A method and apparatus for confirming node trust

Abstract

This application provides a method and apparatus for confirming node trust, relating to the field of computer network technology, which can ensure the security and reliability of general data transmission. The method includes: receiving log information sent by multiple child nodes, and determining the node trust of each child node based on the data traffic and data digest of each child node at different times.

Description

Technical Field

[0001] This application relates to the field of computer network technology, and in particular to a method and apparatus for confirming node trust. Background Technology

[0002] In the process of data circulation and sharing, data transmission nodes, as key hubs in network communication, are crucial for ensuring data integrity, security, and reliability through trust evaluation methods. By evaluating the trustworthiness of data transmission nodes, the reliability and security of data transmission can be effectively guaranteed, and the efficiency and quality of data transmission can be improved.

[0003] Currently, node trust evaluation methods are mostly geared towards the Internet of Things (IoT), the Internet of Vehicles (IoV), and various network scenarios. Methods for evaluating the trust of data transmission nodes are largely lacking, especially for general-purpose data transmission nodes. Therefore, there is an urgent need to design a trust verification method suitable for general-purpose data transmission nodes to ensure the security and reliability of general-purpose data transmission. Summary of the Invention

[0004] This application provides a node trust confirmation method and apparatus, which can determine the trust level of data transmission nodes, thereby effectively ensuring the security and reliability of general data transmission.

[0005] To achieve the above objectives, this application adopts the following technical solution:

[0006] Firstly, this application provides a method for confirming node trust, the method comprising:

[0007] Receives log information from multiple child nodes. Each child node's log information includes at least its data flow and data summary at different times. The data flow of a child node at any given time refers to the number of bytes received or sent by the child node at that time.

[0008] The node trust level of each child node is determined based on the data traffic and data summary of each child node at different times.

[0009] Based on the above technical solution, this application provides a node trust confirmation method. A central node receives log information from multiple child nodes. Each child node's log information includes at least its data traffic and data digest at different times. Then, based on the data traffic and data digest of each child node at different times, the node trust level of each child node is determined. Through this method, the central node can determine the node trust level of each transmission node by comparing the data traffic and data digest of each transmission node at different times. By selecting transmission nodes with high trust levels for data transmission, the central node effectively ensures the security and reliability of general data sharing.

[0010] Optionally, data traffic includes uplink traffic and downlink traffic, and multiple child nodes include a first child node. Based on this, when determining the node trust level of each child node based on its data traffic and data digest at different times, the process may include: comparing the data traffic and data digest in the log information sent by the first child node to obtain a first comparison result; then comparing the uplink and downlink traffic in the log information of each child node to obtain a second comparison result; and finally, determining the node trust level of the first child node based on the first and second comparison results.

[0011] Optionally, the multiple child nodes may also include a second child node. The first child node sends the target data to the second child node at a first time, and the second child node receives the target data from the first child node at a second time. The log information sent by the first child node includes the uplink traffic and data summary of the first child node at the first time, and the log information sent by the second child node includes the downlink traffic and data summary of the second child node at the second time.

[0012] Based on this, the comparison of data traffic in the log information of each child node to obtain a second comparison result may include: comparing the uplink traffic of the first child node at the first moment and the downlink traffic of the second child node at the second moment to obtain a second comparison result.

[0013] Optionally, determining the node trust level of the first child node based on the first comparison result and / or the second comparison result may include: increasing the node trust level of the first child node according to a first rule when the difference between the data traffic and data digest in the log information sent by the first child node is less than a first threshold, and the difference between the uplink traffic and downlink traffic in the log information of each child node is less than a second threshold, as indicated by the first comparison result. Alternatively, decreasing the node trust level of the first child node according to a second rule when the difference between the data traffic and data digest in the log information sent by the first child node is greater than or equal to the first threshold, or when the difference between the uplink traffic and downlink traffic in the log information of each child node is greater than or equal to the second threshold, as indicated by the second comparison result.

[0014] Optionally, the log information of each child node may also include a transaction identifier. Based on this, the central node may merge the log information sent by each child node according to the transaction identifier to obtain at least one merged log. For each merged log, the merged log is encrypted to obtain an encrypted log, which is then sent to the target child node. The target child node is used to decrypt the encrypted log and update the node trust level of each child node based on the data traffic and data digest of each child node at different times contained in the decrypted log.

[0015] Optionally, the target child node can be any node among the node with the highest trust level and / or the node with the highest idle level.

[0016] Optionally, before determining the node trust level of each child node based on the data traffic and data digest of each child node at different times, the central node can also receive node information sent by multiple child nodes, and determine the initial trust level of each child node based on the node information of the child node.

[0017] Based on this, when determining the node trust level of each sub-node based on the data traffic and data digest of each sub-node at different times, it can include: updating the initial trust level of each sub-node based on the data traffic and data digest of each sub-node at different times to obtain the node trust level of each sub-node.

[0018] Optionally, when determining the initial trust level of a child node based on its node information, the following can be included: if the node information of the child node includes the address information, port identifier, and enterprise information to which the child node belongs, and the address information, port identifier, and enterprise information all meet preset conditions, then the initial trust level of the child node is set to the first trust level.

[0019] Secondly, this application provides a node trust verification device, the device comprising:

[0020] The receiving unit is used to receive log information sent by multiple child nodes. Each child node's log information includes at least its data flow and data summary at different times. The data flow of a child node at any given time refers to the number of bytes received or sent by the child node at that time.

[0021] The determination unit is used to determine the node trust level of each child node based on the data flow and data digest of each child node at different times.

[0022] Optionally, the data traffic includes uplink traffic and downlink traffic, and the multiple child nodes include the first child node. Based on this, the determining unit is also used to compare the data traffic and data digest in the log information sent by the first child node to obtain a first comparison result. Then, it compares the uplink traffic and downlink traffic in the log information of each child node to obtain a second comparison result. Finally, based on the first comparison result and the second comparison result, it determines the node trust level of the first child node.

[0023] Optionally, the determining unit is further configured to determine the node trust level of the first child node based on the first comparison result and / or the second comparison result.

[0024] Optionally, before determining the node trust level of each child node based on the data traffic and data digest of each child node at different times, the receiving unit is also used to receive node information sent by multiple child nodes.

[0025] Optionally, before determining the node trust level of each child node based on the data traffic and data summary of each child node at different times, the determining unit is also used to determine the initial trust level of each child node based on the node information of the child node.

[0026] Thirdly, this application provides a node trust verification device, which includes a processor and a communication interface. The communication interface is coupled to the processor, which is used to run computer programs or instructions to implement the node trust verification method as described in the first aspect and any of its possible implementations.

[0027] Fourthly, this application provides a computer-readable storage medium storing instructions that, when executed on a terminal, cause the terminal to perform the node trust confirmation method as described in the first aspect and any possible implementation thereof.

[0028] Fifthly, this application provides a computer program product containing computer instructions that, when executed on a computer, cause the computer to perform the node trust confirmation method as described in the first aspect and any possible implementation thereof.

[0029] Understandably, the beneficial effects that the node trust verification device of the second aspect, the node trust verification device of the third aspect, the computer-readable storage medium of the fourth aspect, and the computer program product of the fifth aspect can achieve can be referred to the beneficial effects of the first aspect and any possible design, which will not be repeated here. Attached Figure Description

[0030] Figure 1 An architecture diagram of a node trust confirmation system provided in this application embodiment;

[0031] Figure 2 A flowchart illustrating a node trust confirmation method provided in this application embodiment. Figure 1 ;

[0032] Figure 3 A flowchart illustrating a node trust confirmation method provided in this application embodiment. Figure 2 ;

[0033] Figure 4 A flowchart illustrating a node trust confirmation method provided in this application embodiment. Figure 3 ;

[0034] Figure 5 A flowchart illustrating a node trust confirmation method provided in this application embodiment. Figure 4 ;

[0035] Figure 6 An interactive flowchart illustrating a node trust confirmation method provided in an embodiment of this application;

[0036] Figure 7 This is a schematic diagram of the structure of a node trust verification device provided in an embodiment of this application;

[0037] Figure 8 This is a schematic diagram of another node trust verification device provided in an embodiment of this application. Detailed Implementation

[0038] The following describes in detail, with reference to the accompanying drawings, a node trust confirmation method and apparatus provided in the embodiments of this application.

[0039] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0040] The terms "first" and "second," etc., used in the specification and drawings of this application are used to distinguish different objects or to distinguish different treatments of the same object, rather than to describe a specific order of objects.

[0041] Furthermore, the terms "comprising" and "having," and any variations thereof, used in the description of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.

[0042] It should be noted that in the embodiments of this application, the words "exemplary" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0043] In today's era of rapid digital development, the data element market is booming, and data has become one of the most important resources for all industries. Through data sharing, enterprises can not only promote the efficient use of data, but also access a wider range of data resources, thereby conducting more in-depth data mining and analysis to uncover potential business opportunities and value.

[0044] In the process of data sharing and circulation, data transmission nodes, as key hubs in network communication, are crucial for ensuring data integrity, security, and reliability through trust evaluation methods. However, due to the complexity and uncertainty of the network environment, various security threats may arise during data transmission, such as malicious attacks, data tampering, and node failure. Therefore, by evaluating the trustworthiness of data transmission nodes, the reliability and security of data transmission can be effectively guaranteed, and the efficiency and quality of data transmission can be improved.

[0045] Currently, the application of relevant transmission node trust evaluation methods is mostly focused on the Internet of Things, the Internet of Vehicles, and various network scenarios. There is a lack of a trust evaluation method specifically for data transmission nodes, especially a lack of a trust evaluation method for general data transmission nodes.

[0046] To address the aforementioned technical problems, this application provides a node trust confirmation method. A central node receives log information from multiple child nodes. Each child node's log information includes at least its data traffic and data digest at different times. Then, based on the data traffic and data digest of each child node at different times, the node trust level of each child node is determined. Through this method, the central node can determine the node trust level of each child node based on whether the data traffic and data digest of each child node match at different times, thereby ensuring the security and reliability of general data sharing.

[0047] Figure 1 An architecture diagram of a node trust confirmation system provided in this application embodiment is shown below. Figure 1 As shown, the system architecture includes: central node 101 and sub-node 102.

[0048] In this embodiment of the application, the central node 101 can be a server or an electronic device, and the child node 102 can also be a server or an electronic device.

[0049] The server can be a high-performance server providing various services on the internet, a standalone physical server, a server cluster consisting of multiple physical servers, or a cloud server providing at least one of the following basic cloud computing services: cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks, and big data or artificial intelligence platforms. This application embodiment does not limit the specific services provided. Of course, the server can also include other functions to provide more comprehensive and diversified services.

[0050] The electronic device may be a device that provides voice and / or data connectivity to a user, a device with wireless connectivity, or other devices connected to a wireless modem. The terminal device may be at least one of a desktop computer, laptop, wireless terminal, or laptop computer. In one embodiment, the electronic device has communication capabilities and is able to access a wired or wireless network.

[0051] It should be noted that the embodiments of this application do not specifically limit the number of child nodes 102, that is, the node trust confirmation system can contain more than [a certain number of child nodes 102]. Figure 1 More or fewer child nodes.

[0052] The central node 101 includes a node information module, a transaction information merging module, a secret processing and distribution module, a trust calculation module, and an information broadcasting module.

[0053] In this embodiment, the node information module stores the node information of child nodes 102. The transaction information merging module merges the received log information from child nodes 102 to obtain a merged log. The secret processing and distribution module encrypts the merged log and segments the decrypted log information for distribution to child nodes 102. The trust calculation module calculates and stores the trust level of child nodes 102. The information broadcasting module broadcasts the trust level of each child node 102 to all child nodes 102.

[0054] Sub-node 102 includes a log module, a trust calculation module, a secret processing module, and an information broadcasting module.

[0055] In this embodiment, the log module stores the log information of child nodes 102 and sends the log information of child nodes 102 to the central node 101. The trust calculation module calculates and stores the trust level of child nodes 102. The secret processing module receives encrypted logs sent by the central node 101 and decrypts the encrypted logs. The information broadcasting module broadcasts the trust level of each child node 102 to all child nodes 102.

[0056] In this embodiment, child node 102 sends log information to central node 101. Central node 101 receives the log information sent by child node 102 and then determines the node trust level of child node 102 based on the data traffic and data digest of child node 102 at different times.

[0057] In some embodiments, the child node 102 may also send node information to the central node. The central node 101 receives the node information sent by the child node 102, and then determines the initial trust level of the child node 102 based on the node information of the child node 102.

[0058] In some embodiments, the central node 101 can also merge the log information sent by the child node 102 to obtain a merged log, then encrypt the merged log to obtain an encrypted log, and send the encrypted log to the child node 102. The child node 102 decrypts the encrypted log and updates its node trust level based on the data traffic and data digest of the child node 102 at different times contained in the decrypted log.

[0059] Figure 2 This is a flowchart illustrating a node trust confirmation method provided in an embodiment of this application, as shown below. Figure 2 As shown, the method includes:

[0060] S201 receives log information sent by multiple child nodes.

[0061] Each child node's log information includes at least the child node's data traffic and data summary at different times. The data traffic of a child node at any given time refers to the number of bytes received or sent by the child node at that time, i.e., the uplink and downlink traffic of the child node at different times.

[0062] For example, suppose that child node A sends 512 bytes of data to child node B at time t1, and correspondingly, child node B receives 512 bytes of data sent by child node A at time t2. Then, the uplink traffic of child node A at time t1 is 512, and the downlink traffic of child node B at time t2 is 512.

[0063] The log information of the child nodes can specifically include transmission behavior records and communication behavior records. Transmission behavior records include timestamps, the child node sending data, the child node receiving data, and a data digest. Communication behavior records include timestamps, uplink traffic, and downlink traffic. Transmission behavior records can be denoted as DLog = {timestamp, node i, node j, data digest}, and communication behavior records can be denoted as TLog = {timestamp, uplink traffic, downlink traffic}. Here, node i represents the child node sending data, node j represents the child node receiving data sent by node i, the timestamp represents a specific moment when the child node receives or sends data, uplink traffic represents the number of bytes of data sent by the child node at any given time, and downlink traffic represents the number of bytes of data received by the child node at any given time.

[0064] For example, the central node receives the log information DLog sent by child node A. A ={t1,A,B,abstract_A1},TLog A ={t1, up_flow_t1, down_flow_t1}, and the log information DLog received from child node B. B ={t2,A,B,abstract_B1},TLog B = {t2, up_flow_t2, down_flow_t2}. A represents the child node sending data, B represents the child node receiving data sent by child node A, t1 represents a certain moment when child node A sends data to child node B, t2 represents a certain moment when child node B receives data sent by child node A, up_flow_t1 represents the uplink flow of child node A at time t1, down_flow_t1 represents the downlink flow of child node A at time t1, up_flow_t2 represents the uplink flow of child node B at time t2, and down_flow_t2 represents the downlink flow of child node B at time t2.

[0065] S202, based on the data traffic and data digest of each sub-node at different times, determine the node trust level of each sub-node.

[0066] In some embodiments, after receiving log information from each child node, the central node can compare the data traffic (uplink or downlink traffic) of each child node sending or receiving data at any given time with the number of bytes in the data digest of that child node at the same time. Finally, the node trust level of each child node is determined based on the comparison results.

[0067] In some embodiments, where the data traffic of multiple child nodes includes uplink traffic and downlink traffic, and the multiple child nodes include a first child node, such as Figure 3 As shown, the above S202 can be implemented as follows:

[0068] S301, compare the data traffic and data digest in the log information sent by the first child node to obtain the first comparison result.

[0069] The first child node can be either the child node that sends data or the child node that receives data.

[0070] In some embodiments, the central node compares the data traffic of each child node at any given time in the received log information with the number of bytes in the data digest of that child node at the same time, and determines whether the value of the data traffic of each child node at any given time matches the number of bytes in the data digest, thereby obtaining a first comparison result.

[0071] For example, in one embodiment, assuming the first child node is child node A, child node A sends data to child node B at time t1, and child node A can generate content including DLog. A ={t1, A, B, abstract_A1} and TLog A Log information for {t1, up_flow_t1, down_flow_t1}. Child node A can send its own generated log information to the central node. After receiving the log information from child node A, the central node can process the DLog. A The number of bytes in the data digest (i.e., abstract_A1), and TLog A The values ​​in the data flow (i.e., up_flow_t1) are compared to obtain the first comparison result.

[0072] In another embodiment, assuming the first child node is child node B, child node B receives data sent by child node A at time t2, and child node B can generate content including DLog. B ={t2, A, B, abstract_B1} and TLog B Log information for {t2, up_flow_t2, down_flow_t2}. Child node B can send its own generated log information to the central node. After receiving the log information from child node B, the central node can process the DLog. B The number of bytes in the data digest (i.e., abstract_B1), and TLog A The values ​​in the data flow (i.e., down_flow_t2) are compared to obtain the first comparison result.

[0073] S302, compare the uplink and downlink traffic in the log information of each child node to obtain the second comparison result.

[0074] In some embodiments, the plurality of child nodes may further include a second child node. The first child node may send target data to the second child node at a first moment, and the second child node may receive the target data from the first child node at a second moment. The time difference between the first moment and the second moment refers to the time difference generated during the transmission of the target data.

[0075] Accordingly, the log information sent by the first child node may include the uplink traffic and data digest of the first child node at the first moment; the log information sent by the second child node may include the downlink traffic and data digest of the second child node at the second moment. In this case, the above S302 can be implemented as follows: comparing the uplink traffic of the first child node at the first moment and the downlink traffic of the second child node at the second moment to obtain a second comparison result.

[0076] For example, suppose the first child node is child node A, and the second child node is child node B. Node A sends data to child node B at time t1, and child node B receives the data sent by child node A at time t2. Child node A can generate content including DLog. A ={t1, A, B, abstract_A1} and TLog A Log information for {t1, up_flow_t1, down_flow_t1}, child node B can generate content including DLog. B ={t2, A, B, abstract_B1} and TLog B The log information is defined as {t2, up_flow_t2, down_flow_t2}. Child nodes A and B can send their own generated log information to the central node. After receiving the log information from child nodes A and B, the central node can process the TLog data. A Upstream flow (up_flow_t1) and TLog B The second comparison result is obtained by comparing the downflow (down_flow_t2).

[0077] S303, Based on the first comparison result and the second comparison result, determine the node trust level of the first child node.

[0078] In some embodiments, the central node determines the node trust level of the first child node based on the first comparison result and the second comparison result, according to a preset rule.

[0079] Specifically, if the difference between the data traffic and data digest in the log information sent by the first child node, as indicated by the first comparison result, is less than a first threshold, and the difference between the uplink traffic and downlink traffic in the log information of each child node, as indicated by the second comparison result, is less than a second threshold, the central node can increase the node trust level of the first child node according to the first rule. The first rule is to incrementally calculate the node trust level of the node according to preset data, that is, the node trust level calculation method of the child node is Ci = Ci + num. Wherein, num can be any natural number such as 1, 2, 3, etc., and this embodiment of the application does not limit it.

[0080] If, according to the first comparison result, the difference between the data traffic and the data digest in the log information sent by the first child node is greater than or equal to a first threshold, or if, according to the second comparison result, the difference between the uplink traffic and the downlink traffic in the log information of each child node is greater than or equal to a second threshold, the node trust level of the first child node is reduced according to the second rule. The second rule is to calculate the reduction of the node trust level according to a preset value, that is, the node trust level of the child node is calculated as Ci = Ci - num. Here, num can be any natural number such as 1, 2, or 3, and this embodiment of the application does not limit this.

[0081] For example, in one embodiment, if the first comparison result represents the TLog in the log information of child node A... A The values ​​in the data flow (i.e., up_flow_t1) and DLog A The difference in the number of bytes in the data digest (i.e., abstract_A1) is less than a first threshold (e.g., 10M), and the second comparison result characterizes the TLog in the log information of child node A. A The uplink flow (up_flow_t1) and the TLog in the child node B log information B If the difference in downflow (down_flow_t2) is less than the second threshold (e.g., 10M), the central node increases the node trust of child node A, i.e., C, according to the first rule. A =C A +1. If the first comparison result represents the TLog in the log information of child node A. A The values ​​in the data flow (i.e., up_flow_t1) and DLog A The difference in the number of bytes in the data digest (i.e., abstract_A1) is greater than or equal to a first threshold (e.g., 10M), or the second comparison result characterizes the TLog in the log information of child node A. A The uplink flow (up_flow_t1) and the TLog in the child node B log information BIf the difference between the downflow (down_flow_t2) and the downflow (down_flow_t2) is greater than or equal to the second threshold (e.g., 10M), the central node reduces the node trust of child node A, i.e., C, according to the second rule. A =C A -1.

[0082] In another embodiment, if the first comparison result represents the TLog in the log information of child node B... B The values ​​in the data flow (i.e., down_flow_t1) and DLog B The difference in the number of bytes in the data digest (i.e., abstract_B1) is less than a first threshold (e.g., 10M), and the second comparison result characterizes the TLog in the log information of child node B. B The downflow (down_flow_t1) and the TLog in the log information of child node A A If the difference between the uplink flow (down_flow_t2) and the downlink flow (down_flow_t2) is less than the second threshold (e.g., 10M), the central node increases the node trust of child node B according to the first rule, i.e., C. B =C B +1. If the first comparison result represents the TLog in the log information of child node B. B The values ​​in the data flow (i.e., down_flow_t1) and DLog B The difference in the number of bytes in the data digest (i.e., abstract_B1) is greater than or equal to a first threshold (e.g., 10M), or the second comparison result characterizes the TLog in the log information of child node B. B The downflow (down_flow_t1) and the TLog in the log information of child node A A If the difference between the uplink flow (down_flow_t2) and the downlink flow (down_flow_t2) is greater than or equal to the second threshold (e.g., 10M), the central node reduces the node trust of child node B according to the second rule, i.e., C. B =C B -1.

[0083] When the node trust level of a child node is less than a preset threshold, the child node is considered an insecure node. Therefore, after determining the node trust level of each child node, the central node can broadcast the node identifier of the child node with a trust level less than the preset threshold, so that the other child nodes know that the child node is an insecure node and cancel communication with it. This application embodiment does not limit the preset threshold; for example, the preset threshold can be 7 or 5.

[0084] Through the above technical solution, after receiving log information from multiple child nodes, the central node can compare the data traffic of each child node at any given time with the number of bytes in the data digest of each child node at the same time. It can also compare the uplink and downlink traffic of each child node. Finally, based on these two comparison results, the central node can increment or decrement the node trust level of each child node according to preset rules. Compared with the high cost and resource waste caused by frequent data transmission on the blockchain in existing technologies, the above solution provides a lightweight node trust level calculation method, improving the working efficiency of the central node and effectively avoiding resource redundancy. Furthermore, after determining the node trust level of each child node, the central node will broadcast a warning among all child nodes to those with a trust level below a threshold, so that other child nodes are aware that the child node is insecure. This warns child nodes to avoid communicating with child nodes with low trust levels, ensuring the security of the data transmission environment.

[0085] In an optional implementation, the log information of each child node may also include a transaction identifier, such as... Figure 4 As shown, before executing S202, the following steps can also be performed:

[0086] S401, based on the transaction identifier, merge the log information sent by each child node to obtain at least one merged log.

[0087] In some embodiments, the transaction identifier may consist of the node identifier and sequence number of the child node that first transmits data in a certain transport transaction.

[0088] The embodiments of this application do not limit the sequence number. The sequence number can be randomly generated or determined according to the execution order of the currently executing transmission transactions. For example, assuming that child node A and child node B need to transmit a total of 3 pieces of data, and the transmission process of each piece of data can be called a transmission transaction, then when child node A and child node B execute the first transmission transaction (i.e., transmit the first piece of data), the sequence number can be 1, and when child node A and child node B execute the second transmission transaction (i.e., transmit the second piece of data), the sequence number can be 2.

[0089] For example, suppose child node A, child node B, and child node C jointly execute a transmission transaction. Child node A first transmits data to child node B at time t1, child node B receives the data transmitted by child node A at time t2, and child node C transmits data to child node B at time t3. That is, the child node that first transmits data is child node A. Accordingly, the transaction identifier contained in the log information of child node A, child node B, and child node C can all be A1, where A represents the node identifier information of child node A, and 1 represents the execution order of the currently executing transaction.

[0090] After completing the above transmission transaction, suppose child nodes A, D, and F need to jointly execute another transmission transaction. Child node A first transmits data to child node D at time t4, child node D receives the data transmitted by child node A at time t5, and child node F transmits data to child node D at time t6. That is, the child node that first transmits data is child node A. Accordingly, the transaction identifier contained in the log information of child nodes A, D, and F can all be A2. A represents the node identifier information of child node A, and 2 represents the execution order of the currently executing transaction.

[0091] Specifically, after receiving the log information sent by each child node, the central node can merge at least one log message with the same transaction identifier in chronological order to obtain multiple merged log messages with different transaction identifiers.

[0092] For example, suppose child node A transmits data to child node B at times t1 and t2, respectively, and child node B receives the data sent by child node A at times t3 and t4, respectively. The content generated by child node A includes DLog. A ={A1,t1,A,B,abstract_A1},TLog A ={t1, up_flow_t1, down_flow_t1}, DLog A ={A1, t2, A, B, abstract_A2}, TLog A The log information for {t2, up_flow_t2, down_flow_t2}, the content generated by child node B includes DLog. B ={A1, t3, B, A, abstract_B1}, TLog B ={t3, up_flow_t3, down_flow_t3}, DLog B ={A1, t4, B, A, abstract_B2}, TLog B The log information is defined as {t4, up_flow_t4, down_flow_t4}. The central node, based on transaction A1, merges the log information sent by each child node according to the time sequence of t1, t2, t3, and t4, forming a merged log.

[0093] A1{t1: A, B, abstract_A1, up_flow_t1, down_flow_t1; t2: A, B, abstract_A2, up_flow, down_flow; t3: B, A, abstract_B1, up_flow_t3, down_flow_t3; t4: B, A, abstract_B2, up_flow, down_flow}. Where, in the merged log at time t2, up_flow (uplink flow) = up_flow_t2 - up_flow_t1, down_flow (uplink flow) = down_flow_t2 - down_flow_t1; at time t4, up_flow (uplink flow) = up_flow_t4 - up_flow_t3, down_flow (uplink flow) = down_flow_t4 - down_flow_t3.

[0094] S402, for each merged log, encrypt the merged log to obtain an encrypted log.

[0095] In some embodiments, the central node may use the Shamir secret sharing algorithm to encrypt the merged logs, resulting in encrypted logs.

[0096] After executing S401 and S402 above, the node trust level of each sub-node is determined based on the data traffic and data digest of each sub-node at different times. That is, S202 above can also be implemented as:

[0097] S403 sends the encrypted log to the target child node.

[0098] The target child node can be the node with the highest trust level and / or the node with the highest idle level.

[0099] The target child node can be used to decrypt the encrypted log and update the node trust level of each child node based on the data traffic and data digest of each child node at different times contained in the decrypted log.

[0100] Specifically, the central node divides the encrypted log into N parts. Then, based on the node trust levels of each child node, it determines the top few child nodes with the highest trust levels. From these top N child nodes, it randomly selects N child nodes and distributes the encrypted log to them. Based on the idle time of these N child nodes, it selects S child nodes with the highest idle time to decrypt the encrypted logs they hold, forming the decrypted log information. If all S child nodes can decrypt the encrypted logs, their node trust levels are incremented (C = C + 1). If none of the S child nodes can decrypt the encrypted logs, their node trust levels are decremented (C = C - 1). Finally, if the S child nodes successfully decrypt the encrypted logs they hold, then among the S child nodes, one child node is randomly selected and the above S301-S303 scheme is followed. Based on the decrypted log information, the data traffic and data digest of each child node at different times are compared. At the same time, the uplink traffic and downlink traffic of each child node are compared. Based on the two comparison results, the node trust of each child node is incremented or decremented according to the first rule or the second rule, thereby determining the node trust of each child node.

[0101] If a child node receives notifications from multiple child nodes, and the node trust levels of these child nodes are inconsistent, the child node shall take the notification from the child node with the highest node trust level as the correct one.

[0102] For example, the central node randomly selects child node A, child node B, and child node C from among the child nodes with the highest trust levels to issue encrypted logs. Then, it selects child nodes A and B with higher idle levels from among child nodes A, B, and C to decrypt the encrypted logs, forming decrypted log information. The central node randomly selects a child node (e.g., child node A) from child nodes A and B. Then, child node A, referring to the scheme described in S301-S303 above, compares the data traffic and data digests of each child node at different times based on the decrypted log information, and also compares the uplink and downlink traffic of each child node. Finally, based on the comparison results, it determines the node information of each child node.

[0103] The above technical solution involves the central node receiving log information from each child node. Based on the transaction identifiers contained in the log information, log information with the same transaction identifier is merged to obtain at least one merged log. This merged log is then encrypted using the Shamir secret sharing algorithm and distributed to the target child nodes with the highest trust level and / or the highest idle level. This sharding approach encrypts and stores the log information of each child node, ensuring the security of their log information. Furthermore, the solution provides a lightweight computational method where the target child node decrypts the encrypted logs and determines the trust level of each child node based on the decrypted log information. This enables a randomized, distributed multi-child node approach to comprehensively determine the trust level of each child node, reducing the workload of the central node.

[0104] In an optional implementation, before determining the node trust level of each child node based on the data traffic and data digest of each child node at different times, i.e., before executing S201, the central node can determine the initial trust level of the child nodes based on the node information of the child nodes, such as... Figure 5 As shown, the method also includes:

[0105] S501 receives node information sent by multiple child nodes.

[0106] The node information of a child node may include: the address information, port identifier, and enterprise information to which the child node belongs, as well as the node capabilities of each child node (such as node memory, node bandwidth, etc.).

[0107] S502, for each child node, determines the initial trust level of the child node based on the node information of the child node.

[0108] In some embodiments, if the node information of a child node includes the address information, port identifier, and enterprise information to which the child node belongs, and the address information, port identifier, and enterprise information all meet preset conditions, the initial trust level of the child node is set to the first trust level.

[0109] The preset conditions include: 1. Conducting communication tests on the addresses and ports of child nodes using automated or manual methods; 2. Verifying the enterprise information to which the child node belongs using automated or manual methods. If the child node's information passes the communication test and verification, it means the child node's information meets the preset conditions; if it fails, it means the child node's information does not meet the preset conditions. Even if the child node's address information, port identifier, and enterprise information all meet the preset conditions, the completeness of the child node's information still needs to be assessed. Finally, the initial trust level of the child node is determined based on a comprehensive evaluation of all the above factors.

[0110] For example, if the address information, port identifier, and enterprise information of child node A all meet the preset conditions, and the node information of child node A also includes information representing the node's capabilities such as memory and bandwidth, then it means that the node information of child node A is complete. Based on the above, the central node determines the initial trust level of child node A to be C. A =10. If the address information, port identifier, and enterprise information of child node A all meet the preset conditions, but the node information does not include information representing the node's capabilities such as memory and bandwidth, then it means that the node information of child node A is incomplete. Based on the above situation, the central node determines the initial trust level of child node A to be C. A =0. The first trust level of a child node can be any natural number such as 1, 2, or 3; this embodiment does not limit this.

[0111] After completing S501 and S502 above, S202 can be implemented as follows:

[0112] S503 updates the initial trust level of each child node based on the data traffic and data digest of each child node at different times, and obtains the node trust level of each child node.

[0113] For example, assuming that the node information of child node A meets the preset conditions and is complete, and the node information of child node B meets the preset conditions but is incomplete, the central node determines the initial trust level of child node A to be C based on the node information of child node A and child node B. A =10, the initial trust level of child node B is C. A =0. The central node receives log information sent by child node A and child node B, where the log information DLog of child node A is... A ={A1,t1,A,B,abstract_A1},TLog A = {t1, down_flow_t1, down_flow_t1}, the log information of child node B is DLog. B ={A1, t2, A, B, abstract_B1}, TLog B ={t2, down_flow_t2, down_flow_t2}.

[0114] In one embodiment, if the TLog in the log information of child node A... A The values ​​in the data flow (i.e., up_flow_t1) and DLog A The difference in the number of bytes in the data digest (i.e., abstract_A1) is less than a first threshold (e.g., 10M), and the second comparison result characterizes the TLog in the log information of child node A. AThe uplink flow (up_flow_t1) and the TLog in the child node B log information B If the difference in downflow_t2 is less than the second threshold, then the node trust level of child node A is C. A =10+num. If the TLog in the log information of child node A is... A The values ​​in the data flow (i.e., up_flow_t1) and DLog A The difference in the number of bytes in the data digest (i.e., abstract_A1) is greater than or equal to a first threshold (e.g., 10M), or the second comparison result characterizes the TLog in the log information of child node A. A The uplink flow (up_flow_t1) and the TLog in the child node B log information B If the difference between the downflow (down_flow_t2) and the second threshold is greater than or equal to the second threshold, then the node trust level C of child node A is [value missing]. A =10-num.

[0115] In another embodiment, if the TLog in the log information of child node B... B The values ​​in the data flow (i.e., down_flow_t1) and DLog B The difference in the number of bytes in the data digest (i.e., abstract_B1) is less than a first threshold (e.g., 10M), and the second comparison result characterizes the TLog in the log information of child node B. B The downflow (down_flow_t1) and the TLog in the log information of child node A A If the difference between the uplink flow (down_flow_t2) and the uplink flow (down_flow_t2) is less than the second threshold (e.g., 10M), then the node trust level of child node B is C. B =0 + num. If the first comparison result represents the TLog in the log information of child node B. B The values ​​in the data flow (i.e., down_flow_t1) and DLog B The difference in the number of bytes in the data digest (i.e., abstract_B1) is greater than or equal to a first threshold (e.g., 10M), or the second comparison result characterizes the TLog in the log information of child node B. B The downflow (down_flow_t1) and the TLog in the log information of child node A A If the difference between the uplink flow (down_flow_t2) and the uplink flow (down_flow_t2) is greater than or equal to the second threshold (e.g., 10M), then the node trust level of child node B is C. B = 0 + num.

[0116] Through the above technical solution, the central node can determine the initial trust level of each child node based on whether the node information of each child node meets preset conditions and whether the node information is complete. This allows child nodes whose node information meets all preset conditions and has complete information to obtain a higher initial trust level, while child nodes whose node information meets all preset conditions but has incomplete information to obtain a lower initial trust level. Then, the central node, the node with the highest node trust level, and / or the node with the highest idle level can update the node trust level of each child node based on the data traffic and data digest of each child node at different times, thus obtaining the node trust level of each child node. Compared with existing technologies, the above method provides a method for node information compliance authentication, which can filter out child nodes with compliant information for data transmission, and child nodes with compliant and complete information can obtain a certain initial trust level. Furthermore, it can comprehensively determine the node trust level of each child node from multiple dimensions based on the initial trust level of the child nodes, the node trust level of each child node determined by the central node, and the node trust level of each child node determined by the node with the highest node trust level or the node with the highest idle level.

[0117] Figure 6 An interactive flowchart of a node trust confirmation method provided in an embodiment of this application is shown below. Figure 6 As shown, the method includes:

[0118] S601, multiple child nodes send node information and log information to the central node.

[0119] This step is as follows: Figure 1 The log modules for each child node shown are now complete.

[0120] S602, the central node determines the initial trust level of each child node based on the node information sent by each child node.

[0121] This step is as follows: Figure 1 The node information management module and trust calculation module of the central node shown are now complete.

[0122] S603, the central node merges the log information sent by each child node to obtain the merged log.

[0123] This step is as follows: Figure 1 The transaction information merging module of the central node shown has been completed.

[0124] S604, the central node updates the initial trust level of each child node based on the data traffic and data summary of each child node at different times in the merged log, and obtains the node trust level of each child node.

[0125] When a node's trust level falls below a threshold, the central node broadcasts a warning to all nodes, indicating that its trust level is questionable and suggesting that communication be canceled.

[0126] This step is as follows: Figure 1 The trust calculation module and information broadcasting module shown are now complete.

[0127] S605, the central node uses the Shamir secret sharing algorithm to encrypt the merged log, resulting in encrypted logs.

[0128] This step is as follows: Figure 1 The secret processing and distribution module of the central node shown is complete.

[0129] S606: The central node divides the encrypted log into several parts and randomly distributes them to each child node. The central node keeps one copy of the encrypted log.

[0130] This step is as follows: Figure 1 The secret processing and distribution module of the central node shown is complete.

[0131] Optionally, the above S606 can also be implemented as follows:

[0132] S607, the central node divides the encrypted log into N parts, randomly selects N child nodes from the multiple child nodes with the highest trust level to distribute the encrypted log, and then selects S child nodes with the highest idle level among the N child nodes to perform decryption.

[0133] This step is as follows: Figure 1 The secret processing and distribution module of the central node shown is complete.

[0134] S608, S child nodes decrypt the encrypted logs they hold, and based on the data traffic and data digests of each child node at different times contained in the decrypted log information, determine and update the node trust level of each child node, and broadcast it within all child nodes.

[0135] This step is as follows: Figure 1 The secret processing module, trust calculation module, and information broadcasting module of each sub-node shown are completed.

[0136] Figure 7 This is a schematic diagram of the structure of a node trust verification device provided in an embodiment of this application, as shown below. Figure 7 As shown, the device includes:

[0137] The receiving unit 701 is used to receive log information sent by multiple child nodes. The log information of each child node includes at least the data flow and data summary of the child node at different times. The data flow of a child node at any given time refers to the number of bytes received or sent by the child node at that time.

[0138] The determination unit 702 is used to determine the node trust level of each child node based on the data traffic and data digest of each child node at different times.

[0139] Optionally, the data traffic includes uplink traffic and downlink traffic, and multiple child nodes include the first child node. Based on this, the determining unit 702 is further used for:

[0140] The data traffic and data digest in the log information sent by the first child node are compared to obtain the first comparison result. Then, the uplink traffic and downlink traffic in the log information of each child node are compared to obtain the second comparison result. Finally, based on the first comparison result and the second comparison result, the node trust level of the first child node is determined.

[0141] Optionally, the determining unit is also used for:

[0142] Based on the first comparison result and / or the second comparison result, the node trust level of the first child node is determined.

[0143] Optionally, before determining the node trust level of each child node based on the data traffic and data digest of each child node at different times, the receiving unit is also used for:

[0144] Receive node information sent by multiple child nodes.

[0145] Optionally, before determining the node trust level of each child node based on its data traffic and data digest at different times, the determining unit is also used for:

[0146] For each child node, the initial trust level of the child node is determined based on the node information of the child node.

[0147] Figure 8 This diagram illustrates another possible structural design of the node trust verification device described in the above embodiments. The node trust verification device includes a processor 801 and a communication interface 802. The processor 801 controls and manages the operation of the node trust verification device, and the communication interface 802 supports communication between the node trust verification device and other network entities. The node trust verification device may also include a memory 803 and a bus 804. The memory 803 stores the program code and data of the node trust verification device.

[0148] The memory 803 may be a memory in a node trust verification device, and the memory may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as read-only memory, flash memory, hard disk or solid-state drive; the memory may also include a combination of the above types of memory.

[0149] The processor 801 described above can implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computing functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0150] The 804 bus can be an Extended Industry Standard Architecture (EISA) bus, etc. The 804 bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 8 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0151] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0152] This application provides a computer program product containing instructions that, when run on a computer, cause the computer to execute the node trust confirmation method in the above method embodiments.

[0153] This application also provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the node trust confirmation method in the method flow shown in the above method embodiments.

[0154] The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: electrical connections having one or more wires; portable computer disks; hard disks; random access memory (RAM); read-only memory (ROM); erasable programmable read-only memory (EPROM); registers; hard disks; optical fibers; portable compact disc read-only memory (CD-ROM); optical storage devices; magnetic storage devices; or any suitable combination thereof; or any other form of computer-readable storage medium known in the art. An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium may also be a component of the processor. The processor and the storage medium may reside in an application-specific integrated circuit (ASIC). In the embodiments of this application, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0155] Embodiments of the present invention provide a computer program product containing instructions that, when executed on a computer, cause the computer to perform the node trust confirmation method described in the embodiments of this application.

[0156] Since the node trust verification device, computer-readable storage medium, and computer program product in the embodiments of the present invention can be applied to the above method, the technical effects they can achieve can also be referred to the above method embodiments. The embodiments of the present invention will not be repeated here.

[0157] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0158] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0159] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0160] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for confirming trustworthiness of a node, characterized in that, The method is applied to a center node, and comprises the following steps: receiving log information sent by a plurality of sub-nodes; the log information of each sub-node at least comprises data traffic and data digest of the sub-node at different time points; the data traffic of the sub-node at any time point refers to the number of bytes received or sent by the sub-node at the time point; the data traffic comprises uplink traffic of sending target data to other sub-nodes and downlink traffic of the other sub-nodes receiving the target data; comparing the data traffic and the data digest in the log information sent by the sub-nodes to obtain a first comparison result; comparing the uplink traffic and the downlink traffic in the log information of the sub-nodes to obtain a second comparison result; determining a node trust degree of the sub-nodes based on the first comparison result and / or the second comparison result.

2. The method of claim 1, wherein, The sub-nodes are first sub-nodes; the other sub-nodes are second sub-nodes; the first sub-nodes send the target data to the second sub-nodes at a first time point, and the second sub-nodes receive the target data from the first sub-nodes at a second time point; the log information sent by the first sub-nodes comprises uplink traffic and data digest of the first sub-nodes sending the target data at the first time point; the log information sent by the second sub-nodes comprises downlink traffic and data digest of the second sub-nodes receiving the target data at the second time point; The comparing the uplink traffic and the downlink traffic in the log information of the sub-nodes to obtain a second comparison result comprises: comparing the uplink traffic of the first sub-nodes at the first time point and the downlink traffic of the second sub-nodes at the second time point to obtain the second comparison result.

3. The method of claim 2, wherein, The determining a node trust degree of the sub-nodes based on the first comparison result and / or the second comparison result comprises: in a case where the first comparison result represents that a difference between the data traffic and the data digest in the log information sent by the first sub-nodes is less than a first threshold value, and the second comparison result represents that a difference between the uplink traffic and the downlink traffic in the log information of the sub-nodes is less than a second threshold value, increasing the node trust degree of the first sub-nodes according to a first rule; or in a case where the first comparison result represents that the difference between the data traffic and the data digest in the log information sent by the first sub-nodes is greater than or equal to the first threshold value, or the second comparison result represents that the difference between the uplink traffic and the downlink traffic in the log information of the sub-nodes is greater than or equal to the second threshold value, decreasing the node trust degree of the first sub-nodes according to a second rule.

4. The method according to any one of claims 1 to 3, characterized in that, The log information of each sub-node further comprises a transaction identifier; Before the determining a node trust degree of the sub-nodes based on the first comparison result and / or the second comparison result, the method further comprises the following steps: merging the log information sent by the sub-nodes based on the transaction identifier to obtain at least one merged log; encrypting the merged log to obtain an encrypted log; The determining a node trust degree of the sub-nodes based on the first comparison result and / or the second comparison result comprises: sending the encrypted log to a target child node; the target child node is configured to decrypt the encrypted log, and update a node trust degree of the child node based on data traffic and data digest of the child node at different time instants included in the decrypted log.

5. The method of claim 4, wherein, The target child node is any node satisfying at least one of the following conditions: a node with the highest node trust degree; a node with the highest idle degree.

6. The method of claim 1, wherein, Before the determining the node trust degree of the child node based on the first comparison result and / or the second comparison result, the method further comprises: receiving node information sent by the plurality of child nodes; for each child node, determining an initial trust degree of the child node based on the node information of the child node; The determining the node trust degree of the child node based on the first comparison result and / or the second comparison result comprises: updating the initial trust degree of the child node based on the data traffic and data digest of the child node at different time instants, to obtain the node trust degree of the child node.

7. The method of claim 6, wherein, The determining the initial trust degree of the child node based on the node information of the child node comprises: in a case where the node information of the child node includes address information, port identification and enterprise information to which the child node belongs, and the address information, the port identification and the enterprise information all satisfy a preset condition, setting the initial trust degree of the child node as a first trust degree.

8. A node trustworthiness confirmation apparatus characterized by comprising: The apparatus comprises: a receiving unit configured to receive log information sent by a plurality of child nodes; the log information of each child node at least includes data traffic and data digest of the child node at different time instants; the data traffic of the child node at any time instant refers to a number of bytes received or sent by the child node at the time instant; the data traffic includes uplink traffic of sending target data to other child nodes and downlink traffic of the other child nodes receiving the target data; a determining unit configured to compare the data traffic and data digest in the log information sent by the child nodes, to obtain a first comparison result; compare uplink traffic and downlink traffic in the log information of the child nodes, to obtain a second comparison result; and determine a node trust degree of the child node based on the first comparison result and / or the second comparison result.

9. A node trustworthiness confirmation apparatus, characterized by comprising: comprise: a processor and a communication interface; the communication interface and the processor are coupled, and the processor is configured to run computer programs or instructions, to implement the node trust degree confirmation method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores instructions, and when a computer executes the instructions, the computer executes the node trust degree confirmation method according to any one of claims 1-7.

11. A computer program product, characterised in that, The computer program product contains computer instructions, and when the computer instructions are run on a computer, the computer instructions make the computer execute the node trust degree confirmation method according to any one of claims 1-7.

Images