A strategy authentication-based quorum system

Abstract

The application provides a strategy authentication-based quorum decision system, which comprises a strategy authentication receiver, a data authenticator, a data combiner, an authentication data recorder, an authentication data parser, and a strategy authentication sender. The strategy authentication receiver is used for receiving an authentication strategy sent by a dispatcher. The data authenticator is used for performing authentication processing on to-be-output data of an execution body according to the authentication strategy. The data combiner is used for combining the to-be-output data and authentication data and then sending the combined data to a decision maker. The authentication data recorder is used for storing the authentication data. The authentication data parser is used for parsing the authentication data from the combined data sent by the execution body which is received first, then searching the authentication data recorder to check whether the authentication data exists, if the authentication data exists, directly sending the to-be-output data to an external user, if the authentication data does not exist, comparing the to-be-output data sent by each execution body, if the to-be-output data is consistent, storing the parsed authentication data in the authentication data recorder, if the to-be-output data is not consistent, not storing the authentication data in the authentication data recorder. The strategy authentication sender is used for sending the authentication strategy to each execution body.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of mimicry defense, and in particular to a mimicry decision system based on strategy authentication. BACKGROUND

[0002] The mimicry system relies on a decision mechanism to identify unknown threats. In order to ensure the accuracy of the identification, the decision maker needs to make a decision on the output data. However, whether it is a "large number decision" or a "backward decision" mechanism, it is inevitable to process the output data of three execution bodies, which undoubtedly brings additional system overhead. How to reduce the number of decisions on the output data of the execution body while ensuring the accuracy of the decision is of great significance to reducing the additional overhead of the mimicry system. SUMMARY

[0003] In order to solve the above problems, it is necessary to provide a mimicry decision system based on strategy authentication.

[0004] The first aspect of the present application provides a mimicry decision system based on strategy authentication, comprising:

[0005] A strategy authentication receiver is arranged in each execution body and is used to receive an authentication strategy sent by a scheduler;

[0006] A data authenticator is arranged in each execution body and is used to authenticate the to-be-output data of the execution body according to the authentication strategy;

[0007] A data combiner is arranged in each execution body and is used to combine the to-be-output data and the authentication data and then send the combined data to a decision maker;

[0008] An authentication data recorder is arranged in the decision maker and is used to store the authentication data;

[0009] An authentication data parser is arranged in the decision maker and is used to parse the authentication data from the combined data sent by the execution body that is received first, and then search the authentication data recorder to check whether there is the authentication data. If there is the authentication data, the to-be-output data of the execution body is directly sent to an external user, and the data sent by other execution bodies is no longer processed;

[0010] If there is no authentication data in the authentication data recorder, the to-be-output data sent by each execution body is compared to check whether they are consistent. If they are consistent, the parsed authentication data is stored in the authentication data recorder. If they are not consistent, the authentication data recorder does not record the authentication data;

[0011] A strategy authentication sender is arranged in the scheduler and is used to send the authentication strategy to each execution body at a regular time.

[0012] The second aspect of the present application provides a mimicry decision method based on strategy authentication, comprising the following steps:

[0013] The scheduler strategy authentication transmitter sends the authentication strategy to the strategy authentication receiver of the execution body;

[0014] After the execution body receives the data to be output, the data authenticationer first authenticates the data to be output by using the authentication strategy; after the authentication, the data combiner combines the data to be output and the authenticated data and sends them to the adjudicator;

[0015] After the adjudicator receives the combined data sent by the first execution body, the authentication data parser first parses the authentication data from the combined data, and then searches the authentication data recorder to find whether the authentication data exists;

[0016] If the authentication data does not exist in the authentication data recorder after the search, the combined data of other execution bodies are waited for, and the data to be output of all execution bodies are judged; if the judgment is consistent, the authentication data is stored in the authentication data recorder; if the judgment is inconsistent, the authentication data recorder does not record the authentication data, and the adjudicator notifies the scheduler to clean up the abnormal execution body;

[0017] If the authentication data is found in the authentication data recorder, the data to be output of the execution body is directly sent to the external user, and the combined data sent by other execution bodies is directly discarded and no longer processed.

[0018] The present application introduces a strategy authentication mechanism in the quasisystem, adopts the judgment strategy of "authenticating the effective and releasing the judgment", and does not need to compare and verify each output data, thereby improving the judgment efficiency of the adjudicator and enabling the quasisystem to effectively cope with the business scene of "large amount of query data and small amount of modified data".

[0019] Additional aspects and advantages of the present application will become apparent from the following description with reference to the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0020] The above and / or additional aspects and advantages of the present application will become apparent and more readily appreciated from the following description, taken in conjunction with the accompanying drawings, in which:

[0021] Figure 1 The system structure block diagram of the present application is shown.

[0022] Figure 2 The system structure block diagram of the application example of the present application is shown. DETAILED DESCRIPTION

[0023] In order to enable the above-mentioned objects, features and advantages of the present application to be clearer, the following further describes the present application with reference to the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0024] In the following description, a large number of specific details are set forth in order to facilitate a thorough understanding of the present application, however, the present application can also be implemented in other manners different from those described herein, and therefore, the protective scope of the present application is not limited by the specific embodiments disclosed below.

[0025] As shown in Figure 1 The present application proposes a mimic decision system based on policy authentication, comprising:

[0026] A policy authentication receiver is arranged in each execution body and is used to receive the authentication policy sent by the scheduler;

[0027] A data authenticator is arranged in each execution body and is used to perform authentication processing on the to-be-output data of the execution body according to the authentication policy;

[0028] A data combiner is arranged in each execution body and is used to combine the to-be-output data and the authentication data and then send the combined data to the decision maker;

[0029] An authentication data recorder is arranged in the decision maker and is used to store the authentication data;

[0030] An authentication data parser is arranged in the decision maker and is used to parse the authentication data from the combined data sent by the execution body that is received first, then search the authentication data recorder to check whether there is the authentication data, if there is the authentication data, directly send the to-be-output data of the execution body to the external user, and the data sent by other execution bodies is not processed any more;

[0031] If there is no authentication data in the authentication data recorder, compare the to-be-output data sent by each execution body to check whether they are consistent, if they are consistent, store the parsed authentication data in the authentication data recorder, if they are not consistent, the authentication data recorder does not record the authentication data;

[0032] A policy authentication sender is arranged in the scheduler and is used to send the authentication policy to each execution body at a regular time.

[0033] The method for implementing the decision of the mimic decision system based on policy authentication of the present application comprises the following steps:

[0034] The policy authentication sender of the scheduler sends the authentication policy to the policy authentication receiver of the execution body at a regular time;

[0035] After the execution body receives the data to be output, the data authenticator first authenticates the data to be output by using the authentication strategy; after the authentication, the data combiner combines the data to be output and the authenticated data and sends the combined data to the arbiter;

[0036] After the arbiter receives the combined data sent by the first execution body, the authentication data parser first parses the authentication data from the combined data, and then searches the authentication data recorder to find whether the authentication data exists;

[0037] If the authentication data does not exist in the authentication data recorder after the search, the combined data of other execution bodies is waited for, and the data to be output of all execution bodies is judged; if the judgment is consistent, the authentication data is stored in the authentication data recorder; if the judgment is inconsistent, the authentication data recorder does not record the authentication data, and the arbiter notifies the scheduler to clean up the abnormal execution body;

[0038] If the authentication data is found in the authentication data recorder, the data to be output of the execution body is directly sent to the external user, and the combined data sent by other execution bodies is directly discarded and not processed.

[0039] Particularly, the authentication strategy in the present application can adopt a data encryption strategy (MD5 encryption, DES encryption, self-defined encryption algorithm) or a data compression strategy (HASH operation, self-defined compression), and the scheduler strategy authentication sender sends the authentication strategy, and dynamic adjustment is performed.

[0040] As shown in the following, the specific implementation mode of the embodiment is introduced in detail by taking that a user requests data in a database through an HTTP protocol as an example. Figure 2

[0041] A user table exists in the mysql database on the execution body, the user table has three data (A, B, C), and when a user requests user data through a browser, a web application on the execution body takes out the data (A, B, C) from the database and then sends the data to the user through an HTTP protocol.

[0042] The scheduler strategy authentication sender sends a HASH authentication strategy to the execution bodies 1-3;

[0043] ​At t0, the user data of the mysql database is data (A, B, C), after the execution body 1-3 receives the user request data, the data authenticator first takes data (A, B, C) from the mysql data, and then adopts the HASH authentication strategy to authenticate data (A, B, C), and the authenticated data is HASH (A, B, C), the data combiner encapsulates uuid=HASH (A, B, C) into the HEADER field in the HTTP protocol, and encapsulates data (A, B, C) into the body text;

[0044] After the adjudicator receives the reply data sent by the execution body 1, first parses the uuid field in the HEADER of the HTTP data message, and then finds whether the HASH (A, B, C) data exists in the authentication data recorder; after searching, it does not exist, then waits for the HTTP response message of the other execution body, and judges the data in the body of the three HTTP response messages, and if the judgment is consistent, the uuid is stored in the authentication data recorder; if the judgment is inconsistent, the adjudicator notifies the scheduler to clean up the abnormal execution body, and the uuid is not recorded in the authentication data recorder.

[0045] At t1, the mysql database of each execution body does not change, after receiving the user HTTP request, the HTTP response data returned by the execution body is the same as the processing method at t0. After the adjudicator receives the response data sent by the execution body 1, the uuid field in the HEADER is extracted, and whether the field exists in the authentication data recorder is found; after searching, the field exists, then the data of the execution body 1 is directly sent to the user, and later the response data of the execution body 2 and the execution body 3 is received, and is directly discarded without further processing.

[0046] At t2, when the mysql database of each execution body changes, the same processing method as at t0 is adopted.

[0047] Among them, the authentication strategy sent by the scheduler changes, and will not affect the processing flow at t0, t1 and t2; only when the authentication strategy changes, the adjudicator needs to record the authentication data again.

[0048] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A policy-based authentication based aposiopesis adjudication system, characterized in that, The method comprises the following steps: The policy authentication receiver is arranged in each execution body and is used for receiving the authentication policy sent by the dispatcher; The data authenticator is arranged in each execution body and is used for performing authentication processing on the to-be-output data of the execution body according to the authentication policy; The data combiner is arranged in each execution body and is used for combining the to-be-output data and the authentication data and then sending the combined data to the adjudicator; The authentication data recorder is arranged in the adjudicator and is used for storing the authentication data; The authentication data parser is arranged in the adjudicator, the authentication data is parsed from the combined data sent by the first received execution body, and then it is determined whether the authentication data exists in the authentication data recorder; If the authentication data does not exist in the authentication data recorder, it is determined whether the to-be-output data sent by each execution body is consistent, if the to-be-output data is consistent, the parsed authentication data is stored in the authentication data recorder, and if the to-be-output data is inconsistent, the authentication data is not recorded in the authentication data recorder; The policy authentication sender is arranged in the dispatcher and is used for sending the authentication policy to each execution body at a fixed time.

2. The policy-based authentication-based aposematism adjudication system according to claim 1, characterized in that: The authentication policy adopts a data encryption policy or a data compression policy.

3. A mimicry adjudication method based on policy authentication, characterized in that, The method comprises the following steps: The policy authentication sender of the dispatcher sends the authentication policy to the policy authentication receiver of the execution body at a fixed time; After the execution body receives the to-be-output data, the data authenticator first performs authentication on the to-be-output data according to the authentication policy, the data combiner combines the to-be-output data and the authenticated data and then sends the combined data to the adjudicator after the authentication is completed; After the adjudicator receives the combined data sent by the first execution body, the authentication data parser first parses the authentication data from the combined data, and then determines whether the authentication data exists in the authentication data recorder; If the authentication data does not exist in the authentication data recorder, the combined data of other execution bodies is waited for, and the to-be-output data of all execution bodies is determined; if the determination is consistent, the authentication data is stored in the authentication data recorder; If the determination is inconsistent, the authentication data is not recorded in the authentication data recorder, and the dispatcher is notified by the adjudicator to clean up the abnormal execution body; If the authentication data is found in the authentication data recorder, the to-be-output data of the execution body is directly sent to the external user, and the combined data sent by other execution bodies is directly discarded and is not processed.

4. The quorum judgment method based on policy authentication according to claim 3, wherein: The authentication policy adopts a data encryption policy or a data compression policy, and the authentication policy sent by the policy authentication sender of the dispatcher is dynamically adjusted.

Images