Trustworthiness measurement method, apparatus, device, and medium

Abstract

The application discloses a trust measurement method, device, equipment and medium, and relates to the field of industrial internet, and comprises the following steps: acquiring a first target index, a record header and a first hash value of a first to-be-measured record stored in a preset reference library; determining a current file chain table based on the first target index, and determining a first data block mapping area corresponding to the current file chain table by using the record header; if an operation subject of a second to-be-measured record stored in the first data block mapping area has operation permission, locating a second target index based on a keyword in the record header, acquiring a corresponding current reference value chain table according to the second target index, and determining a second data block mapping area corresponding to the current reference value chain table by using the record header; and if a second hash value of a third to-be-measured record stored in the second data block mapping area is the same as the first hash value, determining that the first to-be-measured record satisfies a preset trust condition. In the environment of limited memory and low performance of an industrial control system, the trust measurement decision efficiency is improved.

Description

Technical Field

[0001] This invention relates to the field of industrial internet, and particularly to trust measurement methods, devices, equipment, and media. Background Technology

[0002] With the increasing number of threats and attacks targeting the industrial control system (ICS) field, the security issues of power systems are becoming increasingly prominent. As a crucial node in the nation's critical information infrastructure, ICS, represented by power systems, need to support secure and trustworthy technologies to achieve trusted computing functions in hardware, operating systems, and applications, thereby establishing a trustworthy system security architecture. The core functions of trust measurement include application system status monitoring, which requires the trust measurement module to compare the measured objects. This typically uses a trusted benchmark library to store benchmark values ​​for executable file libraries, important configuration file libraries, protected file and directory libraries, and protected programs.

[0003] When performing security measurements, the trusted measurement module needs to access the trusted benchmark library file to obtain the benchmark value or other information of the object being measured to determine whether it is safe and trustworthy. This process incurs significant time overhead in accessing the benchmark library and retrieving records, potentially impacting normal system operations. Due to the slow disk read / write speed, general-purpose databases often use memory caching to alleviate this issue. Common relational and non-relational databases have high memory requirements, but industrial control systems have limited memory resources, failing to meet the basic memory requirements of general-purpose databases, which may even be unable to run. Therefore, text databases are often used in industrial control systems for storing and comparing trusted benchmark values. However, disk input / output (I / O) speeds are low, and the access efficiency of general-purpose databases cannot meet the demands of fast measurement performance.

[0004] In summary, improving the efficiency of trust measurement decisions in industrial control systems with limited memory and low performance is a problem that needs to be solved in this field. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a trust measurement method, apparatus, device, and medium to improve the efficiency of trust measurement decisions in the context of limited memory and low performance in industrial control systems. The specific solution is as follows:

[0006] Firstly, this application discloses a credibility measurement method, including:

[0007] Obtain the first target index, record header, and first hash value of the first record to be measured stored in the preset benchmark library;

[0008] The current file linked list is determined based on the first target index, and the first data block mapping area corresponding to the current file linked list is determined using the record header;

[0009] Determine whether the entity operating the second record to be measured stored in the first data block mapping area has the necessary operating permissions;

[0010] If so, the second target index is located based on the keyword in the record header, the corresponding current benchmark value chain is obtained according to the second target index, and the second data block mapping area corresponding to the current benchmark value chain is determined using the record header;

[0011] Determine whether the second hash value of the third record to be measured stored in the second data block mapping area is the same as the first hash value;

[0012] If so, the first record to be measured is determined to meet the preset trust conditions.

[0013] Optionally, the step of determining the current file linked list based on the first target index and determining the first data block mapping area corresponding to the current file linked list using the record header includes:

[0014] Determine the current directory level corresponding to the first record to be measured, and determine the file linked list information of the current directory level based on the first target index;

[0015] Based on the file list information, determine the current unmeasured file list, and use the record header to determine the first data block mapping area corresponding to the current file list.

[0016] Optionally, determining whether the entity performing the operation on the second record to be measured stored in the first data block mapping area has the necessary operating permissions includes:

[0017] The actual path for obtaining the second record to be measured stored in the first data block mapping area is obtained by using the first target index, the current file linked list, and the first data block mapping area.

[0018] Determine whether the actual path matches the target path recorded in the preset benchmark library;

[0019] If they match, then the operating entity of the second record to be measured stored in the first data block mapping area has the operating authority.

[0020] Optionally, after determining whether the actual path matches the target path recorded in the preset benchmark library, the method further includes:

[0021] If not, determine whether there is an unmeasured file list in the file list information; if so, determine the next file list based on the file list information.

[0022] Update the next file list to the current file list, and then jump back to the step of determining the first data block mapping area corresponding to the current file list using the record header.

[0023] Optionally, after determining whether the operating entity of the second record to be measured stored in the first data block mapping area has operating permissions, the method further includes:

[0024] If not, determine whether there is an unmeasured file list in the file list information; if so, determine the next file list based on the file list information.

[0025] Update the next file list to the current file list, and then jump back to the step of determining the first data block mapping area corresponding to the current file list using the record header.

[0026] Optionally, determining whether the second hash value of the third record to be measured stored in the second data block mapping area is the same as the first hash value includes:

[0027] Determine whether the corresponding third record to be measured is stored in the mapping area of ​​the second data block;

[0028] If it exists, then determine whether the second hash value of the third record to be measured is the same as the first hash value;

[0029] If it does not exist, then the first record to be measured is determined not to meet the preset trust conditions.

[0030] Optionally, before obtaining the first target index, record header, and first hash value of the first record to be measured stored in the preset benchmark library, the method further includes:

[0031] Construct a preset benchmark library containing an index area and several data block storage areas; wherein, the data block storage area includes the record header and record content of the first record to be measured, and the record header includes the keyword of the first record to be measured.

[0032] Secondly, this application discloses a trust measurement device, comprising:

[0033] The information acquisition module is used to acquire the first target index, record header, and first hash value of the first record to be measured stored in the preset benchmark library;

[0034] The first mapping area determination module is used to determine the current file linked list based on the first target index and to determine the first data block mapping area corresponding to the current file linked list using the record header.

[0035] The first judgment module is used to determine whether the operating entity of the second record to be measured stored in the first data block mapping area has the operating permission.

[0036] The second mapping area determination module is used to locate the second target index based on the keyword in the record header if the condition is met, obtain the corresponding current benchmark value chain according to the second target index, and determine the second data block mapping area corresponding to the current benchmark value chain using the record header.

[0037] The second judgment module is used to determine whether the second hash value of the third record to be measured stored in the second data block mapping area is the same as the first hash value;

[0038] The trust measurement determination module is used to determine that the first record to be measured meets the preset trust conditions if the condition is met.

[0039] Thirdly, this application discloses an electronic device, including:

[0040] Memory, used to store computer programs;

[0041] A processor for executing the computer program to implement the steps of the aforementioned disclosed trust measurement method.

[0042] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the steps of the aforementioned disclosed trust measurement method.

[0043] As can be seen, this application obtains the first target index, record header, and first hash value of the first record to be measured stored in the preset benchmark library; determines the current file linked list based on the first target index, and uses the record header to determine the first data block mapping area corresponding to the current file linked list; determines whether the operating entity of the second record to be measured stored in the first data block mapping area has operating authority; if so, it locates the second target index based on the keyword in the record header, obtains the corresponding current benchmark value linked list according to the second target index, and uses the record header to determine the second data block mapping area corresponding to the current benchmark value linked list; determines whether the second hash value of the third record to be measured stored in the second data block mapping area is the same as the first hash value; if so, it determines that the first record to be measured meets the preset trust conditions. Therefore, this application determines the first and second data block mapping areas based on the record header of the first record to be measured, meaning it only needs to read the record header from the disk into memory, rather than the entire record to be measured. This greatly reduces the retrieval content, significantly improves query efficiency, and reduces memory requirements, thereby achieving the goal of improving the efficiency of trust measurement decisions in the limited memory and low-performance environment of industrial control systems. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0045] Figure 1 This is a flowchart of a credibility measurement method disclosed in this application;

[0046] Figure 2 This is a schematic diagram of a specific preset benchmark library format disclosed in this application;

[0047] Figure 3 This is a schematic diagram of a specific indexed linked list relationship disclosed in this application;

[0048] Figure 4 This is a schematic diagram of a specific database structure disclosed in this application;

[0049] Figure 5 This is a schematic diagram illustrating a specific data block filling method disclosed in this application;

[0050] Figure 6 This is a flowchart of a specific credibility measurement method disclosed in this application;

[0051] Figure 7This is a schematic diagram illustrating a specific operation permission determination disclosed in this application;

[0052] Figure 8 Here is a flowchart of another specific credibility measurement method disclosed in this application;

[0053] Figure 9 This is a schematic diagram of a specific credibility measurement based on a benchmark value linked list disclosed in this application;

[0054] Figure 10 This is a schematic diagram of the structure of a reliability measurement device disclosed in this application;

[0055] Figure 11 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0056] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0057] When performing security measurements, the trusted measurement module needs to access the trusted benchmark library file to obtain the benchmark value or other information of the object being measured to determine its security and trustworthiness. This process incurs significant time overhead in accessing the benchmark library and retrieving records, potentially impacting normal system operations. Due to the slow disk read / write speed, general-purpose databases often use memory caching to alleviate this issue. Common relational and non-relational databases have high memory requirements, but industrial control systems have limited memory resources, failing to meet the basic memory requirements of general-purpose databases, sometimes even rendering them unusable. Therefore, text databases are often used in industrial control systems for storing and comparing trusted benchmark values. However, disk input / output speeds are low, and the access efficiency of general-purpose databases cannot meet the demands of fast measurement performance.

[0058] Therefore, this application provides a trust measurement scheme to improve the efficiency of trust measurement decisions in the context of limited memory and low performance of industrial control systems.

[0059] See Figure 1 As shown in the figure, this application discloses a trust measurement method, including:

[0060] Step S11: Obtain the first target index, record header, and first hash value of the first record to be measured stored in the preset benchmark library.

[0061] In this embodiment, before obtaining the first target index, record header, and first hash value of the first record to be measured stored in the preset benchmark library, the method further includes: constructing a preset benchmark library containing an index area and several data block storage areas; wherein, the data block storage area includes the record header and record content of the first record to be measured, and the record header includes the keyword of the first record to be measured. This embodiment adopts the approach of object-oriented databases, directly saving the in-memory data structure to the disk, and designing the data structure accordingly to meet the requirements of adapting to the trusted computing measurement data model, as well as the requirements of minimum storage space, indexing, support for efficient read / write and concurrent retrieval.

[0062] For example Figure 2 The diagram illustrates a specific pre-defined benchmark library format. To accommodate the needs of the trustworthy measurement decision data model, the pre-defined benchmark library is designed to consist of an index area and multiple data blocks (i.e., data areas). The index is located at the beginning of the benchmark library file and has a size of 16KB. For example... Figure 3 The diagram illustrates a specific indexed linked list relationship, categorized into two types based on the characteristics of the trusted measurement type: One type establishes 256 indexes based on the keywords of the trusted object for determining the baseline value of the measurement record. Each index corresponds to a linked list of the baseline value information of the trusted measurement object, with each index pointing to the head and tail of the linked list. This type of index is the second index. The other type establishes 60 indexes based on the keyword (file level) of the record for determining whether a measurement record has operation permissions. Each index corresponds to a linked list of the trusted measurement protected file information, with each index pointing to the head and tail of the linked list. This type of index is the first index. Data blocks store the baseline value and other attribute content of the measured object, such as... Figure 4 The diagram illustrates a specific database structure. The data structure of the trustworthy measurement benchmark object is designed with two parts: a fixed-length header and a variable-length content. The header includes keywords, record type, record mode, record content length, record content position, previous record block number, and previous record position. The record content includes the benchmark value and the information of the file being measured. This design meets the requirements of trustworthy measurement data content, reduces redundancy, and separates the filter condition header from other attribute information, minimizing the length of the header that needs to be traversed and improving traversal efficiency. Figure 5 The diagram shows a specific data block filling method. Each data block is 1MB in size and there is no connection between multiple data blocks. Within each data block, data is filled from the head and tail towards the middle. This has two advantages: first, it ensures byte alignment of the header information; second, it avoids reading content from the disk into memory during queries, which can significantly improve query efficiency.

[0063] To address the issue of low data access efficiency, this invention proposes a design where the memory data structure is consistent with the disk file data structure, and leverages the independent data content of each data block. This allows for the rapid mapping of disk data files into memory blocks using mmap (which maps a file or other object into memory). Each time, only the data area requiring read / write operations is mapped. If the queried data is not within the mapped data area, the next data area is released and mapped. This "block mapping" method satisfies the requirements of low-latency data processing while ensuring data security and integrity. The first target index, the record header, and the first hash value of the first record to be measured, stored in a preset benchmark database, are obtained for subsequent trustworthy measurement decisions. The first target index is one of 60 first indices.

[0064] Step S12: Determine the current file linked list based on the first target index, and use the record header to determine the first data block mapping area corresponding to the current file linked list.

[0065] In this embodiment, the first target index is copied to obtain the file linked list information of the corresponding directory level. It can be understood that the file linked list information contains several file linked lists. The current file linked list is determined from these several file linked lists. It is then determined whether there is a record corresponding to the corresponding record header in the current first data block mapping area. If not, the first data block mapping area corresponding to the record header is found again.

[0066] Step S13: Determine whether the operating entity of the second record to be measured stored in the first data block mapping area has the operating permission.

[0067] If a record corresponding to the corresponding record header exists in the current first data block mapping area, then it is determined whether the operation subject of the second record to be measured stored in the first data block mapping area has operation permission. Determining whether the operation subject of the second record to be measured has operation permission is to determine whether the record is protected and whether the measurement decision process is protected. The record corresponding to the corresponding record header is the second record to be measured.

[0068] Step S14: If yes, locate the second target index based on the keyword in the record header, obtain the corresponding current benchmark value linked list according to the second target index, and use the record header to determine the second data block mapping area corresponding to the current benchmark value linked list.

[0069] The second target index is located based on the keywords contained in the record header, where the first target index is one of 256 second indexes. The corresponding current baseline value linked list is obtained based on the second target index. If the baseline value of the current baseline value linked list is not in the current second data block mapping area, then the corresponding second data block mapping area needs to be mapped based on the baseline value position.

[0070] Step S15: Determine whether the second hash value of the third record to be measured stored in the second data block mapping area is the same as the first hash value.

[0071] After determining the corresponding second data block mapping area, and after judging whether the second hash value of the third record to be measured stored in the second data block mapping area is the same as the first hash value, it also includes: if the second hash value is different from the first hash value, then the dynamic library of the measurement decision execution program and the important configuration file are not trustworthy.

[0072] Step S16: If yes, then determine that the first record to be measured meets the preset trust conditions.

[0073] It is understandable that if the second hash value of the third record to be measured is the same as the first hash value, then the first record to be measured is determined to meet the preset trust conditions, that is, the dynamic library of the measurement decision execution program and the important configuration files are trustworthy.

[0074] As can be seen, this application obtains the first target index, record header, and first hash value of the first record to be measured stored in the preset benchmark library; determines the current file linked list based on the first target index, and uses the record header to determine the first data block mapping area corresponding to the current file linked list; determines whether the operating entity of the second record to be measured stored in the first data block mapping area has operating authority; if so, it locates the second target index based on the keyword in the record header, obtains the corresponding current benchmark value linked list according to the second target index, and uses the record header to determine the second data block mapping area corresponding to the current benchmark value linked list; determines whether the second hash value of the third record to be measured stored in the second data block mapping area is the same as the first hash value; if so, it determines that the first record to be measured meets the preset trust conditions. Therefore, this application determines the first and second data block mapping areas based on the record header of the first record to be measured, meaning it only needs to read the record header from the disk into memory, rather than the entire record to be measured. This greatly reduces the retrieval content, significantly improves query efficiency, and reduces memory requirements, thereby achieving the goal of improving the efficiency of trust measurement decisions in the limited memory and low-performance environment of industrial control systems.

[0075] See Figure 6 As shown in the figure, this application discloses a specific trust measurement method, including:

[0076] Step S21: Obtain the first target index, record header, and first hash value of the first record to be measured stored in the preset benchmark library.

[0077] When accessing the preset benchmark library to retrieve a record, the preset benchmark library is divided into two mappings: index area mapping and data information area mapping. One index mapping corresponds to the index area, with a fixed length of 16K, which is used to quickly locate the benchmark value queue. One data mapping corresponds to a block of information data of a specified index, with a fixed length of 1M, which is used to read the specified benchmark value and other information.

[0078] Step S22: Determine the current file linked list based on the first target index, and use the record header to determine the first data block mapping area corresponding to the current file linked list.

[0079] Alternatively, in this embodiment, the current file list is determined based on the first target index, and the first data block mapping area corresponding to the current file list is determined using the record header. This includes: determining the current directory level corresponding to the first record to be measured; determining the file list information of the current directory level based on the first target index; determining the unmeasured current file list based on the file list information; and determining the first data block mapping area corresponding to the current file list using the record header. For example... Figure 7 The diagram illustrates a specific operation permission determination method. The record set is opened, containing pre-defined search conditions and information such as copying the first index. If the current directory level is not a top-level directory, the file list information of the current directory level is determined based on the first target index. The file list information contains several file lists. From these file lists, the unmeasured current file list is determined. If the first data block mapping area currently pointed to by the unmeasured current file list does not contain a record corresponding to the record header, the record header is used to map to the corresponding first data block mapping area.

[0080] Step S23: Use the first target index, the current file linked list, and the first data block mapping area to obtain the actual path for retrieving the second record to be measured stored in the first data block mapping area.

[0081] If the first data block mapping area currently pointed to by the unmeasured current file linked list contains a record corresponding to the record header, then the actual path for retrieving the second record to be measured stored in the first data block mapping area is obtained. If the first data block mapping area currently pointed to by the unmeasured current file linked list does not contain a record corresponding to the record header, then after mapping the record header to the corresponding first data block mapping area, the actual path for retrieving the second record to be measured stored in that first data block mapping area is obtained. It can be understood that the first target index, the current file linked list, and the first data block mapping area form the actual path for retrieving the second record to be measured stored in the first data block mapping area.

[0082] Step S24: Determine whether the actual path is consistent with the target path recorded in the preset benchmark library; if consistent, determine whether the operating entity of the second record to be measured stored in the first data block mapping area has operating permissions.

[0083] In this embodiment, after determining whether the actual path is consistent with the target path recorded in the preset benchmark library, the method further includes: if not, determining whether there is an unmeasured file list in the file list information; if so, determining the next file list based on the file list information; updating the next file list to the current file list; and jumping back to the step of determining the first data block mapping area corresponding to the current file list using the record header. For example... Figure 7 As shown, if the actual path is inconsistent with the target path recorded in the preset benchmark library, it is necessary to determine whether there is an unmeasured file list in the file list information, that is, to determine whether all file lists in the file list information have been traversed. If not, the next file list is determined to start the next round of trust measurement decision.

[0084] In this embodiment, after determining whether the operating entity of the second record to be measured stored in the first data block mapping area has operating permissions, the method further includes: if not, determining whether there is an unmeasured file list in the file list information; if there is, determining the next file list based on the file list information; updating the next file list to the current file list; and jumping back to the step of determining the first data block mapping area corresponding to the current file list using the record header. For example... Figure 7 As shown, if the entity operating the second record to be measured does not have the operating authority, the next round of trust measurement decision needs to be initiated. The specific process is to determine whether all file linked lists in the file linked list information have been traversed. If not, the next file linked list is determined.

[0085] It is important to note that if all file links in the file list information have been traversed, the next directory level can be redefined. If the determined next target level is not the top-level directory level, the next directory level is updated to the current directory level, and a new round of trust measurement judgment begins. If the next target level is the top-level directory level, the trust measurement judgment fails directly, and the trust measurement ends.

[0086] Step S25: If yes, locate the second target index based on the keyword in the record header, obtain the corresponding current benchmark value linked list according to the second target index, and use the record header to determine the second data block mapping area corresponding to the current benchmark value linked list.

[0087] Step S26: Determine whether the second hash value of the third record to be measured stored in the second data block mapping area is the same as the first hash value.

[0088] Step S27: If yes, then determine that the first record to be measured meets the preset trust conditions.

[0089] Therefore, it can be seen that in the process of operation permission determination, this application does not need to read the record content from the disk into memory, but only needs to use the record header for corresponding processing, which significantly improves the traversal efficiency and greatly improves the efficiency of operation permission determination.

[0090] See Figure 8 As shown in the figure, this application discloses a specific trust measurement method, including:

[0091] Step S31: Obtain the first target index, record header, and first hash value of the first record to be measured stored in the preset benchmark library.

[0092] Step S32: Determine the current file linked list based on the first target index, and use the record header to determine the first data block mapping area corresponding to the current file linked list.

[0093] Step S33: Determine whether the operating entity of the second record to be measured stored in the first data block mapping area has the operating permission.

[0094] Step S34: If yes, locate the second target index based on the keyword in the record header, obtain the corresponding current benchmark value linked list according to the second target index, and use the record header to determine the second data block mapping area corresponding to the current benchmark value linked list.

[0095] In this embodiment, as Figure 9 The diagram illustrates a specific reliability measurement based on a benchmark value linked list. The index is located based on the keyword of the queried record, that is, the second target index is located based on the keyword in the record header, and the current benchmark value linked list pointed to by the second target index is traversed sequentially.

[0096] Step S35: Determine whether the corresponding third record to be measured is stored in the second data block mapping area.

[0097] It is necessary to determine whether the baseline value of the current baseline value linked list is in the current second data block mapping area, that is, to determine whether the corresponding third record to be measured is stored in the second data block mapping area.

[0098] Step S36: If it exists, determine whether the second hash value of the third record to be measured is the same as the first hash value.

[0099] It is understandable that the second data block mapping area stores the corresponding third record to be measured. After determining whether the second hash value of the third record to be measured is the same as the first hash value, it also includes the following: if the second hash value of the third record to be measured is different from the first hash value, then the first record to be measured is determined not to meet the preset trust condition, that is, the first record to be measured is determined to be untrustworthy, and the trust measurement process ends.

[0100] Step S37: If it does not exist, then determine that the first record to be measured does not meet the preset trust conditions.

[0101] If the second data block mapping area does not store the corresponding third record to be measured, the first record to be measured is directly determined to not meet the preset trust conditions, that is, the first record to be measured is determined to be untrustworthy, and the trust measurement process ends.

[0102] Step S38: If yes, then determine that the first record to be measured meets the preset trust conditions.

[0103] If the second hash value of the third record to be measured is the same as the first hash value, then the first record to be measured is determined to meet the preset trust condition, that is, the first record to be measured is determined to be trustworthy, and then the trust measurement process ends, so that the trustworthy first record to be measured can be operated accordingly in the future.

[0104] Therefore, in the trust measurement based on the benchmark value linked list in this application, there is no need to read the record content from the disk into memory. Only the record head needs to be used for corresponding processing. This can greatly reduce the content to be searched, reduce the memory requirements, and thus achieve the goal of improving the efficiency of trust measurement decision.

[0105] See Figure 10 As shown in the figure, this application discloses a trust measurement device, including:

[0106] Information acquisition module 11 is used to acquire the first target index, record header and first hash value of the first record to be measured stored in the preset benchmark library;

[0107] The first mapping area determination module 12 is used to determine the current file linked list based on the first target index and to determine the first data block mapping area corresponding to the current file linked list using the record header.

[0108] The first judgment module 13 is used to determine whether the operating entity of the second record to be measured stored in the first data block mapping area has the operating permission.

[0109] The second mapping area determination module 14 is used to locate the second target index based on the keyword in the record header if the condition is met, obtain the corresponding current benchmark value chain according to the second target index, and use the record header to determine the second data block mapping area corresponding to the current benchmark value chain.

[0110] The second judgment module 15 is used to determine whether the second hash value of the third record to be measured stored in the second data block mapping area is the same as the first hash value;

[0111] The credibility measurement determination module 16 is used to determine that the first record to be measured meets the preset credibility conditions if the condition is met.

[0112] As can be seen, this application obtains the first target index, record header, and first hash value of the first record to be measured stored in the preset benchmark library; determines the current file linked list based on the first target index, and uses the record header to determine the first data block mapping area corresponding to the current file linked list; determines whether the operating entity of the second record to be measured stored in the first data block mapping area has operating authority; if so, it locates the second target index based on the keyword in the record header, obtains the corresponding current benchmark value linked list according to the second target index, and uses the record header to determine the second data block mapping area corresponding to the current benchmark value linked list; determines whether the second hash value of the third record to be measured stored in the second data block mapping area is the same as the first hash value; if so, it determines that the first record to be measured meets the preset trust conditions. Therefore, this application determines the first and second data block mapping areas based on the record header of the first record to be measured, meaning it only needs to read the record header from the disk into memory, rather than the entire record to be measured. This greatly reduces the retrieval content, significantly improves query efficiency, and reduces memory requirements, thereby achieving the goal of improving the efficiency of trust measurement decisions in the limited memory and low-performance environment of industrial control systems.

[0113] Furthermore, embodiments of this application also provide an electronic device. Figure 11 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0114] Figure 11This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Specifically, it may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the trust measurement method performed by the electronic device disclosed in any of the foregoing embodiments.

[0115] In this embodiment, the power supply 23 is used to provide operating voltage for various hardware devices on the electronic device; the communication interface 24 can create a data transmission channel between the electronic device and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0116] The processor 21 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 21 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 21 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0117] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored on it include operating system 221, computer program 222 and data 223, etc., and the storage method can be temporary storage or permanent storage.

[0118] The operating system 221 manages and controls the various hardware devices and computer programs 222 on the electronic device to enable the processor 21 to perform calculations and processing on the massive amounts of data 223 in the memory 22. The operating system can be Windows, Unix, Linux, etc. The computer program 222, in addition to including a computer program capable of performing the trust measurement method executed by the electronic device as disclosed in any of the foregoing embodiments, may further include computer programs capable of performing other specific tasks. The data 223 may include data received by the electronic device from external devices, as well as data collected by its own input / output interface 25.

[0119] Furthermore, embodiments of this application also disclose a computer-readable storage medium storing a computer program, which, when loaded and executed by a processor, implements the method steps performed during the trust measurement process disclosed in any of the foregoing embodiments.

[0120] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0121] The above provides a detailed description of the reliability measurement method, apparatus, device, and medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A credibility measurement method, characterized in that, include: Obtain the first target index, record header, and first hash value of the first record to be measured stored in the preset benchmark library; The current file linked list is determined based on the first target index, and the first data block mapping area corresponding to the current file linked list is determined using the record header; Determine whether the entity operating the second record to be measured stored in the first data block mapping area has the necessary operating permissions; If so, the second target index is located based on the keyword in the record header, the corresponding current benchmark value chain is obtained according to the second target index, and the second data block mapping area corresponding to the current benchmark value chain is determined using the record header; Determine whether the second hash value of the third record to be measured stored in the second data block mapping area is the same as the first hash value; If so, the first record to be measured is determined to meet the preset trust conditions; The step of determining the current file linked list based on the first target index and determining the first data block mapping area corresponding to the current file linked list using the record header includes: Determine the current directory level corresponding to the first record to be measured, and determine the file list information of the current directory level based on the first target index; determine the current unmeasured file list based on the file list information, and determine the first data block mapping area corresponding to the current file list using the record header; The step of determining whether the entity performing the operation on the second record to be measured stored in the first data block mapping area has the necessary permissions includes: The actual path for obtaining the second record to be measured stored in the first data block mapping area is obtained using the first target index, the current file linked list, and the first data block mapping area; it is determined whether the actual path is consistent with the target path recorded in the preset benchmark library; if they are consistent, it is determined whether the operating entity of the second record to be measured stored in the first data block mapping area has the operation permission. Before obtaining the first target index, record header, and first hash value of the first record to be measured stored in the preset benchmark library, the method further includes: Construct a preset benchmark library containing an index area and several data block storage areas; wherein, the data block storage area includes a record header and record content of a first record to be measured, and the record header includes the keyword of the first record to be measured; wherein, each data block is filled in from the head and tail of the data block toward the middle.

2. The credibility measurement method according to claim 1, characterized in that, After determining whether the actual path matches the target path recorded in the preset benchmark library, the method further includes: If not, determine whether there is an unmeasured file list in the file list information; if so, determine the next file list based on the file list information. Update the next file list to the current file list, and then jump back to the step of determining the first data block mapping area corresponding to the current file list using the record header.

3. The credibility measurement method according to claim 1, characterized in that, After determining whether the entity performing the operation on the second record to be measured stored in the first data block mapping area has the necessary permissions, the method further includes: If not, determine whether there is an unmeasured file list in the file list information; if so, determine the next file list based on the file list information. Update the next file list to the current file list, and then jump back to the step of determining the first data block mapping area corresponding to the current file list using the record header.

4. The credibility measurement method according to claim 1, characterized in that, The step of determining whether the second hash value of the third record to be measured stored in the second data block mapping area is the same as the first hash value includes: Determine whether the corresponding third record to be measured is stored in the mapping area of ​​the second data block; If it exists, then determine whether the second hash value of the third record to be measured is the same as the first hash value; If it does not exist, then the first record to be measured is determined not to meet the preset trust conditions.

5. A reliability measurement device, characterized in that, The steps for implementing the trust measurement method as described in any one of claims 1 to 4 include: The information acquisition module is used to acquire the first target index, record header, and first hash value of the first record to be measured stored in the preset benchmark library; The first mapping area determination module is used to determine the current file linked list based on the first target index and to determine the first data block mapping area corresponding to the current file linked list using the record header. The first judgment module is used to determine whether the operating entity of the second record to be measured stored in the first data block mapping area has the operating permission. The second mapping area determination module is used to locate the second target index based on the keyword in the record header if the condition is met, obtain the corresponding current benchmark value chain according to the second target index, and determine the second data block mapping area corresponding to the current benchmark value chain using the record header. The second judgment module is used to determine whether the second hash value of the third record to be measured stored in the second data block mapping area is the same as the first hash value; The trust measurement determination module is used to determine that the first record to be measured meets the preset trust conditions if the condition is met.

6. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the trust measurement method as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, Used to store a computer program; wherein, when the computer program is executed by a processor, it implements the steps of the trust measurement method as described in any one of claims 1 to 4.

Images