Gatac: Research on microservice access control techniques based on trust assessment and game analysis

Abstract Microservice architecture faces security issues due to the large scale of services, resulting in a large attack surface. Integrating the concept of “continuous authentication, never trust” from the zero-trust security model into the access control of microservices has been extensively studied, but current microservice access control mechanisms still face issues like poor adaptability, inadequate security measures, and limited control capabilities, failing to fully implement zero-trust principles. In response, this paper proposes a dynamic trust evaluation and access control model named GATAC, based on machine learning and a game-theoretic reward-punishment algorithm. To meet the need for dynamic and highly accurate access evaluation, the model first introduces a trust computation method that enhances the FORBP neural network using random forest. Furthermore, to improve the access control capability of microservices, a game state based reward and punishment algorithm (MICGA) is proposed to encourage honest user access behaviors. Experimental results indicate that the proposed solution outperforms existing access control mechanisms in terms of accuracy, resistance to attacks, and adaptability.