Access control-based secure routing method, device and storage medium

Abstract

The present invention relates to the field of wireless communication technology, and discloses a secure routing method, device and storage medium based on access control, the method comprising: when there is a message to be forwarded in the current node, obtaining the neighbor node of the current node; determining the node trust value of the neighbor node by a preset node trust measurement method; when the node trust value is greater than the reference trust value, judging whether the neighbor node meets the authority condition of the first access control tree according to the attribute information of the neighbor node; if so, judging the neighbor node as a trusted node, and transmitting the message to be forwarded to the trusted node. Since the present invention realizes the judgment of whether the neighbor node is a trusted node through the node trust value and the first access control tree when there is a message to be forwarded in the current node, the security of message transmission based on the node can be ensured.

Description

Technical Field

[0001] The present invention relates to the field of wireless communication technology, and in particular to a secure routing method, device and storage medium based on access control. Background Art

[0002] The successful transmission of data in social perception networks is mainly based on the mutual cooperation between nodes. The process of forwarding data requires access to data including the "context" and "content" privacy data of the header. However, once a malicious node invades the social perception network, it will inevitably hijack and tamper with the privacy data of the social perception network. Therefore, a method is urgently needed to ensure the security of messages during transmission.

[0003] The above contents are only used to assist in understanding the technical solution of the present invention, and do not constitute an admission that the above contents are related technologies. Summary of the invention

[0004] The main purpose of the present invention is to provide a secure routing method, device and storage medium based on access control, aiming to solve the technical problem that the existing node-based data transmission method in social perception networks is difficult to ensure the security of messages during the transmission process.

[0005] To achieve the above object, the present invention provides a secure routing method based on access control, the method comprising the following steps:

[0006] When there is a message to be forwarded at the current node, obtaining a neighbor node of the current node;

[0007] Determine the node trust value of the neighbor node by using a preset node trust measurement method;

[0008] When the node trust value is greater than the reference trust value, judging whether the neighbor node meets the permission condition of the first access control tree according to the attribute information of the neighbor node;

[0009] If so, the neighbor node is determined to be a trusted node, and the message to be forwarded is transmitted to the trusted node.

[0010] Optionally, obtaining the contact intimacy of the neighboring node to the current node;

[0011] Defining the attribute value of the neighbor node through the context information of the neighbor node, and determining the attribute trust value of the neighbor node according to the number of attributes of the neighbor node;

[0012] The node trust value of the neighbor node is determined according to the contact intimacy and the attribute trust value. Optionally, the calculation formula of the node trust value is:

[0013] T=αFij +βP j

[0014] Among them, T is the node trust value, F ij is the contact intimacy between the neighbor node j and the current node i, P j is the attribute trust value of the neighbor node j, α+β=1;

[0015] The calculation formula of the attribute trust value is:

[0016]

[0017] Among them, γ is the weight factor of positive attributes, (1-γ) is the weight factor of negative attributes, m is the number of positive information, n is the number of negative information, S j is the number of attributes of the neighbor node.

[0018] Optionally, when the node trust value is greater than the reference trust value, before judging whether the neighboring node meets the permission condition of the first access control tree according to the attribute information of the neighboring node, the method includes:

[0019] Acquire attribute information of the current network, and divide the attribute information into a normal attribute set and a malicious attribute set;

[0020] A first access control tree in the current network is constructed based on the normal attribute set.

[0021] Optionally, the constructing the first access control tree in the current network based on the normal attribute set includes:

[0022] Acquire threshold value information in the current network, and define a root node according to the threshold value information;

[0023] Define non-leaf nodes according to a preset threshold standard;

[0024] Determining a plurality of leaf nodes based on the normal attribute set, wherein each of the leaf nodes corresponds to a plurality of attributes in the normal attribute set;

[0025] The first access control tree is determined by using the root node, the non-leaf nodes, and the leaf nodes.

[0026] Optionally, when the node trust value is greater than a reference trust value, judging whether the neighboring node meets the permission condition of the first access control tree according to the attribute information of the neighboring node includes:

[0027] When the node trust value is greater than the reference trust value, obtaining each attribute value of the neighbor node;

[0028] Compare the attribute values ​​with the leaf node information in the first access control tree, and determine whether the neighbor node meets the preset threshold standard according to the comparison result.

[0029] Accordingly, if yes, determining that the neighbor node is a trusted node, and transmitting the message to be forwarded to the trusted node, includes:

[0030] When the neighbor node meets the preset threshold standard, determining the neighbor node as a trusted node;

[0031] The message to be forwarded is transmitted to the trusted node.

[0032] Optionally, when there is a message to be forwarded at the current node, before obtaining the neighbor node of the current node, the method includes:

[0033] Obtaining a target plaintext message, and encrypting the target plaintext message according to a preset encryption mode to obtain a ciphertext message;

[0034] Constructing a second access control tree based on the standard attribute information of the destination node and the decryption function corresponding to the preset encryption mode;

[0035] Determining the ciphertext message and the second access control tree as messages to be forwarded;

[0036] Optionally, after transmitting the message to be forwarded to the trusted node, the method further includes:

[0037] When the trusted node is a destination node, determining whether the destination node meets the permission conditions of the second access control tree;

[0038] If so, the decryption function is obtained and the ciphertext message is decrypted according to the decryption function to obtain the target plaintext message.

[0039] In addition, to achieve the above-mentioned purpose, the present invention also proposes an access control-based secure routing device, the device comprising: a memory, a processor, and an access control-based secure routing program stored in the memory and executable on the processor, the access control-based secure routing program being configured to implement the steps of the access control-based secure routing method as described above.

[0040] In addition, to achieve the above objectives, the present invention also proposes a storage medium, on which a secure routing program based on access control is stored. When the secure routing program based on access control is executed by a processor, the steps of the secure routing method based on access control as described above are implemented.

[0041] In the present invention, when there is a message to be forwarded in the current node, the neighbor node of the current node is obtained; the node trust value of the neighbor node is determined by a preset node trust measurement method; when the node trust value is greater than the reference trust value, it is judged whether the neighbor node meets the permission conditions of the first access control tree according to the attribute information of the neighbor node; if so, the neighbor node is determined to be a trusted node, and the message to be forwarded is transmitted to the trusted node. Since the present invention realizes the judgment of whether the neighbor node is a trusted node through the node trust value and the access control tree when there is a message to be forwarded in the current node, it can ensure the security of message transmission based on the node. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 A schematic diagram of the structure of a secure routing device based on access control in a hardware operating environment involved in an embodiment of the present invention;

[0043] Figure 2 A schematic diagram of a flow chart of a first embodiment of a secure routing method based on access control according to the present invention;

[0044] Figure 3 A schematic diagram of a flow chart of a second embodiment of a secure routing method based on access control according to the present invention;

[0045] Figure 4 A schematic diagram of tree-shaped access control in the second embodiment of the access control-based secure routing method of the present invention;

[0046] Figure 5 A schematic diagram of a flow chart of a third embodiment of a secure routing method based on access control according to the present invention;

[0047] Figure 6 The figure is a schematic diagram of the entire process of the secure routing method based on access control of the present invention.

[0048] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0049] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0050] Reference Figure 1 , Figure 1 The present invention is a schematic diagram of a secure routing device structure based on access control in a hardware operating environment according to an embodiment of the present invention.

[0051] like Figure 1As shown, the access control-based secure routing device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM), or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0052] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation on the access control-based secure routing device, and may include more or less components than those shown in the figure, or combine certain components, or arrange the components differently.

[0053] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and a security routing program based on access control.

[0054] exist Figure 1 In the access control-based secure routing device shown, the network interface 1004 is mainly used for data communication with a network server; the user interface 1003 is mainly used for data interaction with a user; the processor 1001 and the memory 1005 in the access control-based secure routing device of the present invention can be set in the access control-based secure routing device, and the access control-based secure routing device calls the access control-based secure routing program stored in the memory 1005 through the processor 1001, and executes the access control-based secure routing method provided in an embodiment of the present invention.

[0055] The embodiment of the present invention provides a secure routing method based on access control. Figure 2 , Figure 2 It is a flowchart of the first embodiment of the secure routing method based on access control of the present invention.

[0056] In this embodiment, the access control-based secure routing method includes the following steps:

[0057] Step S10: When there is a message to be forwarded at the current node, obtain the neighboring nodes of the current node.

[0058] It is understandable that data can be forwarded based on nodes in a social perception network, and the process of message transmission can be regarded as a process from a source node through multiple intermediate nodes to a destination node. However, the process of forwarding data requires access to data including the "context" and "content" privacy data of the header, and once a malicious node invades the social perception network, it will inevitably hijack and tamper with the privacy data of the social perception network. Therefore, this embodiment realizes the judgment of whether a neighbor node is a trusted node through a preset node trust measurement method and an access control tree, ensures that each intermediate node for message transmission is a trusted node, prevents malicious node invasion, and realizes the secure transmission of messages.

[0059] It should be noted that the method of this embodiment can be applied to scenarios where messages are transmitted based on nodes in social perception networks, and can also be applied to other scenarios where messages are forwarded based on nodes. The execution subject of this embodiment can be a computing service device with data transmission, network communication and program running functions, such as a mobile phone, a tablet computer, a personal computer, etc., or other electronic devices that implement the same or similar functions. The following takes the above-mentioned access control-based secure routing device (hereinafter referred to as "device") as an example to illustrate this embodiment and the following embodiments.

[0060] It is understandable that the current node can be a source node or an intermediate node in the message transmission process, and the neighbor node of the current node is any node in the next hop node link set of the current node. The current node can use each next hop node in the next hop node link set as a neighbor node to perform subsequent steps.

[0061] Step S20: Determine the node trust value of the neighbor node by using a preset node trust metric method.

[0062] It should be noted that node trust measurement is a method of measuring node trust relationships through node contact frequency and node attribute trust values. When two nodes maintain frequent and regular contact in long-term contact and communication, they can be regarded as trustworthy by each other. Therefore, in order to specifically explain the preset node trust measurement method, step S20 includes:

[0063] Step S201: Obtain the contact intimacy of the neighboring node to the current node.

[0064] It should be noted that contact intimacy can be defined as the ratio of the contact frequency between two nodes in the network after they meet to the sum of the contact frequencies between the two nodes and other nodes. Since each node contacts different nodes and the number of contacts is also different, the evaluation process of contact intimacy can be a one-way evaluation process, that is, the contact intimacy F of neighbor node j to current node i is ij The contact intimacy F between the current node i and the neighbor node j ji Not the same.

[0065] Specifically, the contact intimacy calculation formula can be used to calculate the contact intimacy F of the neighbor node to the current node: ij , the contact intimacy calculation formula is:

[0066]

[0067] Among them, Con ij represents the number of contacts between the current node i and its neighbor node j, Indicates the total number of contacts between the current node i and other nodes.

[0068] Step S202: defining the attribute value of the neighbor node through the context information of the neighbor node, and determining the attribute trust value of the neighbor node according to the number of attributes of the neighbor node.

[0069] It should be noted that the context information of a node can be defined in the form of a set of attribute values. The specific process can be:

[0070] First, define G1 as a bilinear group of order p, where p is a prime number and g is a generator in group G1. There exists a mapping e:G1×G2→G2 which is a bilinear mapping. Each attribute value of a neighbor node is represented by the set Z p An element in , defining the Lagrange coefficient as: Where i∈Z p . Secondly, define a global attribute set U, and randomly select n independent elements in U |U| = t1, t2, ..., t n ∈Z p , the global attribute set U is divided into the positive attribute set U p and negative attribute set U q Next, obtain the attribute value of the neighbor node and convert S j The attribute values ​​of the neighbor nodes and the positive attribute set U p and negative attribute set U q The number of positive information m and the number of negative information n of the neighboring nodes are matched respectively. The matching process is expressed as: m = |S j ∩U p | and n = |Sj ∩U q |.

[0071] Finally, the attribute trust value calculation formula can be used to assign different weights to positive attributes and malicious attributes, thereby determining the attribute trust value P of the neighbor node j: j , the calculation formula of the attribute trust value can be:

[0072]

[0073] Among them, γ is the weight factor of positive attributes, (1-γ) is the weight factor of negative attributes, m is the number of positive information, n is the number of negative information, S j is the number of attributes of the neighbor node.

[0074] Step S203: determining the node trust value of the neighbor node according to the contact intimacy and the attribute trust value.

[0075] Specifically, a calculation formula for the node trust value may be used to calculate the node trust value of the neighboring node. The calculation formula for the node trust value may be:

[0076] T=αF ij +βP j

[0077] Among them, T is the node trust value, F ij is the contact intimacy between the neighbor node j and the current node i, P j is the attribute trust value of the neighbor node j, α+β=1;

[0078] Step S30: When the node trust value is greater than the reference trust value, judging whether the neighbor node meets the permission condition of the first access control tree according to the attribute information of the neighbor node.

[0079] It should be noted that the node trust value of the neighbor node calculated above can reflect the trust metric between the neighbor node and the source node of the message transmission, so the reference trust value can be the trust metric of the source node and the destination node. When the node trust value is greater than the reference trust value, it is considered that the neighbor node has passed the node attribute trust calculation, and then it can be further determined whether the neighbor node can pass the authority of the access control tree.

[0080] It should also be noted that the first access control tree may be a pre-built tree-shaped access control structure, and the first access control tree may be set based on the attribute information of the network where the node is located, and is used to make further credibility judgments on the attribute information of the neighboring nodes.

[0081] In a specific implementation, when the node trust value of a neighbor node is greater than a reference trust value, it can be regarded as passing the trust measurement, and then it can be further determined whether the neighbor node can pass the authority of the preset first access control tree based on the attribute information of the neighbor node.

[0082] Step S40: If yes, determine that the neighbor node is a trusted node, and transmit the message to be forwarded to the trusted node.

[0083] It should be noted that when the neighbor node meets the permission conditions of the first access control tree, the neighbor node is determined to be a trusted node that can be used for message transmission, and the message to be forwarded can be transmitted from the current node to the trusted node to realize node-based message transmission.

[0084] This embodiment obtains the neighbor node of the current node when there is a message to be forwarded in the current node; determines the node trust value of the neighbor node by a preset node trust measurement method; when the node trust value is greater than the reference trust value, determines whether the neighbor node meets the permission conditions of the first access control tree according to the attribute information of the neighbor node; if so, determines that the neighbor node is a trusted node, and transmits the message to be forwarded to the trusted node. Since this embodiment realizes the judgment of whether the neighbor node is a trusted node through the node trust value and the access control tree when there is a message to be forwarded in the current node, it can ensure the security of message transmission based on the node.

[0085] refer to Figure 3 , Figure 3 It is a flowchart of the second embodiment of the secure routing method based on access control of the present invention.

[0086] Based on the above embodiment, in order to construct the first access control tree, in this embodiment, before step S30, the following is further included:

[0087] Step S01: Acquire attribute information of the current network, and divide the attribute information into a normal attribute set and a malicious attribute set.

[0088] It should be noted that the attribute information of the current network can be the sum of the positive information and negative information contained in the current network. In order to judge the credibility of the node, the attribute information of the current network can be divided in advance. For example, the attribute information of the current network is used as the global attribute set U as described above, and the global attribute set U is divided into the positive attribute set U p and negative (malicious) attribute set U q .

[0089] Step S02: constructing a first access control tree in the current network based on the normal attribute set.

[0090] It should also be noted that the access control tree can be composed of leaf nodes, non-leaf nodes and root nodes. The root node can be the data finally accessed, and the visitor needs to meet the minimum threshold of the access control tree to obtain the data of the root node. The non-leaf node can be a threshold node, which is used to set the threshold condition of the visitor. The leaf node can be the attribute value information used to determine the threshold condition.

[0091] Specifically, the device can obtain the threshold value information in the current network, define the root node according to the threshold value information; define the non-leaf node according to the preset threshold standard; determine a number of leaf nodes based on the normal attribute set, wherein each leaf node corresponds to a number of attributes in the normal attribute set; and determine the first access control tree through the root node, the non-leaf node and the leaf node.

[0092] It should also be noted that the threshold value information in the current network may be permission information for verifying whether a neighboring node can receive and transmit the message to be forwarded; the preset threshold standard may be a threshold limit of an attribute value or a logical relationship.

[0093] Accordingly, step S30 includes:

[0094] Step S301: when the node trust value is greater than the reference trust value, obtaining each attribute value of the neighbor node.

[0095] It should be noted that when the node trust value is greater than the reference trust value, attribute access control may be performed according to each attribute value of the neighboring node. Each attribute value of the neighboring node may be defined based on the context information of the neighboring node.

[0096] Step S302: Compare the attribute values ​​with the leaf node information in the first access control tree, and determine whether the neighbor node meets the preset threshold standard according to the comparison result.

[0097] It should be noted that since non-leaf nodes can be set layer by layer, only when the attribute value of the neighboring node meets the preset threshold standard of each non-leaf node can it recursively enter the previous layer of non-leaf nodes to lift the threshold of the nodes in that layer until the access restriction of the root node is met.

[0098] Correspondingly, the step S40 includes: when the neighbor node meets the preset threshold standard, determining that the neighbor node is a trusted node; and transmitting the message to be forwarded to the trusted node.

[0099] You can refer to here Figure 4 The specific process of performing access control on the neighboring nodes based on the access control tree in this embodiment is described. Figure 4 This is a schematic diagram of tree access control in the second embodiment of the access control-based secure routing method of the present invention.

[0100] exist Figure 4 In the figure, leaf nodes a~j can be several attributes in the normal attribute set, and non-leaf nodes are threshold nodes, where the data form is represented by (n, t): the non-leaf node has a total of n child nodes, and when there are t child nodes that meet the conditions, the non-leaf node meets the conditions.

[0101] In a specific implementation, each attribute value of the neighboring node is compared with the attributes of the leaf node (several attributes in the normal attribute set). Taking the non-leaf node (4,1) as an example, if among the attribute values ​​of the neighboring node, at least one of the four attribute values ​​corresponding to the leaf nodes g, h, i, and j meets the preset threshold standard, then the neighboring node passes through the non-leaf node and enters the upper layer of non-leaf nodes (2,2) to continue the corresponding condition judgment until the access restriction of the root node is met. Only then can the permission conditions of the entire first access control tree be passed to obtain the threshold value information at the root node, that is, it is judged as a trusted node and has the authority to receive and transmit the message to be forwarded.

[0102] It should be noted that the preset threshold standard of the non-leaf nodes of each layer mentioned above can be an existence standard or a quantitative standard based on numerical attribute values, which is not limited in this embodiment.

[0103] This embodiment obtains the attribute information of the current network, and divides the attribute information into a normal attribute set and a malicious attribute set; constructs the first access control tree in the current network based on the normal attribute set. Specifically, the threshold value information in the current network is obtained, and the root node is defined according to the threshold value information; the non-leaf nodes are defined according to the preset threshold standard; a number of leaf nodes are determined based on the normal attribute set, wherein each leaf node corresponds to a number of attributes in the normal attribute set; the first access control tree is determined through the root node, the non-leaf node and the leaf node. Since the context information of the node is defined as the attribute value in this embodiment, the privacy security of the node is guaranteed, the attributes in the network are divided, and the first access control tree is constructed based on the normal attribute set. Only when the neighboring node passes the preset threshold standard can the authority information of receiving the transmission message at the root node be obtained, and it is determined as a trusted node that can be used for data transmission, the reliability of the node that transmits the message can be further improved.

[0104] refer to Figure 5 , Figure 5 It is a flowchart of the third embodiment of the secure routing method based on access control of the present invention.

[0105] Based on the above embodiment, in order to realize encrypted transmission and message decryption of the message to be forwarded, before step S10, the following steps are included:

[0106] Step S001: Obtain a target plaintext message, and encrypt the target plaintext message according to a preset encryption mode to obtain a ciphertext message.

[0107] It should be noted that the preset encryption mode can be the Cipher Block Chaining (CBC) mode in the Advanced Encryption Standard (AES). The CBC mode can first divide the target plaintext message into several small segments, and then each small segment is XORed with the initial block or the previous ciphertext segment, and then encrypted with the key; repeat the above steps until all ciphertext blocks are processed to obtain the ciphertext message.

[0108] It should also be noted that CBC mode encryption requires an initialization vector (IV) during the encryption and decryption process. Before each encryption or after decryption, the initialization vector is used to XOR with the plaintext or ciphertext. The encryption process can be expressed as: C = E (K, P), where C is the encrypted ciphertext, i.e. the message to be forwarded, K is the key, P is the plaintext, i.e. the target plaintext message, and E is the encryption function; the decryption process can be expressed as: P = D (K, P), where D is the decryption function, and the decryption process is the inverse operation of the encryption process.

[0109] Step S002: construct a second access control tree based on the standard attribute information of the destination node and the decryption function corresponding to the preset encryption mode.

[0110] It should be noted that since the neighbor node can be an intermediate node for transmission or the last hop node that the data transmission needs to reach, that is, the destination node, the authority of the destination node can be judged when reaching the destination node, and the access control tree can also be used to judge the decryption authority of the destination node.

[0111] It is understandable that the second access control tree can be constructed in the same or similar manner as the first access control tree. The standard attribute information can be the information of the final receiving node of the plaintext message determined when the plaintext message is generated, so the leaf nodes and non-leaf nodes in the second access control tree can be defined based on the standard attribute information of the destination node, and the root node information in the second access control tree can be defined based on the decryption function information corresponding to the above encryption function.

[0112] Step S003: Determine the ciphertext message and the second access control tree as messages to be forwarded.

[0113] It should be noted that the second access control tree can be embedded in the above ciphertext message and used as a message transmitted in the node, namely, a message to be forwarded. When the neighbor node is determined to be a trusted node, it can receive the message to be forwarded transmitted by the previous hop node.

[0114] Therefore, in order to decrypt the target plaintext message when the message to be forwarded is transmitted to the destination node, after transmitting the message to be forwarded to the trusted node, the method further includes:

[0115] Step S501: when the trusted node is a destination node, determining whether the destination node meets the permission condition of the second access control tree.

[0116] Step S502: If yes, obtain the decryption function and decrypt the ciphertext message according to the decryption function to obtain the target plaintext message.

[0117] In a specific implementation, when the message to be forwarded is transmitted to the destination node, the destination node is verified by determining whether the destination node meets the permission conditions in the second access control tree; if passed, the decryption function information at the root node of the second access control tree is obtained, and then the ciphertext message in the message to be forwarded is decrypted and restored through the decryption function to obtain the target plaintext message, thereby completing the message transmission process from the source node to the destination node.

[0118] In addition, you can refer to Figure 6 The whole process of the secure routing method based on access control of the present invention is described. Figure 6 The figure is a schematic diagram of the entire process of the secure routing method based on access control of the present invention.

[0119] exist Figure 6 In the method, first, the source node generates a target plaintext message and encrypts it; then the intermediate node carries the ciphertext message for message transmission; before the current node transmits the message to be transmitted to the next hop node, the P value (node ​​trust value) and access control (first access control tree) of the neighboring node are verified; if the verification and access control fail, the neighboring node is determined to be a malicious node; if the verification and access control pass, the neighboring node is determined to be a trusted node, and the message to be forwarded is transmitted to the trusted node; until the message is transmitted to the destination node, the authority of the destination node is judged through the second access control tree in the message to be forwarded; if the verification and access control fail, the decryption fails; if the verification and access control pass, the decryption function is obtained to decrypt the ciphertext message and recover the target plaintext message.

[0120] This embodiment encrypts the target plaintext message before the message is transmitted and constructs a second access control tree for destination node verification, so that when the message is transmitted to the destination node, the decryption function corresponding to the preset encryption mode at the root node can be obtained when the destination node passes the permission conditions of the second access control tree, and the ciphertext information can be decrypted, thereby realizing a node-based message transmission process, which is beneficial to further ensure the security of the message during the transmission process.

[0121] In addition, an embodiment of the present invention further proposes a storage medium on which a secure routing program based on access control is stored. When the secure routing program based on access control is executed by a processor, the steps of the secure routing method based on access control as described above are implemented.

[0122] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0123] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0124] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory / random access memory, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0125] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A secure routing method based on access control, characterized in that: The method comprises: When there is a message to be forwarded at the current node, obtaining a neighbor node of the current node; Determine the node trust value of the neighbor node by using a preset node trust measurement method; When the node trust value is greater than the reference trust value, judging whether the neighbor node meets the permission condition of the first access control tree according to the attribute information of the neighbor node; If yes, the neighbor node is determined to be a trusted node, and the message to be forwarded is transmitted to the trusted node; Wherein, determining the node trust value of the neighbor node by using a preset node trust metric method includes: Obtaining the contact intimacy of the neighboring node to the current node; Defining the attribute value of the neighbor node through the context information of the neighbor node, and determining the attribute trust value of the neighbor node according to the number of attributes of the neighbor node; Determining a node trust value of the neighbor node according to the contact intimacy and the attribute trust value; The calculation formula of the node trust value is: T=αF ij +βP j Among them, T is the node trust value, F ij is the contact intimacy between the neighbor node j and the current node i, P j is the attribute trust value of the neighbor node j, α+β=1; The calculation formula of the attribute trust value is: Among them, γ is the weight factor of positive attributes, (1-γ) is the weight factor of negative attributes, m is the number of positive information, n is the number of negative information, S j is the number of attributes of the neighbor node; When the node trust value is greater than the reference trust value, before judging whether the neighbor node meets the permission condition of the first access control tree according to the attribute information of the neighbor node, the method includes: Acquire attribute information of the current network, and divide the attribute information into a normal attribute set and a malicious attribute set; Constructing a first access control tree in the current network based on the normal attribute set; When there is a message to be forwarded at the current node, before obtaining the neighbor node of the current node, the method includes: Obtaining a target plaintext message, and encrypting the target plaintext message according to a preset encryption mode to obtain a ciphertext message; Constructing a second access control tree based on the standard attribute information of the destination node and the decryption function corresponding to the preset encryption mode; The ciphertext message and the second access control tree are determined as messages to be forwarded.

2. The access control-based secure routing method according to claim 1, characterized in that: The step of constructing the first access control tree in the current network based on the normal attribute set includes: Acquire threshold value information in the current network, and define a root node according to the threshold value information; Define non-leaf nodes according to a preset threshold standard; Determining a plurality of leaf nodes based on the normal attribute set, wherein each of the leaf nodes corresponds to a plurality of attributes in the normal attribute set; The first access control tree is determined by using the root node, the non-leaf nodes, and the leaf nodes.

3. The access control-based secure routing method according to claim 2, characterized in that: When the node trust value is greater than the reference trust value, judging whether the neighboring node meets the permission condition of the first access control tree according to the attribute information of the neighboring node includes: When the node trust value is greater than the reference trust value, obtaining each attribute value of the neighbor node; Comparing each of the attribute values ​​with the leaf node information in the first access control tree, and judging whether the neighbor node meets the preset threshold standard according to the comparison result; Accordingly, if yes, determining that the neighbor node is a trusted node, and transmitting the message to be forwarded to the trusted node, includes: When the neighbor node meets the preset threshold standard, determining the neighbor node as a trusted node; The message to be forwarded is transmitted to the trusted node.

4. The access control-based secure routing method according to claim 1, characterized in that: After transmitting the message to be forwarded to the trusted node, the method further includes: When the trusted node is a destination node, determining whether the destination node meets the permission conditions of the second access control tree; If so, the decryption function is obtained and the ciphertext message is decrypted according to the decryption function to obtain the target plaintext message.

5. A secure routing device based on access control, characterized in that: The access control-based secure routing device includes: a memory, a processor, and an access control-based secure routing program stored in the memory and executable on the processor. When the access control-based secure routing program is executed by the processor, the steps of the access control-based secure routing method as described in any one of claims 1 to 4 are implemented.

6. A storage medium, characterized in that: The storage medium stores a secure routing program based on access control, and when the secure routing program based on access control is executed by the processor, the steps of the secure routing method based on access control as described in any one of claims 1 to 4 are implemented.

Images