Design method of data asset management platform based on mimicry defense

Abstract

The invention provides a design method of a data asset management platform based on mimicry defense, which relates to the technical field of data assets, and comprises the following steps: S1, obtaining external access data by a mimicry distribution gateway; s2, establishing an executor, processing the external access data through the mimicry distribution gateway, and then distributing the external access data to the executor; s3, the executor processes the external access data and outputs a processing result to the mimicry judgment gateway; s4, the mimicry judgment gateway votes and records the processing result; s5, performing metadata search on the access data by the metadata service, and judging and recording a search result; according to the invention, by introducing a mimicry defense core concept of dynamic, heterogeneous and redundant, and through mimicry defense core function components of mimicry distribution, mimicry decision, feedback control and executor scheduling, a safe execution environment of the platform is constructed, and the problem of blockage or on-hook of the service platform caused by a large amount of calculation is prevented.

Description

Technical Field

[0001] The present invention relates to the field of digital asset technology, and in particular to a design method for a data asset management platform based on mimicry defense. Background Art

[0002] In today's digital economy, data assets have become one of the most valuable resources for enterprises. The value of data is not only reflected in its scale, but also in its ability to bring deep insights and decision-making support to enterprises. Accurately assessing the value of data assets is crucial to enterprise resource allocation, investment decisions, risk management and the formulation of business strategies. Therefore, security protection of data asset trading platforms is becoming increasingly important.

[0003] In the prior art, in a mimicry environment, a data asset management platform needs to form n (n>3) parallel executors. When external access is made to the executors, the normalized voting of non-idempotent operations needs to be guaranteed. Due to the large amount of computation, the service platform may be blocked or hung up. Therefore, a design method for a data asset management platform based on mimicry defense is needed to solve the above problems. Summary of the invention

[0004] In view of the shortcomings of the prior art, the purpose of the present invention is to provide a design method for a data asset management platform based on mimetic defense. By introducing the core concepts of mimetic defense: dynamic, heterogeneous and redundant, and through the core functional components of mimetic defense: mimetic distribution, mimetic arbitration, feedback control and executor scheduling, a secure execution environment of the platform is constructed to prevent the problem of service platform blocking or hanging up due to large computing volume.

[0005] In order to achieve the above object, the present invention is implemented through the following technical solution: a design method of a data asset management platform based on mimicry defense, the method comprising the following steps:

[0006] The mimic distribution gateway obtains external access data;

[0007] Establish an execution body, process the external access data through the mimic distribution gateway and distribute it to the execution body;

[0008] The executor processes the external access data and outputs the processing results to the mimicry decision gateway;

[0009] The mimicry adjudication gateway votes and records the processing results;

[0010] The metadata service performs metadata searches on accessed data and adjudicates and records the search results.

[0011] Furthermore, establishing an execution body, distributing the external access data to the execution body after processing through the mimic distribution gateway includes the following sub-steps:

[0012] The mimic distribution gateway parses the acquired external access data and extracts the target address, port and protocol type of the external access data;

[0013] Establishing a plurality of execution bodies, wherein the execution bodies are heterogeneous execution bodies;

[0014] Establishing an executive scheduler, wherein the executive scheduler is used to evaluate the performance of the executive;

[0015] After receiving the access data, the execution body scheduler performs performance evaluation on all execution bodies, and selects some execution bodies that meet the conditions and sets them as the first processing execution body 1 to the first processing execution body n;

[0016] The mimic distribution gateway distributes the target address, port and protocol type of the external access data to the first processing execution body 1 to the first processing execution body n at the same time.

[0017] Furthermore, the execution body processes the external access data and outputs the processing result to the mimic decision gateway, which includes the following sub-steps:

[0018] The first processing execution body 1 to the first processing execution body n process the received data in parallel according to their own hardware configuration, operating system and software version to obtain processing results 1 to processing results n;

[0019] Send processing results 1 to processing results n to the mimicry decision gateway.

[0020] Furthermore, the mimic arbitration gateway votes and records the processing results, including the following sub-steps:

[0021] The mimic decision gateway collects the processing results of all executors;

[0022] The mimic decision gateway votes on processing results 1 to n through a voting algorithm;

[0023] When the voting results are consistent, any output result is output to the metadata service;

[0024] When the voting results are inconsistent, the results are sent to the feedback controller, which records the inconsistent voting results and returns them to the executor scheduler for rescheduling.

[0025] Furthermore, the voting algorithm is a consistency voting algorithm, including: when the mimic decision gateway obtains processing results 1 to processing results n, comparing processing results 1 to processing results n, when processing results 1 to processing results n are the same, outputting the voting results to be consistent, and when any one of processing results 1 to processing results n is different from the other processing results, judging that the voting results are inconsistent.

[0026] Furthermore, the rescheduling includes the executor scheduler obtaining an executor with consistent processing results, setting it as the second processing executor 1 to the second processing executor m, and the mimetic distribution gateway simultaneously distributes the target address, port and protocol type of the external access data to the second processing executor 1 to the second processing executor m.

[0027] Further, the feedback controller is used to record and detect the security of the system, including: when an inconsistent voting result is obtained, setting the execution body that produces the inconsistent voting result as an abnormal execution body, isolating the abnormal execution body, obtaining the execution body with a consistent voting result, using the execution body with a consistent voting result to cover the abnormal execution body, and recording the operation;

[0028] When an inconsistent ruling result is obtained, the execution body that produces the inconsistent ruling result is set as an abnormal execution body, the abnormal execution body is isolated, the execution body with a consistent ruling result is obtained, the abnormal execution body is overwritten with the execution body with a consistent ruling result, and the operation is recorded.

[0029] Furthermore, the metadata service performs metadata search on the access data, and adjudicates and records the search results, including the following sub-steps:

[0030] After receiving the output result, the metadata service calls the metadata index service to perform metadata search or data source import to obtain the operation result;

[0031] Return the operation results of the metadata service to the mimicry adjudication gateway;

[0032] The mimicking adjudication gateway distributes the operation result of the metadata service to the first processing execution body 1 to the first processing execution body n;

[0033] The first processing execution body 1 to the first processing execution body n process the operation result to obtain processing information 1 to processing information n;

[0034] The mimetic distribution gateway calls the mimetic decision gateway to make decisions on processing information 1 to processing information n;

[0035] When the decision results are consistent, the mimetic decision gateway returns a decision consistency signal, and the mimetic distribution gateway randomly selects a processing message and returns it to the user;

[0036] When the arbitration results are inconsistent, the results are sent to the feedback controller, which records the inconsistent results. The feedback controller sends a rescheduling signal to the executor scheduler, and the executor scheduler performs rescheduling.

[0037] Beneficial effects of the present invention: The present invention firstly constructs multiple heterogeneous and redundant execution bodies to synchronously process access data, thereby ensuring that the platform has high reliability and that the service is not blocked or hung up;

[0038] The present invention also votes on the processing results of multiple execution bodies, and through a "find the difference" design method, can quickly find inconsistent results in the execution body, and return them to the feedback controller, so as to quickly isolate the abnormal execution body and reduce the performance loss of the system;

[0039] The present invention also adopts a non-invasive transformation method. The user does not need to send special personnel to assist the transformer in application transformation, and the transformer does not need to invest a large number of developers to adapt the application, which saves a lot of time and manpower costs, thereby reducing the overall cost of mimetic transformation.

[0040] Advantages of additional aspects of the present invention will be given in part in the description of the following specific embodiments, and in part will become apparent from the following description, or will be learned through the practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0042] Figure 1 is a flow chart of the method steps of the present invention;

[0043] Figure 2 It is a schematic diagram of the mimicry transformation of the present invention. DETAILED DESCRIPTION

[0044] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0045] It should be noted that the terms used herein are for describing specific embodiments only and are not intended to be limiting of exemplary embodiments according to the present invention.

[0046] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0047] Embodiment 1, first aspect, see Figure 1 As shown, a design method for a data asset management platform based on mimicry defense includes the following steps:

[0048] Step S1: The mimic distribution gateway obtains external access data; in the specific implementation process, the external access data includes data such as the target address, port and protocol type of the registered access platform;

[0049] Step S2: Establish an execution body, and distribute the external access data to the execution body after processing through the mimic distribution gateway;

[0050] See also Figure 2 As shown, step S2 includes the following sub-steps:

[0051] Step S201: the mimic distribution gateway parses the acquired external access data and extracts the target address, port and protocol type of the external access data;

[0052] Step S202: Establish several execution bodies, which are heterogeneous execution bodies. In the specific implementation process, the heterogeneous execution bodies are composed of heterogeneous components, including different software and hardware components, such as CPU, DSP, GPU, AS IC, FPGA, etc. By dynamically scheduling and combining heterogeneous execution bodies, the dynamic and unpredictable nature of the defense strategy can be achieved, further improving the security of the system.

[0053] Step S203: Establishing an executive scheduler, which is used to evaluate the performance of the executive. In the specific implementation process, the performance evaluation of the executive includes evaluating the processing capability, stability, security, maintainability and integration with the existing system of the executive.

[0054] Step S204: After receiving the access data, the execution body scheduler performs performance evaluation on all execution bodies, and selects some execution bodies that meet the conditions and sets them as the first processing execution body 1 to the first processing execution body n; in the specific implementation process, the first processing execution body 1 to the first processing execution body n are randomly selected from the execution bodies that meet the conditions, and the randomness of the execution body selection makes the system present uncertainty, so as to ensure that it is difficult for attackers to build an effective attack chain;

[0055] Step S205: the mimic distribution gateway distributes the target address, port and protocol type of the external access data to the first processing execution body 1 to the first processing execution body n at the same time;

[0056] Step S3: The execution body processes the external access data and outputs the processing result to the mimic arbitration gateway;

[0057] Step S3 includes the following sub-steps:

[0058] Step S301: The first processing executor 1 to the first processing executor n processes the received data in parallel according to their own hardware configurations, operating systems and software versions to obtain processing results 1 to n. In the specific implementation process, the heterogeneity of the processing executors not only improves the processing efficiency of the system, but also increases the security and reliability of the system. Even if an executor fails or is attacked, data and services can be restored through other executors.

[0059] Step S302: Send processing results 1 to n to the mimicry decision gateway;

[0060] Step S4: The mimic arbitration gateway votes and records the processing results; Step S4 includes the following sub-steps:

[0061] Step S401: the mimic arbitration gateway collects the processing results of all executables;

[0062] Step S402: the mimic decision gateway votes on processing results 1 to n through a voting algorithm;

[0063] The voting algorithm in step S402 is a consistency voting algorithm, including: when the mimic arbitration gateway obtains processing results 1 to processing results n, the processing results 1 to processing results n are compared, and when the processing results 1 to processing results n are the same, the output voting results are consistent; when any processing result from processing results 1 to processing results n is different from other processing results, the voting results are judged to be inconsistent; in the specific implementation process, the consistency voting algorithm requires that the output results of all the executors participating in the voting are completely consistent, and only then is the processing result considered to be correct. The algorithm has strict requirements and can greatly improve the accuracy of the output results;

[0064] Step S403: When the voting results are consistent, any output result is output to the metadata service;

[0065] When the voting results are inconsistent, the results are sent to the feedback controller, which records the inconsistent voting results and returns them to the executor scheduler for rescheduling. In the specific implementation process, the mimic arbitration gateway has changed the traditional "find friends" approach in design and adopted a "find differences" design approach. The number of request connections in a finite set is limited, and the "outliers" can be quickly found using the consistency voting algorithm, which ensures that the processing speed is improved while reducing the loss.

[0066] The rescheduling includes the execution body scheduler obtaining the execution body with the same processing result, setting it as the second processing execution body 1 to the second processing execution body m, and the mimetic distribution gateway distributing the target address, port and protocol type of the external access data to the second processing execution body 1 to the second processing execution body m at the same time; in the specific implementation process, the second processing execution body 1 to the second processing execution body m will replace the original first processing execution body 1 to the first processing execution body n for processing;

[0067] The feedback controller is used to record and detect the security of the system, including: when inconsistent voting results are obtained, the executor that produces inconsistent voting results is set as an abnormal executor, the abnormal executor is isolated, the executor with consistent voting results is obtained, the abnormal executor is covered with the executor with consistent voting results, and the operation is recorded; in the specific implementation process, for example, in a consistency voting process, if two inconsistent voting results appear, the executors that produce the two voting results are marked as abnormal executors, and the two abnormal executors are isolated, and at the same time, an executor with consistent voting results is selected to cover the abnormal executor. Due to the heterogeneity of the executors and the randomness of the selection, the system presents uncertainty, making it difficult for attackers to build an effective attack chain;

[0068] Step S5: The metadata service searches for metadata on the accessed data, and determines and records the search results;

[0069] Step S5 includes the following sub-steps:

[0070] Step S501: after receiving the output result, the metadata service calls the metadata index service to perform metadata search or data source import to obtain the operation result; in the specific implementation process, the metadata service includes a unified metadata warehouse for storing metadata of all data assets, and the metadata search includes using the metadata index service to search the metadata warehouse to find the target;

[0071] Step S502: returning the operation result of the metadata service to the mimicry decision gateway;

[0072] Step S503: the mimicking adjudication gateway distributes the operation result of the metadata service to the first processing execution body 1 to the first processing execution body n;

[0073] Step S504: the first processing execution body 1 to the first processing execution body n process the operation result to obtain processing information 1 to processing information n;

[0074] Step S505: the mimetic distribution gateway calls the mimetic decision gateway to make a decision on the processing information 1 to the processing information n; in the specific implementation process, the decision algorithm uses consistency decision: if the output results of all execution bodies are completely consistent, then the result will be directly output as the final decision;

[0075] When the decision results are consistent, the mimetic decision gateway returns a decision consistency signal, and the mimetic distribution gateway randomly selects a processing message and returns it to the user;

[0076] When the arbitration results are inconsistent, the results are sent to the feedback controller, which records the inconsistent results. The feedback controller sends a rescheduling signal to the executor scheduler, and the executor scheduler performs rescheduling.

[0077] In the specific implementation process, when an inconsistent ruling result is obtained, the execution body that produces the inconsistent ruling result is set as an abnormal execution body, the abnormal execution body is isolated, the execution body with a consistent ruling result is obtained, the abnormal execution body is overwritten with the execution body with a consistent ruling result, and the operation is recorded.

[0078] Embodiment 2, second aspect, the present application provides an electronic device, including a processor and a memory, the memory storing computer-readable instructions, when the computer-readable instructions are executed by the processor, the steps in the above method are executed. Through the above technical solution, the processor and the memory are interconnected and communicate with each other through a communication bus and / or other forms of connection mechanisms, the memory stores a computer program executable by the processor, when the electronic device is running, the processor executes the computer program to execute the method in any optional implementation of the above embodiment to achieve the following functions: the mimetic distribution gateway obtains external access data; establishes an execution body, and distributes the external access data to the execution body after processing through the mimetic distribution gateway; the execution body processes the external access data and outputs the processing results to the mimetic arbitration gateway; the mimetic arbitration gateway votes and records the processing results; the metadata service performs metadata search on the access data, and makes decisions and records the search results.

[0079] Embodiment 3, third aspect, the present application provides a storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps in the above method are executed. Through the above technical solution, when the computer program is executed by the processor, the method in any optional implementation of the above embodiment is executed to achieve the following functions: the mimetic distribution gateway obtains external access data; an execution body is established, and the external access data is processed by the mimetic distribution gateway and then distributed to the execution body; the execution body processes the external access data and outputs the processing results to the mimetic decision gateway; the mimetic decision gateway votes and records the processing results; the metadata service performs metadata search on the access data, and decides and records the search results.

[0080] It should be understood by those skilled in the art that the embodiments of the present invention can be provided as methods, systems or computer program products. Therefore, the present invention can take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program codes. Among them, the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read-Only Memory, referred to as EPROM), programmable read-only memory (Programmable Read-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic storage, flash memory, magnetic disk or optical disk. These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0081] The above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A design method for a data asset management platform based on mimicry defense, characterized in that: The steps include: The mimic distribution gateway obtains external access data; Establish an execution body, process the external access data through the mimic distribution gateway and distribute it to the execution body; The executor processes the external access data and outputs the processing results to the mimicry decision gateway; The mimicry adjudication gateway votes and records the processing results; The metadata service performs metadata searches on accessed data and adjudicates and records the search results.

2. According to claim 1, a design method for a data asset management platform based on mimicry defense is characterized in that: Establishing an execution body and distributing external access data to the execution body after processing through the mimic distribution gateway includes the following sub-steps: The mimic distribution gateway parses the acquired external access data and extracts the target address, port and protocol type of the external access data; Establishing a plurality of execution bodies, wherein the execution bodies are heterogeneous execution bodies; Establishing an executive scheduler, wherein the executive scheduler is used to evaluate the performance of the executive; After receiving the access data, the execution body scheduler performs performance evaluation on all execution bodies, and selects some execution bodies that meet the conditions and sets them as the first processing execution body 1 to the first processing execution body n; The mimic distribution gateway distributes the target address, port and protocol type of the external access data to the first processing execution body 1 to the first processing execution body n at the same time.

3. The design method of a data asset management platform based on mimicry defense according to claim 2 is characterized in that: The execution body processes the external access data and outputs the processing results to the mimic decision gateway, which includes the following sub-steps: The first processing execution body 1 to the first processing execution body n process the received data in parallel according to their own hardware configuration, operating system and software version to obtain processing results 1 to processing results n; Send processing results 1 to processing results n to the mimicry decision gateway.

4. The design method of a data asset management platform based on mimicry defense according to claim 3 is characterized in that: The mimic arbitration gateway votes and records the processing results, including the following sub-steps: The mimic decision gateway collects the processing results of all executors; The mimic decision gateway votes on processing results 1 to n through a voting algorithm; When the voting results are consistent, any output result is output to the metadata service; When the voting results are inconsistent, the results are sent to the feedback controller, which records the inconsistent voting results and returns them to the executor scheduler for rescheduling.

5. The design method of a data asset management platform based on mimicry defense according to claim 4 is characterized in that: The voting algorithm is a consistency voting algorithm, including: when the mimicry decision gateway obtains processing results 1 to processing results n, the processing results 1 to processing results n are compared, when the processing results 1 to processing results n are the same, the voting results are output to be consistent, and when any one of the processing results 1 to processing results n is different from the other processing results, the voting results are judged to be inconsistent.

6. The design method of a data asset management platform based on mimicry defense according to claim 5 is characterized in that: The rescheduling includes the executor scheduler obtaining the executor with the consistent processing result, setting it as the second processing executor 1 to the second processing executor m, and the mimetic distribution gateway distributing the target address, port and protocol type of the external access data to the second processing executor 1 to the second processing executor m at the same time.

7. The design method of a data asset management platform based on mimicry defense according to claim 6 is characterized in that: The feedback controller is used to record and detect the security of the system, including: when obtaining inconsistent voting results, setting the execution body that produces inconsistent voting results as an abnormal execution body, isolating the abnormal execution body, obtaining the execution body with consistent voting results, using the execution body with consistent voting results to cover the abnormal execution body, and recording the operation; When an inconsistent ruling result is obtained, the execution body that produces the inconsistent ruling result is set as an abnormal execution body, the abnormal execution body is isolated, the execution body with a consistent ruling result is obtained, the abnormal execution body is overwritten with the execution body with a consistent ruling result, and the operation is recorded.

8. The design method of a data asset management platform based on mimicry defense according to claim 7 is characterized in that: The metadata service searches for metadata on accessed data and adjudicates and records the search results, including the following sub-steps: After receiving the output result, the metadata service calls the metadata index service to perform metadata search or data source import to obtain the operation result; Return the operation results of the metadata service to the mimicry adjudication gateway; The mimicking adjudication gateway distributes the operation result of the metadata service to the first processing execution body 1 to the first processing execution body n; The first processing execution body 1 to the first processing execution body n process the operation result to obtain processing information 1 to processing information n; The mimetic distribution gateway calls the mimetic decision gateway to make decisions on processing information 1 to processing information n; When the decision results are consistent, the mimetic decision gateway returns a decision consistency signal, and the mimetic distribution gateway randomly selects a processing message and returns it to the user; When the arbitration results are inconsistent, the results are sent to the feedback controller, which records the inconsistent results. The feedback controller sends a rescheduling signal to the executor scheduler, and the executor scheduler performs rescheduling.

Images