A data processing method, device and computer readable storage medium

Abstract

Embodiments of the present application disclose a data processing method, which is applied to a first node having a function corresponding to a gateway, and includes: obtaining a to-be-processed message sent by a target node; wherein the target node includes a source node and a destination node for interaction of the to-be-processed message; performing trusted state detection on the to-be-processed message to obtain a first trusted state; in a case where the first trusted state does not satisfy a target trusted state, requesting a second node to perform trusted state detection on target information in the to-be-processed message to obtain a detection result of performing trusted state detection on the target information; wherein the target trusted state includes trusted and untrusted; the detection result includes a second trusted state; and determining a trusted state of the to-be-processed message based on the first trusted state or the second trusted state. Embodiments of the present application also disclose a data processing device and a computer readable storage medium.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, and in particular to a data processing method, device and computer readable storage medium. BACKGROUND

[0002] In recent years, with the increasing popularity of the network, the security and trustworthiness of the data circulating in the network become increasingly important; and the data processing of the trustworthiness of the data packet circulating in the network plays a key role in data trustworthiness protection. However, the current data processing scheme for data packets usually only detects the security of the source Internet Protocol (IP) address in the message, and the detection method only detects the message features of the source IP address through a historical message feature model, and judges the trustworthiness and security level of the source IP address according to the detection result. This scheme is affected by the correctness of the historical message feature model in the judgment of trustworthiness, and only detects the source IP address without considering the trustworthiness of the target IP address. Therefore, there is a problem of single basis for judging the trustworthiness of the data packet and high false positive rate of trustworthiness. At the same time, the trustworthiness detection of the source IP address by the gateway according to this scheme has the problem of high consumption of the computing, storage and network resources of the gateway. SUMMARY

[0003] To solve the above technical problems, the embodiments of the present application provide a data processing method, device and computer readable storage medium, which solve the problems of single basis for judging the trustworthiness of the data packet, high false positive rate of trustworthiness, and high consumption of the computing, storage and network resources of the gateway.

[0004] To achieve the above purpose, the technical scheme of the present application is as follows:

[0005] A data processing method, the method is applied to a first node, the first node has the function corresponding to a gateway, and the method comprises:

[0006] obtaining a to-be-processed message sent by a target node; wherein the target node includes a source node and a destination node that interact with the to-be-processed message;

[0007] detecting the trustworthiness state of the to-be-processed message to obtain a first trustworthiness state;

[0008] if the first trustworthiness state does not meet a target trustworthiness state, requesting a second node to detect the trustworthiness state of target information in the to-be-processed message to obtain a detection result of detecting the trustworthiness state of the target information; wherein the target trustworthiness state includes trustworthiness and untrustworthiness; and the detection result includes a second trustworthiness state;

[0009] determine a trust state of the to-be-processed packet based on the first trust state or the second trust state.

[0010] In the above scheme, the trust state detection on the to-be-processed packet includes:

[0011] determining a target IP address from the to-be-processed packet, wherein the target IP address corresponds to the target node;

[0012] in a case where the target IP address matches an IP address in a first target trust list, obtaining the first trust state based on the target IP address and the first target trust list, wherein the first target trust list includes information representing trust states of IP addresses, and the first trust state includes trust, untrust and unknown.

[0013] In the above scheme, the case where the first trust state does not satisfy the target trust state includes:

[0014] a case where the first trust state is unknown and a communication corresponding to the to-be-processed packet is not established.

[0015] In the above scheme, the request for the second node to detect the trust state of the target information in the to-be-processed packet includes:

[0016] sending a first detection request carrying the target IP address to the second node, wherein the target information in the to-be-processed packet is the target IP address;

[0017] receiving a detection result of the trust state detection on the target IP address sent by the second node, wherein the detection result includes a second trust state of the target IP address;

[0018] updating the first target trust list based on the second trust state.

[0019] In the above scheme, the scheme further includes:

[0020] querying the first target trust list according to a target period to obtain a first IP address with an unknown trust state;

[0021] obtaining a second IP address based on the first IP address and an IP address in a target session, and sending a first detection request carrying the second IP address to the second node;

[0022] receiving a detection result of the trust state detection on the second IP address sent by the second node, and updating the first target trust list based on the detection result.

[0023] In the above solution, before the trusted state detection on the to-be-processed packet to obtain the first trusted state, the method further comprises:

[0024] determining whether the to-be-processed packet is within the protection range of the target trusted policy based on the target trusted policy;

[0025] Correspondingly, the trusted state detection on the to-be-processed packet to obtain the first trusted state of the to-be-processed packet comprises:

[0026] In the case that the to-be-processed packet is determined to be within the protection range, performing the trusted state detection on the to-be-processed packet to obtain the first trusted state.

[0027] In the above solution, the determination of the trusted state of the to-be-processed packet based on the first trusted state or the second trusted state comprises:

[0028] In the case that the first trusted state is unknown, determining the trusted state of the to-be-processed packet as the second trusted state;

[0029] In the case that the first trusted state is the target trusted state, determining the trusted state of the to-be-processed packet as the first trusted state.

[0030] A data processing method, applied to a second node, comprises:

[0031] obtaining a first detection request for detecting a trusted state of target information in a to-be-processed packet sent by a first node, and performing the trusted state detection on the target information based on the first detection request to obtain a detection result; wherein the first detection request carries the target information;

[0032] sending the detection result to the first node.

[0033] In the above solution, the obtaining of the first detection request for detecting the trusted state of the target information in the to-be-processed packet sent by the first node, and the trusted state detection on the target information based on the first detection request to obtain the detection result, comprises:

[0034] receiving the first detection request sent by the first node and carrying a target IP address; wherein the target IP address corresponds to a target node; the target node comprises a source node and a destination node that interact with the to-be-processed packet;

[0035] In a case where the target IP address matches an IP address in the second target trust list and a target trust state of the target IP address obtained based on the second target trust list satisfies a target trust state, determining a trust state of the target IP address based on the target IP address and the second target trust list; wherein the target trust state comprises: trusted and untrusted.

[0036] In the above scheme, the scheme further comprises:

[0037] In a case where the target IP address does not match an IP address in the second target trust list or the target IP address obtained based on the second target trust list does not satisfy a target trust state, initiating a trust challenge to the target node corresponding to the target IP address, and updating the second target trust list based on a detection result of the trust state detection.

[0038] In the above scheme, the trust challenge to the target node corresponding to the target IP address and the updating of the second target trust list based on the detection result of the trust state detection comprises:

[0039] sending a second detection request to the target node corresponding to the target IP address;

[0040] receiving a trust measurement report sent by the target node corresponding to the target IP address, and obtaining a third trust state based on the trust measurement report and a reference value of the target node corresponding to the target IP address; wherein the trust measurement report is determined by the target node based on a trusted root in the target node; and the third trust state comprises: trusted and untrusted.

[0041] updating the second target trust list based on the third trust state.

[0042] In the above scheme, the scheme further comprises:

[0043] receiving a first detection request sent by the first node and carrying a second IP address;

[0044] In a case where the second IP address matches an IP address in the second target trust list and a trust state of the second IP address obtained based on the second target trust list satisfies a target trust state, determining a trust state of the second IP address based on the second IP address and the second target trust list; wherein the target trust state comprises: trusted, untrusted.

[0045] In a case that the target IP address does not match an IP address in a second target trusted list, or a target IP address obtained based on the second target trusted list does not satisfy a target trusted state, a second detection request is sent to the target node corresponding to the second IP address;

[0046] A trusted metric report sent by the target node corresponding to the second IP address is received, and a fourth trusted state is obtained based on the trusted metric report and a reference value of the target node corresponding to the second IP address; wherein the trusted metric report is determined by the target node based on a trusted root in the target node; the fourth trusted state includes trusted and untrusted;

[0047] The second target trusted list is updated based on the fourth trusted state.

[0048] In the above scheme,

[0049] A first node having a function corresponding to a gateway, comprising: a first processor, a first memory and a first communication bus;

[0050] The first communication bus is used to realize the communication connection between the first processor and the first memory;

[0051] The first processor is used to execute a data processing program in the first memory, so as to realize the steps of the above-mentioned data processing method.

[0052] A second node, comprising: a second processor, a second memory and a second communication bus;

[0053] The second communication bus is used to realize the communication connection between the second processor and the second memory;

[0054] The second processor is used to execute a data processing program in the second memory, so as to realize the steps of the above-mentioned data processing method.

[0055] A computer readable storage medium, the computer readable storage medium stores one or more programs, the one or more programs can be executed by one or more processors to realize the steps of the above-mentioned data processing method.

[0056] The data processing method, device and computer readable storage medium provided by the embodiment of the application, through the first node, the target node sends the target message to be processed for trusted state detection, and the first trusted state is obtained; in the case that the first trusted state does not meet the target trusted state, the second node is requested to detect the target information in the message to be processed, the detection result of the trusted state detection of the target information is obtained, and then the second trusted state is obtained; thereafter, based on the first trusted state or the second trusted state, the trusted state of the message to be processed is determined. In this way, for the trusted state detection of the message to be processed, the first node only performs part of simple detection, and when it is unable to determine whether the message to be processed is trusted, the second node is requested to perform detection, which realizes the combination of the local trusted state detection of the first node and the remote trusted state detection of the second node, so that the energy consumption for the trusted state detection of the message to be processed is no longer concentrated on the first node, but can be load shared through the second node, thereby reducing the consumption of gateway resources; and not only the trustworthiness of the source node corresponding to the message to be processed can be used as a basis for judging the trustworthiness of the message to be processed, but also the trustworthiness of the destination node corresponding to the message to be processed can be used as a basis for judging the trustworthiness of the message to be processed, thereby solving the problems of single basis for judging the trustworthiness of the data packet, high false positive rate of trustworthiness, and high consumption of gateway computing, storage and network resources. BRIEF DESCRIPTION OF DRAWINGS

[0057] Figure 1 A network architecture diagram for data processing provided by an embodiment of the application;

[0058] Figure 2 A flowchart of a data processing method provided by an embodiment of the application;

[0059] Figure 3 A flowchart of another data processing method provided by an embodiment of the application;

[0060] Figure 4 A flowchart of a data processing method provided by another embodiment of the application;

[0061] Figure 5 A flowchart of another data processing method provided by another embodiment of the application;

[0062] Figure 6 A flowchart of another data processing method provided by another embodiment of the application

[0063] Figure 7 A structural diagram of a first node provided by an embodiment of the application;

[0064] Figure 8 A structural diagram of a second node provided by an embodiment of the application. DETAILED DESCRIPTION

[0065] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application.

[0066] An exemplary network architecture of a node for data processing implementing the embodiments of the present application will be described below, referring to Figure 1 , Figure 1 is a network architecture diagram for data processing provided by the embodiments of the present application, which can include three kinds of nodes, referring to Figure 1 As shown in the figure, the three kinds of nodes include a first node 11, a second node 12 and a target node 13, and the target node can include a first trusted node 13-1, a second trusted node 13-2 and an untrusted node 13-3.

[0067] In the embodiments of the present application, the first node 11 has the function of a gateway and can be used for verifying the trustworthiness of messages flowing between target nodes in the network; the second node 12 is used for remotely evaluating the trust status of the target nodes in the network, and the second node 12 is different from the first node 11; the target node 13 is a service node in the network with a built-in trusted root; the trusted root can be a hardware device in the target node and can be used to ensure that the basis for judging the trustworthiness of the target node is trusted.

[0068] It should be noted that the target node 13 includes a source node and a destination node for interacting with a to-be-processed message; the source node and the destination node can be the same target node or different target nodes; the trust status of the to-be-processed message is related to the trust status of the source node and the destination node corresponding to the to-be-processed message; the first node 11 can obtain the to-be-processed message sent by the source node and verify and process the trustworthiness of the to-be-processed message, and in the case that the first node 11 cannot detect the trustworthiness of the to-be-processed message through local trust status detection, the first node 11 can request the second node 12 to perform remote trust status detection and receive the detection result returned by the second node to determine the trust status of the to-be-processed message; the second node 12 can receive a remote trust status detection request sent by the first node 11, and the remote trust status detection request includes related information of the target node 13 that needs to be verified for trustworthiness, and in the case that the second node 12 cannot detect the trust status of the target node 13 through the information stored locally, the second node 12 can initiate a trust challenge to the target node 13 to obtain information for detecting the trust status of the target node 13, and then detect the trust status of the target node 13 and return the detection result to the first node 11.

[0069] The network architecture provided in the above embodiments of the application combines the local trusted state detection of the first node with the request for remote trusted state detection of the second node, so that the energy consumption for trusted state detection of the to-be-processed packet is no longer concentrated on the first node, but can be shared by the second node, thereby reducing the consumption of gateway resources. In addition, the trustworthiness of the source node corresponding to the to-be-processed packet can be used as a basis for judging the trustworthiness of the to-be-processed packet, and the trustworthiness of the destination node corresponding to the to-be-processed packet can also be used as a basis for judging the trustworthiness of the to-be-processed packet, thereby solving the problems of single basis for judging the trustworthiness of the data packet, high false positive rate of trustworthiness, and high consumption of gateway computing, storage and network resources.

[0070] The embodiment of the application provides a data processing method, which is applied to a first node having a function corresponding to a gateway, as shown in Figure 2 The method comprises the following steps:

[0071] Step 201, obtaining a to-be-processed packet sent by a target node.

[0072] The target node includes a source node and a destination node for interaction of the to-be-processed packet.

[0073] In the embodiment of the application, the to-be-processed packet obtained by the first node is a packet sent by the target node when the target node is the source node. The to-be-processed packet refers to a packet transmitted in the network.

[0074] Step 202, performing trusted state detection on the to-be-processed packet to obtain a first trusted state.

[0075] In the embodiment of the application, the trusted state detection mainly verifies whether the to-be-processed packet is tampered with in the network transmission process and whether the sender and receiver of the packet are trustworthy, and does not involve the trustworthiness verification of the content related to the business in the packet. The first trusted state is obtained by the first node locally performing trusted state detection on the to-be-processed packet, and can be directly queried by the first node pre-stored information.

[0076] It should be noted that the first trusted state is determined according to the trustworthiness of the source node and the destination node of the to-be-processed packet. In this way, the problem of untrusted source of the to-be-processed packet is avoided, and the problems of information leakage or invalidity caused by untrusted destination node of the to-be-processed packet are solved.

[0077] Step 203, in the case that the first trusted state does not satisfy a target trusted state, requesting the second node to perform trusted state detection on target information in the to-be-processed packet to obtain a detection result of the trusted state detection on the target information.

[0078] The target trusted state includes: trusted and untrusted; and the second trusted state includes target information.

[0079] In the embodiment of the present application, if the first trusted state is unknown, the target information determined according to the to-be-processed packet is detected by the second node for remote trusted state detection, and the trusted state of the target information is determined according to the detection result of the remote trusted state detection. The trusted state of the to-be-processed packet can be determined according to the trusted state of the target information in the to-be-processed packet.

[0080] It should be noted that the target information in the to-be-processed packet is related to the source node and the destination node of the to-be-processed packet. In this way, the basis for judging the trustworthiness of the to-be-processed packet is related to the source node and the destination node of the to-be-processed packet, which not only avoids the problem that the source of the to-be-processed packet is untrusted, but also solves the problem of information leakage or invalidity caused by the untrusted destination node of the to-be-processed packet.

[0081] In step 204, the trusted state of the to-be-processed packet is determined based on the first trusted state or the second trusted state.

[0082] In the embodiment of the present application, if the first trusted state is trusted or untrusted, it is not necessary to request the second node to perform remote trusted state detection on the target information in the to-be-processed packet, that is, it is not necessary to obtain the second trusted state, and then the trusted state of the to-be-processed packet can be determined according to the first trusted state. If the first trusted state is unknown, the second trusted state needs to be obtained, and whether the target information in the to-be-processed packet is trusted can be determined according to the second trusted state, and the trustworthiness of the to-be-processed packet is determined according to the trustworthiness of the target information in the to-be-processed packet.

[0083] The data processing method provided in the embodiment of the present application, for the trusted state detection of the to-be-processed packet, the local trusted state detection of the first node is mainly based on the pre-stored information of the first node to detect the trusted state of the to-be-processed packet, and when the to-be-processed packet cannot be determined to be trusted or untrusted through the pre-stored information, the second node is requested to detect the target information of the to-be-processed packet, which realizes the combination of the local trusted state detection of the first node and the remote trusted state detection requested from the second node, so that the energy consumption for the trusted state detection of the to-be-processed packet is no longer concentrated on the first node, but can be shared by the second node, thereby reducing the consumption of gateway resources; and not only the trustworthiness of the source node corresponding to the to-be-processed packet can be used as the basis for judging the trustworthiness of the to-be-processed packet, but also the trustworthiness of the destination node corresponding to the to-be-processed packet can be used as the basis for judging the trustworthiness of the to-be-processed packet, thereby solving the problems of single basis for judging the trustworthiness of the data packet and high misjudgment rate of trustworthiness judgment, and high consumption of the calculation, storage and network resources of the gateway.

[0084] Based on the foregoing embodiments, the embodiments of the present application provide a data processing method, which is applied to a second node, and with reference to Figure 3 as shown, the method comprises the following steps:

[0085] Step 301, obtaining a first detection request for detecting the trusted state of target information in a to-be-processed message sent by a first node, and performing trusted state detection on the target information based on the first detection request to obtain a detection result.

[0086] In the first detection request, the target information is carried.

[0087] In the embodiments of the present application, the second node is a node for trusted state evaluation, and can receive a request for trusted state detection of target information from the first node, wherein the detection result obtained by the target information state detection includes information representing that the target information is trusted or untrusted; the target information is related to the target node.

[0088] In a feasible implementation manner, the target information is obtained by the first node through the to-be-processed message.

[0089] Step 302, sending the detection result to the first node.

[0090] In the embodiments of the present application, the detection result including whether the target information is trusted is sent to the first node.

[0091] In a feasible implementation manner, the target information is obtained by the first node through the to-be-processed message, and the detection result includes a second trusted state representing whether the target information in the to-be-processed message is trusted.

[0092] The data processing method provided by the embodiments of the present application is that the second node performs trusted state detection on the target information based on the request for trusted state detection of the target information from the first node to obtain a detection result, and then sends the detection result to the first node; in this way, the second node shares the energy consumption of the first node for trusted state detection of the target information by receiving the remote trusted state detection request from the first node, and solves the problem of high consumption of computing, storage and network resources of the gateway in the prior art, thereby reducing the consumption of gateway resources.

[0093] Based on the foregoing embodiments, the embodiments of the present application provide a data processing method, which is applied to a second node, and with reference to Figure 4 as shown, the method comprises the following steps:

[0094] Step 401, the first node obtains a to-be-processed message sent by a target node.

[0095] The target node includes a source node and a destination node for interaction of the to-be-processed message.

[0096] Step 402, the first node determines whether the to-be-processed packet is in the protection range of the target trusted policy based on the target trusted policy.

[0097] In the embodiments of the present application, the target trusted policy can be pre-configured in the first node, and the target trusted policy can be started or stopped as needed. The target trusted policy includes a protected subject and a protection policy for protecting the protected subject in different situations. The protected subject can be divided into a source node and a target node, and the corresponding protection policy can be divided into a source node protection policy and a target node protection policy. The protection range of the target trusted policy can be pre-determined. In a feasible implementation manner, when the source IP address and / or the destination IP address of the to-be-processed packet are in the protection range of the target trusted policy, the to-be-processed packet is in the protection range of the target trusted policy. The source IP address corresponds to the source node, and the destination IP address corresponds to the destination node.

[0098] Step 403, in the case that the to-be-processed packet is in the protection range, the first node determines the target IP address from the to-be-processed packet.

[0099] The target IP address corresponds to the target node.

[0100] In the embodiments of the present application, the trusted state of the to-be-processed packet is detected based on the source IP address and / or the destination IP address in the to-be-processed packet that is in the protection range. It should be noted that the trusted state of the to-be-processed packet is determined by the trusted state of the source IP address and / or the destination IP address in the to-be-processed packet that is in the protection range.

[0101] Step 404, in the case that the target IP address matches the IP address in the first target trusted list, the first node obtains a first trusted state based on the target IP address and the first target trusted list.

[0102] The first target trusted list includes information representing the trusted state of the IP address. The first trusted state includes trusted, untrusted, and unknown.

[0103] In the embodiments of the present application, the first trusted state is determined by the first node based on the detection result of the local trusted state detection on the trusted state of the target IP address. The unknown in the first trusted state includes the unknown trusted state of the target IP address queried from the first target trusted list, and the trusted state of the target IP address that is not queried from the first target trusted list. The first target trusted list is a storage unit storing information representing the trusted state of the target node, and is not limited to the list form. The first target trusted list can be stored in the first node.

[0104] It should be noted that the IP address trust state in the first target trust list is unknown, including that the IP address trust state in the first target trust list has been aged; wherein the aging represents that a first time of requesting to obtain the IP address trust state is beyond a target aging time relative to a second time of updating the IP address trust state last time; wherein the last time is relative to the first time; and the target aging time can be pre-set.

[0105] In a case where the first trust state does not satisfy the target trust state, steps 405 to 410 are performed.

[0106] The target trust state includes trust and untrust.

[0107] Step 405, the first node sends a first detection request carrying a target IP address to the second node.

[0108] The target information of the to-be-processed packet is the target IP address.

[0109] In the embodiment of the application, the first detection request is a request for detecting whether the IP address is trustable, and the request needs to carry an IP address whose trust state needs to be detected, the IP address corresponds to a target node, and the trust state of the IP address is determined by the trust state of the target node corresponding to the IP address.

[0110] In a feasible implementation manner, the first node is a firewall, the second node is a trust evaluation server, and the first detection request is a trust verification request. The firewall initiates a trust verification request to the trust evaluation server, and the trust verification request includes a target IP address, identity authentication information for verifying the identity of the firewall, and a random number.

[0111] Step 406, the second node receives the first detection request carrying the target IP address sent by the first node.

[0112] The target IP address corresponds to a target node; and the target node includes a source node and a destination node that interact with the to-be-processed packet.

[0113] In the embodiment of the application, the first detection request is a request for detecting whether the IP address is trustable, and the request needs to carry an IP address whose trust state needs to be detected, the IP address corresponds to a target node. The second node receives the first detection request, and detects the trust state of the IP address carried in the first detection request.

[0114] In a feasible implementation, the second node is a trusted evaluation server, and the first node is a firewall. The first detection request is a trusted verification request. The trusted evaluation server receives the trusted verification request initiated by the firewall, and the trusted verification request includes the target IP address, identity authentication information used for verifying the identity of the firewall, and a random number. The trusted evaluation server verifies the identity of the firewall through the identity authentication information, and if the identity verification is passed, the trusted verification request is received.

[0115] Step 407: When the target IP address matches the IP address in the second target trusted list, and the trusted state of the target IP address obtained based on the second target trusted list meets the target trusted state, the second node determines the trusted state of the target IP address based on the target IP address and the second target trusted list.

[0116] The detection result includes the trusted state of the target IP address. The target trusted state includes trusted and untrusted.

[0117] In the embodiments of the present application, the second target trusted list is a storage unit in which the trusted state of the target node is stored, and is not limited to the form of a list. The second target trusted list can be stored in the second node, and includes the IP address and the trusted state corresponding to the target node. If the second node queries the target IP address carried in the first detection request in the second target trusted list, and the current time of querying the trusted state of the target IP address is not more than the aging time from the time of updating the trusted state last time, the trusted state of the target IP address is determined as the corresponding trusted or untrusted state in the second target trusted list. The aging time is built-in in the second node.

[0118] Step 408: When the target IP address does not match the IP address in the second target trusted list, or the target IP address obtained based on the second target trusted list does not meet the target trusted state, the second node initiates a trusted challenge to the target node corresponding to the target IP address, and updates the second target trusted list based on the result of the trusted challenge.

[0119] In the embodiments of the present application, if the second node does not query the target IP address carried in the first detection request in the second target trust list, or the current time of querying the trust state of the target IP address is more than the aging time from the last time of updating the trust state, the second node initiates a trust challenge to the target IP address, and updates the second target trust list based on the challenge result; wherein the trust challenge is initiated by the second node, and is used to verify the trust state of the target node, and specifically, the trust state of the target node can be evaluated by collecting and analyzing the information of the target node; in the trust challenge, the second node is the trust challenge party initiating the challenge, and the target node whose trust state is verified is the trust challenged party accepting the challenge. It should be noted that the trust state of the target IP address is the trust state of the target node corresponding to the target IP address.

[0120] In step 408, the second node initiates a trust challenge to the target node corresponding to the target IP address, and updates the second target trust list based on the result of the trust challenge, which can be implemented by performing steps 408a to 408c:

[0121] In step 408a, the second node sends a second detection request to the target node corresponding to the target IP address.

[0122] In the embodiments of the present application, the second detection request carries information used for verifying whether the information returned by the target node corresponding to the target IP address is tampered, and identification information used for obtaining information used for evaluating the trust state of the target node.

[0123] In a feasible implementation manner, the second detection request is a trust challenge request, and the second node is a trust evaluation server. The trust evaluation server sends a trust challenge request to the target node, and the trust challenge request carries a random number used for verifying whether the information returned by the target node is tampered, and a platform configuration register (PCR) number used for obtaining information used for evaluating the trust state of the target node; wherein the random number can be carried in the first detection request sent by the first node.

[0124] In step 408b, the second node receives a trust measurement report sent by the target node corresponding to the target IP address, and obtains a third trust state based on the trust measurement report and the reference value of the target node corresponding to the target IP address.

[0125] In step 408b, the second node receives a trust measurement report sent by the target node corresponding to the target IP address, and obtains a third trust state based on the trust measurement report and the reference value of the target node corresponding to the target IP address.

[0126] In the embodiment of the present application, the second node receives a trust measurement report sent by a target node corresponding to the target IP address, the trust measurement report being a report for verifying whether the target node corresponding to the target IP address is trustworthy. The second node compares the trust measurement report with a reference value of the target node, and obtains a third trust state of the target IP address according to a comparison result; wherein the reference value of the target node can be pre-stored in the second node. It should be noted that the trust of the trust measurement report can be guaranteed by a trusted root built in the target node.

[0127] In a feasible implementation, the second node is a trust evaluation server, the trust evaluation server receives a trust measurement report sent by a target node corresponding to the target IP address, and verifies the trust measurement report by using a public key in an Attestation Identity Key (AIK) of the target node, the verification can include verifying a source of sending the trust measurement report and verifying legality of a random number; if the verification is passed, the trust measurement report is parsed, and a reference value of the target node obtained from a trust reference library is compared with a measurement value of the target node to determine whether the target node is in a trustworthy state. The measurement value of the target node is obtained by parsing the trust measurement report; the trust reference library stores reference values of target trusted devices, and the trust reference library can be stored in a trusted evaluation device.

[0128] It should be noted that the trust of the trust measurement report for evaluating whether the target node is trustworthy is guaranteed by a trusted root built in the target node, and the problem that the evaluation of the trust of the target node is untrustworthy from the source is avoided.

[0129] Step 408c, the second node updates the second target trusted list based on the third trust state.

[0130] In the embodiment of the present application, the second target trusted list is updated according to the third trust state, at least including updating a trust state of the target node corresponding to the target IP address in the second target trusted list to the third trust state, and updating an evaluation time of the trust state to a current time.

[0131] Step 409, the second node sends a detection result containing the third trust state to the first node.

[0132] The third trust state is a second trust state used for determining a trust state of a to-be-processed packet.

[0133] Step 410, the first node receives the detection result of the trust state detection of the target IP address sent by the second node.

[0134] The second trust state of the target IP address is included in the detection result.

[0135] In the embodiments of the present application, the detection result of the trusted state detection sent by the second node comprises the trusted state of the target IP address carried in the first detection request.

[0136] In step 411, the first node updates the first target trusted list based on the second trusted state.

[0137] In the embodiments of the present application, the first target trusted list is updated according to the second trusted state, at least comprising updating the trusted state of the target node corresponding to the target IP address in the first target trusted list to the second trusted state, and updating the evaluation time of the trusted state to the current time.

[0138] In step 412, the first node determines the trusted state of the to-be-processed packet as the second trusted state when the first trusted state is unknown.

[0139] In the embodiments of the present application, the first node acquires the second trusted state when the first trusted state is unknown, and determines that the trusted state of the to-be-processed packet is consistent with the second trusted state.

[0140] In step 413, the first node determines the trusted state of the to-be-processed packet as the first trusted state when the first trusted state meets the target trusted state.

[0141] In the embodiments of the present application, the first node determines that the trusted state of the to-be-processed packet is consistent with the first trusted state when the first trusted state is trusted or untrusted.

[0142] It should be noted that the first node processes the to-be-processed packet based on the target trusted strategy after determining the trusted state of the to-be-processed packet.

[0143] The data processing method provided in the embodiments of the present application combines the local trusted state detection of the first node with the remote trusted state detection of the second node, so that the energy consumption for the trusted state detection of the to-be-processed packet is no longer concentrated on the first node, but can be shared by the second node, thereby reducing the consumption of gateway resources; and not only the trustworthiness of the source node corresponding to the to-be-processed packet can be used as a basis for judging the trustworthiness of the to-be-processed packet, but also the trustworthiness of the destination node corresponding to the to-be-processed packet can be used as a basis for judging the trustworthiness of the to-be-processed packet, thereby solving the problems of single basis for judging the trustworthiness of the data packet, high misjudgment rate of the trustworthiness judgment, and high consumption of the computing, storage and network resources of the gateway; in addition, the target node is provided with a trusted root, so that the trustworthiness of the basis for evaluating the trustworthiness of the target node is guaranteed.

[0144] Based on the foregoing embodiments, in other embodiments of this application, for cases where the first trust state does not satisfy the target trust state, the following may also be included:

[0145] The situation where the communication corresponding to the pending message has not been established and the first trusted state is unknown.

[0146] The first trusted state being unknown includes the trusted state of the target IP address queried by the first node from the first trusted list being unknown, and the first node not finding the target IP address from the first trusted list; the trusted state of the target IP address obtained from the first trusted list being unknown includes the trusted state of the target IP address being outdated.

[0147] It should be noted that if the communication corresponding to the message to be processed has not been established and the first trusted state is unknown, steps 405 to 410 are executed.

[0148] In this embodiment, when the first trusted state is unknown and the communication corresponding to the message to be processed has not been established, a first detection request carrying the target IP address is sent to the second node to obtain the second trusted state of the target IP address, thereby updating the first target trusted list. In this way, when the communication corresponding to the message to be processed has been established, there is no need to request the second node to perform remote trusted state detection, thus avoiding the communication delay problem caused by remote trusted state detection.

[0149] In other embodiments of this application, reference is made to Figure 5 As shown, before executing step 402, it is necessary to determine whether the communication for the message to be processed has been established. Whether the communication for the message to be processed has been established can be determined by whether a corresponding session has been established. A message to be processed that has not established a corresponding session is called the first packet; a message to be processed that has established a corresponding session is called a subsequent packet. Specifically, session matching can be performed on the message to be processed to determine whether the communication corresponding to the message has been established.

[0150] In this embodiment of the application, the first packet can be processed by traditional security protection strategies before proceeding with subsequent steps. Traditional security protection strategies may include detecting the communication link and performing subsequent processing based on a blacklist.

[0151] In other embodiments of this application, when it is necessary to distinguish whether communication corresponding to the message to be processed has been established, the following steps may also be performed:

[0152] Step 414: The first node queries the trusted list of the first target according to the target period to obtain the first IP address whose trusted status is unknown.

[0153] In the embodiments of the present application, the target period can be determined by a preset polling time interval within the first node. In a possible implementation, the first IP address is unknown and has been aged.

[0154] In step 415, the first node acquires the second IP address based on the first IP address and the IP address in the target session, and sends a first detection request carrying the second IP address to the second node.

[0155] In the embodiments of the present application, if the first IP address is acquired, the first node matches the first IP address with the target session, and if the first IP address exists in the target session, it indicates that the session corresponding to the first IP address is in an active state, that is, the communication corresponding to the first IP address has been established; the first IP address existing in the target session is the second IP address, the second IP address is acquired, and the first detection request carrying the second IP address is sent to the second node. The first detection request is a request for detecting whether an IP address is trusted, and the first detection request needs to carry an IP address whose trusted state needs to be detected, which corresponds to the target node, and the trusted state of the IP address is determined by the trusted state of the target node corresponding to the IP address.

[0156] In a possible implementation, the first node is a firewall, the second node is a trusted evaluation server, the first detection request is a trusted verification request, and the target session is a session table built in the first node. The firewall acquires the second IP address based on the first IP address and the IP address in the session table, and initiates a trusted verification request to the trusted evaluation server, wherein the trusted verification request includes the second IP address, identity authentication information for verifying the identity of the firewall, and a random number.

[0157] In step 416, the second node receives the first detection request carrying the second IP address sent by the first node.

[0158] The second IP address corresponds to the target node; the target node includes a source node and a destination node that perform message interaction to be processed.

[0159] In a possible implementation of the embodiments of the present application, the first detection request is a trusted verification request, the first node is a firewall, and the second node is a trusted evaluation server. The trusted evaluation server receives the trusted verification request initiated by the firewall, wherein the trusted verification request includes the second IP address, identity authentication information for verifying the identity of the firewall, and a random number. The trusted evaluation server authenticates the identity of the firewall through the identity authentication information, and if the identity authentication is passed, the trusted verification request is received.

[0160] Step 417, in a case that the second IP address matches an IP address in the second target trust list and a trust state of the second IP address obtained based on the second target trust list meets the target trust state, the second node determines the trust state of the second IP address based on the second IP address and the second target trust list.

[0161] The target trust state includes: trusted and untrusted.

[0162] In the embodiment of the present application, if the second node queries the second IP address carried in the first detection request in the second target trust list, and a current time of querying the trust state evaluation of the second IP address is not more than an aging time from a last time of updating the trust state, it is determined that the trust state of the second IP address is the corresponding trusted or untrusted state in the second target trust list; wherein the aging time is built-in in the second node.

[0163] Step 418, in a case that the second IP address does not match an IP address in the second target trust list, or the second IP address obtained based on the second target trust list does not meet the target trust state, the second node sends a second detection request to a target node corresponding to the second IP address.

[0164] In the embodiment of the present application, the second node does not query the second IP address carried in the first detection request in the second target trust list, or the current time of querying the trust state of the second IP address is more than the aging time from the last time of updating the trust state, and then the second node sends a second detection request to the target node corresponding to the second IP address. The second detection request is used by the second node to initiate a trust challenge to the target node corresponding to the second IP address, and the second detection request carries information used for verifying whether information returned by the target node corresponding to the second IP address is tampered, and identification information used for obtaining information used for evaluating the trust state of the target node. It should be noted that the trust state of the second IP address is the trust state of the target node corresponding to the second IP address.

[0165] In a feasible implementation, the second detection request is a trust challenge request, and the second node is a trust evaluation server. The trust evaluation server sends the trust challenge request to the target node, and the trust challenge request carries a random number used for verifying whether information returned by the target node is tampered, and a PCR number used for obtaining information used for evaluating the trust state of the target node; wherein the random number can be carried in the first detection request sent by the first node.

[0166] Step 419, the second node receives a trust measurement report sent by the target node corresponding to the second IP address, and obtains a fourth trust state based on the trust measurement report and a reference value of the target node corresponding to the second IP address.

[0167] The fourth trust state is a trust state of the second IP address; the trust metric report is determined by the target node based on a trust root in the target node; and the fourth trust state includes: trusted and untrusted.

[0168] In the embodiment of the present application, the second node receives the trust metric report sent by the target node corresponding to the second IP address, which is a report for verifying whether the target node corresponding to the second IP address is trusted. The second node compares the trust metric report with the reference value of the target node, and obtains the fourth trust state of the second IP address according to the comparison result. It should be noted that the trust of the trust metric report can be guaranteed by the trust root built-in the target node.

[0169] In a feasible implementation, the second node is a trust evaluation server. The trust evaluation server receives the trust metric report sent by the target node corresponding to the second IP address, and verifies the trust metric report by using the public key in the AIK of the target node. The verification can include verifying the source of sending the trust metric report and verifying the legitimacy of the random number. If the verification is passed, the trust metric report is parsed, and the reference value of the target node obtained from the trust reference library is compared with the metric value of the target node to determine whether the target node is in a trusted state. The metric value of the target node is obtained by parsing the trust metric report. The trust reference library stores the reference value of the target trusted device, and the trust reference library can be stored in the trusted evaluation device.

[0170] It should be noted that the trust of the trust metric report for evaluating whether the target node is trusted is guaranteed by the trust root built-in the target node, which avoids the problem that the evaluation of the trust of the target node is untrusted from the source.

[0171] Step 420, the second node updates the second target trusted list based on the fourth trust state.

[0172] In the embodiment of the present application, the second target trusted list is updated according to the fourth trust state, which at least includes updating the trust state of the target node corresponding to the second IP address in the second target trusted list to the fourth trust state, and updating the evaluation time of the trust state to the current time.

[0173] Step 421, the second node sends the detection result containing the fourth trust state to the first node.

[0174] In the embodiment of the present application, the trust state of the second IP address is the fourth trust state.

[0175] Step 422: The first node receives the detection result of the trusted status detection for the second IP address sent by the second node, and updates the trusted list of the first target based on the detection result.

[0176] The detection results include the trusted status of the second IP address.

[0177] In this embodiment, the trusted state detection result sent by the second node includes a fourth trusted state, which is the trusted state of the second IP address. Updating the first target trusted list based on the fourth trusted state includes at least updating the trusted state of the target node corresponding to the second IP address in the first target trusted list to the fourth trusted state, and simultaneously updating the evaluation time of the trusted state to the current time.

[0178] In this way, the first node updates the trusted status of the second IP address that has established a communication session in the trusted list of the first target through polling. This allows subsequent packets to obtain the trusted status of their corresponding target node through the local detection of the first node without requesting the second node to perform remote trusted status detection. This ensures the determinism of the trusted status of subsequent packets and avoids the communication delay problem caused by remote trusted status detection.

[0179] In one feasible implementation, taking the communication process between the first node, the second node, and the target node as an example, the complete process of the first node requesting the second node to perform a trusted state check on the IP address is illustrated, referring to... Figure 6 As shown, the first node is a firewall, the second node is a trusted assessment server, and the source and destination nodes are the target nodes corresponding to the third IP address; the third IP address can be either the target IP address or the second IP address; the first detection request is a trusted verification request, and the second detection request is a trusted challenge request.

[0180] The trusted evaluation server receives the trusted verification request initiated by the firewall ①, which includes the third IP address, identity authentication information for verifying the identity of the firewall, and a random number. The trusted evaluation server verifies the identity of the firewall through the identity authentication information ②, and receives the trusted verification request if the identity verification is passed. The trusted evaluation server queries the trusted state of the target node corresponding to the third IP address and the time of the last update of the trusted state through the second target trusted list ③. If the trusted state of the third IP address is queried and the time of the last update of the trusted state does not exceed the aging time, the trusted evaluation server returns the trusted verification result containing the trusted state of the third IP address queried in the second target trusted list to the first node. If the trusted state of the third IP address is not queried in the second target trusted list or the queried trusted state is aged ③, the second node sends a trusted challenge request to the target node ④, which carries a random number used for verifying whether the information returned by the target node is tampered with and a PCR number used for obtaining the trusted state information of the target node in the target node for evaluation; wherein the random number can be carried in the first detection request sent by the firewall. After receiving the trusted challenge request, the target node collects the PCR value and the measurement event log to generate a measurement value, and signs the measurement value using the private key in the AIK to generate a trusted measurement report ⑤, and then sends the measurement report to the trusted evaluation server.

[0181] The trusted evaluation server receives the trusted measurement report sent by the target node corresponding to the target IP address, and verifies the trusted measurement report using the public key in the AIK of the target node, which can include verifying the identity of the source sending the trusted measurement report and verifying the legitimacy of the random number ⑥. If the verification is passed, the trusted measurement report is parsed, and the reference value of the target node obtained from the trusted reference library is compared with the measurement value of the target node ⑦ to determine whether the target node is in a trusted state. The measurement value of the target node is obtained by parsing the trusted measurement report ⑦; the trusted reference library stores the reference value of the trusted device, and the trusted reference library can be stored in the trusted evaluation device; and finally the trusted state and the aging time of the target node are updated ⑧.

[0182] The data processing method provided by the embodiments of the present application realizes the combination of the local trusted state detection of the first node and the request for remote trusted state detection of the second node, so that the energy consumption for the trusted state detection of the to-be-processed packet is no longer concentrated on the first node, but can be shared by the second node, thereby reducing the consumption of gateway resources; and not only the trustworthiness of the source node corresponding to the to-be-processed packet can be used as a basis for judging the trustworthiness of the to-be-processed packet, but also the trustworthiness of the destination node corresponding to the to-be-processed packet can be used as a basis for judging the trustworthiness of the to-be-processed packet, thereby solving the problems of single basis for judging the trustworthiness of the data packet, high misjudgment rate of the trustworthiness judgment, and high consumption of the gateway's calculation, storage and network resources. In addition, by embedding a trusted root in the target node, the trustworthiness of the basis for evaluating the trustworthiness of the target node is ensured.

[0183] Based on the foregoing embodiments, the embodiments of the present application provide a first node which can be applied to Figure 2 and 4 The data processing method provided by the corresponding embodiments is described with reference to Figure 7 The first node 4 includes a first processor 41, a first memory 42 and a first communication bus 43.

[0184] The first communication bus 43 is used to realize the communication connection between the first processor 41 and the first memory 42.

[0185] The first processor 41 is used to execute the data processing program stored in the first memory 42, so as to realize the following steps:

[0186] Obtain the to-be-processed packet sent by the target node; wherein the target node includes a source node and a destination node for interacting with the to-be-processed packet;

[0187] Perform trusted state detection on the to-be-processed packet to obtain a first trusted state;

[0188] In the case that the first trusted state does not satisfy a target trusted state, request the second node to perform trusted state detection on the target information in the to-be-processed packet to obtain a detection result of the trusted state detection on the target information; wherein the target trusted state includes trusted and untrusted; and the detection result includes a second trusted state;

[0189] Determine the trusted state of the to-be-processed packet based on the first trusted state or the second trusted state.

[0190] In other embodiments of the present application, the first processor 41 is used to perform the trusted state detection on the to-be-processed packet in the first memory 42 to obtain the first trusted state, so as to realize the following steps:

[0191] Determine a target IP address from the to-be-processed packet; wherein the target IP address corresponds to the target node;

[0192] In a case where the target IP address matches an IP address in the first target trusted list, obtain a first trusted state based on the target IP address and the first target trusted list; wherein the first target trusted list includes information representing a trusted state of an IP address; and the first trusted state includes: trusted, untrusted, and unknown.

[0193] In other embodiments of the present application, the first processor 41 is configured to execute the data processing program stored in the first memory 42, and the data processing program can further include the following cases:

[0194] A case where the communication corresponding to the to-be-processed packet is not established and the first trusted state is unknown.

[0195] In other embodiments of the present application, the first processor 41 is configured to execute the data processing program stored in the first memory 42, and the data processing program can further include the following steps:

[0196] Send a first detection request carrying the target IP address to the second node; wherein the target information in the to-be-processed packet is the target IP address;

[0197] Receive the detection result of the trusted state detection of the target IP address sent by the second node; wherein the detection result includes a second trusted state of the target IP address;

[0198] Update the first target trusted list based on the second trusted state.

[0199] In other embodiments of the present application, the first processor 41 is configured to execute the data processing program stored in the first memory 42, and the data processing program can further include the following steps:

[0200] Query the first target trusted list according to the target period to obtain a first IP address with an unknown trusted state;

[0201] Obtain a second IP address based on the first IP address and the IP address in the target session, and send a first detection request carrying the second IP address to the second node;

[0202] Receive the detection result of the trusted state detection of the second IP address sent by the second node, and update the first target trusted list based on the detection result.

[0203] In other embodiments of the present application, the first processor 41 is configured to perform the trusted state detection on the to-be-processed packet in the first memory 42 to obtain the first trusted state, and the following steps can be further implemented:

[0204] determining whether the to-be-processed packet is within the protection range of the target trusted policy based on the target trusted policy;

[0205] Accordingly, the trusted state detection on the to-be-processed packet is performed to obtain the first trusted state of the to-be-processed packet, including:

[0206] In the case where it is determined that the to-be-processed packet is within the protection range, the trusted state detection on the to-be-processed packet is performed to obtain the first trusted state.

[0207] In other embodiments of the present application, the first processor 41 is configured to execute the first trusted state or the second trusted state in the first memory 42 to determine the trusted state of the to-be-processed packet, so as to implement the following steps:

[0208] In the case where the first trusted state is unknown, the trusted state of the to-be-processed packet is determined as the second trusted state;

[0209] In the case where the first trusted state is the target trusted state, the trusted state of the to-be-processed packet is determined as the first trusted state.

[0210] It should be noted that the specific description of the steps performed by the first processor can refer to the description of the data processing method provided by the corresponding embodiments of Figure 2 and 4 The data processing method provided by the corresponding embodiments, which will not be described here.

[0211] The first node provided by the embodiments of the present application combines the local trusted state detection of the first node with the remote trusted state detection requested from the second node, so that the energy consumption for the trusted state detection on the to-be-processed packet is no longer concentrated on the first node, but can be shared by the second node, thereby reducing the consumption of gateway resources; and not only the trustworthiness of the source node corresponding to the to-be-processed packet can be used as a basis for judging the trustworthiness of the to-be-processed packet, but also the trustworthiness of the destination node corresponding to the to-be-processed packet can be used as a basis for judging the trustworthiness of the to-be-processed packet, thereby solving the problems of single basis for judging the trustworthiness of the data packet, high misjudgment rate of the trustworthiness judgment, and high consumption of the computing, storage and network resources of the gateway; in addition, by embedding the trusted root in the target node, the trustworthiness of the basis for evaluating the trustworthiness of the target node is ensured.

[0212] Based on the foregoing embodiments, the embodiments of the present application provide a second node which can be applied to Figure 3 and Figure 4 the data processing method provided by the corresponding embodiments, which is described with reference toFigure 8 As shown, the second node 5 comprises a second processor 51, a second memory 52 and a second communication bus 53;

[0213] The second communication bus 53 is configured to realize the communication connection between the second processor 51 and the second memory 52;

[0214] The second processor 51 is configured to execute the data processing program stored in the second memory 52 to realize the following steps:

[0215] Obtain the first detection request sent by the first node for detecting the trusted state of the target information in the to-be-processed message, and perform trusted state detection on the target information based on the first detection request to obtain a detection result; wherein the first detection request carries the target information;

[0216] Send the detection result to the first node.

[0217] In other embodiments of the present application, the second processor 51 is configured to execute the second memory 52 to obtain the first detection request sent by the first node for detecting the trusted state of the target information in the to-be-processed message, and perform trusted state detection on the target information based on the first detection request to obtain a detection result, to realize the following steps:

[0218] Receive the first detection request sent by the first node and carrying the target IP address; wherein the target IP address corresponds to the target node; the target node includes the source node and the destination node for interacting with the to-be-processed message;

[0219] In the case that the target IP address matches the IP address in the second target trusted list, and the trusted state of the target IP address obtained based on the second target trusted list meets the target trusted state, determine the trusted state of the target IP address based on the target IP address and the second target trusted list; wherein the detection result includes the trusted state of the target IP address; the target trusted state includes: trusted and untrusted.

[0220] In other embodiments of the present application, the second processor 51 is configured to execute the data processing program stored in the second memory 52, and can also realize the following steps:

[0221] In the case that the target IP address does not match the IP address in the second target trusted list, or the target IP address obtained based on the second target trusted list does not meet the target trusted state, initiate a trusted challenge to the target node corresponding to the target IP address, and update the second target trusted list based on the detection result of the trusted state detection.

[0222] In other embodiments of the present application, the second processor 51 is configured to execute the data processing program stored in the second memory 52 to perform the following steps:

[0223] sending a second detection request to the target node corresponding to the target IP address;

[0224] receiving a trust measurement report sent by the target node corresponding to the target IP address, and obtaining a third trust state based on the trust measurement report and a reference value of the target node corresponding to the target IP address; wherein the trust measurement report is determined by the target node based on a trust root in the target node; and the third trust state includes: trusted and untrusted;

[0225] updating the second target trust list based on the third trust state.

[0226] In other embodiments of the present application, the second processor 51 is configured to execute the data processing program stored in the second memory 52 to perform the following steps:

[0227] receiving a first detection request sent by the first node and carrying a second IP address;

[0228] in a case where the second IP address matches an IP address in the second target trust list and a trust state of the second IP address obtained based on the second target trust list meets a target trust state, determining the trust state of the second IP address based on the second IP address and the second target trust list; wherein the target trust state includes: trusted and untrusted;

[0229] in a case where the target IP address does not match an IP address in the second target trust list or the target IP address obtained based on the second target trust list does not meet the target trust state, sending a second detection request to the target node corresponding to the second IP address;

[0230] receiving a trust measurement report sent by the target node corresponding to the second IP address, and obtaining a fourth trust state based on the trust measurement report and a reference value of the target node corresponding to the second IP address; wherein the trust measurement report is determined by the target node based on a trust root in the target node; and the fourth trust state includes: trusted and untrusted;

[0231] updating the second target trust list based on the fourth trust state.

[0232] It should be noted that the specific description of the steps performed by the second processor can refer to the description of the data processing method provided by the corresponding embodiments of Figure 3 and 4 will not be repeated here.

[0233] The second node provided in this application embodiment, by receiving remote trusted status detection requests from the first node, shares the energy consumption of the first node in detecting the trusted status of target information, solving the problem of high consumption of gateway computing, storage, and network resources in the prior art, and reducing the consumption of gateway resources. Furthermore, the trusted root built into the target node ensures the credibility of the trusted measurement report used to assess whether the target node is trustworthy, avoiding the problem of the target node's credibility assessment being untrustworthy from the source.

[0234] Based on the foregoing embodiments, embodiments of this application provide a computer-readable storage medium storing one or more programs, which can be executed by one or more processors to implement... Figure 2 and Figure 3 The steps in the data processing method provided in the corresponding embodiment.

[0235] It should be noted that the aforementioned computer-readable storage media can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM), etc.; or it can be various electronic devices that include one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0236] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0237] The above embodiment numbers of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0238] Those skilled in the art can clearly understand the above-mentioned embodiment methods by means of software and necessary general hardware platforms, of course, they can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a plurality of instructions for enabling a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device) to perform the methods described in various embodiments of the present application.

[0239] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be realized by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data acquisition devices to produce a machine, so that the instructions executed by the computer or other programmable data acquisition devices produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that performs the functions specified in one or more flows and / or blocks.

[0240] These computer program instructions can also be stored in a computer-readable memory that can guide the computer or other programmable data acquisition devices to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including instruction devices, which implement the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that performs the functions specified in one or more flows and / or blocks.

[0241] These computer program instructions can also be loaded into a computer or other programmable terminal, so that a series of operation steps are performed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide a process for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that performs the functions specified in one or more flows and / or blocks.

[0242] The above merely preferred embodiments of the present application and are not intended to limit the patent scope of the present application, any equivalent structure or equivalent process transformation using the content of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A data processing method, characterized by, The method is applied to a first node having a gateway corresponding function, and comprises the following steps: obtaining a to-be-processed message sent by a target node; wherein the target node comprises a source node and a destination node for interaction of the to-be-processed message; determining whether the to-be-processed message is within a protection range of a target trust policy based on the target trust policy; wherein the target trust policy comprises a protection subject and a protection policy for protecting the protection subject in different cases; the protection subject is divided into the source node and the destination node, and the corresponding protection policy is divided into a source node protection policy and a destination node protection policy; when a source IP address and / or a destination IP address of the to-be-processed message are within the protection range of the target trust policy, the to-be-processed message is within the protection range of the target trust policy; the source IP address corresponds to the source node, and the destination IP address corresponds to the destination node; determining a target Internet Protocol (IP) address from the to-be-processed message when it is determined that the to-be-processed message is within the protection range of the target trust policy; obtaining a first trust state based on the target IP address and a first target trust list when the target IP address matches an IP address in the first target trust list; wherein the first target trust list comprises information representing a trust state of an IP address; the first trust state is determined according to the trust of the source node and the destination node of the to-be-processed message; the first trust state comprises trust, untrust and unknown; sending a first detection request carrying the target IP address to a second node when a communication corresponding to the to-be-processed message is not established and the first trust state is unknown; wherein the target information of the to-be-processed message is the target IP address; receiving a detection result of trust state detection of the target IP address sent by the second node; wherein the detection result comprises a second trust state of the target IP address; the second trust state of the target IP address is determined by the second node based on the target IP address and a second target trust list when the target IP address matches an IP address in the second target trust list and a trust state of the target IP address obtained based on the second target trust list meets a target trust state; updating the first target trust list based on the second trust state; determining a trust state of the to-be-processed message based on the first trust state or the second trust state.

2. The method of claim 1, wherein, The method further comprises the following steps: querying the first target trust list according to a target period to obtain a first IP address with an unknown trust state; obtaining a second IP address based on the first IP address and an IP address in a target session, and sending a first detection request carrying the second IP address to the second node; receiving a detection result of trust state detection of the second IP address sent by the second node, and updating the first target trust list based on the detection result.

3. The method of claim 1, wherein, The method comprises: In the case that the first trust state is unknown, determining the trust state of the to-be-processed packet as the second trust state; In the case that the first trust state is the target trust state, determining the trust state of the to-be-processed packet as the first trust state.

4. A data processing method, characterized by, The method comprises: receiving a first detection request carrying a target IP address sent by the first node; wherein the target node comprises a source node and a destination node for interacting with a to-be-processed packet; In the case that the target IP address matches an IP address in a second target trust list, and the trust state of the target IP address obtained based on the second target trust list meets a target trust state, determining the trust state of the target IP address based on the target IP address and the second target trust list; wherein the detection result comprises the trust state of the target IP address; the target trust state comprises: trust and untrust; the target information is carried in the first detection request; the trust state of the target IP address is used for the first node to update a first target trust list; sending the detection result to the first node; wherein the first detection request is sent by the first node to the second node in the case that a communication corresponding to the to-be-processed packet is not established and the first trust state is unknown; the first trust state is determined by the first node in the case that it is determined based on a target trust policy that the to-be-processed packet is within the protection range of the target trust policy, the target IP address is determined from the to-be-processed packet, and the target IP address matches an IP address in a first target trust list; the first target trust list comprises information representing the trust state of an IP address; wherein the first trust state is determined based on the trust of the source node and the destination node of the to-be-processed packet; the target trust policy comprises a protection subject and a protection policy for protecting the protection subject in different cases; the protection subject is divided into a source node and a destination node, and the corresponding protection policy is divided into a source node protection policy and a destination node protection policy; when the source IP address and / or the destination IP address of the to-be-processed packet are within the protection range of the target trust policy, the to-be-processed packet is within the protection range of the target trust policy; the source IP address corresponds to the source node, and the destination IP address corresponds to the destination node.

5. The method of claim 4, wherein, The method further comprises: In the case that the target IP address does not match an IP address in the second target trust list, or the target IP address obtained based on the second target trust list does not meet the target trust state, initiating a trust challenge to the target node corresponding to the target IP address, updating the second target trust list based on the detection result of the trust state detection.

6. The method of claim 5, wherein, The method further comprises: receiving the first detection request sent by the first node and carrying a second IP address; in a case where the second IP address matches an IP address in the second target trust list and a trust state of the second IP address obtained based on the second target trust list meets a target trust state, determining the trust state of the second IP address based on the second IP address and the second target trust list, wherein the target trust state comprises: trust and untrust; in a case where the target IP address does not match an IP address in the second target trust list or the target IP address obtained based on the second target trust list does not meet the target trust state, sending a second detection request to the target node corresponding to the second IP address; 7. The method of claim 4, wherein, receiving a trust metric report sent by the target node corresponding to the second IP address, and obtaining a fourth trust state based on the trust metric report and a reference value of the target node corresponding to the second IP address, wherein the trust metric report is determined by the target node based on a trust root in the target node; the fourth trust state comprises: trust and untrust; updating the second target trust list based on the fourth trust state. The first node has a function corresponding to a gateway, comprising: a first processor, a first memory and a first communication bus; The first communication bus is used to realize the communication connection between the first processor and the first memory; The first processor is used to execute the data processing program in the first memory, so as to realize the steps of the data processing method in any one of claims 1-3. The second node comprises: a second processor, a second memory and a second communication bus; 8. A first node, characterized in that, The second communication bus is used to realize the communication connection between the second processor and the second memory; The second processor is used to execute the data processing program in the second memory, so as to realize the steps of the data processing method in any one of claims 4-7. The computer readable storage medium stores one or more programs, which can be executed by one or more processors to realize the steps of the data processing method in claims 1-3 or 4-7.

9. A second node, characterized by ​ ​ ​ 10. A computer-readable storage medium, characterized in that, ​

Images