steps of the proxy module (500) intercepting the network request message, parsing the zero-trust behavior context, and generating verification decoy data specifically include: The proxy module (500) intercepts the network request message, extracts the zero-trust behavior context contained in the network request message, and parses out the monotonic timestamp; The proxy module (500) obtains the local current time and calculates the request time difference between the local current time and the monotonic timestamp to complete the anti-replay verification; After completing the anti-replay verification, the proxy module (500) decrypts and extracts the pseudo-random seed from the zero-trust behavior context; The proxy module (500) combines the pseudo-random seed with the hash digest of the target microservice node and calculates the verification decoy data using the verification decoy generation formula.

6. The dynamic access control method based on zero trust and continuous behavior evaluation according to claim 1, characterized in that, The steps by which the proxy module (500) determines that the input parameters of the network request message do not contain the verification decoy data, and then queries the state transition probability matrix in conjunction with the concurrent state vector to obtain the effective transition probability, specifically include: The proxy module (500) performs a traversal scan of the data body and general query parameters of the network request message, and performs a string pattern comparison between the data body and general query parameters and the verification decoy data; After determining that the input parameters of the network request message do not contain the verification decoy data, the proxy module (500) iterates through and extracts each historical microservice interface summary in the concurrent state vector, and combines the historical microservice interface summary with the current target interface summary to form an address key. The proxy module (500) uses the address key to search in the state transition probability matrix to obtain the corresponding basic transition probability; The agent module (500) uses the weighted effective transition probability calculation formula to derive and calculate the effective transition probability in combination with the basic transition probability.

7. The dynamic access control method based on zero trust and continuous behavior evaluation according to claim 1, characterized in that, The agent module (500) calculates the corresponding nonlinear penalty deduction based on the effective transfer probability to dynamically decay the credit score value. The specific steps for calculating the downgraded credit score include: The agent module (500) extracts the current behavioral reputation score from the zero-trust behavior context; The agent module (500) combines the effective transfer probability and the behavioral reputation score into the reputation score downgrade formula to obtain the nonlinear reputation deduction amount; The agent module (500) uses the nonlinear credit deduction amount to introduce a maximum value function and the absolute zero threshold of the credit score to truncate the lower limit, and calculates the downgraded credit score.

8. The dynamic access control method based on zero trust and continuous behavior evaluation according to claim 1, characterized in that, The steps by which the proxy module (500) triggers hierarchical routing control to implement dynamic access control based on the downgraded reputation score and generates a new zero-trust behavior context specifically include: The agent module (500) compares the downgraded reputation score with the multi-level security threshold range maintained internally by the system, and triggers the hierarchical routing control. When the hierarchical routing control is triggered and the degradation conditions are met, the proxy module (500) silently injects a shadow field into the node of the service response message; After injecting the shadow field, the proxy module (500) generates a pseudo-random seed for a new period, executes the encryption process in the symmetric encryption algorithm, and encapsulates the updated decoy context. The proxy module (500) structurally concatenates the downgraded reputation score, the concurrent state vector processed by the time window elimination mechanism, the updated decoy context, and the monotonic timestamp representing the current server physical time to generate the new zero-trust behavior context. The multi-level security threshold range includes a physical blocking threshold and a degradation observation threshold, which are used to implement intervention strategies of different granularities for the current network request during numerical comparison.

9. The dynamic access control method based on zero trust and continuous behavior evaluation according to claim 1, characterized in that, The steps by which the proxy module (500) injects the new zero-trust behavior context into the service response message to perform the delivery operation specifically include: The proxy module (500) performs hash message authentication code calculation on the overall byte stream of the newly generated zero-trust behavior context and generates an anti-tampering identifier; The proxy module (500) appends the anti-tampering identifier to the end of the data of the new zero-trust behavior context to generate a new zero-trust behavior context carrying an anti-tampering signature; The proxy module (500) uses the Base64Url secure encoding format to encode the new zero-trust behavior context carrying the tamper-proof signature, injects the converted payload into the custom hypertext transfer protocol extension header of the reconstructed business response message and performs the distribution operation.

10. The dynamic access control method based on zero trust and continuous behavior evaluation according to claim 1, characterized in that, The interceptor (101) of the client (100) receives a response message containing the new zero-trust behavior context, and performs a state merging calculation to obtain the final merged behavior context for the next network access call. The specific steps include: The interceptor (101) of the client (100) receives the response message, parses the custom extended header field, performs reverse decoding and deserialization parsing, and restores the byte stream to the structured new zero-trust behavior context; The interceptor (101) extracts the old zero-trust behavior context from the local cache and the new zero-trust behavior context as joint input parameters, and performs state merging calculation to obtain the results of the calculation output of each dimension; The interceptor (101) repackages the results of the calculation output of each dimension to generate a structurally complete final merging behavior context for the next network access call.

Images