A rule flow conversion method, device, equipment and storage medium

Abstract

The application discloses a rule flow conversion method and device, equipment and a storage medium. The method comprises the following steps: acquiring rule information and attribute information corresponding to the rule information; acquiring a digital certificate corresponding to the rule information based on the attribute information; establishing a rule data set based on the rule information, the attribute information and the digital certificate; and sending the rule data set. In this way, the authenticity, integrity and non-repudiation of rule data in the rule flow conversion process can be ensured.

Description

Technical Field

[0001] This application relates to the field of rule engine technology, and in particular to a rule flow method, apparatus, device and storage medium. Background Technology

[0002] Snort is an open-source intrusion prevention system that uses a simple, lightweight rule description language to define a set of rules to help define malicious network activity and uses these rules to find matching packets.

[0003] As Snort technology becomes more standardized and mature, Snort rule sets are frequently and automatically imported in practical applications. If the information security attributes of these rule sets are not protected, the rules within them can be easily copied or altered, losing their confidentiality, authenticity, and validity. Furthermore, from a management perspective, Snort rule sets need to be non-repudiable, and their circulation requires a certain level of authority, meaning there needs to be some endorsement from the person or organization that issued the rule set. Additionally, some rules may only be valid within certain organizations, becoming invalid outside of those organizations; or the rule set creators may have imposed a validity period, after which the rule set becomes invalid. Therefore, a rule circulation method is needed to verify and guarantee the confidentiality, authenticity, and non-repudiation of the transmitted Snort rule sets in real time during the rule circulation process. Summary of the Invention

[0004] This application provides a rule transfer method, apparatus, device, and storage medium that can guarantee the authenticity, integrity, and non-repudiation of rule data during the rule transfer process.

[0005] On the one hand, embodiments of this application provide a rule flow method, which includes:

[0006] Retrieve rule information and the corresponding attribute information;

[0007] Obtain the digital certificate corresponding to the rule information based on attribute information;

[0008] A rule dataset is established based on rule information, attribute information, and digital certificates;

[0009] Send the rule dataset.

[0010] Furthermore, the digital certificate corresponding to the rule information is obtained based on attribute information, including:

[0011] Generate the first and second keys corresponding to the rule information; the first and second keys match each other.

[0012] The certificate application document is determined based on the second key and the date, region, and terminal information in the attribute information; the date information is the effective date of the rule information; the region information is the effective region range of the rule information; and the terminal information is the effective terminal device range of the rule information.

[0013] Based on the certificate application document, a digital certificate is applied for and obtained from the public key infrastructure system through the cloud platform; the digital certificate includes certificate data and digital signature; the certificate data includes a second key, date information, geographical information and terminal information; the digital signature is obtained by the public key infrastructure system signing the certificate data with a third key.

[0014] Furthermore, after obtaining the digital certificate corresponding to the rule information based on the attribute information, and before establishing the rule dataset based on the rule information, attribute information, and digital certificate, the following steps are also included:

[0015] The second key in the digital certificate is verified based on the first key corresponding to the rule information;

[0016] If the second key verification is successful, a correspondence is established between the digital certificate and the encoded information in the attribute information; the encoded information is the identification number corresponding to the rule information.

[0017] Furthermore, a rule dataset is established based on rule information, attribute information, and digital certificates, including:

[0018] The rule data information of the rule dataset is determined based on the encoding information in the rule information and attribute information;

[0019] Based on the first key corresponding to the rule information, the rule data information is signed to obtain the signed rule data information.

[0020] A rule dataset is created based on the signed rule data and digital certificate.

[0021] On the other hand, embodiments of this application provide a rule transfer method, which includes:

[0022] In response to a rule import request, the system receives a rule dataset. The rule dataset is constructed by the rule generator based on the rule information, the attribute information corresponding to the rule information, and the digital certificate corresponding to the rule information.

[0023] The digital certificates in the rule dataset are verified based on the pre-built root certificate and online certificate status protocol.

[0024] If the digital certificate verification is successful, the rule data information after being centrally signed in the rule dataset is verified based on the digital certificate;

[0025] If the signed rule data information passes verification, the attribute information in the digital certificate is verified.

[0026] If the attribute information verification passes, import the rule dataset.

[0027] Furthermore, based on the pre-defined root certificate and online certificate status protocol, the digital certificates in the rule dataset are verified, including:

[0028] The trustworthiness of the digital certificate is verified based on the fourth key in the root certificate; the fourth key is matched with the third key.

[0029] The validity of digital certificates is verified based on the online certificate status protocol.

[0030] Furthermore, the attribute information includes date information, geographic information, and terminal information;

[0031] If the attribute information validation passes, import the rule dataset, including:

[0032] If the current date is within the date information, the current region is within the range corresponding to the region information, and the current terminal matches the terminal information, import the rule dataset.

[0033] On the other hand, embodiments of this application provide a rule transfer device, which includes:

[0034] The information acquisition module is used to acquire rule information and the attribute information corresponding to the rule information;

[0035] The digital certificate acquisition module is used to obtain the digital certificate corresponding to the rule information based on attribute information.

[0036] The rule dataset creation module is used to create rule datasets based on rule information, attribute information, and digital certificates.

[0037] The rule dataset sending module is used to send rule datasets.

[0038] Furthermore, the digital certificate acquisition module includes:

[0039] Generate the first and second keys corresponding to the rule information; the first and second keys match each other.

[0040] The certificate application document is determined based on the second key and the date, region, and terminal information in the attribute information; the date information is the effective date of the rule information; the region information is the effective region range of the rule information; and the terminal information is the effective terminal device range of the rule information.

[0041] Based on the certificate application document, a digital certificate is applied for and obtained from the public key infrastructure system through the cloud platform; the digital certificate includes certificate data and digital signature; the certificate data includes a second key, date information, geographical information and terminal information; the digital signature is obtained by the public key infrastructure system signing the certificate data with a third key.

[0042] Furthermore, the device also includes:

[0043] The key verification module is used to verify the second key in the digital certificate based on the first key corresponding to the rule information; if the second key is verified, a correspondence is established between the digital certificate and the encoded information in the attribute information; the encoded information is the identification number corresponding to the rule information.

[0044] Furthermore, the rule dataset building module includes:

[0045] The rule data information of the rule dataset is determined based on the encoding information in the rule information and attribute information;

[0046] Based on the first key corresponding to the rule information, the rule data information is signed to obtain the signed rule data information.

[0047] A rule dataset is created based on the signed rule data and digital certificate.

[0048] On the other hand, embodiments of this application provide a rule transfer device, which includes:

[0049] The rule dataset receiving module is used to receive rule datasets in response to rule import requests; the rule dataset is constructed by the rule generator based on rule information, attribute information corresponding to the rule information, and digital certificate corresponding to the rule information;

[0050] The digital certificate verification module is used to verify digital certificates in the rule dataset based on the pre-set root certificate and online certificate status protocol;

[0051] The rule data information verification module is used to verify the rule data information after it has been centrally signed, based on the digital certificate, if the digital certificate verification is successful.

[0052] The attribute information verification module is used to verify the attribute information in the digital certificate if the signed rule data information passes the verification.

[0053] The rule dataset import module is used to import the rule dataset if the attribute information validation passes.

[0054] Furthermore, the digital certificate verification module includes:

[0055] The trustworthiness of the digital certificate is verified based on the fourth key in the root certificate; the fourth key is matched with the third key.

[0056] The validity of digital certificates is verified based on the online certificate status protocol.

[0057] Furthermore, the attribute information includes date information, geographic information, and terminal information;

[0058] The rule dataset import module includes:

[0059] If the current date is within the date information, the current region is within the range corresponding to the region information, and the current terminal matches the terminal information, import the rule dataset.

[0060] On the other hand, embodiments of this application provide an electronic device, which includes a processor and a memory. The memory stores at least one instruction or at least one program, and the processor loads and executes the rule flow method described above.

[0061] On the other hand, embodiments of this application provide a computer storage medium storing at least one instruction or at least one program, wherein the at least one instruction or at least one program is loaded and executed by a processor to implement the rule flow method described above.

[0062] The rule transfer method, apparatus, device, and storage medium provided in this application have the following technical effects:

[0063] The process involves acquiring rule information and its corresponding attribute information, obtaining the digital certificate corresponding to the rule information based on the attribute information, building a rule dataset based on the rule information, attribute information, and digital certificate, and then sending the rule dataset. This ensures the authenticity, integrity, and non-repudiation of rule data during the rule flow process. Attached Figure Description

[0064] To more clearly illustrate the technical solutions and advantages in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0065] Figure 1 This is a schematic diagram of an application environment provided in an embodiment of this application;

[0066] Figure 2 This is a flowchart illustrating a rule transfer method provided in an embodiment of this application;

[0067] Figure 3 This is a flowchart illustrating a rule transfer method provided in an embodiment of this application;

[0068] Figure 4 This is a flowchart illustrating a rule transfer method provided in an embodiment of this application;

[0069] Figure 5 This is a flowchart illustrating a rule transfer method provided in an embodiment of this application;

[0070] Figure 6 This is a schematic diagram of the structure of a regular flow device provided in an embodiment of this application;

[0071] Figure 7 This is a schematic diagram of the structure of a regular flow device provided in an embodiment of this application;

[0072] Figure 8 This is a hardware structure block diagram of a server for a rule flow method provided in an embodiment of this application. Detailed Implementation

[0073] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0074] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0075] Please see Figure 1 , Figure 1This is a schematic diagram of an application environment provided in an embodiment of this application, including a rule generation terminal 101, a rule import terminal 102, and a rule transfer system 103. The rule generation terminal 101 generates the rule information required by the rule import terminal 102; the rule import terminal 102 imports the rule information and performs corresponding operations based on the rule information, such as intrusion detection and defense. The rule generation terminal 101 and the rule import terminal 102 are each equipped with a rule transfer system 103, or the rule generation terminal 101 and the rule import terminal 102 are each connected to the rule transfer system 103. The rule generation terminal 101 establishes a rule dataset corresponding to the rule information through the rule transfer system 103; the rule import terminal 102 verifies the received rule dataset through the rule transfer system, and if the verification is successful, imports the rule information contained in the rule dataset.

[0076] Specifically, the rule generation end 101 obtains the rule information and the attribute information corresponding to the rule information, obtains the digital certificate corresponding to the rule information based on the attribute information, establishes a rule dataset based on the rule information, attribute information and digital certificate, and sends the rule dataset.

[0077] Specifically, the rule importer 102 responds to the rule import request by receiving the rule dataset. The rule dataset is constructed by the rule generator based on the rule information, the attribute information corresponding to the rule information, and the digital certificate corresponding to the rule information. Based on the pre-set root certificate and online certificate status protocol, the digital certificate in the rule dataset is verified. If the digital certificate verification is successful, the signed rule data information in the rule dataset is verified based on the digital certificate. If the signed rule data information verification is successful, the attribute information in the digital certificate is verified. If the attribute information verification is successful, the rule dataset is imported.

[0078] In this embodiment, multiple rule generation endpoints 101 and multiple rule import endpoints 102 can exist. One rule generation endpoint 101 can correspond to multiple rule import endpoints 102, defining rules and generating rule datasets for the multiple rule import endpoints 102; one rule import endpoint 102 can also correspond to multiple rule generation endpoints 101, receiving and importing rule datasets from the multiple rule generation endpoints 101. Correspondingly, multiple rule transfer systems 103 can also exist. One rule generation endpoint 101 can transmit rules to different rule import endpoints 102 through different rule transfer systems 103, and one rule import endpoint 102 can receive rule datasets from different rule generation endpoints 101 through different rule transfer systems 103. Thus, one or more rule transfer chains are formed between the rule generation endpoints 101 and the rule import endpoints 102, thereby forming a large-scale rule transfer system.

[0079] In this embodiment of the application, the rule transfer system 103 may be an application program or software built into a computer or server, or it may be a cloud platform, or a dedicated computer or server for executing the rule transfer method.

[0080] The following describes a specific embodiment of a rule-based workflow method according to this application. Figure 2 This is a flowchart illustrating a rule flow method provided in an embodiment of this application. This specification provides method operation steps as shown in the embodiments or flowcharts, but based on conventional or non-inventive labor, more or fewer operation steps may be included. The order of steps listed in the embodiments is merely one possible execution order among many, and does not represent the only execution order. In actual system or server product execution, the method can be executed sequentially according to the embodiments or drawings, or in parallel (e.g., in a parallel processor or multi-threaded processing environment). Specifically, as shown... Figure 2 As shown, the method may include:

[0081] S201: Obtain rule information and the attribute information corresponding to the rule information.

[0082] In this embodiment of the application, the rule generation end 101 obtains the rule information and the attribute information corresponding to the rule information based on the entered rule fields.

[0083] As an optional implementation, rule fields can be entered based on a rule data form. These rule fields may include the following: rule name, rule type, rule header, and rule body.

[0084] As an optional implementation, the rule header may include source address, source port, destination address, destination port, rule action, and protocol type. The rule body may include keywords and variable values. Among the keywords, the sid and mid fields are required and unique.

[0085] As an optional implementation, when entering rule fields, non-empty checks and legality checks are performed on the fields other than the rule body variable values ​​to ensure the validity and legality of the rule information obtained.

[0086] As an optional implementation, when entering rule fields, information such as the effective date, effective region, and effective terminal device range for the relevant rule fields will also be entered simultaneously. The effective date yields the date information of the rule information, the effective region yields the region information of the rule information, and the effective terminal device range yields the terminal information of the rule information. Furthermore, since the sid field in the rule body keyword is unique, it can be used as the encoding information of the rule information, uniquely identifying a single rule. Attribute information is obtained from the aforementioned date information, region information, terminal information, and encoding information.

[0087] S203: Obtain the digital certificate corresponding to the rule information based on attribute information.

[0088] In this embodiment, a digital certificate corresponding to rule information is obtained based on date information, geographic information, and terminal information in the attribute information. Specifically, the date information limits the validity period of the digital certificate, the geographic information limits the effective domain range of the digital certificate, and the terminal information limits the effective terminal range of the digital certificate. Therefore, the obtained digital certificate reflects the date information, geographic information, and terminal information corresponding to the rule information, and based on the content of the obtained digital certificate, the validity period, effective domain range, and effective terminal devices of the rule information can be determined.

[0089] Specifically, Figure 3 The following is a flowchart illustrating a rule transfer method provided in an embodiment of this application, as shown in the figure. Figure 3 As shown, step S203: Obtaining the digital certificate corresponding to the rule information based on attribute information may include:

[0090] S301: Generate the first key and the second key corresponding to the rule information.

[0091] In this embodiment of the application, the first key and the second key are matched, wherein the first key is a private key stored locally on the rule generation terminal 101, and the second key is a public key written into the digital certificate. The first key and the second key constitute a key pair.

[0092] As an optional implementation, the final generated rule dataset can contain multiple rule pieces, which can use the same key pair (i.e., a first key and a second key) and the same digital certificate; that is, one rule dataset corresponds to one digital certificate. In this case, the multiple rule pieces in the rule dataset have the same attribute information.

[0093] As an alternative implementation, multiple rule information entries in a rule dataset may each use a key pair and a different digital certificate, thus a rule dataset may contain multiple digital certificates.

[0094] As an alternative implementation, each rule information can be encapsulated into a rule dataset, and the digital certificate in the rule dataset is only valid for the rule information in that rule dataset.

[0095] As an optional implementation, a key pair library can be pre-set, containing multiple pre-written pairs of first and second keys. For each rule piece of information obtained, a pair of first and second keys is extracted from this key pair library. The extraction can be performed in a specific order or according to a pattern, or it can be random. By limiting the first and second keys through the key pair library, the data storage requirements of the rule generation terminal 101 can be reduced when the number of rule pieces of information is large.

[0096] S303: Determine the certificate application file based on the second key and the date, region and terminal information in the attribute information.

[0097] In this embodiment of the application, the second key is used as the public key of the digital certificate, the date information is used as the validity period of the digital certificate, the geographical information is used as the geographical scope of the digital certificate, and the terminal information is used as the terminal device scope of the digital certificate, thereby determining the certificate application document.

[0098] S305: Apply for and obtain a digital certificate from the public key infrastructure system through a cloud platform based on the certificate application document.

[0099] In this embodiment, the digital certificate includes certificate data and a digital signature. The certificate data includes a second key, date information, geographic information, and terminal information. The digital signature is obtained by a Public Key Infrastructure (PKI) system signing the certificate data using a third key. The third key is the private key of the PKI system, and correspondingly, a fourth key matching the third key exists as the public key of the PKI system.

[0100] In this embodiment of the application, due to the industry practice of public key infrastructure (PKI) system applications, digital certificate applicants cannot directly establish a connection with the public key infrastructure (PKI) system to apply for digital certificates. Instead, they need to establish an intermediate connection through a cloud platform and apply for digital certificates from the public key infrastructure (PKI) system through the cloud platform.

[0101] In this embodiment of the application, the cloud platform can be a dedicated cloud platform for the rule generation end 101, or it can be a shared cloud platform for all rule generation ends 101 and rule import ends 102 that adopt the rule transfer method of this application.

[0102] In this embodiment, before applying for and obtaining a digital certificate from a Public Key Infrastructure (PKI) system, the rule generation end 101 needs to establish a certificate chain with other rule generation ends 101, rule import ends 102, and the cloud platform. This operation can be completed during the initial construction of the rule flow system. This certificate chain enables the establishment of a secure and reliable data transmission chain between each rule generation end 101, rule import end 102, and cloud platform within it. Each rule generation end 101, rule import end 102, and cloud platform in the certificate chain can have a pre-configured general certificate and a root certificate. The general certificate is used to establish the certificate chain connection; the root certificate is used to verify the received data, and the root certificate includes the public key of the Public Key Infrastructure (PKI), i.e., the fourth key.

[0103] In this embodiment, the rule generator 101 sends the determined certificate application file to the cloud platform to obtain the digital certificate. Optionally, the certificate application file can be a P10 request.

[0104] As an alternative implementation, a Public Key Infrastructure (PKI) system can be one that can directly recognize P10 requests. Upon receiving the certificate request file, the cloud platform directly forwards it to the PKI.

[0105] As an alternative implementation, the Public Key Infrastructure (PKI) system may be a system that cannot directly recognize P10 requests. After receiving the certificate application file, the cloud platform converts the certificate application file into a format that the corresponding PKI system can recognize, and then sends the converted certificate application file to the PKI system.

[0106] In this embodiment of the application, after receiving the certificate application file, the Public Key Infrastructure (PKI) system obtains the second key, date information, regional information and terminal information contained in the certificate application file, i.e., certificate data. Then, it performs a hash operation on the certificate data to obtain the hash value corresponding to the certificate data. Then, it encrypts the hash value with the third key to complete the signing of the certificate data and obtain a digital signature.

[0107] As an optional implementation, after the Public Key Infrastructure (PKI) system generates a digital certificate, it can publish the digital certificate to a Lightweight Directory Access Protocol (LDAP) or Online Certificate Status Protocol (OSCP) server so that the rule importer 102 can verify whether the digital certificate contained in the rule dataset has been revoked after receiving the rule dataset, thereby ensuring the validity of the rule dataset imported by the rule importer 102.

[0108] As an alternative implementation, a digital certificate will be revoked if one or more of the following conditions exist:

[0109] In the first scenario, the rule information is proven to be incorrect;

[0110] The second scenario is that the digital certificate has expired or been lost;

[0111] The third scenario is that the key for the rule information becomes invalid, that is, either the first key or the second key becomes invalid.

[0112] In the fourth scenario, the rule generator 101 requests a rejection of the rule dataset it generates.

[0113] As an optional implementation, the rule flow method provided in this application embodiment may include, but is not limited to, the above four situations, in which the digital certificate for calibration information can be revoked.

[0114] As an optional implementation, after obtaining the digital certificate, the obtained digital certificate can also be verified. Specifically, based on the first key corresponding to the rule information, the second key in the digital certificate is verified, thereby preventing the digital certificate from being tampered with during the process of sending it to the rule generation terminal 101. At the same time, it avoids the rule generation terminal 101 from establishing an incorrect correspondence between the digital certificates and the rule information when obtaining multiple digital certificates at the same time.

[0115] As an optional implementation, if the second key verification is successful, a correspondence is established between the digital certificate and the encoded information. Since the encoded information uniquely identifies a rule information, establishing a correspondence between the encoded information and the digital certificate allows the digital certificate to be associated with the rule information.

[0116] The digital certificate corresponding to the rule information is obtained through the above method. The standardized information such as the validity period, geographical scope and terminal device scope of the digital certificate is linked with the rule circulation method. The digital certificate is used to ensure the constraints on date information, geographical information and terminal information during the rule circulation process, and to prevent the rule import terminal 102 from importing inapplicable rule datasets.

[0117] S205: Establish a rule dataset based on rule information, attribute information, and digital certificates.

[0118] In the embodiments of this application, Figure 4 The following is a flowchart illustrating a rule transfer method provided in an embodiment of this application, as shown in the figure. Figure 4 As shown, step S205: Establishing a rule dataset based on rule information, attribute information, and digital certificates may include:

[0119] S401: Determine the rule data information of the rule dataset based on the encoding information in the rule information and attribute information.

[0120] In this embodiment of the application, the rule data information includes rule information and the encoding information corresponding to the rule information.

[0121] As an optional implementation, the rule data information may also include remarks, which are additional descriptions of the rule information or the terminal device used, i.e., the rule import terminal 102.

[0122] As an optional implementation, the rule data information may also include the key ID of the fifth key. Accordingly, before constructing the rule data information, the rule information is first encrypted using the fifth key generated by the key management system (KMS), and the key ID corresponding to the fifth key is obtained. Specifically, the rule generation end 101 calls the key management system (KMS) interface, passing in the encoded information corresponding to the rule information, i.e., the sid field; the key management system (KMS) generates a symmetric key based on the encoded information, i.e., the fifth key, and simultaneously returns the key ID of the fifth key to the rule generation end 101; the rule generation end calls the security middleware to encrypt the rule information using the key ID of the fifth key, thereby ensuring the confidentiality of the rule information.

[0123] As an optional implementation, the rule data information may also include other attribute information, namely date information, region information and terminal information, to create redundancy in the rule data information. This allows for further verification of the reliability of the date information, region information and terminal information in the digital certificate when the rule import terminal 102 verifies the rule dataset in the subsequent process, thereby improving the reliability of the rule dataset.

[0124] S403: Based on the first key corresponding to the rule information, sign the rule data information to obtain the signed rule data information.

[0125] In this embodiment of the application, the rule data information is first hashed to obtain the hash value of the rule data information. Then, the hash value of the rule data information is encrypted using the first key corresponding to the rule information, thereby completing the signature of the rule data information and obtaining the signed rule data information.

[0126] S405: Establish a rule dataset based on the signed rule data information and digital certificate.

[0127] As an optional implementation, the rule dataset may also include the service address of at least one of the Lightweight Directory Access Protocol (LDAP) and Online Certificate Status Protocol (OSCP), providing an access address for the rule importer 102 to query the validity status of the received rule dataset in LDAP and OSCP.

[0128] S207: Send the rule dataset.

[0129] By establishing a rule dataset using the above method, not only can the rule information be signed with a digital certificate, ensuring the authenticity, integrity, and non-repudiation of the calibration results during the rule circulation process, but the digital signature corresponding to the rule information in the rule dataset can also reflect the effective date, effective domain range, and effective terminal device range of the rule information.

[0130] Figure 5 This application illustrates a rule flow method provided by an embodiment, such as... Figure 5 As shown, the method includes:

[0131] S501: Receives the rule dataset in response to the rule import request.

[0132] In this embodiment of the application, the rule dataset received by the rule import terminal 102 is constructed by the rule generation terminal 101 based on the rule information, the attribute information corresponding to the rule information, and the digital certificate corresponding to the rule information.

[0133] S503: Verifies digital certificates in the rule dataset based on pre-built root certificates and online certificate status protocols.

[0134] In this embodiment, the verification of digital certificates in the rule dataset is divided into two steps: trustworthiness verification and validity verification. Specifically, the digital certificate is verified for legitimacy based on the pre-set root certificate to confirm whether the digital certificate was generated by the public key infrastructure (PKI) system corresponding to the certificate chain where the rule importer 102 is located; the digital certificate is verified for validity based on the Lightweight Directory Access Protocol (LDAP) or the Online Certificate Status Protocol (OSCP) to confirm whether the digital certificate has been revoked and whether it is still usable.

[0135] As an alternative implementation, whether to query whether a digital certificate has been revoked based on Lightweight Directory Access Protocol (LDAP) or Online Certificate Status Protocol (OSCP) depends on whether the rule dataset centrally stores the service address of Lightweight Directory Access Protocol (LDAP) or Online Certificate Status Protocol (OSCP).

[0136] As an optional implementation, trust verification of digital certificates based on a pre-installed root certificate is actually performed based on the fourth key in the root certificate. Specifically, the certificate data in the digital certificate is hashed, and the digital signature in the digital certificate is decrypted using the fourth key in the root certificate. If the calculated values ​​match, the digital certificate verification is successful.

[0137] S505: If the digital certificate verification is successful, the rule data information after being centrally signed in the rule dataset shall be verified based on the digital certificate.

[0138] In this embodiment of the application, a hash operation is performed on the signed rule data information, and the signed rule data information is decrypted using a second key. If the calculated values ​​are consistent, the signed rule data information is verified, thereby ensuring the reliability of the rule data information and confirming whether the signed rule data information has been tampered with during transmission.

[0139] S507: If the signed rule data information passes verification, verify the attribute information in the digital certificate.

[0140] In this embodiment, the attribute information in the digital certificate includes date information, geographic information, and terminal information. Verifying the attribute information in the digital certificate specifically includes: verifying whether the current date is within the date information; verifying the geographic location of the rule import terminal 102, i.e., whether the current region is within the range corresponding to the geographic information; and verifying the terminal device corresponding to the rule import terminal 102, i.e., whether the current terminal matches the terminal information.

[0141] S509: If the attribute information verification passes, import the rule dataset.

[0142] In this embodiment of the application, if the current date is within the date information, the current region is within the range corresponding to the region information, and the current terminal matches the terminal information, the rule dataset is imported.

[0143] As an optional implementation, when importing the rule dataset, if the rule information in the rule dataset is encrypted in advance using a key management system (KMS), then the rule importer 102 calls the key management system (KMS) interface, decrypts the encrypted rule information using the key ID in the rule dataset, and obtains and imports the rule information.

[0144] By using the above rule transfer method, when importing the rule dataset, the digital certificate, the signed rule data information and attribute information are verified in sequence, thereby ensuring the legality, validity and reliability of the finally imported rule information.

[0145] This application also provides a rule-based flow device. Figure 6 This is a schematic diagram of the structure of a regular flow device provided in an embodiment of this application, as shown below. Figure 6 As shown, the device includes:

[0146] The information acquisition module 601 is used to acquire rule information and the attribute information corresponding to the rule information;

[0147] Digital certificate acquisition module 602 is used to acquire digital certificates corresponding to rule information based on attribute information;

[0148] The rule dataset creation module 603 is used to create a rule dataset based on rule information, attribute information, and digital certificates.

[0149] The rule dataset sending module 604 is used to send rule datasets.

[0150] As an optional implementation, the digital certificate acquisition module 602 includes:

[0151] Generate the first and second keys corresponding to the rule information; the first and second keys match each other.

[0152] The certificate application document is determined based on the second key and the date, region, and terminal information in the attribute information; the date information is the effective date of the rule information; the region information is the effective region range of the rule information; and the terminal information is the effective terminal device range of the rule information.

[0153] Based on the certificate application document, a digital certificate is applied for and obtained from the public key infrastructure system through the cloud platform; the digital certificate includes certificate data and digital signature; the certificate data includes a second key, date information, geographical information and terminal information; the digital signature is obtained by the public key infrastructure system signing the certificate data with a third key.

[0154] As an optional implementation, the device further includes:

[0155] The key verification module is used to verify the second key in the digital certificate based on the first key corresponding to the rule information; if the second key is verified, a correspondence is established between the digital certificate and the encoded information in the attribute information; the encoded information is the identification number corresponding to the rule information.

[0156] As an optional implementation, the rule dataset creation module 603 includes:

[0157] The rule data information of the rule dataset is determined based on the encoding information in the rule information and attribute information;

[0158] Based on the first key corresponding to the rule information, the rule data information is signed to obtain the signed rule data information.

[0159] A rule dataset is created based on the signed rule data and digital certificate.

[0160] As an optional implementation, this application also provides a rule-based workflow device. Figure 7 This is a schematic diagram of the structure of a regular flow device provided in an embodiment of this application, as shown below. Figure 7 As shown, the device includes:

[0161] The rule dataset receiving module 701 is used to receive the rule dataset in response to the rule import request; the rule dataset is constructed by the rule generating end based on the rule information, the attribute information corresponding to the rule information, and the digital certificate corresponding to the rule information;

[0162] The digital certificate verification module 702 is used to verify digital certificates in the rule dataset based on the preset root certificate and online certificate status protocol;

[0163] The rule data information verification module 703 is used to verify the rule data information after it has been centrally signed in the rule dataset, based on the digital certificate, if the digital certificate verification is successful.

[0164] The attribute information verification module 704 is used to verify the attribute information in the digital certificate if the signed rule data information is verified successfully.

[0165] The rule dataset import module 705 is used to import the rule dataset if the attribute information verification passes.

[0166] As an optional implementation, the digital certificate verification module 702 includes:

[0167] The trustworthiness of the digital certificate is verified based on the fourth key in the root certificate; the fourth key is matched with the third key.

[0168] The validity of digital certificates is verified based on the online certificate status protocol.

[0169] As an optional implementation method, the attribute information includes date information, region information, and terminal information;

[0170] Rule dataset import module 705 includes:

[0171] If the current date is within the date information, the current region is within the range corresponding to the region information, and the current terminal matches the terminal information, import the rule dataset.

[0172] The apparatus and method embodiments in this invention are based on the same application concept.

[0173] The methods and embodiments provided in this application can be executed on mobile terminals, computer terminals, servers, or similar computing devices. Taking running on a server as an example, Figure 8 This is a hardware structure block diagram of a server for a rainfall determination method provided in an embodiment of this application. For example... Figure 8As shown, the server 800 can vary significantly due to different configurations or performance. It may include one or more central processing units (CPUs) 810 (CPUs 810 may include, but are not limited to, microprocessors such as MCUs or programmable logic devices such as FPGAs), a memory 830 for storing data, and one or more storage media 820 (e.g., one or more mass storage devices) for storing application programs 823 or data 822. The memory 830 and storage media 820 may be temporary or persistent storage. The program stored in the storage media 820 may include one or more modules, each module may include a series of instruction operations on the server. Furthermore, the CPU 810 may be configured to communicate with the storage media 820 and execute the series of instruction operations stored in the storage media 820 on the server 800. Server 800 may also include one or more power supplies 860, one or more wired or wireless network interfaces 850, one or more input / output interfaces 840, and / or one or more operating systems 821, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0174] The input / output interface 840 can be used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of server 800. In one example, the input / output interface 840 includes a network interface controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the input / output interface 840 may be a radio frequency (RF) module for wireless communication with the Internet.

[0175] Those skilled in the art will understand that Figure 8 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, server 800 may also include... Figure 8 The more or fewer components shown, or having the same Figure 8 The different configurations shown.

[0176] An embodiment of this application also provides a rule transfer device, which includes a processor and a memory. The memory stores at least one instruction, at least one program, code set, or instruction set. The processor loads and executes the at least one instruction, at least one program, code set, or instruction set to implement the rule transfer method.

[0177] The embodiments of this application also provide a storage medium, which can be located in a server to store at least one instruction, at least one program, code set, or instruction set related to implementing a quantity determination method in the method embodiments. The at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by the processor to implement the rule flow method provided in the above method embodiments.

[0178] Optionally, in this embodiment, the storage medium may be located at at least one of the multiple network servers in a computer network. Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0179] As can be seen from the embodiments of the rule transfer method, apparatus, device, and storage medium provided in this application, this application obtains rule information and corresponding attribute information, obtains the digital certificate corresponding to the rule information based on the attribute information, establishes a rule dataset based on the rule information, attribute information, and digital certificate, and sends the rule dataset. In this way, the authenticity, integrity, and non-repudiation of the rule data during the rule transfer process can be guaranteed.

[0180] It should be noted that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, specific embodiments have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims can be performed in a different order than that shown in the embodiments and still achieve the desired result. Additionally, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0181] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the device embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0182] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware, or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0183] The above are merely preferred embodiments of this application and are not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A rule-based flow method, characterized in that, The method comprises: acquiring rule information and attribute information corresponding to the rule information; acquiring a digital certificate corresponding to the rule information based on the attribute information; establishing a rule data set based on the rule information, the attribute information, and the digital certificate; sending the rule data set; acquiring a digital certificate corresponding to the rule information based on the attribute information, comprising: generating a first key and a second key corresponding to the rule information; the first key and the second key match each other; determining a certificate application file based on the second key, and date information, regional information, and terminal information in the attribute information; the date information is a valid date of the rule information; the regional information is a valid regional range of the rule information; the terminal information is a valid terminal device range of the rule information; applying for and acquiring the digital certificate through a cloud platform to a public key infrastructure system based on the certificate application file; the digital certificate comprises certificate data and a digital signature; the certificate data comprises the second key, the date information, the regional information, and the terminal information; the digital signature is obtained by the public key infrastructure system signing the certificate data through a third key.

2. The method of claim 1, wherein, After the digital certificate corresponding to the rule information is acquired based on the attribute information, before the rule data set is established based on the rule information, the attribute information, and the digital certificate, the method further comprises: verifying the second key in the digital certificate based on the first key corresponding to the rule information; if the second key is verified, establishing a corresponding relationship between the digital certificate and coded information in the attribute information; the coded information is an identification number corresponding to the rule information.

3. The method of claim 1, wherein, The rule data set is established based on the rule information, the attribute information, and the digital certificate, comprising: determining rule data information of the rule data set based on the rule information and coded information in the attribute information; signing the rule data information based on the first key corresponding to the rule information to obtain signed rule data information; establishing the rule data set based on the signed rule data information and the digital certificate.

4. A method of routing rules, characterized by, The method comprises: In response to a rule import request, a rule data set is received; the rule data set is constructed by a rule generation end based on rule information, attribute information corresponding to the rule information, and a digital certificate corresponding to the rule information; the digital certificate corresponding to the rule information is obtained by the rule generation end based on the attribute information, including: generating a first key and a second key corresponding to the rule information; the first key and the second key match each other; determining a certificate application file based on the second key, and date information, region information, and terminal information in the attribute information; the date information is a valid date of the rule information; the region information is a valid region range of the rule information; the terminal information is a valid terminal device range of the rule information; based on the certificate application file, a digital certificate is applied for and obtained from a public key infrastructure system through a cloud platform; the digital certificate includes certificate data and a digital signature; the certificate data includes the second key, the date information, the region information, and the terminal information; the digital signature is obtained by the public key infrastructure system by signing the certificate data with a third key; Based on a pre-set root certificate and an online certificate status protocol, the digital certificate in the rule data set is verified; If the digital certificate is verified, the signed rule data information in the rule data set is verified based on the digital certificate; If the signed rule data information is verified, the attribute information in the digital certificate is verified; If the attribute information is verified, the rule data set is imported.

5. The method of claim 4, wherein, The verification of the digital certificate in the rule data set based on the pre-set root certificate and the online certificate status protocol includes: Based on a fourth key in the root certificate, the digital certificate is verified for trustworthiness; the fourth key and the third key match; Based on the online certificate status protocol, the digital certificate is verified for validity.

6. The method of claim 4, wherein, The attribute information includes date information, region information, and terminal information; If the attribute information is verified, the rule data set is imported, including: If the current date is within the date information, the current region is within the range corresponding to the region information, and the current terminal matches the terminal information, the rule data set is imported.

7. A rule flow switching apparatus characterized by comprising: The device includes: An information acquisition module for acquiring rule information and attribute information corresponding to the rule information; A digital certificate acquisition module for obtaining a digital certificate corresponding to the rule information based on the attribute information; A rule data set establishment module for establishing a rule data set based on the rule information, the attribute information, and the digital certificate; A rule data set sending module for sending the rule data set; The obtaining of the digital certificate corresponding to the rule information based on the attribute information includes: Generating a first key and a second key corresponding to the rule information; the first key and the second key match each other; determine a certificate application file based on the second key and date information, region information, and terminal information in the attribute information; the date information is a valid date of the rule information; the region information is a valid region range of the rule information; and the terminal information is a valid terminal device range of the rule information; apply for and obtain the digital certificate from a public key infrastructure system through a cloud platform based on the certificate application file; the digital certificate includes certificate data and a digital signature; the certificate data includes the second key, the date information, the region information, and the terminal information; and the digital signature is obtained by the public key infrastructure system signing the certificate data through a third key.

8. A rule flow switching apparatus, characterized by comprising: The apparatus includes: a rule data set receiving module configured to receive a rule data set in response to a rule import request; the rule data set is constructed by a rule generation end based on rule information, attribute information corresponding to the rule information, and a digital certificate corresponding to the rule information; the digital certificate corresponding to the rule information is obtained by the rule generation end based on the attribute information, including: generating a first key and a second key corresponding to the rule information; the first key and the second key match each other; determining a certificate application file based on the second key and date information, region information, and terminal information in the attribute information; the date information is a valid date of the rule information; the region information is a valid region range of the rule information; and the terminal information is a valid terminal device range of the rule information; applying for and obtaining the digital certificate from a public key infrastructure system through a cloud platform based on the certificate application file; the digital certificate includes certificate data and a digital signature; the certificate data includes the second key, the date information, the region information, and the terminal information; and the digital signature is obtained by the public key infrastructure system signing the certificate data through a third key; a digital certificate verification module configured to verify the digital certificate in the rule data set based on a pre-stored root certificate and an online certificate status protocol; a rule data information verification module configured to, if the digital certificate verification is passed, verify signed rule data information in the rule data set based on the digital certificate; an attribute information verification module configured to, if the signed rule data information verification is passed, verify attribute information in the digital certificate; a rule data set import module configured to, if the attribute information verification is passed, import the rule data set.

9. An electronic device, comprising: The electronic device includes a processor and a memory, the memory stores at least one instruction or at least one program, the at least one instruction or the at least one program is loaded and executed by the processor to implement the rule flow method of any one of claims 1-3 or 4-6.

10. A computer storage medium, characterized in that, The computer storage medium stores at least one instruction or at least one program, the at least one instruction or the at least one program is loaded and executed by the processor to implement the rule flow method of any one of claims 1-3 or 4-6.

Images