A network boundary access flow security auditing system based on trusted authentication

Abstract

The application discloses a network boundary entrance and exit flow security auditing system based on trusted authentication, relates to the technical field of network security auditing, and comprises the following modules: a data frame generating module, which is used for generating boundary trusted auditing data frames; a passport constructing module, which is used for constructing authentication flow passports with digital signatures, permission constraints and authentication trusted attenuation coefficients; a passport slicing module, which is used for generating passport slices and updating passport slice states; a feature coding module, which is used for generating passport slice feature matrices and boundary flow feature matrices; a trusted matching module, which is used for generating passport-flow matching matrices; a consumption accounting module, which is used for generating flow consumption ledgers and calculating passport-flow consumption residuals; and a risk auditing module, which is used for identifying risk flows, executing hierarchical disposal and writing trusted auditing evidence chains. The application can realize trusted matching auditing between authentication identities, access permissions and boundary flows, and improve network boundary abnormal access identification and disposal capabilities.

Description

Technical Field

[0001] This invention relates to the field of network security auditing technology, and in particular to a network boundary entry and exit traffic security auditing system based on trusted authentication. Background Technology

[0002] With the widespread deployment of zero-trust access, border proxies, VPN access, and encrypted communication in government and enterprise networks, network boundary ingress and egress traffic security auditing is gradually shifting from plaintext content auditing to the correlation auditing of authentication results, traffic appearance, and access behavior. In existing technologies, solutions such as JA3 / JA3S can generate encrypted traffic fingerprints based on TLS handshake characteristics. Some network device access auditing solutions have publicly disclosed post-authentication policy distribution, target IP and port permission judgment, and encryption protocol auditing. Zero-trust single-packet authentication solutions have also publicly disclosed digest, signature, and temporary access authorization mechanisms. SuperGlue-like feature matching networks have publicly disclosed technical paths for attention matching, optimal transmission, and rejecting unmatchable points.

[0003] However, in actual boundary auditing operations, authentication, authorization, encrypted traffic identification, and log auditing are still mostly handled separately: authentication credentials are usually only used for one-time release or policy verification, and are difficult to transform into traffic audit objects that can be continuously consumed and tracked for deduction; the appearance characteristics of encrypted traffic can only help identify the communication type, and it is difficult to determine whether the traffic has actually consumed the corresponding authentication license; in proxy, VPN, and NAT scenarios, the same authentication session may have problems such as wrong domain access, credential reuse, post-authentication access drift, and excessive consumption. Traditional log chains can only record the results and are difficult to form a causal evidence chain between "authentication generation, slice consumption, residual identification, and handling results".

[0004] Therefore, how to provide a network boundary entry and exit traffic security audit system based on trusted authentication is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a network boundary ingress and egress traffic security auditing system based on trusted authentication. This invention fully utilizes trusted authentication, authentication traffic passports, heterogeneous feature encoding, and improved SuperGlue trusted matching technology. It describes in detail the process of matching boundary ingress and egress traffic with authentication permissions, residual identification, and evidence chain solidification. It has the advantages of high auditing accuracy, timely risk identification, traceable handling, and applicability to encrypted traffic scenarios.

[0006] A network boundary ingress / egress traffic security auditing system based on trusted authentication according to an embodiment of the present invention includes the following modules: The data frame generation module is used to extract encrypted traffic appearance features, perform time stamp correction, session segmentation, and cross-source association on network boundary ingress and egress traffic, trusted authentication records, and boundary mapping records to generate boundary trusted audit data frames. The passport building module is used to build an authentication traffic passport with digital signatures, permission constraints, and authentication trust decay coefficients based on trusted authentication results; The passport slicing module is used to perform multi-dimensional slicing of authentication traffic passports according to time window, resource permission, protocol permission, access direction and consumption quota, generate passport slices, and update the passport slice status based on quota inheritance and sliding window failure mechanism. The feature encoding module is used to perform heterogeneous feature encoding on passport slices and border entry / exit flows, respectively, to generate passport slice feature matrices and border flow feature matrices. The trusted matching module is used to input the passport slice feature matrix and the boundary flow feature matrix into the improved SuperGlue trusted matching model, and generate the passport-flow matching matrix through certified trusted location encoding, cross-domain trusted attention and refusalable passport consumption matching. The consumption accounting module is used to perform the matching consumption of boundary inlet and outlet traffic to passport slices based on the passport-traffic matching matrix, generate a traffic consumption ledger, and calculate the passport-traffic consumption residual. The risk audit module is used to identify risky traffic based on changes in passport-traffic consumption residuals and continuous passport slice residuals, perform tiered handling, and write passport generation, slice consumption, residual results, and handling results into a trusted audit evidence chain.

[0007] Optionally, the data frame generation module specifically includes: Perform session segmentation on network boundary ingress and egress traffic, generate boundary traffic sessions based on the five-tuple, packet direction and continuous packet time interval, and write egress session number and mapping chain number to traffic forwarded by proxy, VPN or NAT; Perform non-decrypted appearance parsing on TLS, QUIC, and VPN tunnel traffic, and generate encrypted traffic appearance feature vectors based on handshake phase fields, certificate digests, connection identifiers, packet length sequences, arrival time intervals, and uplink / downlink ratios. Generate an authentication session index based on trusted authentication records, and generate a boundary mapping index based on boundary mapping records; Time stamp correction is performed using the audit server clock as a unified benchmark, and a sliding window cross-source association is performed on the authentication session, boundary mapping session, and boundary traffic session based on the corrected timestamp to generate triple association relationships and association confidence. Generate a boundary trusted audit data frame based on the authentication session index, authentication status parameters, boundary traffic session identifier, boundary mapping index, policy index, encrypted traffic appearance feature vector, triple association, association confidence, and source trustworthiness flag.

[0008] Optionally, the passport construction module specifically includes: The authentication session status is verified based on the authentication session index, authentication status parameters, boundary mapping index, and policy index. When authentication fails, the session is logged out, or the terminal's trusted status does not meet the access policy requirements, the authentication session is written to the passport exception handling queue. According to the access policy table, the licensed resources, licensed protocol, licensed port, licensed direction, traffic quota, and access frequency limit are written into the consumable license field; The corresponding weights are obtained by looking up tables based on authentication strength, terminal trust status, device risk level, and network location change status. The weights are then summed to obtain the authentication trust attenuation coefficient, which is then written into the status attenuation field. Write the authentication session index, boundary mapping index, and policy index into the index binding field, and generate the authentication subject digest and device digest based on the authentication subject identifier, device identifier, and authentication session index; Generate an authentication traffic passport based on the authentication subject summary, device summary, consumable license field, state decay field, index binding field, and passport signature value.

[0009] Optionally, the passport slicing module specifically includes: A continuous time window is generated based on the passport slice time granularity configured in the access policy and the validity period of the certified traffic passport; Based on the licensed resources, licensed protocol, licensed port, licensed direction, traffic quota, and access frequency limit in the consumable license field, each time window is multidimensionally segmented to generate passport slices; The available quota and available access frequency of the passport slice are adjusted according to the state decay field. When the authentication trust decay coefficient is lower than the downgrade threshold, the available quota and available access frequency are reduced. When the authentication trust decay coefficient is lower than the failure threshold, the passport slice is marked as unconsumable. The remaining quota of the previous passport slice is converted into an inheritable quota according to the preset inheritance ratio and merged with the basic consumption quota of the current passport slice. The quota inheritance is stopped when the previous passport slice has a historical abnormal consumption mark. Based on the sliding window failure mechanism, passport slices that are outside the sliding window range, have expired authentication sessions, or have expired policy versions are updated to expired or revoked status. A slice number is generated based on the passport serial number, time window identifier, licensed resource summary, protocol port summary, access direction identifier, and slice status. A slice verification value is generated based on the slice number, passport verification summary, time window, consumable license field, remaining quota, remaining access frequency, and slice status.

[0010] Optionally, the feature encoding module specifically includes: Passport slice objects are generated from passport slices in a consumable state, and border traffic objects are generated from border traffic sessions in a pending matching state. Convert the licensed resources, license agreement, licensed port, access direction, slice status, status decay field, and remaining consumption status into standard fields on the passport side; Convert the destination resource, protocol port, traffic direction, boundary mapping index, association confidence, source confidence tag, and encrypted traffic appearance feature vector into standard fields on the traffic side; Discrete fields in the standard fields of the passport side are embedded and encoded, continuous fields are standardized, and the encoded results are concatenated and mapped to passport slice feature vectors through a linear projection layer. Discrete fields in the standard fields of the traffic side are embedded and encoded, continuous fields are standardized, and the encrypted traffic appearance feature vector is concatenated with the encoding result and mapped to the boundary traffic feature vector through a linear projection layer. Passport slice feature vectors are stacked to generate a passport slice feature matrix, and boundary flow feature vectors are stacked to generate a boundary flow feature matrix.

[0011] Optionally, the trusted matching module specifically includes: The passport slice feature matrix and the boundary traffic feature matrix are input into the improved SuperGlue trusted matching model. The improved SuperGlue trusted matching model includes a passport-side feature embedding layer, a traffic-side feature embedding layer, an authentication trusted location encoding layer, a traffic context location encoding layer, an attention graph neural network, a cross-domain trusted gating attention layer, a matching projection layer, a rejection node layer, and a Sinkhorn optimal transmission layer. The passport-side feature embedding layer generates passport slice embedding sequences, and the flow-side feature embedding layer generates boundary flow embedding sequences. The authentication trusted location encoding layer generates authentication trusted location codes and superimposes them onto the passport slice embedding sequence; the traffic context location encoding layer generates traffic context location codes and superimposes them onto the boundary traffic embedding sequence. The attention graph neural network performs passport-side self-attention, flow-side self-attention, passport-to-flow cross-attention, and flow-to-passport cross-attention to generate passport slice update representations and boundary flow update representations. The cross-domain trusted gating attention layer modulates the cross-attention score according to the trusted gating weights to generate passport slice matching representation and boundary traffic matching representation; The matching projection layer generates a passport-traffic score matrix, and the rejection node layer adds rejection nodes without passport traffic and rejection nodes without consumed passport slices to the passport-traffic score matrix. The Sinkhorn optimal transport layer generates a passport-traffic matching probability matrix, and generates a passport-traffic matching matrix, a passport-free traffic marker, an unconsumed passport slice marker, and a passport contention consumption marker based on the passport-traffic matching probability matrix.

[0012] Optionally, the cross-domain trusted gating attention layer specifically includes: Generate a trusted location code for authentication based on the passport slice order, time window, policy version, authentication trust decay coefficient, and boundary mapping index; Generate traffic context location codes based on traffic occurrence time, egress mapping location, session order, and source credibility; Based on authentication strength, device trust status, time window overlap, exit mapping consistency, resource policy consistency, protocol consistency, direction consistency, and remaining quota consistency, corresponding gating values ​​are generated, and the trust gating weight is obtained by multiplying the gating values. The cross-attention score between the passport slice update representation and the boundary flow update representation is multiplied by the trusted gating weight to obtain the gating cross-attention score; Update the passport slice matching representation and the boundary flow matching representation based on the gated cross attention score; Matches that have a matching probability that reaches the matching threshold, have not fallen into the passport-less traffic rejection node, and whose corresponding passport slices are in a consumable state are considered valid matches. When the matching probability between the boundary traffic and the unpassported traffic rejection node is the highest, an unpassported traffic tag is generated; when the matching probability between the passport slice and the unconsumed passport slice rejection node is the highest, an unconsumed passport slice tag is generated; when the matching probability between the same passport slice and multiple boundary traffic flows all reach the competition threshold, a passport competition consumption tag is generated.

[0013] Optionally, the consumption accounting module specifically includes: Based on the valid matches in the passport-traffic matching matrix, the passport-free traffic flag, and the passport contention consumption flag, a consumption transaction is generated according to the matching probability, trusted gating weight, and passport slice status. Perform a slice verification on the passport slice, and after the verification is passed, perform a concurrent lock on the passport slice corresponding to the consuming transaction; The actual consumption is calculated based on the number of upstream bytes, downstream bytes, and connection counts of the boundary traffic, and the actual consumption and access counts are converted into the amount to be deducted in this instance. Based on the remaining quota and remaining access frequency of the passport slices to be deducted in this round, the consumption status of the passport slices will be updated after the deduction. When the amount to be deducted exceeds the remaining usable range of the passport slice, record the excess consumption status and retain the unmet consumption amount; When the same passport slice corresponds to multiple boundary traffic within the same processing cycle, the deduction is performed from high to low according to the product of the matching probability and the trusted gating weight; A traffic consumption ledger is generated based on the consumption transaction, the state before deduction, the state after deduction, the boundary traffic summary, the unpassport traffic marker, and the passport competing consumption marker, and the passport-traffic consumption residual is calculated based on the traffic consumption ledger.

[0014] Optionally, the step of calculating the passport-traffic consumption residual based on the traffic consumption ledger specifically includes: The actual consumption results of border traffic are compared item by item with the time window of the passport slice, the permitted resources, the permitted agreement, the access direction, the available quota, the access frequency, and the exit mapping chain; A passportless residual is generated when the boundary flow corresponds to a flow without a passport tag or does not match a valid passport slice. A temporal residual is generated when the boundary flow occurs outside the passport slice time window. Resource mismatch residuals are generated when boundary traffic accesses objects that exceed the permitted resources. When a boundary traffic protocol or port does not conform to the licensing protocol, a protocol mismatch residual is generated. When the boundary flow direction does not conform to the passport slice permitted direction, a directional anomaly residual is generated. When the actual consumption of boundary traffic exceeds the available quota of the passport slice, an over-consumption residual is generated. When the number of boundary traffic accesses exceeds the remaining access frequency, a frequency mutation residual is generated. When multiple export mapping chains compete for consumption or corresponding passport competition consumption markers exist for the same passport slice, an export competition residual is generated. The passport-traffic consumption residual is obtained by combining the passport-free residual, time residual, resource mismatch residual, protocol mismatch residual, direction anomaly residual, quota overconsumption residual, frequency mutation residual, and export competition residual in a preset order.

[0015] Optionally, the risk audit module specifically includes: Based on the passport-traffic consumption residual, traffic consumption ledger, and unused passport slice markers, the residual records are merged according to the authentication subject summary, device summary, passport serial number, and time window to form a continuous passport slice residual sequence. A residual baseline table is established based on the quantile range of similar residuals in historical compliance consumption records. The current passport-flow consumption residual is compared with the residual baseline table. When any residual exceeds the corresponding baseline range, the corresponding boundary flow is written into the risk candidate record. Sliding window analysis is performed on the continuous passport slice residual sequence. When the residual increments are all positive within a preset number of consecutive time windows and the terminal residual exceeds the historical compliance baseline range, a post-certification drift flow marker is generated. The risk traffic type is determined based on the residual type. The risk traffic type includes traffic without a passport, traffic accessing the wrong domain, traffic spoofing the protocol, suspected traffic of data outflow, suspected traffic of credential reuse, traffic drifting after authentication, and abnormal authorization not being used. The handling level is determined by referring to a table based on the type of risky traffic, the data sensitivity level configured in the access policy, the authentication trust attenuation coefficient, and the passport-traffic matching probability. Then, audit prompts, secondary authentication, access rate limiting, session blocking, outbound blocking, device isolation, or account freezing are performed according to the handling level. Bind the certified traffic passport record, passport slice status record, traffic consumption ledger record, passport-traffic consumption residual, risky traffic type and handling result according to the same audit event number to generate a trusted audit event; Perform summary calculation on credible audit events, and establish a chain link between the current audit event summary and the previous audit event summary, and write it into the credible audit evidence chain.

[0016] The beneficial effects of this invention are: (1) This invention uses a data frame generation module to perform time stamp correction, session segmentation, and cross-source association on network boundary entry and exit traffic, trusted authentication records, and boundary mapping records. This generates a boundary trusted audit data frame containing authentication session index, boundary mapping index, encrypted traffic appearance feature vector, and association confidence. This solves the problem of authentication logs, mapping logs, and boundary traffic being separated in VPN, proxy, and NAT scenarios, which makes it impossible to accurately attribute the audit object. It establishes the correspondence between authentication sessions, mapping links, and traffic sessions from the data entry point, improving the traceability and data credibility of subsequent security audits.

[0017] (2) This invention converts trusted authentication results into authentication traffic passports with consumable permission fields, state decay fields and index binding fields through a passport construction module and a passport slicing module. Passport slices are generated according to time window, resource permission, protocol permission, access direction and consumption limit. This solves the problem that traditional authentication credentials are only used for one-time access and it is difficult to constrain continuous access behavior after authentication. It enables authentication permissions to be consumed and expired in different time periods, resources and limits, and forms a quantifiable audit basis for excessive access, wrong domain access and permission drift after authentication.

[0018] (3) This invention introduces authentication trusted location encoding, traffic context location encoding, cross-domain trusted gating attention, passportless traffic rejection nodes and unconsumed passport slice rejection nodes through the improved SuperGlue trusted matching model to generate a passport-traffic matching matrix. It also forms a traffic consumption ledger and passport-traffic consumption residual through the consumption accounting module. This solves the problems that encrypted traffic cannot be audited based on content alone and ordinary matching models cannot distinguish between passportless traffic and permission contention consumption. It can identify credential reuse, protocol spoofing, suspected data transmission traffic and post-authentication drift traffic. The residual results and handling results are written into the trusted audit evidence chain, which improves the interpretability and handling closed-loop capability of boundary security audit. Attached Figure Description

[0019] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a general framework diagram of a network boundary ingress and egress traffic security auditing system based on trusted authentication proposed in this invention; Figure 2 This is a schematic diagram of a network boundary ingress and egress traffic security auditing system based on trusted authentication proposed in this invention; Figure 3 This is a framework diagram of an improved SuperGlue trusted matching model in a network boundary ingress and egress traffic security audit system based on trusted authentication proposed in this invention. Detailed Implementation

[0020] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0021] refer to Figures 1-3 A network boundary ingress and egress traffic security auditing system based on trusted authentication includes the following modules: The data frame generation module is used to extract encrypted traffic appearance features, perform time stamp correction, session segmentation, and cross-source association on network boundary ingress and egress traffic, trusted authentication records, and boundary mapping records to generate boundary trusted audit data frames. The passport building module is used to build an authentication traffic passport with digital signatures, permission constraints, and authentication trust decay coefficients based on trusted authentication results; The passport slicing module is used to perform multi-dimensional slicing of authentication traffic passports according to time window, resource permission, protocol permission, access direction and consumption quota, generate passport slices, and update the passport slice status based on quota inheritance and sliding window failure mechanism. The feature encoding module is used to perform heterogeneous feature encoding on passport slices and border entry / exit flows, respectively, to generate passport slice feature matrices and border flow feature matrices. The trusted matching module is used to input the passport slice feature matrix and the boundary flow feature matrix into the improved SuperGlue trusted matching model, and generate the passport-flow matching matrix through certified trusted location encoding, cross-domain trusted attention and refusalable passport consumption matching. The consumption accounting module is used to perform the matching consumption of boundary inlet and outlet traffic to passport slices based on the passport-traffic matching matrix, generate a traffic consumption ledger, and calculate the passport-traffic consumption residual. The risk audit module is used to identify risky traffic based on changes in passport-traffic consumption residuals and continuous passport slice residuals, perform tiered handling, and write passport generation, slice consumption, residual results, and handling results into a trusted audit evidence chain.

[0022] In this embodiment, the data frame generation module specifically includes: Configure collection interfaces at network border switching devices, border firewalls, VPN gateways, proxy servers, NAT gateways, and trusted authentication gateways to receive network border inbound and outbound traffic, trusted authentication records, and border mapping records, and write them into the border audit cache according to the collection source number; Perform session segmentation on network boundary ingress and egress traffic, and generate boundary traffic sessions based on the five-tuple, packet direction, and continuous packet time interval; for traffic forwarded by a proxy, VPN, or NAT, write the egress session number and mapping chain number. Perform non-decrypted appearance parsing on TLS, QUIC, and VPN tunnel traffic, read handshake phase fields, certificate digest, connection identifier, packet length sequence, arrival time interval, and uplink / downlink ratio, and input the packet length sequence and arrival time interval into a one-dimensional convolutional encoder to generate encrypted traffic appearance feature vectors; Perform session indexing processing on trusted authentication records, and generate an authentication session index based on the authentication subject identifier, device identifier, authentication strength, terminal trusted status, authentication time, session validity period and policy version; Perform mapping chain organization on the boundary mapping records, generate a boundary mapping index based on the internal and external network address translation relationship, mapping port, forwarding protocol, mapping start and end time and gateway session number, and record the forwarding order between NAT, proxy and VPN; Using the audit server clock as a unified benchmark, time stamp correction is performed on the records of each collection source. Collection sources that exceed the preset drift threshold are written with low-confidence time stamps, and the association weight of the corresponding collection source is reduced in cross-source association. Specifically, the preset drift threshold is determined based on the average clock deviation of each acquisition source within a continuous sampling period and three times the standard deviation. In this embodiment, the preset drift threshold is 2s, and a low-confidence time marker is written when the clock deviation of the acquisition source exceeds 2s. Based on the corrected timestamp, a sliding window cross-source association is performed, placing the authentication session, boundary mapping session, and boundary traffic session in the same time window. The association confidence is calculated based on the time intersection, mapping chain integrity, protocol consistency, and session number consistency, and a triplet association relationship is generated. Specifically, the window length for cross-source association of the sliding window is determined based on the border gateway log writing delay and the authentication log synchronization delay. In this embodiment, the sliding window length is 30 seconds. When the authentication session, border mapping session, and border traffic session have a time intersection within the 30-second window, the association confidence is calculated. The associated data is standardized by field, duplicate records are merged, missing fields are filled in, and anomaly sampling is marked to generate a boundary trusted audit data frame. The boundary trusted audit data frame includes an authentication session index, authentication subject identifier, device identifier, authentication status parameters, boundary traffic session identifier, boundary mapping index, policy index, encrypted traffic appearance feature vector, triple association relationship, association confidence and source trust mark.

[0023] In this embodiment, the passport construction module specifically includes: Read the authentication session index, authentication subject identifier, device identifier, authentication status parameters, boundary mapping index, and policy index from the boundary trust audit data frame, and verify whether the authentication session is in a valid state; when authentication fails, the session is logged out, or the terminal trust state does not meet the access policy requirements, write the corresponding authentication session to the passport exception handling queue. Read the access policy table based on the policy index and write the permitted resources, license protocol, permitted port, permitted direction, traffic quota and access frequency limit into the consumable license field; The authentication strength weight, terminal trust weight, device risk weight, and network location weight are obtained by looking up tables based on authentication strength, terminal trust status, device risk level, and network location change status, respectively. The weights are then summed to obtain the authentication trust attenuation coefficient. The authentication trust attenuation coefficient is then written into the status attenuation field. Specifically, the values ​​of authentication strength weight, terminal trust weight, device risk weight, and network location weight all range from 0 to 1; in this embodiment, the authentication strength weight accounts for 0.30, the terminal trust weight accounts for 0.30, the device risk weight accounts for 0.25, and the network location weight accounts for 0.15; when the authentication trust attenuation coefficient is lower than 0.60, a downgrade threshold is triggered, and when the authentication trust attenuation coefficient is lower than 0.30, a failure threshold is triggered. Among them, the device risk level is obtained from the terminal trust status and historical anomaly markers in the trusted authentication record, and the network location change status is obtained from the exit location change in the boundary mapping record; Write the authentication session index, boundary mapping index, and policy index into the index binding field, and generate the authentication subject digest and device digest based on the authentication subject identifier, device identifier, and authentication session index; The authentication traffic passport is assembled according to the certificate-style data structure. The passport header contains the passport version, passport serial number, issuance time and passport validity period. The passport payload contains the authentication subject summary, device summary, consumable license field, state decay field and index binding field. Perform normalized encoding on the passport header and passport payload, and call the signature module on the audit server side to generate the passport signature value; Generate a passport verification digest based on the passport serial number, authentication subject digest, device digest, policy version, passport validity period, and passport signature value; Write the authentication traffic passport, passport verification digest, authentication session index, boundary mapping index, policy index, and issuance status into the passport signing table to generate an authentication traffic passport with a consumable license field, a state decay field, and an index binding field.

[0024] In this embodiment, the passport slicing module specifically includes: Read the authentication traffic passport, passport verification digest, passport validity period, consumable license field, state decay field and index binding field from the passport signing table, and perform signature verification on the authentication traffic passport. Authentication traffic passports that fail verification are written to the passport exception handling queue. Based on the passport slice time granularity configured in the access policy and the validity period of the certified traffic passport, a continuous time window is generated, and each time window is bound to the passport serial number. Specifically, the passport slice time granularity is determined according to the resource sensitivity level configured in the access policy; in this embodiment, the passport slice time granularity corresponding to highly sensitive resources is 5 minutes, and the passport slice time granularity corresponding to general business resources is 15 minutes. Based on the licensed resources, licensed protocol, licensed port, licensed direction, traffic limit, and access frequency limit in the consumable license field, each time window is multidimensionally segmented to generate a passport slice with time window, resource license, protocol license, port license, direction license, and consumable limit; The available quota and access frequency of the passport slice are adjusted according to the status decay field. When the authentication trust decay coefficient is lower than the degradation threshold, the available quota and access frequency of the passport slice are reduced. When the authentication trust decay coefficient is lower than the failure threshold, the corresponding passport slice is marked as unconsumable. For adjacent passport slices, the remaining quota of the previous passport slice is converted into an inheritable quota according to a preset inheritance ratio and merged with the basic consumption quota of the current passport slice; when the previous passport slice has a historical abnormal consumption mark, the quota inheritance is stopped. Specifically, when the previous passport slice does not have an abnormal consumption status, the preset inheritance ratio is 30%; when the previous passport slice has an excessive consumption status, no passport consumption status, export competition consumption status, or license mismatch consumption status, the preset inheritance ratio is 0. The passport slice status is updated based on the sliding window failure mechanism. As the current audit time slides, passport slices that are outside the sliding window range, have expired authentication sessions, or have expired policy versions are updated to expired or revoked status. Specifically, the sliding window failure mechanism uses the valid window that is traced back from the current audit time; in this embodiment, the valid window is 60 minutes, and passport slices that have exceeded the valid window and have not been consumed are updated to the expired state; Based on the current time, authentication session status, status decay field, remaining quota, and remaining access frequency, update the passport slice to an inactive status, a consumable status, a consumed status, an expired status, a revoked status, or an abnormally frozen status. A slice number is generated based on the passport serial number, time window identifier, licensed resource summary, protocol port summary, access direction identifier, and slice status. A slice verification value is generated based on the slice number, passport verification summary, time window, consumable license field, remaining quota, remaining access frequency, and slice status. Passport slices are written to the passport slice table, and the binding relationships between passport slices and authentication session index, boundary mapping index, policy index and passport verification digest are established to generate passport slices.

[0025] In this embodiment, the feature encoding module specifically includes: Read passport slices in a consumable state from the passport slice table to generate passport slice objects, and read border traffic sessions in a pending matching state from the border trusted audit data frame to generate border traffic objects. Perform field cleaning on the passport slice object, converting the licensed resources, licensed protocol, licensed port, access direction, slice status, status decay field and remaining consumption status into standard fields on the passport side, and write low-trust tags for passport slices that are missing key fields. Perform field cleaning on boundary traffic objects, converting destination resource, protocol port, traffic direction, boundary mapping index, association confidence, source trustworthiness mark and encrypted traffic appearance feature vector into standard fields on the traffic side, and write boundary traffic objects whose session boundaries cannot be determined into the exception handling queue. Discrete fields in the standard fields of the passport side are embedded and encoded, continuous fields are standardized, and the encoded results are concatenated and mapped to passport slice feature vectors through a linear projection layer. Discrete fields in the standard fields of the traffic side are embedded and encoded, continuous fields are standardized, and the encrypted traffic appearance feature vector is concatenated with the encoding result and mapped to the boundary traffic feature vector through a linear projection layer. Specifically, the embedding dimension of discrete fields is 32-dimensional, and continuous fields are mapped to 32-dimensional continuous feature vectors after standardization; the passport slice feature vector and the boundary flow feature vector are uniformly mapped to 128-dimensional vectors through a linear projection layer. Passport slice feature vectors are stacked according to the same coding batch to generate a passport slice feature matrix, and boundary flow feature vectors are stacked to generate a boundary flow feature matrix. Write batch number, number of objects, feature dimension, low confidence marker and source index into the passport slice feature matrix and the border flow feature matrix to complete the heterogeneous feature encoding of passport slice and border entry and exit flow.

[0026] In this embodiment, the trusted matching module specifically includes: The passport slice feature matrix and the boundary flow feature matrix are input into the improved SuperGlue trusted matching model. The improved SuperGlue trusted matching model is based on the existing SuperGlue feature matching network and retains the feature embedding layer, position encoding, self attention layer, cross attention layer, attention graph neural network, Sinkhorn optimal transmission layer and rejection node structure. The passport slice feature matrix is ​​input into the passport-side feature embedding layer, and the boundary flow feature matrix is ​​input into the flow-side feature embedding layer to generate the passport slice embedding sequence and the boundary flow embedding sequence, respectively. The existing key point location encoding in SuperGlue is replaced with authentication trusted location encoding and traffic context location encoding. The authentication trusted location encoding is generated based on the passport slice order, time window, policy version, authentication trusted decay coefficient and boundary mapping index, and is superimposed on the passport slice embedding sequence. The traffic context location encoding is generated based on the traffic occurrence time, egress mapping location, session order and source trustworthiness, and is superimposed on the boundary traffic embedding sequence. The passport slice embedding sequence and the boundary flow embedding sequence after superimposed position encoding are input into the attention graph neural network, and passport-side self-attention, flow-side self-attention, passport-to-flow cross attention and flow-to-passport cross attention are performed in sequence to obtain passport slice update representation and boundary flow update representation; Before cross-attention calculation, corresponding gating values ​​are generated based on authentication strength, device trust status, time window overlap, exit mapping consistency, resource policy consistency, protocol consistency, direction consistency, and remaining quota consistency. The trust gating weight is obtained by multiplying the gating values. Specifically, the value of each gate value ranges from 0 to 1; the gate value is 1 when the correspondence is completely consistent, 0.5 when there is partial consistency but weight reduction is required, and 0.05 when the correspondence is inconsistent; the trusted gate weight is obtained by multiplying the gate values. The cross-attention score is multiplied by the trusted gating weight to obtain the gating cross-attention score. The passport slice matching representation and the boundary flow matching representation are then updated based on the gating cross-attention score, forming the cross-domain trusted gating attention calculation process. The passport slice matching representation and the boundary flow matching representation are input into the matching projection layer to generate the passport slice matching vector and the boundary flow matching vector, and the dot product similarity is calculated to generate the passport-flow score matrix. The existing rejection nodes in SuperGlue are limited to rejection nodes without passport traffic and rejection nodes without consuming passport slices, and these two types of rejection nodes are added to the passport-traffic score matrix. The passport-traffic score matrix after adding the disqualifying node is input into the Sinkhorn optimal transport layer, and a passport-traffic matching probability matrix is ​​generated by alternating row and column normalization. Generate a passport-traffic matching matrix based on the passport-traffic matching probability matrix; select matching items whose matching probability reaches the matching threshold, do not fall into the passport-free traffic rejection node, and whose corresponding passport slice is in a consumable state as valid matching items, and write the valid matching items into the passport-traffic matching matrix; Specifically, in this embodiment, the matching threshold is set to 0.70 and the competition threshold is set to 0.60; a matching item with a matching probability of 0.70, which does not fall into the passportless traffic rejection node and whose corresponding passport slice is in a consumable state is considered a valid matching item; when the matching probability between the same passport slice and multiple boundary traffic reaches 0.60, the passport competition consumption judgment is triggered. When the matching probability between the boundary traffic and the unpassported traffic rejection node is the highest, an unpassported traffic tag is generated; when the matching probability between the passport slice and the unconsumed passport slice rejection node is the highest, an unconsumed passport slice tag is generated; when the matching probability between the same passport slice and multiple boundary traffic lines all reach the contention threshold, a passport contention consumption tag is generated. Output the passport-traffic matching matrix, the no-passport traffic marker, the unconsumed passport slice marker, and the passport contention consumption marker.

[0027] In this embodiment, the consumption accounting module specifically includes: Read the valid matches in the passport-traffic matching matrix, and read the no-passport traffic flag and passport contention consumption flag. Generate consumption transactions based on the matching probability, trusted gating weight and passport slice status. Write consumption rejection records for matches that do not meet the valid match conditions. Before the consumption is executed, the passport slice is checked for slice verification value. After the verification is passed, the passport slice corresponding to the consumption transaction is concurrently locked, and the current consumption status, remaining quota and remaining access frequency of the passport slice are read. The actual consumption is calculated based on the number of upstream bytes, downstream bytes, and connection counts of the boundary traffic, and the actual consumption and access counts are converted into the amount to be deducted in this instance. Specifically, the number of uplink bytes and downlink bytes are normalized to MB and included in the actual consumption, and the number of connections is included in the amount to be deducted this time according to the access frequency; Based on the remaining quota and remaining access frequency of the passport slices to be deducted in this round, the consumption status of the passport slices will be updated after the deduction. When the amount to be deducted exceeds the remaining usable range of the passport slice, record the excess consumption status and retain the unmet consumption amount; When the same passport slice corresponds to multiple boundary traffic within the same processing cycle, the deduction is performed from high to low according to the product of the matching probability and the trusted gating weight. After each boundary traffic deduction is completed, the passport slice status is refreshed, and then the deduction judgment is performed on the next boundary traffic. A traffic consumption ledger is generated based on the consumption transaction, the state before deduction, the state after deduction, the boundary traffic summary, the passportless traffic marker, and the passport contention consumption marker. The traffic consumption ledger is used to record the matching, deduction, remaining state, and abnormal consumption state of boundary traffic against passport slices. Among them, abnormal consumption status includes excessive consumption status, consumption without passport status, export competition consumption status, and license mismatch consumption status. Based on the traffic consumption ledger, the actual consumption results of the boundary traffic are compared item by item with the time window, licensed resources, licensed agreements, access direction, available quota, access frequency and exit mapping chain of the passport slice; When the border traffic corresponds to a traffic without a passport tag or does not match a valid passport slice, a passport-less residual is generated. When the border traffic occurs outside the passport slice time window, a time residual is generated. When the border traffic accesses objects that exceed the permitted resources, a resource mismatch residual is generated. When the border traffic protocol or port does not conform to the permitted protocol, a protocol mismatch residual is generated. When the direction of the boundary traffic does not conform to the direction permitted by the passport slice, a direction abnormality residual is generated. When the actual consumption of the boundary traffic exceeds the available quota of the passport slice, a quota over-consumption residual is generated. When the number of accesses of the boundary traffic exceeds the remaining access frequency, a frequency mutation residual is generated. When there are multiple egress mapping chains competing for consumption or corresponding passport competition consumption markers for the same passport slice, an egress competition residual is generated. Specifically, the passport-less residual, time residual, resource mismatch residual, protocol mismatch residual, direction anomaly residual, and export competition residual are marked with 0 or 1, where 0 indicates not triggered and 1 indicates triggered; the quota overspending residual is determined according to the ratio of the excess quota to the available quota, and is 0 when the available quota is not exceeded; the frequency mutation residual is determined according to the ratio of the number of visits exceeded to the remaining number of visits, and is 0 when the remaining number of visits is not exceeded. The passport-traffic consumption residual is obtained by combining the passport-free residual, time residual, resource mismatch residual, protocol mismatch residual, direction anomaly residual, quota overconsumption residual, frequency mutation residual, and export competition residual in a preset order.

[0028] In this embodiment, the risk audit module specifically includes: Read the passport-traffic consumption residual, traffic consumption ledger and unused passport slice markers, and merge the residual records according to the authentication subject summary, device summary, passport serial number and time window to form a continuous passport slice residual sequence under the same authentication session; A residual baseline table is established based on the quantile range of similar residuals in historical compliance consumption records. The residual baseline table records the baseline range of various residuals according to the authentication subject type, access resource type, protocol type, and business time period. Specifically, the residual baseline table is established based on the compliance consumption records of similar businesses over the past 30 days, and the 95th percentile value is taken as the upper limit of the baseline range of the corresponding residuals. The current passport-flow consumption residual is compared with the residual baseline table. When any residual exceeds the corresponding baseline range, the corresponding boundary flow is written into the risk candidate record. Sliding window analysis is performed on the continuous passport slice residual sequence, and the residual changes of adjacent passport slices are read in chronological order. When the residual increments are all positive within a preset number of consecutive time windows, and the terminal residual exceeds the historical compliance baseline range, a post-certification drift flow marker is generated. Specifically, in this embodiment, the consecutive preset number is 3. When the residual increment is positive for 3 consecutive time windows and the residual of the 3rd time window exceeds the upper limit of the baseline range in the residual baseline table, a post-authentication drift traffic marker is generated. Based on the residual type, the risk traffic type is determined as follows: the passportless residual corresponds to the passportless traffic; the resource mismatch residual corresponds to the wrong domain access traffic; the protocol mismatch residual corresponds to the protocol spoofing traffic; the direction abnormal residual and the quota over-consumption residual correspond to the suspected data transmission traffic; the export competition residual corresponds to the suspected credential reuse traffic; the continuously increasing passport slice residual corresponds to the post-authentication drift traffic; and the unconsumed passport slice is marked as the authorization unused abnormality. The handling level is determined by referring to a table based on the type of risky traffic, the data sensitivity level configured in the access policy, the authentication trust attenuation coefficient, and the passport-traffic matching probability. Then, audit prompts, secondary authentication, access rate limiting, session blocking, outbound blocking, device isolation, or account freezing are performed according to the handling level. Specifically, the handling levels include low risk, medium risk and high risk; low risk is subject to audit prompts, medium risk is subject to two-factor authentication or access rate limiting, and high risk is subject to session blocking, exit blocking, device isolation or account freezing. After the processing is completed, record the passport slice status before processing, processing action, processing time and processing result, and update the corresponding passport slice to the processed status, abnormal frozen status or revoked status. Bind the certified traffic passport record, passport slice status record, traffic consumption ledger record, passport-traffic consumption residual, risky traffic type and handling result according to the same audit event number to generate a trusted audit event; A summary calculation is performed on the trusted audit event, and a chain association is established between the current audit event summary and the previous audit event summary, which is written into the trusted audit evidence chain; the trusted audit evidence chain records the correspondence between passport generation, slice consumption, residual identification and handling results.

[0029] Example 1: To verify the feasibility of this invention in practice, it was applied to a network boundary ingress / egress traffic security audit scenario for a government or enterprise organization. This organization deployed three VPN gateways, two NAT exits, one proxy server, and one trusted authentication gateway. For 14 consecutive days, network boundary ingress / egress traffic, trusted authentication records, and boundary mapping records were collected, resulting in 1.864 million boundary traffic sessions, of which approximately 1.427 million were TLS, QUIC, and VPN tunnel traffic, and 96,000 were trusted authentication sessions. After review by security personnel, 412 risky traffic instances were identified, including traffic without a passport, traffic accessing the wrong domain, protocol spoofing traffic, suspected credential reuse traffic, and post-authentication drift traffic.

[0030] In this embodiment, the preset timescale drift threshold is 2s, and the sliding window cross-source association length is 30s; the passport slice time granularity for highly sensitive resources is 5min, and for general business resources it is 15min; the authentication trust decay coefficient is lower than 0.60 to trigger degradation, and lower than 0.30 to trigger failure; the matching threshold is 0.70, and the contention threshold is 0.60; the residual baseline table uses the 95th percentile of the compliance consumption records of the most recent 30 days as the upper limit of the baseline range.

[0031] System A uses traditional boundary log auditing; System B uses authentication and authorization log correlation auditing; System C uses the unmodified SuperGlue model for passport slicing and boundary traffic matching; this system uses boundary trusted audit data frames, authentication traffic passports, passport slicing, the improved SuperGlue trusted matching model, traffic consumption ledger, and passport-traffic consumption residuals for auditing. The test results are shown in Table 1 below: Table 1. Comparison of Implementation Data for Security Audit of Network Boundary Ingress and Egress Traffic

[0032] As can be seen from Table 1, compared with System A, which adopts traditional boundary log auditing, the rules are simple and the deployment cost is low, making it suitable for general log retrieval and basic retention; however, it lacks authentication traffic passport and passport slicing consumption mechanism, and can only perform coarse-grained association according to IP, port, account and time. The authentication-traffic association accuracy rate is 81.6%, the risk traffic recall rate is 54.9%, and it is easy to miss the drift traffic after authentication and suspected traffic of credential reuse.

[0033] Compared to System B, which introduced the association between authentication authorization and access logs, the accuracy of authentication-traffic association improved to 87.8%, and the average audit traceability time was shortened to 27.3 minutes, indicating that the authentication context can improve the effect of boundary traffic attribution. However, it still mainly relies on the static comparison of authorization records and access records, and cannot continuously calculate the consumption of traffic quota, access frequency and exit mapping chain after authentication. Therefore, the risk traffic recall rate is 68.4%, the evidence chain integrity rate is 84.9%, and it is insufficient in identifying excessive consumption and cross-exit competitive consumption.

[0034] Compared to System C, which uses the unmodified SuperGlue model, the authentication-traffic association accuracy reaches 91.3% and the risk traffic recall rate reaches 78.2%, indicating that the feature matching model has a strong modeling ability for the correspondence between passport slices and boundary traffic. However, it does not introduce authentication trusted location encoding, traffic context location encoding, cross-domain trusted gating attention layer, and passport consumption matching that can be rejected. Passport-less traffic, unconsumed passport slices, and passport competitive consumption are easily mismatched, the false alarm rate is still 9.6%, and the average audit traceability time is 21.8 minutes.

[0035] The system achieves an authentication-traffic association accuracy of 95.7%, a 4.4 percentage point improvement over comparison system C; a risk traffic recall rate of 88.6%, a 10.4 percentage point improvement over comparison system C; a false alarm rate of 5.8%, a 3.8 percentage point reduction compared to comparison system C; an average audit traceability time of 12.2 minutes; and an evidence chain integrity rate of 97.1%. These data demonstrate that the system establishes the correspondence between authentication sessions, boundary mapping sessions, and boundary traffic sessions through boundary trusted audit data frames; transforms authentication results into consumable audit objects through authentication traffic passports and passport slices; and reduces erroneous matches in scenarios involving traffic without passports, passport contention, and post-authentication drift through the improved SuperGlue trusted matching model.

[0036] As illustrated in the embodiments, this invention can transform trusted authentication results into sliceable, matchable, and deductible authentication traffic passports. It distinguishes between passportless traffic, traffic accessing the wrong domain, protocol spoofing traffic, suspected credential reuse traffic, and post-authentication drift traffic through a traffic consumption ledger and passport-traffic consumption residuals. Compared to traditional log auditing, authentication log correlation auditing, and the unmodified SuperGlue model, this invention can more accurately locate risky sessions in complex VPN, proxy, and NAT boundary scenarios. It also incorporates passport generation, slice consumption, residual results, and handling results into a trusted audit evidence chain, enhancing risk identification, audit traceability, and evidence solidification capabilities.

[0037] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A network boundary ingress and egress traffic security auditing system based on trusted authentication, characterized in that, Includes the following modules: The data frame generation module is used to extract encrypted traffic appearance features, perform time stamp correction, session segmentation, and cross-source association on network boundary ingress and egress traffic, trusted authentication records, and boundary mapping records to generate boundary trusted audit data frames. The passport building module is used to build an authentication traffic passport with digital signatures, permission constraints, and authentication trust decay coefficients based on trusted authentication results; The passport slicing module is used to perform multi-dimensional slicing of authentication traffic passports according to time window, resource permission, protocol permission, access direction and consumption quota, generate passport slices, and update the passport slice status based on quota inheritance and sliding window failure mechanism. The feature encoding module is used to perform heterogeneous feature encoding on passport slices and border entry / exit flows, respectively, to generate passport slice feature matrices and border flow feature matrices. The trusted matching module is used to input the passport slice feature matrix and the boundary flow feature matrix into the improved SuperGlue trusted matching model, and generate the passport-flow matching matrix through certified trusted location encoding, cross-domain trusted attention and refusalable passport consumption matching. The consumption accounting module is used to perform the matching consumption of boundary inlet and outlet traffic to passport slices based on the passport-traffic matching matrix, generate a traffic consumption ledger, and calculate the passport-traffic consumption residual. The risk audit module is used to identify risky traffic based on changes in passport-traffic consumption residuals and continuous passport slice residuals, perform tiered handling, and write passport generation, slice consumption, residual results, and handling results into a trusted audit evidence chain.

2. The network boundary ingress and egress traffic security auditing system based on trusted authentication according to claim 1, characterized in that, The data frame generation module specifically includes: Perform session segmentation on network boundary ingress and egress traffic, generate boundary traffic sessions based on the five-tuple, packet direction and continuous packet time interval, and write egress session number and mapping chain number to traffic forwarded by proxy, VPN or NAT; Perform non-decrypted appearance parsing on TLS, QUIC, and VPN tunnel traffic, and generate encrypted traffic appearance feature vectors based on handshake phase fields, certificate digests, connection identifiers, packet length sequences, arrival time intervals, and uplink / downlink ratios. Generate an authentication session index based on trusted authentication records, and generate a boundary mapping index based on boundary mapping records; Time stamp correction is performed using the audit server clock as a unified benchmark, and a sliding window cross-source association is performed on the authentication session, boundary mapping session, and boundary traffic session based on the corrected timestamp to generate triple association relationships and association confidence. Generate a boundary trusted audit data frame based on the authentication session index, authentication status parameters, boundary traffic session identifier, boundary mapping index, policy index, encrypted traffic appearance feature vector, triple association, association confidence, and source trustworthiness flag.

3. The network boundary ingress and egress traffic security auditing system based on trusted authentication according to claim 1, characterized in that, The passport construction module specifically includes: The authentication session status is verified based on the authentication session index, authentication status parameters, boundary mapping index, and policy index. When authentication fails, the session is logged out, or the terminal's trusted status does not meet the access policy requirements, the authentication session is written to the passport exception handling queue. According to the access policy table, the licensed resources, licensed protocol, licensed port, licensed direction, traffic quota, and access frequency limit are written into the consumable license field; The corresponding weights are obtained by looking up tables based on authentication strength, terminal trust status, device risk level, and network location change status. The weights are then summed to obtain the authentication trust attenuation coefficient, which is then written into the status attenuation field. Write the authentication session index, boundary mapping index, and policy index into the index binding field, and generate the authentication subject digest and device digest based on the authentication subject identifier, device identifier, and authentication session index; Generate an authentication traffic passport based on the authentication subject summary, device summary, consumable license field, state decay field, index binding field, and passport signature value.

4. A network boundary ingress / egress traffic security auditing system based on trusted authentication as described in claim 1, characterized in that, The passport slicing module specifically includes: A continuous time window is generated based on the passport slice time granularity configured in the access policy and the validity period of the certified traffic passport; Based on the licensed resources, licensed protocol, licensed port, licensed direction, traffic quota, and access frequency limit in the consumable license field, each time window is segmented in multiple dimensions to generate passport slices; The available quota and available access frequency of the passport slice are adjusted according to the state decay field. When the authentication trust decay coefficient is lower than the downgrade threshold, the available quota and available access frequency are reduced. When the authentication trust decay coefficient is lower than the failure threshold, the passport slice is marked as unconsumable. The remaining quota of the previous passport slice is converted into an inheritable quota according to the preset inheritance ratio and merged with the basic consumption quota of the current passport slice. The quota inheritance is stopped when the previous passport slice has a historical abnormal consumption mark. Based on the sliding window failure mechanism, passport slices that are outside the sliding window range, have expired authentication sessions, or have expired policy versions are updated to expired or revoked status. A slice number is generated based on the passport serial number, time window identifier, licensed resource summary, protocol port summary, access direction identifier, and slice status. A slice verification value is generated based on the slice number, passport verification summary, time window, consumable license field, remaining quota, remaining access frequency, and slice status.

5. A network boundary ingress / egress traffic security auditing system based on trusted authentication according to claim 1, characterized in that, The feature encoding module specifically includes: Passport slice objects are generated from passport slices in a consumable state, and border traffic objects are generated from border traffic sessions in a pending matching state. Convert the licensed resources, license agreement, licensed port, access direction, slice status, status decay field, and remaining consumption status into standard fields on the passport side; Convert the destination resource, protocol port, traffic direction, boundary mapping index, association confidence, source confidence tag, and encrypted traffic appearance feature vector into standard fields on the traffic side; Discrete fields in the standard fields of the passport side are embedded and encoded, continuous fields are standardized, and the encoded results are concatenated and mapped to passport slice feature vectors through a linear projection layer. Discrete fields in the standard fields of the traffic side are embedded and encoded, continuous fields are standardized, and the encrypted traffic appearance feature vector is concatenated with the encoding result and mapped to the boundary traffic feature vector through a linear projection layer. Passport slice feature vectors are stacked to generate a passport slice feature matrix, and boundary flow feature vectors are stacked to generate a boundary flow feature matrix.

6. A network boundary ingress / egress traffic security auditing system based on trusted authentication according to claim 1, characterized in that, The trusted matching module specifically includes: The passport slice feature matrix and the boundary traffic feature matrix are input into the improved SuperGlue trusted matching model. The improved SuperGlue trusted matching model includes a passport-side feature embedding layer, a traffic-side feature embedding layer, an authentication trusted location encoding layer, a traffic context location encoding layer, an attention graph neural network, a cross-domain trusted gating attention layer, a matching projection layer, a rejection node layer, and a Sinkhorn optimal transmission layer. The passport-side feature embedding layer generates passport slice embedding sequences, and the flow-side feature embedding layer generates boundary flow embedding sequences. The authentication trusted location encoding layer generates authentication trusted location codes and superimposes them onto the passport slice embedding sequence; the traffic context location encoding layer generates traffic context location codes and superimposes them onto the boundary traffic embedding sequence. The attention graph neural network performs passport-side self-attention, flow-side self-attention, passport-to-flow cross-attention, and flow-to-passport cross-attention to generate passport slice update representations and boundary flow update representations. The cross-domain trusted gating attention layer modulates the cross-attention score according to the trusted gating weights to generate passport slice matching representation and boundary traffic matching representation; The matching projection layer generates a passport-traffic score matrix, and the rejection node layer adds rejection nodes without passport traffic and rejection nodes without consumed passport slices to the passport-traffic score matrix. The Sinkhorn optimal transport layer generates a passport-traffic matching probability matrix, and generates a passport-traffic matching matrix, a passport-free traffic marker, an unconsumed passport slice marker, and a passport contention consumption marker based on the passport-traffic matching probability matrix.

7. A network boundary ingress / egress traffic security auditing system based on trusted authentication as described in claim 6, characterized in that, The cross-domain trusted gating attention layer specifically includes: Generate a trusted location code for authentication based on the passport slice order, time window, policy version, authentication trust decay coefficient, and boundary mapping index; Generate traffic context location codes based on traffic occurrence time, egress mapping location, session order, and source credibility; Based on authentication strength, device trust status, time window overlap, exit mapping consistency, resource policy consistency, protocol consistency, direction consistency, and remaining quota consistency, corresponding gating values ​​are generated, and the trust gating weight is obtained by multiplying the gating values. The cross-attention score between the passport slice update representation and the boundary flow update representation is multiplied by the trusted gating weight to obtain the gating cross-attention score; Update the passport slice matching representation and the boundary flow matching representation based on the gated cross attention score; Matches that have a matching probability that reaches the matching threshold, have not fallen into the passport-less traffic rejection node, and whose corresponding passport slices are in a consumable state are considered valid matches. When the matching probability between the boundary traffic and the unpassported traffic rejection node is the highest, an unpassported traffic tag is generated; when the matching probability between the passport slice and the unconsumed passport slice rejection node is the highest, an unconsumed passport slice tag is generated; when the matching probability between the same passport slice and multiple boundary traffic flows all reach the competition threshold, a passport competition consumption tag is generated.

8. A network boundary ingress / egress traffic security auditing system based on trusted authentication according to claim 1, characterized in that, The consumption accounting module specifically includes: Based on the valid matches in the passport-traffic matching matrix, the passport-free traffic flag, and the passport contention consumption flag, a consumption transaction is generated according to the matching probability, trusted gating weight, and passport slice status. Perform a slice verification on the passport slice, and after the verification is passed, perform a concurrent lock on the passport slice corresponding to the consuming transaction; The actual consumption is calculated based on the number of upstream bytes, downstream bytes, and connection counts of the boundary traffic, and the actual consumption and access counts are converted into the amount to be deducted in this instance. Based on the remaining quota and remaining access frequency of the passport slices to be deducted in this round, the consumption status of the passport slices will be updated after the deduction. When the amount to be deducted exceeds the remaining usable range of the passport slice, record the excess consumption status and retain the unmet consumption amount; When the same passport slice corresponds to multiple boundary traffic within the same processing cycle, the deduction is performed from high to low according to the product of the matching probability and the trusted gating weight; A traffic consumption ledger is generated based on the consumption transaction, the state before deduction, the state after deduction, the boundary traffic summary, the unpassport traffic marker, and the passport competing consumption marker, and the passport-traffic consumption residual is calculated based on the traffic consumption ledger.

9. A network boundary ingress / egress traffic security auditing system based on trusted authentication as described in claim 8, characterized in that, The calculation of the passport-traffic consumption residual based on the traffic consumption ledger specifically includes: The actual consumption results of border traffic are compared item by item with the time window of the passport slice, the permitted resources, the permitted agreement, the access direction, the available quota, the access frequency, and the exit mapping chain; A passportless residual is generated when the boundary flow corresponds to a flow without a passport tag or does not match a valid passport slice. A temporal residual is generated when the boundary flow occurs outside the passport slice time window. Resource mismatch residuals are generated when boundary traffic accesses objects that exceed the permitted resources. When a boundary traffic protocol or port does not conform to the licensing protocol, a protocol mismatch residual is generated. When the boundary flow direction does not conform to the passport slice permitted direction, a directional anomaly residual is generated. When the actual consumption of boundary traffic exceeds the available quota of the passport slice, an over-consumption residual is generated. When the number of boundary traffic accesses exceeds the remaining access frequency, a frequency mutation residual is generated. When multiple export mapping chains compete for consumption or corresponding passport competition consumption markers exist for the same passport slice, an export competition residual is generated. The passport-traffic consumption residual is obtained by combining the passport-free residual, time residual, resource mismatch residual, protocol mismatch residual, direction anomaly residual, quota overconsumption residual, frequency mutation residual, and export competition residual in a preset order.

10. A network boundary ingress / egress traffic security auditing system based on trusted authentication according to claim 1, characterized in that, The risk audit module specifically includes: Based on the passport-traffic consumption residual, traffic consumption ledger, and unused passport slice markers, the residual records are merged according to the authentication subject summary, device summary, passport serial number, and time window to form a continuous passport slice residual sequence. A residual baseline table is established based on the quantile range of similar residuals in historical compliance consumption records. The current passport-flow consumption residual is compared with the residual baseline table. When any residual exceeds the corresponding baseline range, the corresponding boundary flow is written into the risk candidate record. Sliding window analysis is performed on the continuous passport slice residual sequence. When the residual increments are all positive within a preset number of consecutive time windows and the terminal residual exceeds the historical compliance baseline range, a post-certification drift flow marker is generated. The risk traffic type is determined based on the residual type. The risk traffic type includes traffic without a passport, traffic accessing the wrong domain, traffic spoofing the protocol, suspected traffic of data outflow, suspected traffic of credential reuse, traffic drifting after authentication, and abnormal authorization not being used. The handling level is determined by referring to a table based on the type of risky traffic, the data sensitivity level configured in the access policy, the authentication trust attenuation coefficient, and the passport-traffic matching probability. Then, audit prompts, secondary authentication, access rate limiting, session blocking, outbound blocking, device isolation, or account freezing are performed according to the handling level. Bind the certified traffic passport record, passport slice status record, traffic consumption ledger record, passport-traffic consumption residual, risky traffic type and handling result according to the same audit event number to generate a trusted audit event; Perform summary calculation on credible audit events, and establish a chain link between the current audit event summary and the previous audit event summary, and write it into the credible audit evidence chain.

Images