A disaster-resistant onion routing method based on lightweight cloud trust model

Abstract

The present invention discloses a disaster-resilience onion routing method based on a lightweight cloud trust model, the method comprising: calculating the trust of node service capability, stability and security factors based on the lightweight cloud trust model based on the bandwidth, computing power, running time and other attributes reported by the node to the directory server; designing an intelligent algorithm combining knowledge sharing and maximum angle evolution, searching for the best multi-disaster recovery routing path based on the existing trust. The present invention realizes the management of nodes in an anonymous network through trust, and proposes a multi-disaster recovery routing algorithm based on an intelligent algorithm, which is of great significance to improving the reliability and management efficiency of anonymous networks.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a disaster-resistant onion routing method based on a lightweight cloud trust model. Background Art

[0002] As an anonymous communication method, anonymous networks can protect the relationship between the two communicating parties from being known by attackers. They are proposed to solve the problem of privacy leakage. According to their anonymous implementation methods, they can be mainly divided into two categories: broadcast and rerouting. In an anonymous network based on rerouting, the sender does not send the message directly to the receiver, but transmits the message through multi-level jump nodes in the link, which is more efficient and therefore widely used.

[0003] Tor is an anonymous network based on rerouting. It uses three-hop relay nodes to transfer user data. Due to its low latency and high versatility, it has become the most popular anonymous network. Currently, about 2 million people use the Tor network every day. Although Tor has been widely used, its design has certain defects. Most of Tor's nodes are provided by volunteers, and their reliability is difficult to guarantee. There may be problems such as easy failure and high bandwidth fluctuation. Due to the lack of a trusted evaluation mechanism for nodes, directory nodes may allocate failed nodes or low-quality service nodes when allocating paths to clients. Secondly, this method also provides convenience for attackers. Since Tor's routing selection is a bandwidth-weighted algorithm, it leads to a tendency towards high-bandwidth nodes. Attackers can monitor and analyze traffic by deploying high-bandwidth nodes, resulting in reduced network anonymity.

[0004] At present, there are few studies on the credibility evaluation of nodes in anonymous networks, and most routing algorithms are only based on node bandwidth. Therefore, trust evaluation is performed on the multi-dimensional attributes of nodes, and a disaster-resistant onion routing algorithm is designed on this basis to improve the service capability of the network. Summary of the invention

[0005] The purpose of the present invention is to provide a disaster-resistant onion routing method based on a lightweight cloud trust model in response to the problems existing in the existing anonymous network.

[0006] The technical solution to achieve the purpose of the present invention is: a disaster-resistant onion routing method based on a lightweight cloud trust model, comprising the following steps:

[0007] a) Extract the attributes of node servers in the anonymous network to evaluate the three aspects of nodes: service capability, stability and security;

[0008] b) Based on the lightweight trust cloud model, the cloud operator calculates each trust cloud vector of the node server;

[0009] c) Determine the weight of multi-dimensional attributes based on the entropy weight method, and fuse the trust of multi-dimensional attributes through weighted average;

[0010] d) Calculate the actual trust of the node through the cloud similarity algorithm;

[0011] e) Elect multi-disaster-resilience routing nodes based on an improved intelligent algorithm for shared knowledge;

[0012] f) The directory server updates node attributes and trust through user feedback and node reporting.

[0013] Furthermore, by configuring the daemon process, the attribute information of the server is collected regularly to reflect the service capability, stability and security of the node. The attributes reflecting the service capability include computing power, maximum measured bandwidth, average bandwidth used by the program, maximum bandwidth used by the program, geographic location, node geographic location, port support, number of connections with different IP addresses, current number of connections, number of bytes flowing through, and average time each packet is in the queue; the attributes reflecting stability include running time, number of successful communications, number of failed communications, number of times the bandwidth limit is exceeded, number of times the file descriptor is exhausted, number of times the computing power limit is exceeded, and number of program crashes; the attributes reflecting security include packet loss rate, number of SYN attacks, and inflow and outflow delays.

[0014] Furthermore, after receiving the attribute information reported by the node server, the directory server calculates the trust cloud vectors of the node server based on the lightweight cloud trust model of MCMC sampling, namely the expectation, entropy and super entropy in the cloud model, and finally obtains the evaluation cloud of the multi-dimensional attributes of each node.

[0015] Furthermore, the weights of each attribute in the node's multidimensional attributes are determined based on the entropy weight method; and the user's weights on the three aspects of service capability, stability and security are introduced.

[0016] Furthermore, the attributes are quantified to obtain information entropy, and finally the weights of the attributes of each dimension of the node are obtained according to the information entropy.

[0017] Furthermore, the optimal values ​​of the attributes of all nodes in each dimension are taken as the expected attribute set, and the cloud vector of the expected attribute set is calculated using the lightweight trust cloud model as the benchmark evaluation cloud for calculating cloud similarity.

[0018] Furthermore, based on the improved shared knowledge evolution algorithm, routing nodes are selected to implement a multi-disaster recovery routing algorithm, specifically:

[0019] (1) Take the number of routing nodes to be selected N as the population dimension, initialize the population size P, and learn the factor k f , learning rate k r ;

[0020] (2) Calculate the fitness f(x) of each population i ), the fitness formula is:

[0021]

[0022] Among them, x i is the current individual containing N dimensions, x ij is the trust level of the current individual in the jth dimension;

[0023] (3) Sort the individuals in the population according to their fitness from large to small, and update them, using the learning rate k r Control the update rate to keep some contemporary individuals to the next generation; specifically, by generating a random number and k r Compare, if it is less than k r Then update; the update is divided into two stages, the primary stage and the advanced stage. When the update dimension exceeds half, it enters the advanced stage; the calculation method of the dimension D that needs to be updated in each iteration is:

[0024]

[0025] Among them, GEN represents the total number of iterations, G represents the current number of iterations, and k represents the knowledge learning rate;

[0026] Initial stage update method:

[0027]

[0028] in, is the individual value of the updated contemporary era, x i-1 is the previous poor individual, x r is a randomly selected individual from the population;

[0029] In the advanced stage, individual values ​​are sorted and divided into three categories: best individuals, middle individuals, and worst individuals; the best individuals and the worst individuals each account for 10%, and the middle individuals account for 80%. The update method is:

[0030]

[0031] Among them, x rbest is a random individual in the optimal individual set, x rworst is a random individual in the worst individual set, x m is a random individual from the intermediate individual set;

[0032] (4) The current population and the previous population are merged, and the optimal P populations are selected as the next generation through environmental selection. The selection method is the maximum angle selection algorithm; first, the N optimal individuals with the smallest angles are retained, and then the PN individuals with the largest angles are retained;

[0033]

[0034] Where g(x i ) is individual x i The trust vector in N dimensions, C j The trust vector of the global optimal individual value, cosθ is the angle between the vectors, and g represents the inner product of the vectors;

[0035] (5) The iteration stops when the preset number of iterations is reached, and the optimal individual is returned, whose N dimensions are the searched routing nodes.

[0036] Furthermore, the link length in the anonymous network is 3 hops, and each hop has multiple backups; when the connection to the next hop node fails, the previous hop node or client will automatically try to connect to the backup node on the same hop.

[0037] Furthermore, the trust is updated in two ways: after the user establishes a connection based on the routing node, the path used is sent back to the directory server; the node server reports the timing attributes; the user's path will be used to update the current number of connections and the number of successful connection attributes; the node server's timing report will synchronize the latest statistics to the directory server.

[0038] In a second aspect, the present invention provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described in the first aspect when executing the program.

[0039] Compared with the prior art, the present invention has the following significant advantages:

[0040] 1) By collecting multi-dimensional attributes such as node server computing power, bandwidth, number of connections, etc. in the anonymous network, node trust evaluation is performed based on the lightweight trust cloud model, which improves the ability to manage nodes in the network and provides a more reliable basis for the routing algorithm.

[0041] 2) By searching for disaster-resistant routing paths based on an intelligent algorithm based on knowledge sharing and maximum angle evolution, the possibility of node damage is taken into account, thereby improving the security and service capabilities of the network.

[0042] In general, the present invention collects multi-dimensional attributes of nodes and combines them with a trust evaluation algorithm to achieve a comprehensive evaluation of nodes, and on this basis proposes a disaster-resistant routing algorithm, which is of great significance for improving the service capabilities of anonymous networks.

[0043] The present invention is further described in detail below in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1This is a flow chart of the trust evaluation of multi-dimensional attributes of nodes in an anonymous network according to the present invention.

[0045] Figure 2 This is a schematic diagram of multi-disaster recovery routing.

[0046] Figure 3 The present invention is a flow chart of the trust-based disaster recovery onion routing algorithm. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0048] Figure 1 The present invention is a flow chart of trust evaluation for multi-dimensional attributes of nodes in an anonymous network. The evaluation method comprises the following steps:

[0049] (1) Multi-dimensional attribute trust calculation:

[0050] Extract the attributes of the node server in the anonymous network, and regularly collect the server's computing power, bandwidth, location and other attribute information by configuring the daemon process. The attributes are used to evaluate the three aspects of the node: service capability, stability and security. The details are shown in the following table:

[0051]

[0052]

[0053] The directory server receives the attribute information reported by the node server, generates sample data through the Markov Chain Monte Carlo (MCMC) sampling method, and then calculates the trust cloud vectors of the node server based on the cloud operator of the lightweight trust cloud model, namely the expectation, entropy and super entropy in the cloud model, and finally obtains the evaluation cloud of the multi-dimensional attributes of each node.

[0054] (2) Trust Integration:

[0055] Based on the entropy weight method, the weights of each attribute in the node's multi-dimensional attributes are determined, and the information entropy is obtained by quantifying the attributes. Finally, the weights of each dimension of the node's attributes are obtained based on the information entropy. At the same time, the custom weights of service capabilities, stability, and security are introduced to represent the user's orientation. Finally, the trust attributes of each node are integrated according to the weighted average method to generate a comprehensive cloud trust vector.

[0056] The optimal values ​​of all node attributes in each dimension are taken as the expected attribute set, which is divided into positive optimal values ​​and negative optimal values. Computing power, maximum measurement bandwidth, etc. are positive optimal values, and their optimal values ​​are maximum values; packet loss rate, number of communication failures, number of program crashes, etc. are negative optimal values, and their optimal values ​​are minimum values. The cloud vector of the expected attribute set is calculated using the lightweight trust cloud model as the benchmark evaluation cloud for calculating cloud similarity.

[0057] Through the cloud similarity algorithm, the similarity between the benchmark evaluation cloud and the comprehensive trust cloud is calculated as the actual trust of the node.

[0058] (3) Trust update: The routing node selected by the routing algorithm is sent to the user. After the user successfully establishes a link, the successful link will be sent back to the directory server, which will be used to update the node's current number of connections, number of successful connections, and other attributes. At the same time, the node server's scheduled report will also synchronize the latest local statistical attributes to the directory server, and finally complete the attribute update, further realizing the trust update.

[0059] Based on the trust, the intelligent algorithm based on knowledge sharing is used to select routing nodes to implement a multi-disaster recovery routing algorithm. Trust updates come from two sources: (1) After the user establishes a connection based on the routing node, the path used is sent back to the directory server. (2) The node server reports the timed attributes.

[0060] Figure 2 The multi-disaster recovery diagram is shown. The link length in the anonymous network is 3 hops, and each hop has multiple backups. When the connection to the next hop node fails, the previous hop node or client will automatically try to connect to the backup node on the same hop to improve the network connectivity rate.

[0061] Figure 3 This is a flow chart of an intelligent algorithm based on knowledge sharing, which is used to search for routing nodes. The main steps are as follows:

[0062] (1) Take the number of routing nodes to be selected N as the population dimension, initialize the population size P, and learn the factor k f , learning rate k r .

[0063] (2) Calculate the fitness f(x) of each population i ), the fitness formula is:

[0064]

[0065] Among them, x i is the current individual containing N dimensions, x ij is the trust of the current individual in the jth dimension.

[0066] (3) Sort the individuals in the population according to their fitness from large to small, and update them, using the learning rate k r Control the update rate to keep some contemporary individuals to the next generation. Specifically, by generating a random number and k r Compare, if it is less than k r The update is then performed. The update is divided into two stages, the primary stage and the advanced stage. When the updated dimension exceeds half, it enters the advanced stage. The calculation method for the dimension D that needs to be updated in each iteration is:

[0067]

[0068] Among them, GEN represents the total number of iterations, G represents the current number of iterations, and k is the knowledge learning rate.

[0069] Initial stage update method:

[0070]

[0071] Among them, x i new is the individual value of the updated contemporary era, x i-1 is the previous poor individual, x r is a randomly selected individual from the population.

[0072] In the advanced stage, the individual values ​​are sorted into three categories: the best individual, the middle individual, and the worst individual. The best individual and the worst individual each account for 10%, and the middle individual accounts for 80%. The update method is:

[0073]

[0074] Among them, x rbest is a random individual in the optimal individual set, x rworst is a random individual in the worst individual set, x m is a random individual from the intermediate set of individuals.

[0075] (4) The current population and the previous population are merged, and the optimal P populations are selected as the next generation through environmental selection. The selection method is the maximum angle selection algorithm. First, the N optimal individuals with the smallest angles are retained, and then the PN individuals with the largest angles are retained to ensure population diversity.

[0076]

[0077] Where g(x i ) is individual x i The trust vector in N dimensions, C j The trust vector of the global optimal individual value, cosθ is the angle between the vectors, and g represents the vector inner product.

[0078] (5) The iteration stops when the preset number of iterations is reached, and the optimal individual is returned, whose N dimensions are the searched routing nodes.

Claims

1. A disaster-resistant onion routing method based on a lightweight cloud trust model, characterized in that: The steps include: a) Extract the attributes of node servers in the anonymous network to evaluate the three aspects of nodes: service capability, stability and security; By configuring the daemon process, the attribute information of the server is collected regularly to reflect the service capability, stability and security of the node. The attributes reflecting the service capability include computing power, maximum measured bandwidth, average bandwidth used by the program, maximum bandwidth used by the program, geographic location, node geographic location, port support, number of different IP connections, number of current connections, number of bytes flowing through, and average time each packet is in the queue; the attributes reflecting stability include running time, number of successful communications, number of failed communications, number of times exceeding the bandwidth limit, number of times file descriptors are exhausted, number of times exceeding the computing power limit, and number of program crashes; the attributes reflecting security include packet loss rate, number of SYN attacks, and inflow and outflow delays; b) Based on the lightweight trust cloud model, the cloud operator calculates each trust cloud vector of the node server; After receiving the attribute information reported by the node server, the directory server calculates each trust cloud vector of the node server based on the lightweight cloud trust model of MCMC sampling, namely the expectation, entropy and super entropy in the cloud model, and finally obtains the evaluation cloud of the multi-dimensional attributes of each node; c) Determine the weight of multi-dimensional attributes based on the entropy weight method, and fuse the trust of multi-dimensional attributes through weighted average; d) Calculate the actual trust of the node through the cloud similarity algorithm; The optimal values ​​of all the node attributes in each dimension are taken as the expected attribute set, and the cloud vector of the expected attribute set is calculated using the lightweight trust cloud model as the benchmark evaluation cloud for calculating cloud similarity; e) Based on the improved shared knowledge intelligent algorithm, multiple disaster recovery routing nodes are selected, specifically: (1) Take the number of routing nodes to be selected N as the population dimension, initialize the population size P, and learn the factor k f , learning rate k r ; (2) Calculate the fitness f(x) of each population i ), the fitness formula is: Among them, x i is the current individual containing N dimensions, x ij is the trust level of the current individual in the jth dimension; (3) Sort the individuals in the population according to their fitness from large to small, and update them, using the learning rate k r Control the update rate to keep some contemporary individuals to the next generation; specifically, by generating a random number and k r Compare, if it is less than k r Then update; the update is divided into two stages, the primary stage and the advanced stage. When the update dimension exceeds half, it enters the advanced stage; the calculation method of the dimension D that needs to be updated in each iteration is: Among them, GEN represents the total number of iterations, G represents the current number of iterations, and k is the knowledge learning rate; Initial stage update method: in, is the individual value of the updated contemporary era, x i-1 is the previous poor individual, x r is a randomly selected individual from the population; In the advanced stage, individual values ​​are sorted and divided into three categories: best individuals, middle individuals, and worst individuals; the best individuals and the worst individuals each account for 10%, and the middle individuals account for 80%. The update method is: Among them, x rbest is a random individual in the optimal individual set, x rworst is a random individual in the worst individual set, x m is a random individual from the intermediate individual set; (4) The current population and the previous population are merged, and the optimal P populations are selected as the next generation through environmental selection. The selection method is the maximum angle selection algorithm; first, the N optimal individuals with the smallest angles are retained, and then the PN individuals with the largest angles are retained; Where g(x i ) is individual x i The trust vector in N dimensions, C j The trust vector of the global optimal individual value, cosθ is the angle between the vectors, and · represents the inner product of the vectors; (5) Iterate until the preset number of iterations has been reached and stop iterating. The optimal individual is returned, and its N dimensions are the searched routing nodes. f) The directory server updates node attributes and trust through user feedback and node reporting.

2. The method according to claim 1, characterized in that The weights of each attribute in the node's multidimensional attributes are determined based on the entropy weight method; and the weights of users' service capabilities, stability and security are introduced.

3. The method according to claim 2, characterized in that The attributes are quantified to obtain information entropy, and finally the weights of the attributes of each dimension of the node are obtained based on the information entropy.

4. The method according to claim 1, characterized in that: The link length in the anonymous network is 3 hops, and each hop has multiple backups; when the connection to the next hop node fails, the previous hop node or client will automatically try to connect to the backup node on the same hop.

5. The method according to claim 1, characterized in that Trust is updated in two ways: after the user establishes a connection based on the routing node, the path used is sent back to the directory server; the node server reports the timing attributes; the user's path will be used to update the current number of connections and the number of successful connections; the node server's timing report will synchronize the latest statistics to the directory server.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method according to any one of claims 1 to 5 are implemented.

Images