Management and control strategy implementation method and device, terminal and medium

Abstract

The embodiment of the invention discloses a management and control strategy implementation method and device, a terminal and a medium, and belongs to the field of network security, and the method comprises the steps: receiving an issued new management and control strategy tree, and judging whether a management and control strategy in the new management and control strategy tree conflicts with an existing management and control strategy or not; when a conflict exists, calculating an importance score of the conflict management and control strategy; when the importance score is smaller than an importance score threshold value, trust value voting of the conflict management and control strategy is initiated, the adoption value of the conflict strategy is calculated based on the returned trust value of each node and the historical strategy approximation degree of the current node, and when the adoption value exceeds a preset adoption value threshold value, the conflict management and control strategy is executed. And covering the original management and control strategy by using the conflict management and control strategy. And the conflict resolution time delay is reduced. And security threats caused by counterfeiting of the strategy packet by an attacker are avoided.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a management and control policy implementation method and device, a terminal and a medium. BACKGROUND

[0002] With the wide deployment of mobile terminals in enterprise, government and critical infrastructure scenarios, the demand for unified management and control of a large number of heterogeneous terminals is increasingly urgent. In the prior art, a two-level architecture of "central server-Agent agent" is usually adopted: the central server is responsible for generating, maintaining and issuing a complete policy file (Policy Bundle), and the terminal Agent passively receives and parses and executes. This architecture has the advantages of simple implementation and convenient deployment in the early stage of single-point network reachability and controllable policy size.

[0003] In the process of implementing the present application, the inventors found the following technical problems: the current policy model is mainly based on static permission allocation, and lacks dynamic perception ability of terminal real-time behavior and environmental context. When different departments / business lines issue multiple policies for the same terminal, the central server only does simple "overwriting" or "priority stacking", and cannot perform difference analysis and conflict resolution based on policy semantics, resulting in "policy drift" and even functional failure of the terminal. The security of terminal policy execution is reduced. SUMMARY

[0004] The embodiments of the present application provide a management and control policy implementation method and device, a terminal and a medium to solve the technical problem that the central server controls multiple different management and control policies in the prior art, resulting in policy drift and affecting the complete terminal network.

[0005] In a first aspect, the embodiments of the present application provide a management and control policy implementation method, comprising: receiving a new management and control policy tree issued, and determining whether the management and control policy in the new management and control policy tree conflicts with an existing management and control policy; when there is a conflict, calculating the importance score of the conflict management and control policy according to the policy type, the role level of the initiator, the trust score of the initiator and the time sensitivity of the conflict management and control policy; when the importance score of the conflict management and control policy is less than a preset importance score threshold, voting the trust value of the initiator of the conflict management and control policy, calculating the adoption value of the conflict policy based on the returned trust value of each node and the historical policy approximation degree, and when the adoption value exceeds a preset adoption value threshold, using the conflict management and control policy to overwrite the original management and control policy.

[0006] In a second aspect, the embodiments of the present application also provide a management and control policy implementation device, comprising: The receiving module is configured to receive a newly issued management and control policy tree, and determine whether a management and control policy in the newly issued management and control policy tree conflicts with an existing management and control policy; The calculating module is configured to, when there is a conflict, calculate an importance score of the conflicting management and control policy according to a policy type of the conflicting management and control policy, a role level of an initiator, a trust score of the initiator, and time sensitivity; The covering module is configured to, when the importance score of the conflicting management and control policy is less than a preset importance score threshold, initiate a trust value voting of the conflicting management and control policy, calculate an adoption value of the conflicting policy based on a returned trust value of each node and a historical policy approximation degree of the node, and when the adoption value exceeds a preset adoption value threshold, cover the original management and control policy with the conflicting management and control policy.

[0007] In a third aspect, an embodiment of the present application further provides a terminal, comprising: comprising: one or more processors; a storage device configured to store one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the management and control policy implementation method provided by any of the above embodiments.

[0008] In a fourth aspect, an embodiment of the present application further provides a storage medium containing computer executable instructions, which, when executed by a computer processor, are used to perform the management and control policy implementation method provided by the above embodiments.

[0009] The method, device, terminal and medium provided by the embodiment of the present application, by receiving a new management and control policy tree issued, judging whether the management and control policy in the new management and control policy tree conflicts with the existing management and control policy, when there is a conflict, calculating the importance score of the conflict management and control policy according to the policy type, initiator role level, initiator trust score and time sensitivity of the conflict management and control policy, when the importance score of the conflict management and control policy is less than the preset importance score threshold, initiating the trust value voting of the conflict management and control policy, calculating the adoption value of the conflict policy based on the returned trust value of each node and the historical policy approximation degree of the node, when the adoption value exceeds the preset adoption value threshold, using the conflict management and control policy to cover the original management and control policy. After receiving the new policy, the terminal can evaluate the importance of the conflict policy, and judge whether to adopt the conflict policy according to the evaluation result, without returning to the center server for verification, reducing the conflict resolution delay. When the importance evaluation does not meet the modification of the management and control policy, the node with high credibility in the network is used for voting, avoiding the security threat caused by the attacker forging the policy package. In the case that the center server is completely unreachable, the terminal can still complete the conflict decision by using the trust voting node list, not only avoiding the "policy drift", but also reducing the security threat caused by the forged policy package. The security of the terminal is improved. BRIEF DESCRIPTION OF DRAWINGS

[0010] Other features, objects and advantages of the present application will become more apparent from the following detailed description of non-limiting embodiments made with reference to the accompanying drawings: Figure 1 is a flowchart of a management and control policy implementation method provided by the first embodiment of the present application; Figure 2 is a flowchart of a management and control policy implementation method provided by the second embodiment of the present application; Figure 3 is a flowchart of a management and control policy implementation method provided by the third embodiment of the present application; Figure 4 is a schematic diagram of the information contained in the Delta-Tree in the management and control policy implementation method provided by the third embodiment of the present application; Figure 5 is a structural schematic diagram of a management and control policy implementation device provided by the fourth embodiment of the present application; Figure 6 is a structural schematic diagram of a terminal provided by the fifth embodiment of the present application. DETAILED DESCRIPTION

[0011] The present application will be further described in detail below with reference to the accompanying drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application. In addition, it should be noted that, for the convenience of description, only the parts related to the present application are shown in the drawings, but not all the structures.

[0012] Embodiment one Figure 1 is a flowchart of a method for implementing a management and control policy provided by Embodiment one of the present application. The present embodiment can be applied to the case where a terminal discriminates and executes a management and control policy issued by a terminal. The method can be executed by a management and control policy implementation device and integrated in a terminal. The method comprises the following steps: Step 110, receiving a newly issued management and control policy tree, and determining whether the management and control policy in the newly issued management and control policy tree conflicts with an existing management and control policy.

[0013] In the present embodiment, the newly issued management and control policy tree can be issued by a central server or forwarded by other terminals in the same network. The newly issued management and control policy tree can be a set of new management and control policies. After receiving the newly issued management and control policy tree, the management and control policies therein can be extracted and compared with the management and control policies previously issued and configured to take effect, to determine whether there is a conflict. The conflict can be a situation where the previous and subsequent policies are inconsistent and can produce opposite effects. For example, the mutually exclusive instructions of the same node or function can be a situation where the operation object does not change but the operation type is opposite. For example, the original management and control policy is "disable the camera", and the new management and control policy can be "enable the camera". In this case, it can be determined whether the management and control policy in the management and control policy tree conflicts with the existing management and control policy.

[0014] Step 120, when there is a conflict, calculating the importance score of the conflicting management and control policy according to the policy type, the role level of the initiator, the trust score of the initiator and the time sensitivity of the conflicting management and control policy.

[0015] For example, the policy type can include normal configuration policy, emergency policy, sensitive operation type, etc. The role level of the initiator can be different departments and different positions, such as employees of different departments, group leaders, first-level leaders and second-level leaders. The time sensitivity is used to represent the timeliness requirement of policy implementation, such as immediate effect or delayed effect. The trust score of the initiator can be the credibility of the initiator of the newly issued management and control policy tree, for example, the central server can have the highest credibility, and the credibility of other nodes issuing the newly issued management and control policy tree can be recorded by a distributed ledger. Using the above attribute characteristics of the conflicting management and control policy, the importance and credibility of the newly issued conflicting management and control policy can be determined. When the importance score is not less than a preset importance score, the new management and control policy can be used.

[0016] Exemplarily, the method can comprise: assigning a policy type parameter according to a policy type; assigning a role level parameter according to an initiator role level; assigning a time sensitivity parameter according to an effective time requirement of the policy; obtaining an initiator trust score from a distributed ledger; and calculating an importance score by using the policy type parameter, the role level parameter, the initiator trust score, and the time sensitivity parameter. The importance score can be calculated according to the mapping values of the corresponding parameters. Further, weights corresponding to the mapping values of each parameter can be added according to the scene, and the importance score can be obtained by adding the weights.

[0017] In step 130, when the importance score of the conflict management policy is less than a preset importance score threshold, a trust value vote of the conflict management policy is initiated, an adoption value of the conflict policy is calculated based on the returned trust value of each node and the historical policy approximation degree of the node, and when the adoption value exceeds a preset adoption value threshold, the original management policy is covered by the conflict management policy.

[0018] The importance score obtained according to the above steps is compared with a preset importance score threshold. When the importance score is less than the importance score threshold, the reliability of the conflict management policy needs to be evaluated because the conflict management policy conflicts with the previous management policy. The trust degree of each node device to the conflict management policy can be used to calculate the trust value.

[0019] Exemplarily, the method can comprise: calculating an adoption value of each device based on the trust value of each device participating in the vote and the historical policy approximation degree of the device; and calculating an adoption value of the conflict policy according to the adoption value of each device. The trust value of each device can be calculated by using a linear combination of an added time decay factor and a behavior weight using a decay response mechanism, and can be updated at a fixed time or according to other conditions, and stored in the distributed ledger of the current node and other nodes to prevent tampering.

[0020] Further, the adoption value of each node can be calculated based on the approximation degree of the current conflict management policy in the historical management record of the device, using the trust value of each device. The approximation degree can be a comprehensive index of the consistency of the current conflict management policy and the policy of the device in four dimensions of structure, attribute, historical preference, and context environment. After obtaining the adoption value of each device node to the conflict management policy, the adoption value of the conflict policy can be obtained by using an average value calculation method. Further, the weight of the adoption value of each device node can be set according to the trust value of each node, and the adoption value of the conflict policy can be calculated by weighted average based on the weight, so that the node device with a high trust value can obtain a higher weight, and the accuracy of the adoption value of the conflict policy can be improved. The calculated adoption value of the conflict policy is compared with a preset adoption value threshold. If the adoption value exceeds the adoption value threshold, the original management policy is covered by the conflict management policy, that is, a new management policy is adopted.

[0021] The embodiment receives a new management policy tree issued, judges whether the management policy in the new management policy tree conflicts with the existing management policy, calculates the importance score of the conflict management policy according to the policy type, the role level of the initiator, the trust score of the initiator and the time sensitivity when there is a conflict, initiates the trust value voting of the conflict management policy when the importance score of the conflict management policy is less than the preset importance score threshold, calculates the adoption value of the conflict policy based on the returned trust value of each node and the historical policy approximation degree of the node, and uses the conflict management policy to cover the original management policy when the adoption value exceeds the preset adoption value threshold. After receiving the new policy, the terminal can evaluate the importance of the conflict policy, and judge whether to adopt the conflict policy according to the evaluation result, without returning to the center server for verification, reducing the conflict resolution delay. When the importance evaluation does not meet the modification of the management policy, the node with high credibility in the network is used for voting, avoiding the security threat caused by the attacker's fake policy package. In the case that the center server is completely unreachable, the terminal can still complete the conflict decision by using the trust voting node list, which not only avoids the "policy drift", but also reduces the security threat caused by the fake policy package. The security of the terminal is improved.

[0022] The application will be further described in combination with specific application scenarios, wherein the application scenarios can be manufacturing enterprise scenarios and education industry scenarios respectively. The above two scenarios are only used for illustration, and are not all application scenarios.

[0023] In the production workshop of a large manufacturing enterprise, the device can be an industrial tablet, and hundreds of industrial tablets undertake key tasks such as production line data collection and work order issuing. The traditional mobile device management system needs to synchronize complete policy files to these devices every day. Different management departments may issue different management policies, for example: the production department issues a display policy for a certain part in the new production component, requiring full part information display, while the R&D department fine-tunes the part according to customer requirements, and requires not to display full information in the subsequent management policy. The two conflict in the management policy. In this case, relying on the method in the application, the importance score of the subsequent management policy can be calculated to determine whether to adopt the new management policy. In this way, important management policies can be executed first, and policies with low importance and obvious conflicts can be temporarily executed, avoiding "policy drift" and even function failure.

[0024] When the importance score is less than the importance score, the adoption value of the conflict management policy can be calculated by using the method provided in the embodiment, the credibility of the conflict management policy is evaluated by using the adoption value, and since the issued management policy can come from other terminals, the terminal can be illegally intruded, the policy is modified, and a security risk is caused. By using the above-mentioned mode, the security of the conflict management policy can be determined by using the credibility, and when the security meets the requirements, the original management policy is covered by using the new management policy. The security of the policy application is improved.

[0025] In the education scene, the devices can be teaching tablets in the campus, library borrowing terminals, laboratory operation devices, and other mobile terminals. These devices need to follow the management policies such as campus network access permissions and teaching resource calling restrictions. The traditional system relies on the central server to issue complete policy files. The same teaching tablet needs to follow the strict software installation restriction policy in the computer classroom in the morning, and needs to adapt to the policy of allowing the installation of design software in the art classroom in the afternoon. When the two sets of policies are frequently switched on the device, conflicts are easily generated. When the conflicts are generated, the importance score of the subsequent management policy can be calculated by using the method provided in the embodiment, and it is determined whether the new management policy is adopted. By using the mode, the important management policy can be preferentially executed, and the policy with low importance and obvious conflict is temporarily executed, so that the "policy drift" and even the function failure are avoided. And the security of the conflict management policy can be determined by using the credibility, and when the security meets the requirements, the original management policy is covered by using the new management policy. The security of the policy application is improved.

[0026] Embodiment two Figure 2 It is a flowchart of the management policy implementation method provided in the embodiment two of the application. Based on the above-mentioned embodiment, the method can further include the following steps: calculating the trust value of the device by using the device security behavior characteristics and the time attenuation factor; constructing a trust score hash tree based on the trust values of multiple different time periods; and sending the trust score hash tree to the distributed ledger of other devices.

[0027] Referring to Figure 2 , the management policy implementation method comprises: Step 210: receiving a new management policy tree issued, and judging whether the management policy in the new management policy tree conflicts with the existing management policy.

[0028] Step 220: when there is a conflict, calculating the importance score of the conflict management policy according to the policy type of the conflict management policy, the role level of the initiator, the trust score of the initiator, and the time sensitivity.

[0029] Step 230: calculating the trust value of the device by using the device security behavior characteristics and the time attenuation factor.

[0030] For example, it can be implemented in the following way: ; in, Let λ be the initial trust value, λ be the decay coefficient, and t be time. For behavior weights, For behavioral characteristics, such as the number of policy conflicts, e It is a natural constant. Let n be the trust value and n be the number of behavioral features.

[0031] As can be seen from the above formula, the rate of decay λ over time can be used to achieve the goal of trust naturally decaying over time. Furthermore, each security-affecting behavior that needs attention can be evaluated, achieving a "behavior-weight" combination summation, and continuously adjusting the trust value. Using this method, the trust relationship between a node device and other nodes can be dynamically assessed based on time and behavior.

[0032] Step 240: Construct a trust score hash tree based on trust values ​​from multiple different time periods, and send the trust score hash tree to the distributed ledger on other devices.

[0033] Each time a device trust score is updated, a record containing a timestamp, device ID, and the new score value is generated. Multiple device trust score records within a given time period are used as leaf nodes to construct a trust score hash tree. Each device sends its trust score hash tree to the distributed ledger of other devices. This prevents malicious tampering of the trust score within the current device, which could compromise network security.

[0034] Step 250: When the importance score of the conflict management strategy is less than the preset importance score threshold, initiate a trust value vote for the conflict management strategy. Calculate the adoption value of the conflict strategy based on the similarity between the returned trust value of each node and the historical strategy of the node. When the adoption value exceeds the preset adoption value threshold, use the conflict management strategy to override the original management strategy.

[0035] This embodiment adds the following steps: calculating the device's trust value using device security behavior characteristics and a time decay factor; constructing a trust score hash tree based on trust values ​​from multiple different time periods; and sending the trust score hash tree to the distributed ledger of other devices. Using this method, the trust value of a device can be determined using a "behavior-weight" combination, enabling a more accurate evaluation of the trustworthiness of each device within a certain time period. Furthermore, the trust score hash tree can be constructed using trust values ​​from multiple different time periods, compressing the data volume and facilitating its publication to the distributed ledger. The distributed ledger prevents malicious tampering of trust scores on the current device, thus improving the security of policy control.

[0036] Embodiment three Figure 3 is a flowchart of the method for implementing the management and control strategy provided in Embodiment three of the present application. This embodiment is optimized on the basis of the above-mentioned embodiments. The method can further include the following steps: decomposing each strategy instruction into an atomic operation node; topologically sorting the atomic operation nodes based on the lexicographic order of the node operation type and the resource identifier; determining the hierarchical relationship according to the dependency relationship between the atomic operation nodes and the context constraints; generating a virtual node for the logical relationship between the atomic operation nodes; generating a strategy semantic tree using the topological relationship, the hierarchical relationship, the atomic operation nodes, and the virtual nodes; starting from the leaf nodes of the strategy semantic tree, each leaf node calculates the hash value of its own attribute and concatenates it with the hash value of the directly dependent child node to form the parent node hash; based on the structure of the strategy semantic tree, the parent node hash is recursively aggregated upwards to form a management and control strategy tree. Further, the new management and control strategy tree is generated in the following manner: for the new strategy semantic tree and the old strategy semantic tree, respectively extract the tree editing path, and combine consecutive operations of the same type into an atomic operation block; recalculate the hash tree corresponding to the strategy semantic tree affected by the modification to form a new management and control strategy tree; correspondingly, the judgment of whether the management and control strategy in the new management and control strategy tree conflicts with the existing management and control strategy is optimized as follows: extract the management and control leaf node from the new management and control strategy tree, and select the strategy change leaf node from it; determine whether there is a conflict with the existing management and control strategy according to the semantics of the strategy change leaf node.

[0037] Reference Figure 3 , the method for implementing the management and control strategy comprises: Step 310, decompose each strategy instruction into an atomic operation node; topologically sort the atomic operation nodes based on the lexicographic order of the node operation type and the resource identifier; determine the hierarchical relationship according to the dependency relationship between the atomic operation nodes and the context constraints.

[0038] For example, each strategy instruction is decomposed into an atomic operation node, which abstractly represents the semantic logic of the security policy, forming an atomic node, which can include an operation object node, an operation type node, and an operation action node. The dependency relationship, such as sequential execution, conditional triggering, etc., and the context constraints, such as time and location, etc., are obtained.

[0039] And the atomic operation nodes can also be topologically sorted using the lexicographic order of the node operation type and the resource identifier, forming a topological structure, which can ensure that the same semantic graph generates consistent expressions on different devices.

[0040] Step 320, generate a virtual node for the logical relationship between the atomic operation nodes; generate a strategy semantic tree using the topological relationship, the hierarchical relationship, the atomic operation nodes, and the virtual nodes.

[0041] Logical relations between atomic operation nodes, such as AND / OR logic, are generated into virtual nodes. A policy semantic tree is generated using topology relations, hierarchical relations, atomic operation nodes, and virtual nodes. In this way, a security policy based on a text description can be converted into a multi-layer semantic graph structure, and complex dependencies of the multi-layer semantic graph, such as parallel branches and conditional edges, can be converted into a hierarchical structure of a policy tree.

[0042] Step 330: Starting from a leaf node of the policy semantic tree, a hash value of an attribute of each leaf node is calculated, and is spliced with a hash value of a directly dependent child node to form a parent node hash. Based on the structure of the policy semantic tree, the parent node hash is recursively aggregated upwards to form a management and control policy tree.

[0043] In this way, the management and control policy tree is generated by using a hash calculation method to splice and recursively aggregate layer by layer, and a unique fingerprint of the management and control policy tree is formed, which facilitates fast comparison of whether a policy has been changed.

[0044] Step 340: A new management and control policy tree is received, and the new management and control policy tree is generated in the following way. A tree editing path is extracted from a new policy semantic tree and an old policy semantic tree, and continuous same-type operations are combined into an atomic operation block. A hash tree corresponding to the policy semantic tree affected by the modification is recalculated to form a new management and control policy tree.

[0045] By combining continuous same-type operations, such as batch insertion sub-trees, into an atomic operation block, redundant instructions can be effectively reduced. The policy semantic tree affected by the modification (from a leaf to a root) can be recalculated, avoiding full-tree recalculation, and a new semantic fingerprint can be quickly obtained with reduced budget. The new management and control policy tree can be approximately regarded as a difference from the original comprehensive management and control policy tree, that is, a Δ-Tree. Figure 4 is a Δ-Tree information diagram provided in the management and control policy implementation method of Embodiment Three, and Figure 4 As can be seen, the Δ-Tree only involves the corresponding changed management and control policy, and is more similar to a set of changed leaf nodes. Compared with a traditional method, the amount of data of the issued management and control policy is greatly reduced, and the issuance of a new management and control policy can be implemented in a poor network environment.

[0046] Step 350: Management and control leaf nodes are extracted from the new management and control policy tree, and a policy change leaf node is selected from the management and control leaf nodes. Whether there is a conflict with an existing management and control policy is determined according to the semantics of the policy change leaf node.

[0047] Compared with using policy instructions, using the new management policy tree can not only identify changes in logical relationships, but also update policies without accompanying complete policy instructions. For example, if the old policy prohibits ordinary employees from installing non-enterprise application store.apk files on non-company WiFi. The new policy prohibits ordinary employees from installing non-enterprise application store.apk files on non-company WiFi or cellular networks. If using policy instruction comparison, the newly added "or" "cellular network" field cannot be understood by the program alone, and the complete policy instruction needs to be sent to identify and update the policy.

[0048] Using the policy tree, it can be abstracted as A ordinary employee --> B1 non-company WiFi (or) B2 cellular network --> C.apk file --> D non-enterprise application store source --> E prohibit installation. The modified path is "add(root-A-B2-C); B2: cellular network; or(B1, B2)". When device A sends a data packet, it only needs to send the operation type add, the editing path of the tree (root-A-B2-C), the unique index value of the node (root, A, B2, C), the data of the newly added node, and the additional information (the sibling relationship between B1 and B2). Device B receives the data packet and can directly unpack to obtain the corresponding logical information to get the complete new policy logic. Through the complete new policy logic, the original management policy can be compared to determine the conflicting management policy.

[0049] Step 360, when there is a conflict, the importance score of the conflict management policy is calculated according to the policy type of the conflict management policy, the level of the initiator role, the trust score of the initiator, and the time sensitivity.

[0050] Step 370, when the importance score of the conflict management policy is less than the preset importance score threshold, the trust value of the initiator of the conflict management policy is voted, and the adoption value of the conflict policy is calculated based on the returned trust value of each node and the historical policy approximation degree of the node. When the adoption value exceeds the preset adoption value threshold, the conflict management policy is used to overwrite the original management policy.

[0051] The embodiment adds the following steps: decomposing each policy instruction into an atomic operation node; topologically sorting the atomic operation nodes based on the lexicographic order of the node operation type and the resource identifier; determining the hierarchical relationship according to the dependency relationship between the atomic operation nodes and the context constraint; generating a virtual node for the logical relationship between the atomic operation nodes; generating a policy semantic tree using the topological relationship, the hierarchical relationship, the atomic operation nodes and the virtual nodes; starting from the leaf nodes of the policy semantic tree, each leaf node calculates the hash value of its own attribute, and splices the hash value of the directly dependent child node to form the parent node hash; based on the structure of the policy semantic tree, the parent node hash is recursively aggregated upwards to form a management and control policy tree. Further, the new management and control policy tree is generated in the following way: the tree editing path is extracted from the new policy semantic tree and the old policy semantic tree respectively, and the continuous same type operations are combined into an atomic operation block; the hash tree corresponding to the policy semantic tree affected by the modification is recalculated to form a new management and control policy tree; and the judgment of whether the management and control policy in the new management and control policy tree conflicts with the existing management and control policy is correspondingly optimized as follows: the management and control leaf node is extracted from the new management and control policy tree, and the policy change leaf node is selected therefrom; and whether there is a conflict with the existing management and control policy is judged according to the semantics of the policy change leaf node. The definition of the management and control policy tree can convert the security policy based on the text description into a policy tree, generate a unique fingerprint, and facilitate comparison. Meanwhile, a new management and control policy tree can be generated for the modified policy, which compresses the amount of data to be transmitted and facilitates the determination of the modified policy. Further, the conflicting management and control policy can be quickly found.

[0052] Embodiment four Figure 5 is a structural schematic diagram of a management and control policy implementation device provided by the embodiment four of the present application, referring to Figure 5 , the management and control policy implementation device comprises: The receiving module 410 is configured to receive a new management and control policy tree issued, and judge whether the management and control policy in the new management and control policy tree conflicts with the existing management and control policy. The calculation module 420 is configured to calculate the importance score of the conflict management and control policy according to the policy type of the conflict management and control policy, the level of the initiator role, the trust score of the initiator and the time sensitivity when there is a conflict. The coverage module 430 is configured to initiate a trust value voting of the conflict management and control policy when the importance score of the conflict management and control policy is less than the preset importance score threshold, calculate the adoption value of the conflict policy based on the returned trust value of each node and the historical policy approximation degree of the node, and use the conflict management and control policy to cover the original management and control policy when the adoption value exceeds the preset adoption value threshold.

[0053] The device for implementing the management and control strategy provided in the embodiment receives a newly issued management and control strategy tree, judges whether the management and control strategy in the newly issued management and control strategy tree conflicts with an existing management and control strategy, calculates an importance score of the conflicting management and control strategy according to the strategy type, the initiator role level, the initiator trust score and the time sensitivity of the conflicting management and control strategy when there is a conflict, initiates a trust value voting of the conflicting management and control strategy when the importance score of the conflicting management and control strategy is less than a preset importance score threshold, calculates an adoption value of the conflicting strategy based on the returned trust value of each node and the historical strategy approximation degree of the node, and uses the conflicting management and control strategy to overwrite the original management and control strategy when the adoption value exceeds a preset adoption value threshold. After receiving the new strategy, the terminal can evaluate the importance of the conflicting strategy and determine whether to adopt the conflicting strategy according to the evaluation result, without returning to the center server for verification, thereby reducing the conflict resolution delay. When the importance evaluation does not meet the modification of the management and control strategy, the voting of the nodes with high credibility in the network is used to avoid the security threat caused by the forged strategy package of the attacker. In the case where the center server is completely unreachable, the terminal can still complete the conflict decision by using the trust voting node list, which not only avoids the "strategy drift", but also reduces the security threat caused by the forged strategy package. The security of the terminal is improved.

[0054] On the basis of the above-mentioned embodiments, the computing module comprises: The first assignment unit is configured to assign a strategy type parameter according to a strategy type. The second assignment unit is configured to assign a role level parameter according to an initiator role level. The third assignment unit is configured to assign a time sensitivity parameter according to an effective time requirement of the strategy. The acquisition unit is configured to acquire an initiator trust score from a distributed ledger. The computing unit is configured to calculate an importance score by using the strategy type parameter, the role level parameter, the initiator trust score and the time sensitivity parameter.

[0055] On the basis of the above-mentioned embodiments, the device further comprises: The trust value calculation module is configured to calculate a trust value of the device by using a device security behavior feature and a time decay factor. The trust score hash tree construction module is configured to construct a trust score hash tree based on trust values of multiple different time periods. The sending module is configured to send the trust score hash tree to a distributed ledger of another device.

[0056] On the basis of the above-mentioned embodiments, the trust value calculation module is implemented in the following manner: ; Wherein, is an initial trust value, λ is a decay coefficient, and t is time, is a behavior weight, is a behavior feature, e is a natural constant, is a trust value, and n is the number of behavior features.

[0057] On the basis of the above embodiments, the coverage module comprises: a first calculation unit configured to calculate an adoption value of each device based on a trust value of each device participating in voting and a historical strategy approximation degree of the device; a second calculation unit configured to calculate an adoption value of a conflict strategy according to the adoption value of each device.

[0058] On the basis of the above embodiments, the device further comprises: a decomposition module configured to decompose each strategy instruction into an atomic operation node; a sorting module configured to topologically sort the atomic operation nodes based on a lexicographic order of a node operation type and a resource identifier; a determination module configured to determine a hierarchical relationship according to a dependency relationship between the atomic operation nodes and a context constraint; a virtual node generation module configured to generate a virtual node for a logical relationship between the atomic operation nodes; a policy semantic tree generation module configured to generate a policy semantic tree using the topological relationship, the hierarchical relationship, the atomic operation nodes, and the virtual nodes; a parent node hash formation module configured to calculate a hash value of an attribute of each leaf node of the policy semantic tree, and splice the hash value with a hash value of a directly dependent child node to form a parent node hash, starting from the leaf node of the policy semantic tree; a control policy tree formation module configured to recursively aggregate the parent node hashes upwards based on a structure of the policy semantic tree to form a control policy tree.

[0059] On the basis of the above embodiments, the new control policy tree is generated in the following manner: For the new policy semantic tree and the old policy semantic tree, respectively extract a tree editing path, and combine consecutive operations of the same type into an atomic operation block; Recalculate a hash tree corresponding to the policy semantic tree affected by the modification to form a new control policy tree; Correspondingly, the receiving module comprises: an extraction unit configured to extract a control leaf node from the new control policy tree, and select a policy change leaf node therefrom; a judgment unit configured to judge whether there is a conflict with an existing control policy according to semantics of the policy change leaf node.

[0060] The management and control strategy implementation device provided by the embodiment of the present application can execute the management and control strategy implementation method provided by any embodiment of the present application, and has the corresponding function modules and beneficial effects of the execution method.

[0061] Embodiment five Figure 6 A structural schematic diagram of a terminal provided by the embodiment five of the present application is provided. Figure 6 A block diagram of an exemplary terminal 12 suitable for use in implementing embodiments of the present application is shown. Figure 6 The terminal 12 shown is merely one example and should not be taken as limiting the scope of the embodiments of the present application.

[0062] As Figure 6 shown, the terminal 12 is in the form of a general-purpose computing device. The components of the terminal 12 can include, but are not limited to, one or more processors or processing units 16, a memory 28, and a bus 18 that couples various system components including the memory 28 and the processing unit 16.

[0063] The bus 18 represents one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration bus, a processor or local bus using any of a variety of bus architectures. By way of example, these architectures include Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus.

[0064] The terminal 12 typically includes a variety of computer system readable media. Such media can be any available media that is accessible by the terminal 12 and includes both volatile and non-volatile media, removable and non-removable media.

[0065] The memory 28 can include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The terminal 12 can further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, a storage system 34 can be provided for reading from and writing to non-removable, non-volatile magnetic media (e.g., a "hard drive"). Figure 6 (not shown), commonly referred to as a "hard disk drive"). Although not specifically shown, the storage system 34 can include other similar components for reading from and writing to non-removable, non-volatile magnetic media and can include a controller for other peripheral storage devices. Figure 6A disk drive, a floppy disk drive, a CD-ROM drive, etc., can also be provided, as shown in FIG. 1, for reading from or writing to a removable nonvolatile magnetic media (e.g., a "floppy disk"), and to a removable nonvolatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media). In such cases, each will be connected to the bus 18 by one or more data media interfaces. The memory 28 can include at least one program product having a set (e.g., at least one) of program modules that are configured to carry out the functions of embodiments of the application.

[0066] The program / utility 40, having a set (at least one) of program modules 42, can be stored in memory 28 by way of example, and not limitation, as well as an operating system, one or more application programs, other program modules, and program data, each or some combination thereof, may

[0067] The terminal 12 can also be communicatively coupled to one or more external devices 14, such as a keyboard, a pointing device, a display 24, etc.; can further be communicatively coupled to one or more devices that enable a user to interact with the terminal 12; and / or one or more devices that enable the terminal 12 to communicate with one or more other computing devices. Such communication can be facilitated by an Input / Output (I / O) interface 22. Still yet, the terminal 12 can be communicatively coupled to one or more networks, such as a Local Area Network (LAN), a Wide Area Network (WAN), and / or the Internet, through a network adapter 20. As depicted, the network adapter 20 is communicatively coupled to the other components of the terminal 12 via the bus 18. It should be appreciated that, although not shown explicitly, other hardware and / or software modules could be used in connection with the terminal 12, including, but not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems, etc.

[0068] The processing unit 16 performs functions and data processing by running programs stored in the system memory, such as implementing the method for implementing a control policy as provided by embodiments of the present application.

[0069] Embodiment Six Embodiment Six of the present application also provides a storage medium containing computer executable instructions, which when executed by a computer processor, are used to perform any of the methods for implementing a control policy as provided by the above embodiments.

[0070] The computer storage media of the embodiments of the present application can adopt any combination of one or more computer-readable media. The computer-readable media can be computer-readable signal media or computer-readable storage media. The computer-readable storage media may, for example, but is not limited to, an electrical, a magnetic, an optical, an electromagnetic, an infrared, or a semiconductor system, device, or apparatus, or any combination of the above. More specific examples (a non-exhaustive list) of the computer-readable storage media include an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, the computer-readable storage media can be any tangible medium that contains or stores a program in a form that can be used by or in connection with an instruction execution system, apparatus, or device.

[0071] The computer-readable signal media can include a computer-readable program code in a baseband or propagated as a carrier wave in a propagation medium. Such a propagated signal can take a wide variety of forms, including but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium that can be used to carry or store computer program code for use by or in connection with an instruction execution system, apparatus, or device.

[0072] Program code embodied on a computer-readable medium can be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the above.

[0073] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object-oriented programming language such as Java, Smalltalk, C++, or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments of the present application, electronic mail (email) can be utilized as the distrusting mechanism to effectuate exchange of information.

[0074] Note that the above merely describes preferred embodiments of the present application and the principles of the technology applied. Those skilled in the art will understand that the present application is not limited to the specific embodiments described herein, and that various obvious changes, modifications and substitutions can be made without departing from the scope of the present application. Therefore, although the present application has been described in detail through the above embodiments, the present application is not limited to the above embodiments, and can include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the claims.

Claims

1. A method for implementing a control strategy, characterized in that, include: Receive the newly issued control strategy tree and determine whether the control strategies in the new control strategy tree conflict with the existing control strategies; When a conflict exists, the importance score of the conflict management strategy is calculated based on the strategy type, the initiator's role level, the initiator's trust score, and the time sensitivity. When the importance score of the conflict management strategy is less than the preset importance score threshold, a vote on the trust value of the conflict management strategy is initiated. The adoption value of the conflict strategy is calculated based on the similarity between the trust value of each returned node and the historical strategy of the node. When the adoption value exceeds the preset adoption value threshold, the conflict management strategy is used to override the original management strategy.

2. The method according to claim 1, characterized in that, The importance score of the conflict management strategy is calculated based on the strategy type, initiator role level, initiator trust score, and time sensitivity, including: Assign values ​​to the strategy type parameters according to the strategy type; Assign values ​​to the character level parameter based on the initiator's character level; Assign values ​​to the time sensitivity parameters according to the policy's effective time requirements; Obtain the originator's trust score from the distributed ledger; The importance score is calculated using strategy type parameters, role level parameters, initiator trust score, and time sensitivity parameters.

3. The method according to claim 1, characterized in that, The method further includes: Calculate the trust value of the equipment using its safety behavior characteristics and time decay factor; A trust score hash tree is constructed based on trust values ​​from multiple different time periods; Send the trust score hash tree to the distributed ledger on other devices.

4. The method according to claim 3, characterized in that, The calculation of the device's trust value using device security behavior characteristics and time decay factor is implemented in the following way: ； in, Let λ be the initial trust value, λ be the decay coefficient, and t be time. For behavior weights, For behavioral characteristics, e It is a natural constant. Let n be the trust value, and n be the number of behavioral features.

5. The method according to claim 1, characterized in that, The calculation of the adoption value of the conflict strategy based on the trust value of each returned node and the similarity of the node's historical strategy includes: The adoption value of each device is calculated based on the approximation of the trust value of each participating device with the approximation of the device's historical strategy; The adoption value of the conflict strategy is calculated based on the adoption value of each device.

6. The method according to claim 1, characterized in that, The method further includes: Each policy instruction is broken down into atomic operation nodes; Topological sorting of atomic operation nodes based on lexicographical order of node operation type and resource identifier; The hierarchical relationship is determined based on the dependencies between atomic operation nodes and context constraints. Generate virtual nodes to represent the logical relationships between atomic operation nodes; Generate a policy semantic tree using topological relationships, hierarchical relationships, atomic operation nodes, and virtual nodes; Starting from the leaf nodes of the policy semantic tree, each leaf node calculates the hash value of its own attribute and concatenates it with the hash values ​​of its directly dependent child nodes to form the parent node hash. Based on the structure of the policy semantic tree, the management policy tree is formed by recursively aggregating the hashes of the parent nodes upwards.

7. The method according to claim 6, characterized in that, The new control strategy tree is generated in the following manner; For the new policy semantic tree and the old policy semantic tree, extract the tree editing path respectively, and merge consecutive operations of the same type into atomic operation blocks; Recalculate the hash tree corresponding to the policy semantic tree affected by the modification to form a new control policy tree; Accordingly, determining whether the control strategies in the new control strategy tree conflict with existing control strategies includes: Extract the control leaf nodes from the new control policy tree, and select the policy change leaf nodes from them; The semantic determination of leaf nodes based on the strategy is whether it conflicts with the existing management strategy.

8. A control strategy implementation device, characterized in that, include: The receiving module is used to receive the newly issued control policy tree and determine whether the control policies in the new control policy tree conflict with the existing control policies. The calculation module is used to calculate the importance score of the conflict management strategy based on the strategy type, initiator role level, initiator trust score, and time sensitivity when a conflict exists. The overlay module is used to initiate a trust value vote for the conflict management strategy when the importance score of the conflict management strategy is less than a preset importance score threshold. It calculates the adoption value of the conflict strategy based on the similarity between the returned trust value of each node and the historical strategy of the node. When the adoption value exceeds a preset adoption value threshold, the conflict management strategy is used to overwrite the original management strategy.

9. A terminal, characterized in that, include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the control strategy implementation method as described in any one of claims 1-7.

10. A storage medium containing computer-executable instructions, characterized in that, The computer-executable instructions, when executed by a computer processor, are used to perform the control strategy implementation method as described in any one of claims 1-7.

Images