A method and system for automating and responding to security business processes

Abstract

The present invention relates to the field of security services, and in particular to a method and system for automating and responding to security business processes, the method comprising: a security business system randomly generates a number of reference sequences, each of which corresponds to a type of security business data; a sending terminal selects a receiving terminal and a verification terminal; the verification terminal transmits a convolution result to the sending terminal; the sending terminal decrypts according to the reference sequence and the convolution result to obtain a number of decryption convolution parameter sequences; the sending terminal inputs a number of decryption parameter sequences into a smart contract, and if the decryption convolution parameter sequence is equal to the convolution parameter sequence, the verification is passed, and the sending terminal transmits an encrypted security business identifier and a recovery sequence to the receiving terminal; the receiving terminal decrypts the encrypted security business identifier according to the recovery sequence, and responds according to the decryption result. The present invention can prevent malicious interception during data transmission.

Description

Technical Field

[0001] The present invention relates to the fields of security services and blockchain technology, and in particular to a method and system for automating and responding to security business processes. Background Art

[0002] Blockchain technology, blockchain is a new decentralized protocol that can securely store digital currency transactions or other data. The information cannot be forged or tampered with. Transaction confirmation on the blockchain is completed by all nodes on the blockchain, and its consistency is guaranteed by the consensus algorithm. A public ledger is maintained on the blockchain to store the balances of all users on the blockchain network. The public ledger is visible to any node on the storage block, thereby ensuring that it cannot be forged or tampered with.

[0003] At present, some solutions apply blockchain technology to business processes, but they are not suitable for secure business scenarios, and there are problems such as unsafe data transmission and poor system flexibility. Summary of the invention

[0004] In order to solve the above technical problems, the purpose of the present invention is to provide a method and system for automating and responding to security business processes. The technical solutions adopted are as follows:

[0005] The security service system randomly generates a number of reference sequences, each of which corresponds to a type of security service data; the trusted terminal in the security service system generates a pair of convolution parameter sequence and deconvolution parameter sequence for each reference sequence, and obtains the convolution result of the reference sequence and the convolution parameter sequence;

[0006] The sending terminal selects a receiving terminal and selects a trusted terminal with the shortest sum of transmission distances to the sending terminal and the receiving terminal as a verification terminal; the verification terminal transmits the convolution result to the sending terminal; the sending terminal decrypts according to the reference sequence corresponding to its own security service data category and the convolution result to obtain several decryption convolution parameter sequences;

[0007] The sending terminal inputs several decryption convolution parameter sequences into the smart contract. If the decryption convolution parameter sequence is equal to the convolution parameter sequence, the verification is passed. The sending terminal generates a recovery sequence and convolves its own security service identifier according to the decryption convolution parameter sequence when the verification is passed to obtain an encrypted security service identifier. The sending terminal transmits the encrypted security service identifier and the recovery sequence to the receiving terminal;

[0008] The receiving terminal decrypts the encrypted security service identifier according to the recovery sequence and responds according to the decryption result;

[0009] The recovery sequence is specifically: the ratio of the deconvolution parameter sequence to the convolution parameter sequence is recorded as the recovery sequence.

[0010] Preferably, the security business system sets an update time to regularly update the degree of decentralization of the system.

[0011] Preferably, the degree of decentralization is specifically as follows: the degree of trust of the terminal is obtained by weighted summing up the number of times the terminal participates in sending or responding to security services and the number of times the terminal participates in security service verification; the difficulty evaluation value is obtained according to the information entropy of the convolution parameter sequence and the length of the convolution parameter sequence, and the degree of decentralization of the system is obtained according to the weighted sum of the mean value of the degree of trust of the terminal and the difficulty evaluation value.

[0012] Preferably, the number of trusted terminals is obtained according to the degree of decentralization of the system and the total number of terminals.

[0013] The present invention also provides a system for automating and responding to a security business process, the system comprising:

[0014] The data acquisition module is used to randomly generate a number of reference sequences through the security service system, each reference sequence corresponds to a type of security service data; the trusted terminal in the security service system generates a pair of convolution parameter sequence and deconvolution parameter sequence for each reference sequence, and obtains the convolution result of the reference sequence and the convolution parameter sequence;

[0015] The data analysis module is used to select a receiving terminal through a sending terminal, and select a trusted terminal with the shortest sum of transmission distances to the sending terminal and the receiving terminal as a verification terminal; the verification terminal transmits the convolution result to the sending terminal; the sending terminal decrypts according to the reference sequence corresponding to its own security service data category and the convolution result to obtain a number of decryption convolution parameter sequences;

[0016] The data response module is used to input several decryption convolution parameter sequences into the smart contract through the sending terminal. If the decryption convolution parameter sequence is equal to the convolution parameter sequence, the verification is passed. The sending terminal generates a recovery sequence and convolves its own security service identifier according to the decryption convolution parameter sequence when the verification is passed to obtain an encrypted security service identifier. The sending terminal transmits the encrypted security service identifier and the recovery sequence to the receiving terminal; the receiving terminal decrypts the encrypted security service identifier according to the recovery sequence and responds according to the decryption result;

[0017] The recovery sequence is specifically: the ratio of the deconvolution parameter sequence to the convolution parameter sequence is recorded as the recovery sequence.

[0018] The embodiments of the present invention have at least the following beneficial effects:

[0019] The present invention combines the decryption process with the content of the smart contract, simplifies the blockchain structure, makes it better applied to the private chain within the system, improves the computing efficiency, and provides a strategy to effectively control the difficulty of decryption. At the same time, the transmission content is the convolution result, which prevents the data from being intercepted by malicious nodes during the data transmission process. During the response process, the receiving terminal can only perform business identification and cannot obtain smart contract information, thus avoiding the receiving terminal from doing evil. In addition, the degree of decentralization is dynamically updated through the security business information and the trustworthiness of the nodes within the system, reducing the workload of the trusted nodes and improving the system operation efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 The figure is a flow chart of the method. DETAILED DESCRIPTION

[0022] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of the method and system for automating and responding to a security business process proposed by the present invention, its specific implementation method, structure, features and effects, in conjunction with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures, or characteristics in one or more embodiments may be combined in any suitable form.

[0023] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0024] The following describes in detail a specific solution of a method for automating and responding to a security business process provided by the present invention in conjunction with the accompanying drawings.

[0025] Embodiment 1:

[0026] See also Figure 1 , which shows a flowchart of a method for automating and responding to a security business process provided by an embodiment of the present invention, the method comprising the following steps:

[0027] The specific scenarios targeted by this embodiment are: in the full service scenario, the system can be applied to a single enterprise or multiple enterprises, and is implemented using blockchain private chain technology; the security business is pre-assigned with an importance level by the system manager, which is usually divided into four levels. The higher the level, the more important the security business; there are multiple nodes in the system, each node represents a terminal, where the terminal that sends security business data is recorded as a sending terminal, and the terminal that receives and responds to security business data is recorded as a receiving terminal. At the same time, the number of times the terminal participates in the sending or responding of security business and the number of times the terminal participates in the security business verification are weighted and summed to obtain the terminal's trustworthiness, calculate the trustworthiness of all terminals, and select the terminal with a higher degree of trustworthiness as a trusted terminal. Among them, the terminal determined as the central node can also perform security business data verification and accounting operations; communication between nodes adopts conventional communication methods, such as RMI, HTTP-based, hessian, JMS, WebService, etc.

[0028] Implementers of security business data in the security business system can identify and obtain different security business identifiers according to actual scenario requirements. For example, security business data may include identity authentication services, personal information modification services, payment-related services, service interface call services, etc., and are assigned different security business identifiers, such as using unique hot codes 0001, 0010, 0100, 1000, etc. In order to ensure the security of security business data, implementers can use more complex coding, and the coding process will not be repeated here. In the actual system operation process, various types of security business data correspond to different levels of importance, which are preset by the system administrator.

[0029] It should be noted that the conventional use of smart contracts is to allow trusted transactions without a third party, which are traceable and irreversible; here it is simply understood as: when the input meets a certain condition, the smart contract executes certain content. The conditions that need to be met by the smart contract described in this embodiment are that the decryption convolution parameters obtained by the sending terminal are consistent with the preset convolution parameters, and the execution content includes: the sending terminal transmits the encrypted security service identifier and recovery sequence generated after verification to the receiving terminal. Through this application, in the security business system, the data transmission between the sending terminal and the receiving terminal does not require the approval of other high-level roles, and is automatically executed by the smart contract constraints, realizing the automation and response of security business processes.

[0030] First, the security service system randomly generates several reference sequences, each of which corresponds to a type of security service data; the trusted terminal in the security service system generates a pair of convolution parameter sequence and deconvolution parameter sequence for each reference sequence, and obtains the convolution result of the reference sequence and the convolution parameter sequence.

[0031] The security service system randomly generates N reference sequences (where N≥1, and N is an integer), and the lengths of the reference sequences are different. Reference sequences of different lengths correspond to security service data of different importance levels. The higher the security service data level c, the larger the corresponding reference sequence length l. Specifically, l=f(c). Preferably, in this embodiment, f(c) adopts a linear function, such as f(c)=2c.

[0032] Each trusted terminal generates a pair of convolution parameter sequences and deconvolution parameter sequences according to different reference sequences, represented by (W, D). Specifically, the trusted terminal randomly generates a sequence with the same length as the reference sequence X, which is recorded as the convolution parameter sequence W. The corresponding deconvolution parameter sequence D can be uniquely determined based on the obtained convolution parameter sequence W. The convolution parameter sequence W and the deconvolution parameter sequence D are both consistent with the length of the reference sequence X. The kth element in the deconvolution parameter sequence D uniquely determined by the convolution parameter sequence W is represented as d k =w k x k / Y, where w k is the kth element in the convolution parameter sequence W, x k is the kth element in the reference sequence X; that is, when the deconvolution sequence D is known, the convolution parameter sequence W can be verified, that is, w k =d k Y / x k At the same time, X*W=Y is calculated, where * represents the convolution operation and Y is the convolution result. The reason for using convolution and deconvolution here is that the convolution operation is essentially an irreversible operation. It is impossible to calculate the convolution parameter sequence W when the reference sequence X and the convolution result Y are known, which has the same effect as the hash calculation, and the amount of calculation required for verification is greatly reduced.

[0033] Next, the sending terminal selects a receiving terminal and selects a trusted terminal with the shortest sum of transmission distances to the sending terminal and the receiving terminal as the verification terminal; the verification terminal transmits the convolution result to the sending terminal; the sending terminal decrypts the reference sequence and the convolution result corresponding to its own security business data category to obtain several decryption convolution parameter sequences.

[0034] During the actual system operation, the sending terminal randomly selects the receiving terminal, and selects the trusted terminal with the shortest transmission distance to the sending terminal and the receiving terminal as the verification terminal. The verification terminal transmits the convolution result Y to the sending terminal, and its corresponding convolution parameter sequence W is used for the subsequent verification of the smart contract. Each terminal has reference sequence information, and the sending terminal selects a reference sequence X' of corresponding length according to the importance level of its own security business data. At this time, it can be seen from X*W=Y that the sending terminal can decrypt according to the reference sequence X' and the convolution result Y to obtain several decrypted convolution parameter sequences W'. It should be noted that the sending terminal needs to obtain multiple feasible solutions through traversal attempts, but only one feasible solution meets the conditions of the smart contract. Therefore, the sending terminal needs to pay a certain amount of computing resources to obtain a feasible solution that truly meets the conditions. At this time, the proof of work mechanism is met, but other terminals do not need to verify the feasible solution that meets the conditions, but verify it through the smart contract; preferably, constraints on feasible solutions can be set to limit the feasible solutions to a certain range of values, such as limiting the range of each parameter of the feasible solution to an integer and a decimal place in [0,100].

[0035] Then, the sending terminal inputs several decryption convolution parameter sequences into the smart contract. If the decryption convolution parameter sequence is equal to the convolution parameter sequence, the verification is passed. The sending terminal generates a recovery sequence and convolves its own security service identifier according to the decryption convolution parameter sequence when the verification is passed to obtain an encrypted security service identifier. The sending terminal transmits the encrypted security service identifier and the recovery sequence to the receiving terminal; the receiving terminal decrypts the encrypted security service identifier according to the recovery sequence and responds according to the decryption result. The recovery sequence is specifically: the ratio of the deconvolution parameter sequence to the convolution parameter sequence is recorded as the recovery sequence. The beneficial effect of this step is: it can ensure the security of the system and prevent attacks from malicious nodes.

[0036] Specifically, the sending terminal inputs several decryption convolution parameter sequences into the smart contract. If the decryption convolution parameter W' is equal to the convolution parameter sequence W, that is, W'=W, the verification is successful. After the verification is successful, the sending terminal generates a recovery sequence D / W, and convolves its own security service identifier based on the decryption convolution parameter sequence W' when the verification is successful to obtain the encrypted security service identifier Y'. At the same time, the sending terminal transmits the recovery sequence D / W and the encrypted security service identifier Y' to the receiving terminal. The purpose of this step is to prevent data from being intercepted by malicious nodes during transmission.

[0037] The receiving terminal receives the encrypted security service identifier Y' and the recovery sequence D / W, multiplies the encrypted security service identifier Y' with each element in the recovery sequence D / W, and obtains the decryption result as the sending terminal security service identifier, and responds; the purpose of this step is: the receiving terminal can only perform business identification and cannot obtain smart contract information, preventing the receiving terminal from affecting the verification process of the smart contract and avoiding malicious behavior by the receiving terminal.

[0038] Since the security service has been verified by the smart contract, the receiving terminal directly responds according to the security service identification of the sending terminal. For each responded security service, the trusted terminal to which it belongs records it and updates it to the database.

[0039] Furthermore, the security service system sets an update time to regularly update the degree of decentralization of the system. The degree of decentralization is specifically as follows: the number of times the terminal participates in sending or responding to security services and the number of times the terminal participates in security service verification are weighted and summed to obtain the degree of trust of the terminal; the difficulty evaluation value is obtained according to the information entropy of the convolution parameter sequence and the length of the convolution parameter sequence, and the degree of decentralization of the system is obtained according to the weighted sum of the mean value of the degree of trust of the terminal and the difficulty evaluation value. At the same time, the number of trusted terminals is obtained according to the degree of decentralization of the system and the total number of terminals. The beneficial effect of this step is that it can gradually reduce the workload of trusted nodes and achieve efficient system operation.

[0040] Specifically, the system sets an update time to periodically update the degree of decentralization ε. The formula for updating the degree of decentralization is:

[0041]

[0042] Among them, α and β are constant parameters used to control the adjustment range of the degree of decentralization. Preferably, in this embodiment, the values ​​are 0.6 and 0.4 respectively. represents the mean value of the trustworthiness of each terminal, It represents the average difficulty evaluation value of all terminals in the system within a period of time. Preferably, in this embodiment, the period of time is set to half a month.

[0043] The method for obtaining the terminal credibility is specifically as follows:

[0044] The number of trusted terminals Q is determined based on the degree of decentralization ε, which can be expressed as:

[0045]

[0046] in, Express Round down, the decentralization degree ε ranges from [0,1], Q maxis the total number of terminals, which is a known value.

[0047] At the same time, according to the determined Q, the terminals ranked first in the trustworthiness ranking are selected as the trusted terminals of the next system. The calculation method of the terminal trustworthiness is: Where Tr is the trustworthiness of the terminal before the system is updated, z1 is the number of times the terminal participates in sending or responding to security services within the update period, is the z1 growth coefficient, preferably, in this embodiment, set z2 is the number of times the terminal participates in security service verification within the update time. is the growth coefficient of z2. Preferably, in this embodiment,

[0048] The method for obtaining the difficulty evaluation value of the terminal is specifically as follows:

[0049] Preferably, the implementer can control the difficulty of decryption to achieve the purpose of controlling the data flow in the system. Specifically, information entropy is used as a constraint condition. The calculation formula of information entropy is: In this embodiment, Pi is the ratio of the number of elements in the convolution parameter sequence W whose element values ​​are the i-th value to the total number of elements in the convolution parameter sequence W. When i takes the maximum value K (sequence length), the information entropy value is the largest, and the values ​​of the elements in the convolution parameter sequence are all different; and the difficulty evaluation value τ of the terminal is obtained = H*e K .

[0050] The larger the mean difficulty evaluation value, the higher the decryption requirement according to the implementer's settings, the terminal credibility is not high or the data is more important. In this case, a smaller degree of decentralization should be used, and only terminals with high credibility should be used as trusted terminals. The smaller the mean difficulty evaluation value, the lower the decryption requirement according to the implementer's settings, the terminal credibility is sufficient or the data is not very important. In this case, a larger degree of decentralization should be used, and most terminals with high credibility should be used as trusted terminals.

[0051] Embodiment 2:

[0052] This embodiment provides a system for automating and responding to security business processes, the system comprising:

[0053] The data acquisition module is used to randomly generate a number of reference sequences through the security service system, each reference sequence corresponds to a type of security service data; the trusted terminal in the security service system generates a pair of convolution parameter sequence and deconvolution parameter sequence for each reference sequence, and obtains the convolution result of the reference sequence and the convolution parameter sequence;

[0054] The data analysis module is used to select a receiving terminal through a sending terminal, and select a trusted terminal with the shortest sum of transmission distances to the sending terminal and the receiving terminal as a verification terminal; the verification terminal transmits the convolution result to the sending terminal; the sending terminal decrypts according to the reference sequence corresponding to its own security service data category and the convolution result to obtain a number of decryption convolution parameter sequences;

[0055] The data response module is used to input several decryption convolution parameter sequences into the smart contract through the sending terminal. If the decryption convolution parameter sequence is equal to the convolution parameter sequence, the verification is successful. The sending terminal generates a recovery sequence and convolves its own security business identifier according to the decryption convolution parameter sequence when the verification is successful to obtain an encrypted security business identifier. The sending terminal transmits the encrypted security business identifier and the recovery sequence to the receiving terminal; the receiving terminal decrypts the encrypted security business identifier according to the recovery sequence and responds according to the decryption result.

[0056] It should be noted that the sequence of the embodiments of the present invention described above is for description only and does not represent the advantages and disadvantages of the embodiments. The above describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0057] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0058] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for automating and responding to a security business process, characterized in that: The method comprises the following steps: The security service system randomly generates a number of reference sequences, each of which corresponds to a type of security service data; the trusted terminal in the security service system generates a pair of convolution parameter sequence and deconvolution parameter sequence for each reference sequence, and obtains the convolution result of the reference sequence and the convolution parameter sequence; The sending terminal selects a receiving terminal and selects a trusted terminal with the shortest sum of transmission distances to the sending terminal and the receiving terminal as a verification terminal; the verification terminal transmits the convolution result to the sending terminal; the sending terminal decrypts according to the reference sequence corresponding to its own security service data category and the convolution result to obtain several decryption convolution parameter sequences; The sending terminal inputs several decryption convolution parameter sequences into the smart contract. If the decryption convolution parameter sequence is equal to the convolution parameter sequence, the verification is passed. The sending terminal generates a recovery sequence and convolves its own security service identifier according to the decryption convolution parameter sequence when the verification is passed to obtain an encrypted security service identifier. The sending terminal transmits the encrypted security service identifier and the recovery sequence to the receiving terminal; The receiving terminal decrypts the encrypted security service identifier according to the recovery sequence and responds according to the decryption result; The recovery sequence is specifically: the ratio of the deconvolution parameter sequence to the convolution parameter sequence is recorded as the recovery sequence.

2. The method according to claim 1, characterized in that: The method further comprises: The security business system sets an update time and regularly updates the system's degree of decentralization.

3. The method according to claim 2, characterized in that The degree of decentralization is specifically: The terminal's trustworthiness is obtained by taking a weighted sum of the number of times the terminal participates in sending or responding to security services and the number of times the terminal participates in security service verification. The difficulty evaluation value is obtained according to the information entropy of the convolution parameter sequence and the length of the convolution parameter sequence. The degree of decentralization of the system is obtained according to the weighted sum of the mean value of the terminal's trustworthiness and the difficulty evaluation value.

4. The method according to claim 1, characterized in that The method further includes: obtaining the number of trusted terminals according to the degree of decentralization of the system and the total number of terminals.

5. A system for automating and responding to security business processes, characterized in that: The system includes: The data acquisition module is used to randomly generate a number of reference sequences through the security service system, each reference sequence corresponds to a type of security service data; the trusted terminal in the security service system generates a pair of convolution parameter sequence and deconvolution parameter sequence for each reference sequence, and obtains the convolution result of the reference sequence and the convolution parameter sequence; The data analysis module is used to select a receiving terminal through a sending terminal, and select a trusted terminal with the shortest sum of transmission distances to the sending terminal and the receiving terminal as a verification terminal; the verification terminal transmits the convolution result to the sending terminal; the sending terminal decrypts according to the reference sequence corresponding to its own security service data category and the convolution result to obtain a number of decryption convolution parameter sequences; The data response module is used to input several decryption convolution parameter sequences into the smart contract through the sending terminal. If the decryption convolution parameter sequence is equal to the convolution parameter sequence, the verification is passed. The sending terminal generates a recovery sequence and convolves its own security service identifier according to the decryption convolution parameter sequence when the verification is passed to obtain an encrypted security service identifier. The sending terminal transmits the encrypted security service identifier and the recovery sequence to the receiving terminal; the receiving terminal decrypts the encrypted security service identifier according to the recovery sequence and responds according to the decryption result; The recovery sequence is specifically: the ratio of the deconvolution parameter sequence to the convolution parameter sequence is recorded as the recovery sequence.

6. The system according to claim 5, characterized in that The system further comprises: The decentralization degree update module is used to set the update time through the security business system and regularly update the system's decentralization degree.

7. The system according to claim 6, characterized in that The degree of decentralization is specifically: The terminal's trustworthiness is obtained by taking a weighted sum of the number of times the terminal participates in sending or responding to security services and the number of times the terminal participates in security service verification. The difficulty evaluation value is obtained according to the information entropy of the convolution parameter sequence and the length of the convolution parameter sequence. The degree of decentralization of the system is obtained according to the weighted sum of the mean value of the terminal's trustworthiness and the difficulty evaluation value.

8. The system according to claim 5, characterized in that The recovery sequence is specifically: the ratio of the deconvolution parameter sequence to the convolution parameter sequence is recorded as the recovery sequence.

9. The system according to claim 7, characterized in that The system is also used to obtain the number of trusted terminals according to the degree of decentralization of the system and the total number of terminals.

Images