Method and system for ensuring credibility and security of network space

Abstract

The invention provides a method and a system for ensuring credibility and security of a network space. The method comprises the following steps of: S1, realizing multi-identifier addressing of embedded identity authentication and packet signature based on a multi-identifier network; s2, defining a digital customs, a digital passport and a digital visa based on the multi-identification network; s3, performing calculation based on the time data, the digital visa key and the hash function to obtain a digital visa based on the multi-identification network; s4, according to the hash value of the digital visa and the transnational passport key, calculating to obtain a digital passport based on the multi-identification network; s5, realizing a digital customs through a multi-identifier network router, and using and maintaining an exit table through the digital customs; and S6, verifying the digital passport by using an entry table through the digital customs, and updating the entry table. According to the method, the credibility and the security of the network space can be effectively guaranteed, the blockchain log support is traceable, and a better foundation is provided for guaranteeing the orderliness, the handling and the peaceability of the network space.

Description

Technical Field

[0001] The present invention relates to the technical field of cyberspace security, and in particular to a method for ensuring that a cyberspace is trustworthy and secure, and further to a system for ensuring that a cyberspace is trustworthy and secure. Background Art

[0002] With the development of modern science and technology, the Internet has become an indispensable part of today's social development. As a carrier of information, it has penetrated into various fields of human life, including politics, economy, culture, education, and health care. While Internet content and demand are developing rapidly, today's network needs are gradually showing more and more irreconcilable conflicts with the original IP design model. Under the existing IP system, problems such as the single-organization control of the DNS root zone database and the semantic overload of IP addresses have greatly restricted the development of the Internet. The IP network system has three fundamental defects.

[0003] The first flaw is that centralized management allows the founders of IP networks to monopolize cyberspace management and form cyber hegemony. The entire domain name system, including the root server DNS, domain name resolution and address allocation services, is managed by a single organization, and global network communications are essentially monitored and controlled by a single organization. Therefore, it is impossible to build a trustworthy, secure, orderly, law-based and peaceful cyberspace on IP.

[0004] The second flaw is that IP networks lack security genes. The source address of data packets can be forged, tracing is difficult, and user data is leaked, resulting in constant security incidents, difficulty in protecting data privacy and digital assets, and the loss of individual and entity digital rights. The Personal Information Protection Law lists information such as biometrics, specific identities, medical health, financial accounts, and whereabouts as sensitive personal information. Centralized data management may lead to the abuse of personal privacy data.

[0005] The third defect is that the IP network architecture protocol is seriously solidified, and it is difficult to evolve and upgrade, which takes a long time and is costly. For example, upgrading from IPv4 to IPv6 is a time-consuming and expensive task. IPv4 became the standard protocol for scientific research on ARPANET in 1983. In 1990, ARPANET was shut down, marking the end of the experimental mission and the beginning of commercial application. IPv4 replaced other competitors in less than 8 years and became the de facto industry standard in the world. In 1998, IETF began to propose a draft version of IPv6, which was officially released 20 years later in 2017, and it is incompatible with IPv4. In fact, the DNS system of IPv6 is the same as that of IPv4, except that the number of addresses has increased, and there is no essential improvement in other aspects. Therefore, major countries in the world are studying the future network after IP. The IP architecture system is just a prelude, and it is imperative to develop a new network system to replace the IP system.

[0006] It should be noted that the IP network system obviously has security risks in cyberspace. The IP network was originally designed to achieve end-to-end transmission, so security issues were not considered. In the TCP / IP network system, there are several common malicious attack methods at each layer.

[0007] At the data link layer, there are ARP poisoning attacks and MAC address flooding attacks, among which ARP spoofing attacks are implemented using the communication mechanism of Ethernet. If the IP host needs to automatically request the MAC of the target host, then the ARP protocol must be used. The attacker can use the method of impersonating the source host to poison the victim's ARP relationship mapping table to achieve the purpose of data theft, etc. The MAC flooding attack uses the MAC table of the victim host to fill up, causing the switch MAC address table to overflow, so that the data packets entering the switch are broadcast to every port, and the intruder can successfully monitor all the data of the switch from any port of the switch.

[0008] At the network layer, there are smurf flood attacks, IP spoofing attacks, ICMP routing spoofing attacks, etc. Among them, smurf flood attacks usually occur in combination with IP spoofing attacks. Smurf attacks flood the victim host by using ICMP reply request (ping) packets with the reply address set to the broadcast address of the victim network, eventually causing all hosts in the network to respond to this ICMP reply request, resulting in network congestion. More complex smurfs change the source address to a third-party victim, eventually causing the third party to crash. The essence of these attacks lies in the lack of signature and authentication mechanisms under the IP system.

[0009] At the transport layer, attackers can usually use network attack methods such as port scanning and UDP flooding attacks. The principle of port scanning is that when a host makes a request to establish a connection to a port of a remote server, if the other party has this service, it will respond. If the other party has not installed this service, even if you send a request to the corresponding port, the other party will still not respond. Using this principle, if you establish connections to all well-known ports or well-known ports within a range of your choice, and record the responses given by the remote server, you can know which services are installed on the target server by viewing the records.

[0010] At the application layer, a large number of network attacks have emerged in the IP system, such as deception, unauthorized access, identity theft, and flooding.

[0011] Therefore, it is obvious that in order to ensure the trustworthiness and security of cyberspace and to ensure the order, rule of law and peace of cyberspace, there is an urgent need for a network system, method and system that can adapt to the current speed of development. Summary of the invention

[0012] The technical problem to be solved by the present invention is that it is necessary to provide a method for ensuring the credibility and security of cyberspace, aiming to ensure the credibility and security of cyberspace through identity authentication based on a multi-identity network, multi-identity addressing, digital customs, digital passports and digital visas, etc., to provide a better foundation for ensuring the order, rule of law and peace in cyberspace, and to provide a network system, method and system that can adapt to the current development speed.

[0013] To this end, the present invention provides a method for ensuring that the network space is trustworthy and secure, comprising the following steps:

[0014] Step S1, based on the multi-identity network, multi-identity addressing with embedded identity authentication and packet signature is implemented. After the user completes the registration, he first signs each data packet released with his own private key and writes it into the signature area of ​​the multi-identity network packet. The intermediate router regularly maintains the user information table obtained from the multi-identity management system, extracts the signature information of the corresponding user from it after receiving the message, and then performs identity authentication on the received multi-identity network packet through the public key information obtained from the multi-identity management system; and after the identity authentication is passed, the corresponding multi-identity addressing is performed through the message format that supports variable message length;

[0015] Step S2, defining digital customs, digital passports and digital visas based on a multi-identity network;

[0016] Step S3, performing a bitwise XOR operation on the time data and the digital visa key, and performing a one-way mapping on the data after the bitwise XOR operation through a hash function to obtain a digital visa based on a multi-identity network;

[0017] Step S4, calculating and obtaining a digital passport based on a multi-identity network according to the hash value of the digital visa and the transnational passport key;

[0018] Step S5, implementing digital customs through a multi-identity network router, and using and maintaining the exit table through the digital customs;

[0019] Step S6, verifying the digital passport using the entry form through the digital customs and updating the entry form.

[0020] A further improvement of the present invention is that step S1 includes the following sub-steps:

[0021] Step S101, the multi-identity network client generates a public key and a private key for the user locally, and then submits the public key and the identity information signed with the private key to any node in the multi-identity management system; when the node receives the request, it verifies it, and after the verification is successful, the accounting node of the multi-identity management system alliance chain generates a transaction and sends it to all blockchain nodes; when the voting node in the blockchain receives a pre-block, it will vote on whether to allow this pre-block to become a formal block, the leader node collects the voting results, counts them and generates a voting certificate, stores the block information of the pre-block that has passed the vote, and extracts the user registration information from the block information and stores it in the user registration table;

[0022] Step S102: The registered user signs each published data packet with his / her own private key, and writes the digital signature into the signature area of ​​the multi-identity network packet using the SM2 elliptic curve algorithm. The intermediate router regularly maintains the user information table obtained from the multi-identity management system, extracts the signature information of the corresponding user from the received message, and then authenticates the received multi-identity network packet using the public key information obtained from the multi-identity management system.

[0023] Step S103, after the identity authentication is passed, the corresponding multi-identifier addressing is performed through the message format supporting variable message length; the data packet of the message format includes four areas, namely, the identification area, the signature area, the read-only area and the variable area, the identification area is used to store one or more identifications to distinguish different network groups; the signature area is used to store one or more digital signatures, each digital signature is composed of signature information and signature value, the signature information refers to the signature type and the location of the certificate used to verify the signature; the read-only area is used to store the data block filled by the network sender; the variable area includes a protection area and a danger area, the protection area is used to store the modifiable fields that need to be signed, and the danger area is used to store the modifiable fields that do not need to be signed;

[0024] In step S2, the digital customs based on the multi-identity network refers to a border router used to process inbound and outbound multi-identity network packets, issue digital passports for multi-identity network packets leaving the country, and verify digital visas for multi-identity network packets entering foreign countries; the digital passport and digital visa based on the multi-identity network respectively refer to different specific fields carried on the multi-identity network packets, and the specific fields are generated and verified by any one or more of encryption, hash calculation and certificate.

[0025] A further improvement of the present invention is that step S3 includes the following sub-steps:

[0026] Step S301, calculating the time parameter Time by the formula Time=UNIX Time and 0xFFFFFFFFFFFFFFF0, wherein UNIX Time is a 64-bit integer used to represent the number of seconds elapsed since the preset time, and the lowest 4 bits of the second UNIX Time in binary are set to 0;

[0027] Step S302, by the formula Time256=Time×(1+2 64 +2 128 +2 192 )Get 256-bit time data Time256;

[0028] Step S303, perform bitwise XOR operation on the time data Time256 and the digital visa key CVK through the formula Visa=SHA256(Time256 xor CVK), and perform one-way mapping of the hash function to obtain a digital visa Visa based on a multi-identity network; the digital visa key CVK is a 256-bit key, and the digital visa key CVK is associated with the user's multi-identity network identity information and real identity information.

[0029] A further improvement of the present invention is that in step S3, the digital visa calculated based on the current time and the time 16 seconds ago are both valid.

[0030] A further improvement of the present invention is that in step S4, the digital passport Pass based on the multi-identity network is calculated by the formula Pass=SHA256(Visa xorCPK), wherein CPK refers to a pre-agreed 256-bit transnational passport key.

[0031] A further improvement of the present invention is that in step S5, a plurality of exit tables are stored in the digital customs, each of which corresponds to a target country; when the digital customs receives a multi-identification network packet forwarded out of the country by the forwarding table, the target country corresponding to the multi-identification network packet is first checked, and then the multi-identification network packet is assigned to the exit table of the corresponding country for processing, and the processing process includes the following sub-steps:

[0032] Step A1, the digital customs discards the multi-identification network packets of users without exit permit;

[0033] Step A2: When the digital visa Visa carried in the multi-identity network packet is the same as the LastVisa in the exit table, the digital customs directly signs the digital passport in the multi-identity network packet using the LastPass in the exit table and forwards the multi-identity network packet. LastVisa refers to the digital visa of the user's previous multi-identity network packet, and LastPass refers to the digital passport calculated based on the digital visa LastVisa of the user's previous multi-identity network packet.

[0034] Step A3, when the digital visa Visa carried in the multi-identity network packet is different from the LastVisa in the exit table, determine whether the difference between the current time and LastTime is less than 8 seconds. If so, the digital customs directly uses LastPass as the digital passport, fills the digital passport into the multi-identity network packet and forwards it immediately. LastTime refers to the time when the user's last multi-identity network packet arrived; if not, calculate the new digital passport according to the current time, update the exit table according to the new digital passport, and issue the new digital passport into the multi-identity network packet.

[0035] A further improvement of the present invention is that in step S6, an entry table is used and maintained in the digital customs. When a multi-identification network packet is about to enter the network border, the digital customs performs verification processing through the entry table. The verification processing process includes the following sub-steps:

[0036] Step B1, if the sender does not hold a digital passport and is not in a visa-free situation, the multi-identification network packet is directly discarded by the digital customs;

[0037] Step B2: If the sender holds a digital passport, the validity of the digital passport is verified by the digital customs. If it is determined to be invalid, the digital customs discards the multi-identification network packet with the invalid digital passport; if it is determined to be valid, the digital passport and its digital visa corresponding to the multi-identification network packet are verified;

[0038] The process of updating the entry table in step S6 includes any of the following steps:

[0039] Step C, the digital customs traverses all entries in the entry table, and calculates and updates the LastPass, Pass, and NextPass fields at fixed intervals, where LastPass refers to the digital passport calculated based on the digital visa LastVisa of the user's last multi-identity network packet, Pass refers to the digital passport calculated based on the digital visa Visa calculated based on a fixed time after LastTime, and NextPass refers to the digital passport calculated based on twice the fixed time after LastTime;

[0040] Step D: When the digital customs receives the multi-identification network packet, it determines whether the LastPass in the entry table entry has expired. If so, LastPass is replaced with Pass, and Pass is replaced with NextPass; if not, it returns.

[0041] A further improvement of the present invention is that it also includes a mimetic defense step based on a weighted centrality algorithm. In the mimetic defense step, the indicators of each device in the multi-identity network are first obtained, and the indicators include point degree centrality, closeness centrality and betweenness centrality; after obtaining the above three indicators, each indicator is sorted separately as the score of the indicator, and then the scores of the three indicators are added to obtain the sum value sum, and the sum value sum is sorted to obtain the final centrality rank value Rank; for the storage server, a first weight is assigned, and its sum value sum is divided by 3 to obtain a new sum value sum'; for the border router, a second weight is assigned, and its sum value sum is divided by 2 to obtain a new sum value sum'; for the forwarding server, a third weight is assigned, and its sum value sum remains unchanged; the first weight is greater than the second weight, and the second weight is greater than the third weight.

[0042] A further improvement of the present invention is that it also includes step S7, which is used to establish a cyberspace management system; AI detection management is performed in the cyberspace management system, and when the cyberspace is disturbed or attacked, network traffic, user behavior and system logs are monitored and analyzed through at least one of data analysis, deep learning, reinforcement learning and model training, and stored in blockchain log records.

[0043] A further improvement of the present invention is that, in the cyberspace management system, when the attacker corresponding to the interference or attack cannot be found, compensation is made through an insurance service company in the cyberspace, or emergency assistance and support is provided through a cyberspace emergency department, which includes domestic emergency departments and international emergency departments in the cyberspace; the insurance service company and the cyberspace emergency department both implement embedded identity authentication based on a multi-identity network, and access blockchain log records through multi-identity addressing.

[0044] A further improvement of the present invention is that it also includes step S8, which is used to establish a cyberspace adjudication system; in the cyberspace adjudication system, when disputes and conflicts involving data assets, data privacy or cyberspace are involved, investigations are conducted based on blockchain log records, and the investigation results are sent to the corresponding domestic cyber court or international cyber court; and the relevant judgment records are published in the blockchain cyberspace.

[0045] The present invention also provides a system for ensuring that a network space is trustworthy and secure, which adopts the method for ensuring that a network space is trustworthy and secure as described above, and includes:

[0046] The identity authentication and multi-identity addressing module implements multi-identity addressing with embedded identity authentication and packet signature based on the multi-identity network. After the user completes the registration, he / she first signs each data packet published with his / her own private key and writes it into the signature area of ​​the multi-identity network packet. The intermediate router regularly maintains the user information table obtained from the multi-identity management system, extracts the signature information of the corresponding user from the message after receiving it, and then authenticates the received multi-identity network packet through the public key information obtained from the multi-identity management system; and after the identity authentication is passed, the corresponding multi-identity addressing is performed through the message format that supports variable message length;

[0047] Define modules to define digital customs, digital passports and digital visas based on a multi-identity network;

[0048] The digital visa module performs a bitwise XOR operation on the time data and the digital visa key, and performs a one-way mapping of the data after the bitwise XOR operation through a hash function to obtain a digital visa based on a multi-identity network;

[0049] The digital passport module calculates the digital passport based on the multi-identity network according to the hash value of the digital visa and the multinational passport key;

[0050] Using and maintaining the exit table module, realizing digital customs through a multi-identity network router, and using and maintaining the exit table through the digital customs;

[0051] The module for using and updating the entry form verifies the digital passport through the digital customs using the entry form and updates the entry form.

[0052] Compared with the prior art, the beneficial effects of the present invention are: first, multi-identity addressing with embedded identity authentication and packet signature is realized based on a multi-identity network, and then the use and maintenance of the exit form is realized through a digital visa, digital passport and digital customs based on the multi-identity network, and the use and update of the entry form are realized, so that the network system, method and system that adapt to the current development speed can be effectively provided through a multi-identity network and a multi-identity network management system, so as to more effectively guarantee the credibility and security of cyberspace, and provide a better foundation for ensuring the order, rule of law and peace of cyberspace. When it comes to disputes and conflicts involving data assets, data privacy or cyberspace, the victim can conduct an investigation based on the blockchain log records, and send the investigation results to the corresponding domestic cyber court or international cyber court, providing a reliable basis for domestic or international cyber court litigation. The present invention can be better applied in the global cyberspace, facilitating the management of the cyberspace boundaries of various countries, protecting the cyberspace sovereignty of various countries, and combating transnational cyber attacks and crimes.

[0053] On this basis, we have further implemented mimetic defense based on the weighted centrality algorithm, so as to improve the efficiency of network protection in a targeted manner according to user security needs; established an anti-attack random process martingale quantization model, enhanced the flexibility of the hierarchical analysis structure of cyberspace, and further improved the network integrity; established a cyberspace management system and a cyberspace referee system, which provided guarantees for the security and credibility of cyberspace, and provided a good foundation for ensuring the security, peace, rule of law and orderly management of cyberspace. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 It is a schematic diagram of the working process of an embodiment of the present invention;

[0055] Figure 2 This is a schematic diagram of the overall solution architecture of the network space of an embodiment of the present invention;

[0056] Figure 3 This is a schematic diagram of security protection of a multi-identification network system according to an embodiment of the present invention;

[0057] Figure 4 It is a schematic diagram of the format of a multi-identification network packet according to an embodiment of the present invention;

[0058] Figure 5 It is a schematic diagram of a network structure of an international network space based on digital customs according to an embodiment of the present invention;

[0059] Figure 6 It is a schematic diagram of a multi-identity network security defense solution according to an embodiment of the present invention;

[0060] Figure 7 It is a schematic diagram of a hierarchical security solution for a multi-identity network according to an embodiment of the present invention;

[0061] Figure 8 is a Markov chain schematic diagram of a random wandering process of an embodiment of the present invention;

[0062] Fig. 9 is a schematic diagram of a multi-identity network security protection mechanism according to an embodiment of the present invention;

[0063] Fig.10 It is a schematic diagram of attack transfer of a multi-identity network according to an embodiment of the present invention;

[0064] Fig.11 This is a schematic diagram of an active defense cloud environment architecture according to an embodiment of the present invention;

[0065] Fig.12 is a schematic diagram of a virtual machine migration architecture according to an embodiment of the present invention;

[0066] Fig.13 is a task execution flow chart of an embodiment of the present invention;

[0067] Fig.14 It is a schematic diagram of the network attack process;

[0068] Fig.15 It is a detailed working flow diagram of an embodiment of the present invention. DETAILED DESCRIPTION

[0069] Before introducing the preferred embodiments of the present invention, the relevant technical solutions are first introduced.

[0070] The first related technical solution is IP-VPN.

[0071] IP-VPN is the earliest virtual security private network proposed based on the IP system. In the traditional sense, VPN mainly refers to the fact that the connection between any two nodes of the entire VPN network does not have the end-to-end physical link required by the traditional private network. Through the network platform provided by the public network service provider, user data can be transmitted in the logical link. IP-VPN refers to a virtual private network established by using the existing power information network resources through the packetization and encryption transmission of IP network data, and establishing a private data transmission channel through a shared IP network, connecting remote branch offices, business partners, mobile office personnel, etc., and providing end-to-end quality of service (QoS) guarantees and security services.

[0072] At present, IP-VPN mainly relies on the following four technologies to ensure data security: First, tunneling technology (Tunneling), by establishing a tunnel on the public network, encapsulating data in the tunnel for transmission to protect the confidentiality and integrity of the data. Second, encryption technology (Encryption), using encryption algorithms to encrypt data so that it cannot be stolen or tampered with by unauthorized personnel during transmission. Third, key management technology (Key Management), used to generate, distribute and manage the keys required for encrypted communication, ensuring that both parties in communication can share the keys securely. Fourth, user and device authentication technology (Authentication), by verifying the identity of users and devices to ensure that only legitimate users and devices can access IP-VPN, preventing unauthorized access and attacks.

[0073] This related technical solution has the following disadvantages: Although IP-VPN is called a virtual private network in name, it is essentially a logical concept based on the IP protocol architecture rather than a real private network, which leads to some disadvantages. In the past 20-30 years, IP-VPN has not really solved the security problem and has the following limitations: First, security challenges. Since IP-VPN relies entirely on the IP protocol, it faces challenges from various network security threats, such as data leakage and intrusion attacks. Second, trust issues. In traditional IP-VPN, all nodes are considered trusted, which may lead to unauthorized nodes gaining access rights, thereby increasing security risks. Third, scalability limitations. As the scale and complexity of the network increase, traditional IP-VPN is difficult to adapt to large-scale networks and growing user needs. Fourth, management complexity. Traditional IP-VPN requires complex configuration and management, including key management and identity authentication, which also increases the complexity and cost of management.

[0074] The second related technical solution is the traditional firewall.

[0075] Traditional firewalls are network security devices that can control network traffic by filtering IP addresses and service ports in data packets. However, firewalls are often ineffective when attackers use legitimate IP addresses and port numbers to conduct attacks or malicious behaviors, because they can usually only perform surface-level inspections on data packets, and even if deep packet inspection (DPI) technology is used, there are still many challenges. Generally, each malicious attack code has unique features, which can be used to distinguish viruses from normal application code. Antivirus programs identify viruses by storing the features of known viruses. In the ISO / OSI seven-layer network model, firewalls are mainly located between the second and fourth layers. Firewalls will carry out traffic control and analysis at these layers, and have only a small impact on the network layers between the fourth and seventh layers. Antivirus software mainly identifies viruses between the fifth and seventh layers.

[0076] Firewall is a common network security technology, but it is still a protective measure based on IP architecture. This related technical solution has the following disadvantages: First, it cannot deal with advanced threats. Traditional firewalls mainly rely on known virus features or rules for detection and cannot effectively deal with new advanced threats and unknown attack modes. Second, it cannot identify application layer threats. Traditional firewalls perform traffic control and analysis at network levels below the fourth layer, and often cannot identify and prevent threats hidden in the application layer. Third, it is easy to be deceived. Traditional firewalls are vulnerable to attackers using deceptive techniques to bypass detection, such as using encrypted communications or disguised traffic. Fourth, it limits network performance. Traditional firewalls need to perform deep packet inspection and rule matching, which has a certain impact on network performance, especially in high-traffic environments, which may cause network delays and reduced throughput.

[0077] The third related technical solution is IDS and IPS.

[0078] In order to fill the gap between the fourth and fifth layers of the seven-layer network model between firewalls and antivirus software, the industry introduced intrusion detection systems (IDS) and intrusion prevention systems (IPS). IDS is mainly used to detect abnormal intrusion behaviors and issue alarms. IPS is mainly used to detect malicious activities that are clearly judged as attacks and can cause harm to the network, and to perform corresponding defenses. In contrast, IPS focuses more on risk control.

[0079] IDS can monitor network transmission in real time and immediately alert the administrator or firewall when an abnormal situation is found. IDS is a monitoring device that can work without being connected across any link. Therefore, the deployment of IDS requires it to be connected to the link that the traffic must pass through. IDS is usually placed as close as possible to the attack source or protected resources, such as switches in the server area and LAN switches that protect the network segment.

[0080] Similar to IDS, IPS focuses on defense within the data, such as searching for attack code features, filtering or discarding harmful data packets. Most IPS also combine abnormal behaviors in applications or network transmission to assist in identifying attacks. For example, user programs violate security regulations, packets are sent and unpacked during sensitive periods, and application vulnerabilities are exploited. IPS not only considers known virus features, but more importantly, it identifies attack programs or harmful codes and their clones and variants, takes preventive measures, and prevents or at least reduces their harmfulness as early as possible. IPS is usually used as a supplement to firewalls and antivirus software in usage scenarios. If necessary, IPS can also provide effective evidence for pursuing criminal liability of attackers.

[0081] However, this related technical solution has the following disadvantages: IDS systems do not have a good solution for identifying large-scale combined and distributed intrusion attacks, and false alarms and missed alarms are serious. False alarms will cause a large number of alarm events to distract the administrator's attention, and they will not be able to respond to real attacks. Corresponding to false alarms are missed alarms. With the continuous updating of attack methods, whether IDS can report all attacks in the network is also a problem. IDS technology adopts a preset and feature analysis working principle, so the update of detection rules always lags behind the update of attack methods, and it is impossible to actively discover security risks and faults in the network. In addition, IDS only detects and alarms, and does not have the real ability to defend and prevent attacks. At the same time as the alarm is issued, the attack has already occurred.

[0082] IPS technology also has single point failure, performance bottleneck, false positive and false negative problems. The design requires that IPS must work in the network in embedded mode, which may cause bottleneck problems or single point failure. If the IDS fails, the worst case is that some attacks cannot be detected, and problems with embedded IPS devices will seriously affect the normal operation of the network. If the IPS fails and shuts down, users will face a denial of service problem caused by the IPS, and all customers will not be able to access the applications provided by the enterprise network. Because it can detect and block attacks in real time, IPS greatly improves the efficiency and effectiveness of security protection. The weakness of IPS also stems from its advantages. Because it uses the same detection technology as IDS, IPS also faces the risk of false positives and false negatives. When an intrusion is discovered, IPS needs to make a decision to allow or block the data packet to pass immediately, so the false positives and false negatives of IPS will lead to more serious consequences than IDS. The false positives of IDS will at most increase network noise and cause trouble for network administrators, but the false positives of IPS will lead to denial of service and legal access will be denied.

[0083] The fourth related technical solution is Web Application Firewall.

[0084] A Web Application Firewall (WAF) is a device that provides protection for Web applications. It protects Web applications by executing a series of security policies for HTTP / HTTPS. In recent years, as Web applications have become more and more abundant and complex, Web servers have gradually become the main target of attackers. Security incidents such as SQL injection, web page tampering, and web page Trojans have occurred frequently. Traditional firewalls and other devices are often helpless, but Web application protection systems can solve these problems.

[0085] Unlike traditional firewalls, WAF works at the application layer. By learning the business processes and logic of Web applications, WAF can detect various types of requests from Web application clients to verify the security and legality of their content, and interrupt illegal requests in a timely manner, thereby achieving the purpose of protecting website security. The main functions of WAF include auditing devices, access control devices, architecture design tools, and Web application hardening tools. Auditing devices are used to intercept HTTP data or sessions that meet certain rules; access control devices are used to control access to Web applications, and the package provides two security modes: active security mode and passive security mode; architecture design tools are used to allocate functions, centralized control, and virtual infrastructure in reverse proxy mode; Web application hardening tools are used to enhance the security of protected Web applications, including anti-attack, anti-vulnerability, anti-dark link, anti-crawler, anti-Host and anti-DDOS.

[0086] This related technical solution has the following disadvantages: WAF has played a certain role in slowing down hacker attacks, but at the same time WAF also has great limitations. First, there is a certain probability that WAF is "bypassed". WAF parses the HTTP(S) protocol by itself, which may be inconsistent with the web server's understanding of the HTTP(S) request, resulting in "bypass". Secondly, WAF's defense often lags behind hacker attacks and cannot effectively identify and block new attacks. At present, most WAFs on the market are based on rule matching, that is, WAF performs regular matching filtering on the packets received by the docking data. If the regular matching is the same as the attack code in the existing vulnerability knowledge base, it is considered to be malicious code and blocked. Obviously, the update of rules often lags behind the attack. Finally, WAF's defense against logical vulnerabilities is always stretched. WAF's identification of attacks comes from the set rule base, and it is powerless against seemingly "normal" business logic vulnerabilities, such as unauthorized operations, unauthorized access, arbitrary user password resets, and weak password vulnerabilities.

[0087] A fifth related technical solution is situational awareness.

[0088] Situational awareness was proposed in the 1980s, and it includes three levels: perception, understanding, and prediction. The definition of network security situational awareness based on Endsley's theory is: Network security situational awareness is to comprehensively analyze network security elements, evaluate network security status, predict its development trend, and present it to users in a visual way, and provide corresponding reports and countermeasures. The situational awareness platform should use technologies such as big data and machine learning to extract massive data and conduct multi-dimensional correlation analysis. It can provide alarms for security risks, trend prediction, etc. Massive data, correlation analysis, large-screen display and trend prediction are the four key points. Among them, trend prediction is the most core and also the most difficult part to achieve.

[0089] The focus of situational awareness is to deepen the prediction of security trends through technologies such as big data and machine learning. At present, the situational awareness products provided by domestic security vendors include functional modules such as asset management, vulnerability management, big data platform, log analysis platform, threat intelligence, sandbox, user behavior analysis, network traffic analysis, forensic tracing and threat capture. With the expansion of the monitoring scope, the amount of data is also expanding, and a big data platform with big data processing and computing capabilities is needed, which is an important foundation for the construction of the entire situational awareness platform. Threat intelligence is very important for reducing large amounts of data and junk data or alarm noise in alarms, and helping to discover attack behaviors and attackers more quickly and efficiently. The quality of threat intelligence is a very important aspect of testing the capabilities of the situational awareness platform. The core purpose of using platform capabilities such as situational awareness is to monitor complex and advanced attacks. This requires the situational awareness platform to first capture the microscopic state, and low-cost and efficient full-factor data collection capabilities are the basis. At present, cyberspace defense attacks are no longer feature-based monitoring. It is necessary to use threat intelligence and expert experience to build a scenario-based analysis system. This is a process of continuous learning and reference in the offensive and defensive confrontation that keeps pace with the times, and such analysis management needs to be continuously operated.

[0090] This related technical solution has the following disadvantages: The design of traditional security situation awareness only involves data collection and analysis of network behavior, and mainly focuses on a single network environment. As the scale of the network continues to expand, corresponding indicator systems have emerged, but these indicators are often not comprehensive enough and have defects in accuracy and real-time performance. The emergence of big data technology has improved perception capabilities, while deep learning has enhanced predictive analysis capabilities. Therefore, the security situation awareness system has practical application capabilities, but this relies on a large amount of historical data and related data. However, the network situation changes rapidly, and it is difficult to accurately respond to fragmented and long-latency threat behaviors relying solely on prior knowledge. In particular, there are great difficulties in identifying new threats.

[0091] The sixth related technical solution is the zero trust concept.

[0092] In 1994, the term "zero trust" was proposed by Stephen Paul Marsh in his doctoral thesis on computer security at the University of Stirling. Marsh viewed trust as something that could be described mathematically, and asserted that trust could not include human factors such as morality, ethics, legitimacy, justice, and judgment. In 2010, John Kindervag, an analyst at Forrester Research, used the term zero trust model to represent stricter network security plans and access controls within companies. In 2013, the Cloud Security Alliance (CSA) proposed a new generation of network security technology architecture, namely software-defined perimeter SDP, as the first technical solution for zero trust. From 2018 to 2020, NIST and NCCoE carried out related work and issued two draft versions of the zero trust standard, defining zero trust (ZT) as a set of concepts and ideas designed to reduce uncertainty in making accurate, on-request access decisions in information systems and services in the face of networks that are considered compromised.

[0093] Zero trust security includes five basic assumptions: first, the network is in a dangerous environment at all times; second, the network is always subject to external or internal threats; third, the location of the network is not sufficient to determine the degree of network trust; fourth, all devices, users and network traffic should be authenticated and authorized; fifth, network security policies must be dynamic and should be calculated based on as many data sources as possible.

[0094] Zero Trust is not an independent product or a single device, but an evolving network security paradigm that shifts the traditional static network perimeter-based defense approach to focus on users, assets, and resources. Zero Trust architecture does not completely abandon existing security technologies and start from scratch, but still uses many traditional network security technologies, such as identity authentication and access control. Zero Trust simply shifts the scope of authentication and control from the broad network perimeter to a single or small group of resources.

[0095] Zero trust is supported by three key technologies. The development and deployment of the zero trust model will inevitably undergo complex technical iterations and upgrades, involving core technologies such as identity authentication and access management (IAM), micro segmentation, and software defined perimeters. The first is identity authentication and access management, which is the cornerstone of the zero trust architecture, that is, comprehensive verification of identity through dynamic authentication and authorization. Identity authentication and access management technology solves key issues such as unique identity identification, identity attributes, and identity life cycle management. The second is micro segmentation, which effectively prevents the lateral spread of illegal access by segmenting resources in a more granular manner, isolating internal and external system hosts, and independently controlling access rights. Finally, software defined perimeters can establish virtual boundaries in the "mobile + cloud" environment. Only users who have passed device and identity authentication can access resources, and through a temporary, single "access tunnel", the resource location will not be leaked. These three technologies are the core components of the zero trust architecture, and zero trust security has also been widely promoted in recent years.

[0096] This related technical solution has the following disadvantages: The zero trust concept has been promoted for decades since it was proposed in 1994, but there are still ten major events affecting the global network security field every year. In addition, Facebook has also suffered a large-scale personal data leak. For other countries, zero trust requires trusting the IP network domain name system controlled by a single institution, which makes it more difficult to achieve true zero trust.

[0097] The current rapid development of the Internet has brought great challenges to the existing network system. The main participants in IP invention and network control have invested decades of time in researching network security. The existing domain name management system is no longer able to meet the needs of professional service quality and security control. The above-mentioned related technical solutions cannot ensure the trustworthiness and security of the cyberspace with the trend of globalization. In order to ensure the trustworthiness, security, order, rule of law and peace of the cyberspace, it is necessary to provide a network system, method and system that adapts to the current development speed.

[0098] To this end, this embodiment aims to provide a method and system for ensuring that the network space is trustworthy and secure, so as to meet the network system, method and system requirements that adapt to the current development speed. The following will further describe the preferred embodiments of the present invention in detail in conjunction with the accompanying drawings.

[0099] The new generation of network architecture should be a system that supports multiple identifiers including content, identity, IP address, service and geographic space, and a cyberspace that is owned by all mankind, co-managed, co-governed and shared by all countries. The new network system should have a high-security gene, and the new system should be scalable and evolvable to adapt to the development of future networks. It also requires an overall framework to plan security perception and embeddable modular design to prevent and respond to various attacks. When a low-probability attack breaks through the defense line of security technology, the system needs to have corresponding means to resolve the conflict and feed back the processing results to the existing cyberspace to maintain peace, security and rule of law in cyberspace.

[0100] Therefore, if Figures 1 to 14 As shown, this embodiment provides a method for ensuring that a network space is trustworthy and secure, comprising the following steps:

[0101] Step S1, based on the multi-identity network, multi-identity addressing with embedded identity authentication and packet signature is implemented. After the user completes the registration, he first signs each data packet released with his own private key and writes it into the signature area of ​​the multi-identity network packet. The intermediate router regularly maintains the user information table obtained from the multi-identity management system, extracts the signature information of the corresponding user from it after receiving the message, and then performs identity authentication on the received multi-identity network packet through the public key information obtained from the multi-identity management system; and after the identity authentication is passed, the corresponding multi-identity addressing is performed through the message format that supports variable message length;

[0102] Step S2, defining digital customs, digital passports and digital visas based on a multi-identity network;

[0103] Step S3, performing a bitwise XOR operation on the time data and the digital visa key, and performing a one-way mapping on the data after the bitwise XOR operation through a hash function to obtain a digital visa based on a multi-identity network;

[0104] Step S4, calculating and obtaining a digital passport based on a multi-identity network according to the hash value of the digital visa and the transnational passport key;

[0105] Step S5, implementing digital customs through a multi-identity network router, and using and maintaining the exit table through the digital customs;

[0106] Step S6, verifying the digital passport using the entry form through the digital customs and updating the entry form.

[0107] This embodiment also provides a system for ensuring that the network space is trustworthy and secure. Figure 2As shown, the method of ensuring the trustworthiness and security of cyberspace is adopted, including a cyberspace based on the MIN system, security technology and packet data network, a cyberspace management system based on the MIN that provides protection from the management level, and a cyberspace adjudication system based on the MIN that provides protection from the legal level, so as to provide a network system, method and system that adapt to the current development speed.

[0108] In order to ensure that the global cyberspace is trustworthy, safe, orderly, law-abiding and peaceful, it is necessary to solve technical problems, such as Figure 3 As shown, this is achieved through a technical solution that combines security technology, system management of each entity, and internal / global international legal arbitration systems of various countries. The internal / global international legal arbitration systems of various countries can include online courts and traditional domestic / international courts.

[0109] First, in terms of technology, this embodiment adopts a network based on the MIN system. In the MIN network, each country sets up digital customs at the entry and exit routers, signs digital passports for the MIN network packets leaving the country, and verifies the digital visas for the MIN network packets entering the country. Through the digital passport and digital visa mechanism, countries can effectively control the MIN network packets entering and leaving the country, combat transnational cybercrime and attacks, and safeguard their own cyberspace sovereignty. MIN refers to Multi-Identifier Network.

[0110] Second, adopt various security technologies based on the MIN system network. Figure 3 This is a diagram of the security protection of the MIN system. The MIN system relies on strong consistency that meets the three properties of CAP, linearly scalable availability, and partition-tolerant blockchains to manage the global and national cyberspace. It implements real identity registration and network use, and uses cryptography to record various biometric technologies to achieve a balance between privacy protection and controllability. Each user and unit has a cryptographic account and public and private keys. They must register with the blockchain system before they can use the network. Each interactive communication session must first verify their identity before communicating. Each access read and write log has a blockchain record that can be traced and cannot be denied. The application of new technologies, such as blockchain, quantum technology, quantum blockchain, intrinsic security, and mimicry defense, converts unknown threats into known threats at the technical level and improves the security index.

[0111] Third, management is the basic guarantee of security. Without effective management, technical solutions will be difficult to implement. Each unit and individual system can prevent and handle abnormalities in the use of the network through a system based on AI-based active prediction, detection and manual administrator processing. If an unattended incident occurs, it will be handed over to the emergency department for corresponding processing and compensation.

[0112] Fourth, it is the rule of law, legal court system and system. All countries in the world have laws related to cyberspace. When assets, data privacy or other cyberspace damage occurs, the victim can call the police. Since all interactions are logged and traceable, the cyber police can determine the participants who may initiate the incident based on the logs recorded by the blockchain system. If the parties are from the same country, the incident will be tried by the domestic cyber court of that country; if the parties are from different countries, the incident will be reviewed by the international cyber court. Therefore, the negligent or criminal will be punished by law, financial compensation or imprisonment, and the judgment record and execution will also be published in the blockchain cyberspace.

[0113] The MIN network used in this embodiment supports the joint management of top-level identification by various countries and supports interconnection and interoperability; the subordinate identification is independently managed by each country and has independent sovereignty. At the same time, digital customs technology is used between countries to realize the confirmation and protection of cross-border data assets of individuals and enterprises. Finally, combined with security technology, the management of each subject system and the legal arbitration system, the continuous establishment and operation of the system are realized to form a closed loop, so as to realize a reliable and secure method and system for cyberspace based on technical solutions, so that no one dares to deliberately attack and damage the reputation of other people's assets on the network or manipulate other people's physical systems, such as manipulating other people's cars or production equipment, etc., including but not limited to manipulating cars to harm the personal safety of others.

[0114] Step S1 described in this embodiment is used to provide a multi-identity addressing technical solution based on embedded identity authentication and packet signature of a multi-identity network.

[0115] The MIN system adopted in this embodiment uses a multi-identity addressing scheme with embedded identity authentication and packet signature. Before each user and device joins the network, it is necessary to register its real identity information in the MIS alliance chain to obtain its unique identity. Each subsequent data packet needs to be signed with the corresponding private key for forwarding and receiving nodes to authenticate it. In this way, a close binding between users and content can be achieved. If there is a problem with the published or requested content, the individual can be accurately located to ensure that behavior and resources can be effectively managed and controlled. The participants in the overall identity registration and packet forwarding process include the MIN client, the MIS system, and the MIN router. MIS refers to Multi-Identifier System, that is, a multi-identity management system.

[0116] The step S1 described in this embodiment preferably includes steps S101 to S103.

[0117] Step S101, the user identity registration process of this embodiment is preferably based on asymmetric cryptography, and the multi-identity network client generates a public key and a private key for the user locally, and then submits the public key and the identity information signed with the private key to any node in the multi-identity management system; when the node receives the request, it verifies it, first checks its format, then searches for the user information in the local database, and performs simple verification on some of the contents, including but not limited to whether the user name is legal, whether there is duplication of user information, and whether the user's public and private keys are valid, etc. If any of the above verifications fails, this error message is returned to the user; if all verifications are successful, a transaction is generated by the accounting node of the multi-identity management system alliance chain and sent to all blockchain nodes; when the voting node in the blockchain receives a pre-block, it will vote on whether to allow this pre-block to become a formal block, and the formal block includes -1, 0 or 1. The leader node collects the voting results, counts them and generates a voting certificate, and stores the block information of the pre-block that has passed the vote, preferably in the MongoDB database, and extracts the user registration information from the block information and stores it in the user registration table.

[0118] Step S102, after registration is completed, the user signs each published data packet with his own private key, preferably using the SM2 elliptic curve algorithm to write the digital signature into the signature area of ​​the multi-identity network packet. The intermediate router regularly maintains the user information table obtained from the multi-identity management system (MIS), extracts the signature information of the corresponding user after receiving the message, and then authenticates the received multi-identity network packet through the public key information obtained from the multi-identity management system.

[0119] In addition to security factors, considering that different users may have different addressing requirements, the routing process should correspond to different identifiers. In order to support multiple identifiers and get rid of the addressing dependence on traditional networks, this embodiment combines the above-mentioned identity authentication technical solution to design a corresponding multi-identifier addressing method. Different identifiers are suitable for different transmission semantics, mainly including the "push" mode represented by the IP network architecture and the "pull" mode represented by the content-centric network (CCN).

[0120] Therefore, in step S103 of this embodiment, after identity authentication is passed, corresponding multi-identifier addressing is performed through a message format that supports variable message length to enhance the flexibility and scalability of network group definition; at the same time, in terms of security, the message format supports embedded digital signatures in each network group to ensure the integrity of the network group, and supports traceability.

[0121] like Figure 4As shown, the network group coding of the message for multi-identifier addressing in this embodiment includes three elements: type, size and data, which are represented by T (type), S (size) and D (data) respectively. This coding method supports hierarchical nesting and has a variable length characteristic, which can provide stronger expansion functions. The data packet of the message format includes four areas: identification area, signature area, read-only area and variable area.

[0122] The identifier area described in this embodiment is used to store one or more identifiers to distinguish different network groups. The signature area is used to store one or more digital signatures. Each digital signature consists of signature information and signature value. The signature information refers to the signature type and the location of the certificate used to verify the signature. After obtaining their own public key and private key, the user registers in the MIS system. Each time a package is sent, the private key is used to sign the package information and write it into this area, which is used for the forwarding node or source node to authenticate the identity of the sender. This signature area is expandable, which means that the user can choose signature schemes with different security levels such as hop-by-hop signature or source signature according to their security requirements. The read-only area is used to store data blocks filled by the network sender, including 0 to multiple TSD data blocks, which cannot be tampered with by intermediate routers. The read-only area and the signature area work together to ensure the authenticity, integrity and non-repudiation of the sent content. The mutable area includes a protection area and a danger area. The protection area is used to store modifiable fields that need to be signed, and to store relatively important but modifiable fields; the danger area is used to store modifiable fields that do not need to be signed, and to store information with low importance and modifiable, such as time to live (TTL), etc. In the routing process, for different identifiers, content identifiers and service identifiers use pull semantics, and interest packets and data packets are used for communication; General Push Packet (GPPkt) is used for push semantic communication. Common identifiers that use push semantics include identity, geographic information, and IP identifiers.

[0123] The routing device preferably uses a multi-identifier router MIR, which refers to Multi-Identifier Router. MIR contains modules such as logical interface, packet verification module, forwarding module, forwarding table module and decision maker. For the received packet, MIR will first perform a format review, and distinguish the type of packet by identifying the type of identification stored in the identification area. Only multi-identifier network packets (also called MIN packets) will be forwarded. For each MIN packet, MIR first verifies whether its signature is correct and valid with the packet verification module. If the verification fails, the packet is discarded. If the verification passes, the packet is passed to the identification selection module, the identification for forwarding is selected, and different network groups are distinguished according to the identification, and the corresponding forwarding processing flow is executed respectively.

[0124] (1) Interest Packet: First query the local content cache. If the cache is hit, the requested data is returned directly. Otherwise, query the pending interest table (PIT). If there is a matching entry in the PIT, it means that an interest packet with the same name has been sent and has not been satisfied. Then aggregate these same interest packets, record the logical interface that receives the interest packet into the corresponding PIT entry, and stop forwarding the interest packet. If there is no matching entry in the PIT, create a PIT entry for it and query whether there is a matching route in the forwarding information base (FIB). If the query is successful, forward it according to the forwarding strategy; otherwise, choose to discard or return a Nack message according to the forwarding strategy.

[0125] (2) Data packet: First, the PIT table is queried. If no matching entry is found, it means that the data packet is not requested by the user and is directly discarded. Otherwise, the data packet is stored in the local cache and forwarded according to the forwarding policy.

[0126] (3) GPPkt packet: The processing logic of MIR is similar to that of IP routers. It queries the destination identifier in the FIB. If no matching entry is found, it is discarded directly; otherwise, it is forwarded according to the forwarding policy.

[0127] In addition to the network layer, this embodiment also verifies the identity of each user at the application layer. And all the user's access behaviors will also be subject to relevant constraints based on their own access rights. If the identity's authority allows it to perform relevant operations, then the user can access normally; otherwise, the user's operation will be rejected and recorded by the MIS.

[0128] The legitimate users of this embodiment are subject to real-name authentication, and users need to sign when pulling data from the network. For data requested by users within the MIN system, the content and requester are recorded by the blockchain. Once a problem occurs, the problem can be traced back and held accountable immediately to ensure the authenticity and reliability of the information, and to a certain extent, malicious operations by intranet users can be avoided. The above technical solution enables countries to manage cyberspace, just like in the real space, where everyone has a digital passport and needs to obtain a digital visa to enter other countries. Their actions will leave undeniable records in the alliance chain of digital customs of various countries and their own country or in the domestic cyberspace.

[0129] Step S2 described in this embodiment is used to define digital customs, digital passports and digital visas based on a multi-identity network. In step S2, the digital customs based on a multi-identity network refers to a border router used to process inbound and outbound multi-identity network packets, determine whether the country's multi-identity network packets can leave the country, issue digital passports for the country's outbound multi-identity network packets, and verify the digital visas for foreign inbound multi-identity network packets. The multi-identity network packet is also called a MIN network packet or a MIN packet. The main design requirements of the digital customs include being able to realize the functional requirements of the digital customs while meeting the functions of ordinary multi-identity network routers, and a single digital customs can handle the network entry and exit needs of tens of millions of users. Digital customs can effectively control the entry and exit of MIN network packets, thereby shaping and maintaining the cyberspace sovereignty of various countries.

[0130] Digital passports and digital visas based on multi-identity networks refer to different specific fields carried on multi-identity network packets, which are generated and verified by any one or more of encryption, hash calculation and certificates. Applying the first proposed digital passports and digital visas based on multi-identity networks to cyberspace can manage the cyberspace boundaries of various countries through reliable technical solutions, protect the cyberspace sovereignty of various countries, and combat transnational cyber attacks and crimes.

[0131] Specifically, in a multi-identity network, the digital passport refers to a specific field carried on the MIN network packet. This field can be generated and verified by encryption, hashing or certificates. This field is only added by the digital customs to ensure its security and reliability. The digital passport cannot be forged by other countries and can resist network attacks such as replay attacks. The calculation of the digital passport is simple and effective, which reduces the computational burden of the digital customs. This will be described later. The digital passport can reflect the endorsement and recognition of a country's cyberspace sovereignty for the outbound MIN network packet, define clearer responsibility boundaries for cyberspace security incidents, and promote global cyberspace governance.

[0132] In a multi-identity network, a digital visa refers to a specific field on the MIN network packet. This field can be generated and verified by encryption, hashing, or certificates. This field should be added by the user and cannot be forged by digital customs, thereby ensuring that the MIN network packet comes from an authorized foreign user and not forged by digital customs in another country. Digital visas can resist network attacks, such as replay attacks. The calculation of digital visas is simple and effective, reducing the calculation burden of digital customs, which will also be described later. Digital visas can effectively protect the boundaries of cyberspace, prevent the leakage of domestic network data and assets, and effectively combat global transnational cyber attacks and crimes.

[0133] Due to the scalability and evolution of the multi-identity network, the implementation methods of the digital customs, digital passports and digital visas have multiple options and can continue to evolve with the development of technology. This embodiment provides a preferred implementation scheme in steps S3 to S6. Figure 5 What is shown is a schematic diagram of digital customs governance of global network boundaries, that is, a schematic diagram of the networking of international cyberspace based on digital customs.

[0134] Step S3 of this embodiment is to implement a digital visa based on a multi-identity network. This embodiment defines a digital visa as a 256-bit hash value, which is used to determine whether a MIN network packet from abroad can enter the sovereign state's cyberspace. Considering that the multi-identity network supports both push and pull semantics, the digital visa is only applicable to general push packets under push semantics and interest packets under pull semantics.

[0135] In the Multi-Identity Network (MIN), each user obtains a 256-bit MIN identity from the Multi-Identity Management System (MIS). The user uses the real identity information and MIN identity information to apply for a CyberSpace Visa Key (CVK) from a foreign digital customs. The real identity information includes identity information such as the real passport and biometric information. The CyberSpace Visa Key CVK is a 256-bit key. The foreign digital customs records the user's MIN identity information, the CyberSpace Visa Key CVK and the real identity information. The user saves his own CyberSpace Visa Key CVK. When the CyberSpace Visa Key CVK is leaked, the user should promptly report the loss of the CyberSpace Visa Key CVK to the foreign digital customs and reapply.

[0136] In the specific technical solution of the digital visa described in this embodiment, it is preferred that a digital visa key CVK with a length of 256 bits is pre-agreed upon by the user and the digital customs of a foreign country, and a hash function is used to realize the calculation and verification of the digital visa according to the current international time, thereby ensuring its fast calculation speed and high security; and it does not affect the upper layer protocol, and is suitable for the calculation requirements of digital passports in large-scale cross-border scenarios.

[0137] Specifically, step S3 in this embodiment preferably includes the following sub-steps:

[0138] Step S301, calculating the time parameter Time by the formula Time=UNIX Time and 0xFFFFFFFFFFFFFFF0, wherein UNIX Time is a 64-bit integer used to represent the number of seconds elapsed since the preset time, and the lowest 4 bits of the second UNIX Time in binary are set to 0;

[0139] Step S302, by the formula Time256=Time×(1+2 64 +2 128 +2 192 ) Copy the time parameter Time to 4 copies and concatenate them bit by bit to obtain 256-bit time data Time256;

[0140] Step S303, perform bitwise exclusive OR operation on the time data Time256 and the digital visa key CVK through the formula Visa=SHA256(Time256 xor CVK), and perform one-way mapping of the hash function to obtain a digital visa Visa based on a multi-identity network; the digital visa key CVK is a 256-bit key, and the digital visa key CVK is associated with the user's multi-identity network identity information and real identity information; xor represents a bitwise exclusive OR operation.

[0141] That is to say, the present embodiment can calculate the digital visa Visa corresponding to a MIN network packet according to the following method. UNIX Time is a 64-bit integer, which represents the number of seconds elapsed since the preset time. The default is the number of seconds elapsed since January 1, 1970 (midnight of UTC / GMT), without considering leap seconds. The preset time can be set and adjusted according to actual conditions and needs, and the default is January 1, 1970 (midnight of UTC / GMT). The present embodiment preferably assigns the lowest 4 bits of the number of seconds UNIXTime to 0 to obtain the time parameter Time to reduce the complexity of the calculation; the time parameter Time changes every 16 seconds, and the value is a multiple of 16. The 64-bit Time is copied 4 times and connected bit by bit to a 256-bit Time256. The time data Time256 and the digital visa key CVK are bitwise XORed, and then one-way mapped to a digital visa using the SHA256 hash function.

[0142] It should be noted that when the UNIX Time is a multiple of 16, the time used by the user to calculate the digital visa may differ by 16 seconds from the time used by the digital customs to calculate the digital visa. This will cause the MIN network packet holding a legal digital visa to be unable to enter smoothly, which will seriously affect the reliability of cross-border network services. Therefore, in step S3 of this embodiment, the digital visa calculated by the current time and the time 16 seconds ago are both valid, which can well avoid the problem of affecting cross-border network services due to the time difference.

[0143] In addition to the scalability and security of the multi-identity network, this embodiment of implementing digital visas based on a multi-identity network also has the following advantages: First, the use of hash functions instead of symmetric or asymmetric encryption algorithms can make the calculation speed of the digital visa Visa faster and can adapt to high-traffic scenarios of cross-border management. Second, the hash function has a one-way characteristic and cannot be reversed to crack the digital visa key CVK, which makes the digital visa key CVK very safe. Third, except for the hash function operation, all operations in step S3 are binary bit operations, and the hardware execution efficiency is very high. Fourth, the calculation of the digital visa Visa is associated with time, which can effectively avoid replay attacks.

[0144] In this embodiment, due to the digital visa key CVK agreed upon by the user and the digital customs, when the hash value of the digital visa Visa calculated by the user based on the digital visa key CVK and time is consistent with the hash value of the digital visa Visa calculated by the digital customs based on the corresponding user's digital visa key CVK and time, it can be confirmed that the authorized foreign user is entering the sovereign network space. When the hash values ​​of the two digital visas are inconsistent, the MIN network packet holding the illegal digital visa Visa is directly discarded.

[0145] Therefore, through the digital visa of cyberspace, Digital Customs can ensure that all MIN network packets entering cyberspace come from authorized foreign users. Digital Customs can cancel digital visas used for illegal activities and hold the corresponding digital visa holders accountable. This will effectively protect the borders of cyberspace from foreign attacks, prevent domestic data from being easily pulled by foreign users, and provide a better foundation for shaping cyberspace sovereignty.

[0146] Step S4 of this embodiment is used to implement a digital passport based on a multi-identity network. In this embodiment, a digital passport is defined as a 256-bit hash value signed by the digital customs for a MIN network packet. The digital passport is applicable to interest packets and data packets under pull semantics and general push packets (GPPkt) under push semantics.

[0147] The user uses the real identity information and MIN identity information to apply for digital passport authority from the digital customs of the country to which he belongs. The real identity information includes the real passport and biometric information, etc. The digital customs records the real identity information and MIN identity information of the user who holds the online passport authority.

[0148] Country A agrees with each other country on a 256-bit cross-state passport key CPK (Cross-State Passport Key). When a MIN network packet is sent from country A to country B, the digital customs of country A issues a "digital passport" for the MIN network packet in the following manner. The cross-state passport key CPK is preferably agreed upon in advance between country A and country B.

[0149] Specifically, in step S4 of the present embodiment, the digital passport Pass based on the multi-identity network is calculated by the formula Pass=SHA256 (Visa xor CPK), wherein CPK refers to a pre-agreed 256-bit transnational passport key.

[0150] In addition to the advantages and features of a multi-identity network, this embodiment of implementing a digital visa based on a multi-identity network also has the following advantages: First, since the calculation of the digital visa Visa is related to time, and the digital passport Pass is calculated based on the digital visa, the digital passport Pass is also related to time, and thus can also avoid replay attacks on the digital passport Pass. Second, the hash function is one-way, and the transnational passport key CPK is highly secure; the transnational passport key CPK is a private agreement made in advance between two countries, and therefore, it can prevent the digital passport Pass from being forged by other countries. Third, the digital passport Pass is calculated from the digital visa Visa, so the digital customs only needs to check the digital passport Pass, which is equivalent to checking the digital visa Visa at the same time, and thus can effectively reduce the workload and process of the digital customs and reduce unnecessary delays in the cross-border network.

[0151] When the digital customs receives the MIN network packet, it calculates the hash value of the user's legal digital passport Pass through the transnational passport key CPK and the digital visa key CVK, and verifies whether the hash value of the digital passport Pass is consistent. If the digital passport Pass is wrong, the MIN network packet will be discarded. MIN network packets include but are not limited to interest packets, data packets or GPPkt, etc.

[0152] Through the digital passport Pass, digital customs can ensure that all MIN network packets entering the country's cyberspace have been legally authorized by other countries. At the same time, digital customs can also deny some users access to foreign networks, such as denying access to users with a record of cyber attacks. The digital passport Pass based on a multi-identity network can help reduce cross-border cyber attacks and cybercrime, define clearer cyberspace boundaries, and ensure the credibility and security of cyberspace.

[0153] In step S5 of this embodiment, a digital passport is issued by a digital customs based on a multi-identity network. Digital customs is a multi-identity network router designed specifically for border management. Digital customs uses the Exit Border Table (EBT) to sign the digital passport Pass for the outbound MIN network packet. The Exit Border Table EBT stores some fields for each user, as shown in Table 1 below.

[0154] Table 1 Schematic diagram of storage fields of the outbound table EBT

[0155]

[0156]

[0157] Since the transnational passport key CPK is negotiated privately between countries, the hash values ​​of digital passports issued for different countries are different, so there are multiple exit tables EBT in the digital customs, and each exit table EBT corresponds to a target country. In the above table, Identity is the user's MIN identity. Passport holder shows whether the user's MIN network package can leave the country. LastVisa is the digital visa Visa in the user's previous MIN network package. LastPass is the digital passport Pass calculated based on LastVisa. LastTime is the time when the user's previous MIN package arrived, in binary format with the lowest 4 bits being 0.

[0158] When the digital customs forwards the outbound MIN network packet according to the query forwarding table (Forwarding Information Base, FIB), it first checks the target country of the MIN network packet, and then assigns the MIN network packet to the outbound table EBT of the corresponding country for processing. The process performed by the digital customs is represented by the following pseudo code, that is, the process of issuing a digital passport Pass in the digital customs through the MIN data packet.

[0159] Algorithm 1Sign the Cyberspace Passport for a MIN packet P

[0160] 1: id = P.ldentily

[0161] 2: if EBT[id].Passport[hold] = False then 3: Drop the Packet P

[0162] 4: return

[0163] 5: end if

[0164] 6: if EBT[id].LastVisa = P.Visa then 7: P.Pass = EBT[id].LastPass

[0165] 7: P.Pass = EBT[id].LastPass

[0166] 8: else

[0167] 9: if NowTime - EBT[id].LastTime < 8 then

[0168] 10: P.Pass = EBT[id].LastPass

[0169] 11: Send the Packet P

[0170] 12: SlowUpdateEBT(id, P.Visa)

[0171] 13: else

[0172] 14: FastUpdateEBT(id, P.Visa)

[0173] 15: P.Pass = EBT[id].LastPass

[0174] 16: Send the Packet P

[0175] 17: end if

[0176] 18: end if

[0177] 19: return

[0178] Digital Customs first discards the MIN network packet from users without exit permits. When the digital visa Visa carried in the MIN network packet is the same as the LastVisa in the exit table EBT entry, Digital Customs directly signs the digital passport Pass in the MIN network packet using the LastPass in the exit table EBT entry and forwards the MIN network packet. Based on such a design, this embodiment can effectively reduce the load and delay caused by calculating the digital passport Pass.

[0179] That is to say, in step S5 of this embodiment, the digital customs stores multiple exit tables, each of which corresponds to a target country; when the digital customs receives a multi-identification network packet forwarded by the forwarding table, it first checks the target country corresponding to the multi-identification network packet, and then assigns the multi-identification network packet to the exit table of the corresponding country for processing. The processing process includes the following sub-steps:

[0180] Step A1, the digital customs discards the multi-identification network packets of users without exit permit;

[0181] Step A2: When the digital visa Visa carried in the multi-identity network packet is the same as the LastVisa in the exit table, the digital customs directly signs the digital passport in the multi-identity network packet using the LastPass in the exit table and forwards the multi-identity network packet. LastVisa refers to the digital visa of the user's previous multi-identity network packet, and LastPass refers to the digital passport calculated based on the digital visa LastVisa of the user's previous multi-identity network packet.

[0182] Step A3, when the digital visa Visa carried in the multi-identity network packet is different from the LastVisa in the exit table entry, since the digital visa Visa calculated by the current time and the time 16 seconds ago in this embodiment are both valid, this embodiment determines whether the difference between the current time and LastTime is less than 8 seconds. If so (that is, the difference between the current time and LastTime is less than 8 seconds), the digital customs directly uses LastPass as the digital passport, fills the digital passport into the multi-identity network packet and forwards it immediately, so as to effectively reduce the delay caused by calculating the digital passport Pass. LastTime refers to the time when the user's last multi-identity network packet arrived; in addition, the digital customs already knows the user's latest digital visa Visa. The digital customs can use the latest digital visa Visa to calculate the new digital passport Pass after forwarding the MIN network packet, that is, use Slow Update EBT to minimize network delays and ensure the validity of the next issuance.

[0183] If not (that is, the difference between the current time and LastTime is greater than 8 seconds), if LastPass is used directly as the digital passport Pass of the MIN network packet, the digital passport Pass may have expired when the MIN network packet arrives at the foreign digital customs. Therefore, the new digital passport Pass must be calculated and updated immediately, that is, using Fast Update EBT, the digital customs calculates the new digital passport according to the current time, updates the exit table according to the new digital passport, and issues the new digital passport into the multi-identification network packet to avoid the situation where the legal digital passport Pass expires.

[0184] In step S6 of this embodiment, the digital customs in the multi-identity network performs visa verification of the digital passport. The digital customs uses the Arrival Border Table (ABT) to verify the digital visa and digital passport of the MIN network package from foreign countries. The Arrival Border Table ABT stores some fields of each foreign user, as shown in Table 2 below.

[0185] Table 2 Schematic diagram of storage fields of entry table ABT

[0186] Name Type Example Identity 256-bit 6c3c77b9...12fcb238 SrcDomain prefix / pku CVK 256-bit 77aae20b...5a85a2e1 Pass 256-bit 3c66abb1...cda1928c NextVisa 256-bit cc1c17a9...c8d139ad NextPass 256-bit d26a1fe8...7aa9178e LastTime 64-bit 0000000066225c30

[0187] There is only one entry table ABT in the digital customs. Among them, Identity is the user's MIN identity. The country the user comes from is SrcDomain. LastPass is a digital passport calculated based on LastTime. Pass is a digital passport calculated based on 16 seconds after LastTime. NextPass is a digital passport calculated based on 32 seconds after LastTime. When a MIN network packet is about to enter the network border, the process performed by the digital customs is represented by the following pseudo code, that is, the process of visa-verifying the digital passport Pass in the digital customs through the MIN data packet. Visa verification is also called verification processing.

[0188] Algorithm 2Check the entry of a MIN packet P

[0189] 1:id=P.Identily

[0190] 2:if ABTid.CVK=None and VisaWaiver(P)=False then

[0191] 3: Drop the Packet P

[0192] 4:return

[0193] 5:end if

[0194] 6:if ABTlid,.LastTime+32 <NowTime then

[0195] 7:FastUpdateABT(id)

[0196] 8:end if

[0197] 9:if ABTlid].LastPass / Pass / P.Pass then

[0198] 10: Drop the Packet

[0199] 11:return

[0200] 12:end if

[0201] 13:if P.type=Dala Packet then

[0202] 14:Forward the Packet P to PT

[0203] 15return

[0204] 16:else

[0205] 17:if P.type=Interest Packet then

[0206] 18:Forward the Packet P lo CS

[0207] 19:else

[0208] 20:Forward the Packet P to FlB

[0209] 21:end if

[0210] 22:end if

[0211] 23:return

[0212] Specifically, in step S6 of this embodiment, an entry table is used and maintained in the digital customs. When a multi-identification network packet is about to enter the network border, the digital customs performs verification processing through the entry table. The verification processing process includes the following sub-steps:

[0213] Step B1, if the sender does not hold a digital passport and is not in a visa-free situation, the multi-identification network packet is directly discarded by the digital customs;

[0214] Step B2, if the sender holds a digital passport, the validity of the digital passport is verified by the digital customs. If it is determined to be invalid, the digital customs discards the multi-identification network packet with the invalid digital passport; if it is determined to be valid, the digital passport corresponding to the multi-identification network packet and its digital visa are verified; the reason for such verification in this embodiment is that the digital passport is calculated based on the cyberspace visa. As long as the digital passport is legal, the digital visa must be legal, so there is no need to verify the digital visa separately.

[0215] It is worth noting that the entry table ABT of this embodiment has two updating modes, one is Slow Update ABT, namely, step C below; the other is Fast Update ABT, namely, step D below.

[0216] Specifically, the process of updating the entry table in step S6 of this embodiment includes any of the following steps:

[0217] Step C, Digital Customs traverses all entries in the entry table, calculates and updates the LastPass, Pass and NextPass fields at fixed intervals, where LastPass refers to the digital passport calculated based on the digital visa LastVisa of the user's last multi-identity network packet, Pass refers to the digital passport calculated based on the digital visa Visa calculated at a fixed time after LastTime, and NextPass refers to the digital passport calculated based on twice the fixed time after LastTime; the fixed time refers to the preset fixed update cycle, which defaults to 16 seconds; every 16 seconds at most, all entries in the entry table ABT will be updated once. Because it involves the calculation of digital visas and digital passports, it is called Slow UpdateABT;

[0218] Step D: When the digital customs receives the multi-identification network packet, it determines whether the LastPass in the entry table entry has expired. If so, it replaces LastPass with Pass and Pass with NextPass; if not, it returns. Since this update method does not require the calculation of digital visas and digital passports, it is called Fast Update ABT. Combining SlowUpdate ABT and Fast Update ABT, and selecting different update methods according to different situations, can significantly reduce the delay of digital customs verifying digital passports.

[0219] This embodiment adds two additional tables: the entry table ABT and the situation table EBT, which can complete the issuance of the digital passport Pass and the verification of the digital visa Visa and the digital passport Pass with almost no additional delay, and is suitable for serving tens of millions of users.

[0220] This embodiment also includes a mimicry defense step based on a weighted centrality algorithm.

[0221] In addition to user authentication, multi-identity addressing and other behavior management, digital passports and digital visa mechanisms, in terms of network environment security, this embodiment also preferably uses a weighted network centrality measure (WNCM) algorithm to sort the centrality and importance of network devices, and select the most important and influential devices for key protection. The centrality measure (NCM) algorithm is commonly used in the fields of graph theory and network analysis to identify the role of specific nodes in the graph and their impact on the network. In this embodiment, the algorithm is used to select nodes with emphasis to improve the efficiency of network protection based on user security needs when system resources are limited.

[0222] by Figure 6 Take the network topology shown in the figure as an example. Figure 6 In the network environment shown, in addition to external attackers, the intranet contains a total of seven devices that can be protected, including two border routers, three servers providing intranet forwarding services, and two servers providing storage functions. Use the centrality algorithm to compare them and select 2-3 of them to deploy key protection mechanisms. This embodiment selects three core indicators in the centrality algorithm series of indicators: degree centrality, closeness centrality, and between centrality.

[0223] Degree Centrality is used to describe the degree to which a node is connected to n-1 other nodes in a network with a total of n nodes. Closeness Centrality is used to describe the proximity of a node to other nodes and is related to the average length of the shortest path from each node to other nodes. Between Centrality is used to measure the extent to which a node can serve as an intermediary for information transmission between other nodes. It is described by the ratio of the number of times a node appears on the shortest path between any two other vertex pairs to the number of all shortest paths that exist for the vertex pair.

[0224] If the Between Centrality index of a node is relatively high, then the node can be considered to be a core member, playing a relatively important intermediary role, and can control the transmission of information to a greater extent and influence the group. Therefore, in the mimicry defense step of this embodiment, the indicators of each device in the multi-identity network are first obtained, and the indicators include point degree centrality, proximity centrality and betweenness centrality; after obtaining the above three indicators, each indicator is sorted separately as the score of the indicator, and then the scores of the three indicators are added (also called summation) to obtain the sum value sum, and the sum value sum is sorted to obtain the final centrality rank value Rank.

[0225] Rank' represents the weighted centrality level. According to the characteristics of the multi-identity network, this embodiment makes certain adjustments to the weights of each node. Because the storage server stores the core data of the network, the storage server is assigned the highest first weight, and its sum is divided by 3 to obtain a new sum sum'. The border router is responsible for connecting the internal and external networks, withstanding external attacks, and providing packet encapsulation and auditing functions. Therefore, the border router is assigned a medium second weight, and its sum is divided by 2 to obtain a new sum sum'; for the forwarding server, the lowest third weight is assigned, and its sum remains unchanged; the first weight is greater than the second weight, and the second weight is greater than the third weight.

[0226] The proportion of nodes that need to be protected is represented by δ. For example, if the system administrator sets δ=30% and selects two nodes for protection, then if the original Rank indicator is used, EMIR1 (i.e., border router) and forwarding server 2 will be protected; if the weighted Rank' indicator is used, storage server 1 and EMIR1 will be protected. The defender can adjust the weight and protection ratio δ according to system requirements.

[0227] The mimetic defense mechanism will be deployed on the nodes that need to be strengthened and protected as calculated by WNCM. The idea of ​​mimesis originates from the non-similar redundancy structure in the field of reliability. By constructing and reconfiguring the non-similar internal structure, the properties of the information system are transformed from isomorphic static to heterogeneous dynamic. Thereby forming an endogenous security effect, that is, the system has the security capability of generalized robust control without relying on prior knowledge or attack behavior characteristics. Therefore, a dynamic attack surface is presented to the attacker, which destroys the structure and effectiveness of the attack chain and increases the cost and difficulty of the attack. At the application layer, core devices such as firewalls, important routers and servers have solutions for deploying mimetic architectures. This embodiment combines mimesis with encoding and proposes a mimetic storage server.

[0228] The system of the mimetic storage server includes a client, a dynamic heterogeneous module, and an object storage module. The dynamic heterogeneous module also includes dynamic configuration management and heterogeneous function modules. The former is responsible for dynamically managing system configuration, including using pseudo-random methods to rotate erasure codes, so that attackers cannot determine the exact state of the system. The latter includes multiple heterogeneous executors, which are responsible for processing received requests. The results will be collected and determined by the redundancy voter in the dynamic configuration management module. When the output results of the erasure code decoding are inconsistent, the judge determines the correct result and performs subsequent operations such as alarms. In addition, the dynamic configuration management module randomly replaces the online heterogeneous executors with a probability ω every certain period T to prevent potential attackers from lurking in the system.

[0229] The heterogeneous executors of some mimetic storage systems are open source distributed file systems, such as HDFS, Ceph or Lustre, but the heterogeneity between different distributed file systems is limited. This embodiment achieves heterogeneity by using a variety of different erasure codes to encode file data. As a fault-tolerant redundancy technology, erasure codes are widely used in distributed storage systems due to their high performance, and have the advantages of high utilization and strong fault tolerance. (k,n) erasure codes divide the original data into k data blocks, and then encode to generate n (n>k) data blocks and store them in multiple distributed nodes. Its (k,n) characteristic means that any k' (k'≥k) slices after encoding can restore the original complete data. This embodiment preferably embeds a variety of different erasure codes in the system, such as BRS based on binary domain Reed Solomon code, MBR minimum bandwidth regeneration code, MSR minimum storage regeneration code, etc. Since the parameters of each encoding method are different, the size and number of the coded blocks obtained from the same data block are very different. This design can ensure the heterogeneity between executors and the dynamic nature of the network from the bottom layer.

[0230] Next, this embodiment will analyze the reliability and computational complexity achieved based on a multi-identity network.

[0231] The difference between the MIN network system and the IP network system adopted in this embodiment begins to manifest itself at the network layer. The transmission mechanism of the MIN network uses the CS table, PIT table and FIB table to forward data packets. This mechanism largely alleviates some flooding attacks of the IP system. The MIN network is based on identity identification for routing, and it will sign and verify each data packet in the network. These mechanisms ensure the security of the network layer and largely solve the problem of data packet spoofing and tampering that often occurs in the IP network system.

[0232] MIN not only has high security at the network layer, but also can resist and mitigate some IP-based attack methods at the transport layer and application layer. In the MIN network, there is no longer the concept of ports under IP, but instead the LogicalFace network interface. Therefore, network scanning that is common under IP networks is not feasible in the MIN network. And because the MIN network itself is a network based on identity identification and identity authentication, it can more easily implement a secure transmission channel. The user identification in the MIN network contains a lot of information, such as the device used by the user and the user's certificate, etc. At the same time, this information will be locked in the blockchain of the MIN network system and managed by the Multi-Identifier System (MIS). Identity-based management makes it impossible for many network attacks to play a good effect in the MIN network, such as identity theft, account blasting, and unauthorized access / operation. Figure 7 Shown is the hierarchical security scheme of the MIN.

[0233] First, at the bottom layer of the network, the MIN system is designed with multiple identities coexisting and routing solutions centered on real identities to ensure the independence, manageability and controllability of the network, which provides architectural security. This routing solution has embedded underlying identity authentication and packet signatures, allowing MIN to track the source of each packet, ensure that network content can be held accountable, and guarantee the trustworthiness of the identities of entities entering the network. In response to unknown vulnerability threats, MIN proposes a weighted centrality algorithm WNCM to find important nodes in the network, deploy mimicry defense to build an endogenous security system, and ensure data security and service reliability.

[0234] In terms of reliability, this embodiment compares the reliability of the network under four important node selection strategies: WNCM, NCM, random strategy and exhaustive strategy. The exhaustive solution refers to traversing all the available solutions, comparing their anti-attack performance, and selecting the best solution.

[0235] by Figure 6 Take the network topology shown as an example, an external network user wants to access the data stored in storage server 1 and storage server 2 through the MIN network. Through testing, when the above four algorithms are used to select the same proportion of nodes to deploy mimicry defense, when other nodes fail randomly, the probability of user failure to obtain data, that is, access failure. The following Tables 3 and 4 describe the probability of user access failure p when 30% and 40% of the nodes in the MIN network fail randomly under the four selection strategies. f Table 5 describes the user access failure probability p under different failure ratios when the protection ratio δ = 30%. f .

[0236] Table 3 Random failure of 30% of nodes

[0237]

[0238] Table 4 Random failure of 40% of nodes

[0239]

[0240]

[0241] Table 5 Probability of user access failure

[0242]

[0243] From Tables 3 to 5, we can see that the overall rule is that the effect of WNCM is the same as that of the exhaustive scheme, and both are better than NCM and the random scheme. The defensive effects of WNCM and NCM increase linearly with the increase of the protection ratio. Figure 6 In the network topology, when the protection ratio reaches 40%, that is, when 3 nodes are protected, both have constructed a complete information propagation chain and can resist the failure of other nodes. The anti-attack ability of the random scheme does not change with the increase of the protection ratio, because its node protection and node failure are independent random strategies. According to the conditional probability formula and the total probability formula, when the random protection strategy is adopted, the average access failure probability is only related to the number of failed nodes, and has nothing to do with the defender's choice of a few key protection nodes.

[0244] Only when the network fails randomly by 30% and only one key node is selected for protection (i.e., the first column of Table 3), the failure probability of the NCM scheme is higher than that of the random scheme. This is because both the WNCM and NCM schemes are different from the exhaustive schemes that can definitely provide the optimal solution. The centrality algorithm selects common relatively important nodes based on multiple indicators, which is not necessarily the optimal solution in every scenario. In this scenario, the NCM scheme tends to protect important central nodes. But in Figure 6 In the example, according to the exhaustive method, the optimal strategy should be to select four end nodes for protection, which is the reason why the failure probability of the NCM scheme is higher than that of the random scheme. As can be seen from the data in the above three tables, the weighted scheme WNCM in the multi-identity network adjusts the weights of different devices according to the characteristics of the MIN network, and its calculation results are very close to the optimal strategy. In terms of computational complexity, the exhaustive scheme can guarantee the optimal protection strategy, but its computational overhead increases exponentially with the increase of the network scale. Both the WNCM and NCM schemes have polynomial complexity. In short, WNCM can provide a node selection strategy that is quite close to the optimal solution with lower computational complexity at the same protection ratio, that is, the defense cost.

[0245] Therefore, it is obvious that the overall technical solution of this embodiment implemented based on a multi-identity network has strong security and reliability, and can achieve better effects and strategies with lower computational complexity.

[0246] This embodiment also preferably includes the step of establishing a random process martingale quantization model, aiming to provide a random process martingale quantization model that is resistant to attacks.

[0247] Active Cyber ​​Defense (ACD) is a new type of network defense technology that has emerged in recent years. It continuously changes the exploitable attack surface by spontaneously and randomly reconfiguring the network environment. The dynamic nature of active defense reverses the unequal situation of attack and defense in traditional static networks, and provides defenders with tactical advantages in the game of attack and defense.

[0248] This embodiment establishes a complete model for the complete attack and defense process of a complex active defense network, which is named SPM, and uses it to evaluate the security of the active defense network and the interaction of multiple defense technologies. SPM consists of three layers, integrating random return networks, Poisson processes, Markov chains, and martingale theory. The hierarchical analysis structure brings greater flexibility. The three-layer analysis model can be combined to analyze the security of the complete network, or each layer can be used independently to evaluate the effectiveness of the corresponding single ACD (active defense) technology.

[0249] The stochastic process martingale quantization model is generally composed of three interconnected sub-models. At the bottom layer, an SRN model is established to evaluate the effectiveness of NVP technology to ensure the security of a single node, and at the top layer, a Markov and martingale model is established to analyze the effectiveness of VM migration (i.e., virtual machine migration). The two layers of models are connected by a Poisson model as an intermediate layer.

[0250] That is, this embodiment establishes a single-step attack evaluation model based on the deep learning neural network SRN in the bottom model; a discrete-time Markov chain model and a martingale model are established in the top model, and the formula Calculate the average attack time MTTA of the network and use the formula Calculate the average repair time MTTR of the network, where L represents the number of protected devices that the attacker passes through when reaching the target node, T represents the migration period, ω represents the probability of dynamic migration, and e -TrpA It represents the probability of attack failure within a migration cycle. The Poisson model is used as the middle layer to connect the bottom model and the top model.

[0251] It is worth noting that although the bottom SRN model in the above three-layer model can essentially be isomorphic to a Markov process, this layer of modeling has no direct relationship with the Markov chain at the top level of the SPM model. The SRN model targets the internal structure of the node, and its steady-state distribution describes the distribution of possible results of attacking the active defense node at one time. The top-level Markov model describes the change in the attacker's position on the attack chain, and its steady-state describes the total number of breached nodes in the attack chain, that is, the distribution of possible positions of the attacker. Each of the three-layer models focuses on one attack stage, and the output of the lower layer is used as the input of the upper layer. The SRN, Poisson process, Markov and martingale evaluation methods are selected according to the characteristics of the NVP and VM migration defense processes. The reasons for selecting the corresponding modeling method for each layer are given below.

[0252] First, for the single-step attack process of a single active defense node, we focus on analyzing the detailed attack and defense process inside the node after the NVP technology is used to protect it. The attack and defense process of a single node includes many detailed behaviors and interactions between the attacker and the defender. These detailed interactive behaviors increase the difficulty of describing it with other more mathematical methods such as Markov or probabilistic methods. Therefore, for this process, we choose a modeling scheme based on SRN, and establish a single-step attack evaluation model based on SRN to characterize the single attack process within a single node, while giving quantitative calculation results and graphical expressions. At this level, the defense capability is quantitatively measured by the success rate of a single-step attack.

[0253] Then, during multiple migrations, the attacker's repeated attacks on a single node are memoryless. The Poisson distribution is the most suitable random distribution type for simulating the time when critical, memoryless events occur. Therefore, this embodiment uses the Poisson distribution to describe the number of attacks during each migration period.

[0254] Finally, it is necessary to analyze the movement of the attacker's position on the entire attack chain under the VM migration strategy, that is, the change in the position of the attacker's attack node in each migration cycle. Compared with the previous migration cycle, the attacker's position change on the attack chain has three possible movement directions: attacking the next node, returning to the previous node, or staying at the same node. During the entire attacker's movement on the attack chain, no matter how the attacker reaches the current position, the position in the next migration cycle depends only on his current position and the transfer probability in different directions. This presents a Markov feature. Therefore, in the third layer of SPM, a homogeneous discrete-time Markov chain (DTMC) is constructed to describe this process. The DTMC model can calculate the steady-state probability of failure of the target node and lays the foundation for the use of the martingale theory. The martingale model further established on this basis can calculate the failure time and repair time of the entire network.

[0255] Attack chain Figure 8 As shown in Figure 2. Assume that the attacker has invaded k nodes. Next, the expected time for the attacker to move to the next L nodes (i.e., node k+L) or return to the first L nodes (i.e., node kL) is calculated using the martingale theory. L represents the number of protected devices that the attacker passes through when arriving at the target node.

[0256] Here, this embodiment first introduces the concept of martingale:

[0257] Definition 1: Random process Z n , n ≥ 1 is a martingale process if: for all n, E[|Z n |]<∞, and E[Z n+1 |Z1,Z2,…,Z n ]=Z n . n is a natural number, representing the sequence number of the random variable Z.

[0258] When the attacker is located at node k at the beginning of the nth reconfiguration cycle, the attack state can be inferred as follows in the next migration cycle: P{X n+1 =k+1|X n =k} ​​= (1-ω)μ, P{X n+1 = k | X n =k} ​​= (1-ω)(1-μ) and P{X n+1 =k-1|X n =k}=ω. P{*|*} represents the probability of the attack state occurring, k represents the node number, X n represents a random variable, ω represents the probability of dynamic migration, and μ represents the probability of successfully attacking a single node.

[0259] Therefore, we can get E[X n+1 ∣X n = k] = k + (1-ω) μ - ω = X n +(1-ω)μ-ω. E[X n+1 ∣X n =k] indicates that given X n =k next X n+1 conditional expectation.

[0260] Next we build the Martingale sequence.

[0261] Theorem 1: Let random variables M0, M1, …, M n , where M i =X i -[(1-ω)μ-ω]·i, then the sequence M n is about X0,X1,…,X n The martingale sequence of . i is the sequence number, i∈0~n.

[0262] The proof formula is as follows:

[0263] After establishing the martingale sequence, in order to calculate the attack time, you need to define the stopping time first.

[0264] Definition 2: A positive integer random variable N that may take infinite value is a pair process {Z n ,N≥1}, if the event N=n is represented by random variables Z1,…,Z n Determine, that is, know Z1,…,Z n We know whether N = n. If P{N<∞} = 1, then the random time N is called a stop time.

[0265] The relative strength of offensive and defensive capabilities will affect the attacker's overall movement direction in the attack chain. For example, if the offensive capability ((1-ω)μ) is stronger than the defensive capability (ω), the attacker can get closer to the target over time; otherwise, the attacker will be affected by VM migration and lose the privileges he has obtained, which is equivalent to being gradually cleared out of the system. This means that when E[X n+1 ∣X n ]>X n , that is, when ω<μ / (μ+1), the time to approach the target node L hops along the attack chain tends to be positive. On the contrary, when E[X n+1 ∣X n ] <X n, that is, when ω > μ / (μ + 1), the probability of moving to the next node is less than the probability of the attacker returning to the previous node. The VM migration causes the attacker to gradually lose the obtained illegal privileges. At this time, the time to reach the L-th node in the direction of the target node shows a negative trend. Objectively, time can only be positive. In this case, discussing the negative time of the downward L-hop loses meaning, but the time of the upward L-hop can be calculated similarly. Therefore, according to the relative size relationship between ω and μ / (μ + 1), the time to reach different specific nodes for the first time in the corresponding scenario can be analyzed.

[0266] When ω < μ / (μ + 1), at this time, the attack starts from the entrance, that is, its initial position is A0 = 0.

[0267] Definition 3: When ω < μ / (μ + 1), the stopping time S of the martingale sequence is the minimum i value such that: E[X i = L. To derive the number of steps for the attacker to reach the target node by moving downward L hops along the attack chain, the martingale stopping time theorem, that is, Lemma 1, is introduced. The proof process is as follows.

[0268] Lemma 1: S is the stopping time of the martingale sequence {Z n , n ≥ 1}, and satisfies any one of the following conditions: The stopped process Z n is uniformly bounded, or S is bounded, or E[S] ≤ ∞, and there exists an M ≤ ∞ such that E[|Z n+1 - Z n ||Z1,…,Z n |] < M, then E[Z S = E[Z0].

[0269] Theorem 2: For an ACD attack and defense process, with a probability of μ for the attacker to successfully attack a single node, and each node being migrated and reconfigured with a probability of ω every T time. If there are L nodes forming an attack chain and the attacker wins, that is, the expected number of migration cycles to reach the target node L is: T represents the time interval period.

[0270] Proof: When (1 - ω)μ > ω, the condition for the stopping time S is X S = L. At this time, the time to reach the L-th node tends to be positive. After n rounds of migration, it can be judged whether n and S are equal according to the attacker's position. So the moment S is the stopping time of the martingale. Next, verify the third condition of Lemma 1, and prove that it can be used by the following formula:

[0271] So the expected number of steps to reach node L can be calculated according to Lemma 1: E[M S = E[M0] = E[X0] = 0. E[M S = E[X S-[(1-ω)μ-ω]·S]=E[X S ]-[(1-ω)μ-ω]·E[S]=0.

[0272] And because E[X S ]=L, so L-[(1-ω)μ-ω]·E[S]=0,

[0273] When ω=μ / (μ+1), the attacker's probability of going down is equal to the probability of going up, the Markov state obeys the uniform distribution, and the attacker's position remains stable over time, that is, E[X n+1 |X n ]=X n . So the time it takes for him to reach any other node tends to positive infinity.

[0274] When ω>μ / (μ+1), the expected time to reach the next L nodes tends to be negative and has no practical significance. However, in this case, as time goes by, the attacker will gradually move away from the target and be pushed out of the network. Then the expected time required to expel the attacker can be calculated. The expulsion time reflects the network's ability to self-repair (remove the attacker) from the worst case (more than L nodes are compromised).

[0275] In this case, it is assumed that the attack is successful at the beginning, that is, X′0=L. i ′ indicates that i The same distribution, but the initial position of the attacker represented by the two is different, X i ′Start from node L instead of X0=0. The attacker’s position at the beginning of the i-th migration cycle is represented by the random variable X i Next, we analyze the expected time to expel the attacker back to L nodes, that is, to return to the attack entrance.

[0276] Definition 4: When ω ≥ μ / (μ+1), the stopping time S' of the martingale sequence is the minimum i value such that: E[X i '] = 0. The condition for reaching the stop time is X' S′ = 0. The corresponding sequence M i ′=X i ′-[(1-ω)μ-ω]·i is still about X′0,X i ′,…,X′ n In this case, the different size relationship between (1-ω)μ and ω only affects the subjective choice of stopping time, and does not affect the objective existence of X n Sequence and M n Sequence.X i ′ and M i ′ can be regarded as X starting from other nodesi and M i sequence.

[0277] Theorem 3: For an ACD attack and defense process, there is a probability μ that a single node is successfully attacked. Every T time, each node is migrated and reconfigured with probability ω. When the attacker has conquered L nodes, the expected number of migration cycles to drive the attacker back to the entry node is:

[0278] Proof: Similar to the proof process when (1-ω)ω>μ, time S′ is the stopping time of the martingale and satisfies the availability conditions of Lemma 1.

[0279] According to Lemma 1, the number of migration cycles of the repair network satisfies: E[M′ S′ ]=E[M′0]=E[X′0]=L.

[0280] Then, according to Lemma 1 and E[M′ S′ ]=0, the number of migration cycles of the repair network can be obtained: E[M′ S′ ]=E[X′ S′ ]-[(1-ω)μ-ω]·E[S′]=L,

[0281] Corollary 1: For the ACD attack and defense process, where μ is the probability of a single node being hacked and ω is the probability of a node being migrated within each period T, the time expectation for the attacker to go down or up L nodes along the attack chain is:

[0282] According to the above analysis, when attackers and defenders compete with each other at different relative strengths, attackers may gradually approach the target or lose the obtained permissions and be removed from the system over time. Therefore, different defense strengths can be provided according to different scenarios to achieve the corresponding defense goals. First, two scenarios are defined: (1) Ordinary defense scenario: daily defense without detecting the attacker, defenders tend to use lower defense costs in exchange for a certain level of security. Attackers can approach the target, and the mean time to attack (MTTA) is used to evaluate the system's anti-attack capability. (2) Crisis scenario defense: the system may have detected the existence of the attacker or have higher security protection requirements. At this time, the defender is willing to exchange a higher level of security for a more expensive defense cost. More frequent and large-scale VM migration operations will make it difficult for attackers to approach the target, and they will gradually lose illegal privileges. At this time, the mean time to repair (MTTR) is used as an evaluation indicator of anti-attack capability.

[0283] Given the system parameters L, ω, T, r and pA In this case, MTTA and MTTR can be calculated as follows: and Among them, r represents the attack rate of the system, p A Indicates the success rate of a single-step attack.

[0284] Next, this embodiment will analyze the security and computational complexity achieved based on a multi-identity network.

[0285] Since MIN is built with identity identification as the core network, the system itself has better protection effect. The identity identification as the core network of this embodiment is completely different from the data transmission mode of the existing IP network, so the attack against the IP network loses the operating environment in MIN and cannot be effectively launched. MIN filters the access information at the border router EMIR, and only the request content actively initiated in the multi-identity network can pass the EMIR. In other words, the attacker cannot continuously scan and attack the system like in an ordinary passive defense network, and it is even difficult to actively send malicious information into the MIN.

[0286] MIN users must be authenticated by real name, and they need to sign when pulling data from the network. For data requested by MIN internal users, the content and requester are recorded by the blockchain. Once a problem occurs, the problem can be traced back and held accountable immediately, thus ensuring the authenticity and reliability of the information, and to a certain extent avoiding malicious operations by internal network users.

[0287] Fig. 9 The first layer of security protection mainly relies on cryptography and identity authentication and other security mechanisms. The difficulty of attacking existing encryption algorithms has reached an exponential level. Taking the commonly used RSA algorithm as an example, it would take decades to crack it using the current highest performance supercomputer.

[0288] The difficulty of cracking the RSA algorithm is related to the length of the key. The complexity of brute force attack on the RSA algorithm with a public key of e and a modulus of n is O(n e ). The most common cracking method is factorization. If the key length is less than or equal to 256 bits, it can be successfully factored by a high-speed computer within one day. The higher the number of bits, the longer the factorization time is. With current computing power, it takes at least two years to crack a 1024-bit key, and at least 80 years to crack a 2048-bit key. Assuming the cracking time is 50 years, the calculated attack success rate per second is 6.34×10 -10 .

[0289] The nodes that the attacker needs to break through from the MIN's EMIR to the content request node and from the content request node to the core network constitute the attack chain. The attack process at this stage is mainly the spread of malicious information on the attack chain within the MIN, which can be regarded as the movement of malicious information on the attack chain.

[0290] After the content is transmitted to MIN, in addition to the firewall, packet detection, text recognition detection, audio recognition detection, image and video recognition detection, and natural language processing between EMIR and the core network, the attacker needs to break through each layer of protection to reach the target of attack. If the attacker wants to attack the core network along the attack chain, the attacker needs to attack each review node on the link in turn. The attacker advances along the attack chain, and each time he successfully passes a layer of filtering, he moves down the attack chain one step; if he is captured by the filtering means, he moves back one step along the attack chain; if the attack is neither successful nor captured, he stays at this node.

[0291] Let μ be the probability of attacking a single node successfully (i.e., breaking through a layer of filtering), θ be the total number of nodes in the attack chain, and ω be the probability that the system selects the node for dynamic migration (i.e., selects a node to clean it thoroughly and re-filters the filtered content). Assuming that the attacker currently stays at the kth node, i.e., has broken through k nodes, then the attack transfer process is as follows: Fig.10 shown.

[0292] According to the attack transfer graph, construct an attack transfer matrix M θ×θ , element M i,j represents the probability of transferring from the i-th node to the j-th node. During the attack, the attacker moves along the link. After conquering a node, the attacker will obtain the information of the successor node. During the attack, only when the attacked node and the attack starting point are not selected for migration, the single-node attack can succeed. Obviously, the attack has three directions: retreat, downward, and stay where you are. The specific transfer probabilities are as follows.

[0293] (1) Rollback. Regardless of whether the attacker launches an attack or not, as long as the system changes the attacker's node or the target node being attacked during dynamic migration, the attack will not be able to proceed, and the attacker must roll back to the previous node that has been attacked, that is, M. i,i-1 =ω. The attacker needs to re-attack point i as a single node. Only if point i is captured before the next dynamic migration can the attacker continue the downward attack.

[0294] (2) Downward. The probability that the attacker successfully attacks the next node is μ. During the transformation period, the probability that the system does not dynamically migrate the attack-related nodes is (1-ω). Therefore, the probability that the attacker successfully attacks the next node and no dynamic migration occurs during the period is M. i,i+1=(1-ω)μ.

[0295] (3) Stay still. The attacker fails to attack the next node, and the system does not dynamically migrate the relevant nodes. At this time, the state of the system remains unchanged, and there is M i,i =(1-ω)(1-μ). Let X0, X1, X2,…,X n represents a string of random variables, X i represents the node position of the attacker at the beginning of the i-th time period, X i The value range of is [0, θ], where X0 = 0, indicating that the initial position of the attack is the position entering the attack chain. It is known that the attacker is at position k at time n, then the position of the next hop is: P{X n+1 =k+1|X n =k} ​​= (1-ω)μ, P{X n+1 =k|X n =k} ​​= (1-ω)(1-μ) and P{X n+1 =k-1|X n =k}=ω.

[0296] According to Theorem 2, E[S] is the expected number of steps to reach the core network, which can be calculated using θ, ω, and μ. In this way, the quantitative relationship between the limit probability of defeating the system and the system parameters can be obtained. Θ represents the number of nodes in the attack chain.

[0297] Furthermore, this embodiment also preferably adopts the adaptive network defense architecture (AND) to improve the network's anti-attack capability. The core idea of ​​the AND architecture is to integrate network security defense tools to form a dynamic, adaptive network defense system that can quickly adapt and effectively defend against new attacks on the network.

[0298] The AND architecture consists of the following four parts:

[0299] Attack detection layer: responsible for monitoring attack behaviors in the network. This layer usually includes tools such as intrusion detection systems, threat intelligence analysis, and behavior analysis systems. These tools can detect potential attack behaviors by analyzing network traffic, logs, and other data sources.

[0300] Attack response layer: Responsible for responding to detected attacks. This layer usually includes tools such as intrusion prevention systems, anti-virus software, and anti-spyware software. These tools can take corresponding defensive measures based on detected attacks, such as blocking attack traffic or removing malware.

[0301] Collaboration layer: responsible for coordinating the interaction between the attack detection layer and the attack response layer. This layer usually includes tools such as the network security intelligence sharing platform and adaptive security management and control. These tools can help the attack detection layer and the attack response layer to achieve rapid information sharing and response.

[0302] Operation management layer: responsible for managing the operation of the entire AND system. This layer usually includes tools such as network security information and event management system, security analysis and decision support system, and security policy and compliance management system. These tools can help administrators monitor the security status of the network and formulate corresponding security policies and compliance management measures.

[0303] This embodiment is uniformly designed at the technical level and implemented through a multi-identity network; based on a multi-identity architecture, it can adopt current and future technologies that can each improve security gains, so that the probability of network nodes and their applications being defeated by an attack can be theoretically arbitrarily small (related to the cost willing to invest), such as 10 -15 ; 10 -20 ; 10 -25 ,10 -30 At the system management level, relying on the system's continuous perception and security response, users can be reminded of possible dangers in their accounts or devices through email, text messages, and phone calls, and proactively respond to various attacks from online to offline to prevent them from happening. When a low-probability attack occurs, it can also be traced in time, and risks in physical systems and software can be checked. The source can be accurately located, and relevant system configurations or software can be rectified, so that the same attack can be effectively prevented.

[0304] This embodiment also preferably provides an adaptive defense network architecture such as Fig.11 As shown in the figure: the NVP concept is used to improve the security of a single node in the lower layer of the network; VM migration is used to bring dynamics to the network in the upper layer of the network. In the figure, each network node consists of a resource management system (RMS) and multiple heterogeneous executors, also known as heterogeneous service component versions (SCV). Each resource management system is responsible for communicating with other RMSs from different nodes and managing multiple SCVs within the node. The network can be a two-layer structure. The upper network represents the RMS, that is, the connection relationship between different nodes, and the lower network represents the internal structure of each node, that is, the connection relationship between the RMS and the internal SCV.

[0305] The NVP concept is applied to the bottom-level nodes, assigning the received tasks to multiple different SCVs for parallel execution; VM migration is applied to the upper layer of the network, and some nodes are periodically reconstructed.

[0306] Using the idea of ​​NVP to enhance security, tasks are assigned to multiple heterogeneous executors for execution. The heterogeneity between executors can be heterogeneous at various levels such as operating system, software, data format, etc. The requirements and tasks received by the node will be delivered to executors with equivalent functions but different structures or versions for parallel execution. Then the output results of these executors will be returned to RMS, which will be judged according to the pre-set voting rules and the final results will be returned to the user. The voting rules can be selected according to the needs of the system, such as threshold voting, and the output threshold is recorded as M′.

[0307] When a node receives a request or task from a user, RMS will assign them to N′ online SCVs, denoted as SCV1, SCV2, …, SCV N′ Wait until enough result vectors are collected or all SCVs have completed output. Among the collected results, identical vectors that appear equal to or more than M′ are considered correct vectors and output to the user. SCVs that return other results, that is, SCVs that are not identified as correct results, will be marked as suspicious SCVs. In the next round of task allocation, they will be replaced by the backup SCV of this node. This can prevent the attack from spreading within the node. If all SCVs have completed the task and the number of identical results is less than M′, that is, no legal results are output, then RMS will return an error message to prompt the node to perform subsequent processing. In order to avoid the existence of multiple result vectors reaching the threshold at the same time, M′>N′ / 2 is generally taken.

[0308] In terms of virtual machine migration, in the adaptive defense network architecture, within each fixed migration period T, each node is selected as a migration object with a probability of ω and randomly migrated. For nodes that need to be migrated, the corresponding RMS will be migrated to a new physical host, the old virtual machine will be removed, and then the current state of the application and related data and services will be migrated to the new VM. Virtual machine migration will invalidate the information collected and monitored by the attacker and the backdoors that have been installed, making the attack time one of the important constraints for the success of the attack. Through this mechanism, the spread of attacks in the network can be effectively prevented.

[0309] The development of cloud computing provides users with flexible and efficient services, and resources can be allocated and shared on demand. However, this makes it possible for users to share some resources with malicious users, which brings additional security risks. Active defense provides a solution to resist cohabitation attacks from the perspective of reducing cohabitation time through dynamic migration. Cloud computing allows multiple users to use various services on demand, such as storage, computing, and applications. The tasks of the same user can be performed by creating and hosting multiple virtual machines on different physical servers. This virtualization method improves the utilization rate of the underlying hardware platform of the cloud provider and outsources the maintenance of computing resources to users. However, since cloud users need to share IT resources such as physical servers with other tenants, they also face new security risks. Although multiple virtual machines running on the same server are logically isolated from each other, malicious tenants can bypass isolation by creating various side channels. Then when the attack VM of the malicious neighbor resides on the same physical server as the target VM, data may be stolen or even destroyed.

[0310] There are already some defense works to solve this problem by eliminating or detecting side channels, such as eliminating side channels, co-habitation attack detection, building virtual private clouds, adjusting VM allocation strategies, NVP-based defense solutions, etc. However, most defense methods either require changes to existing deployments or are specifically targeted at certain known cross-VM side channel attacks.

[0311] Active defense technology has proposed solutions from different angles to reduce the coexistence time by randomly moving the target to be protected during the execution of the task. In addition, an important advantage of active defense is that it can be used in conjunction with other defense methods without changing the underlying deployment. For example, VM migration and VM allocation strategies can be superimposed, and appropriate VM selection strategies can be used at each migration to further reduce the success rate of attacks. When these technologies are deployed in cloud environments, their effectiveness needs to be proven, especially when these technologies are combined with other defense strategies of the cloud environment itself. However, current analysis and research on their effectiveness either focuses on evaluating the effectiveness of active defense itself or on studying the effectiveness of other static strategies of cloud computing.

[0312] In the selected cloud computing scenario, there are two types of VM placement that need to be considered. The first is initial placement, which is to create VMs for new service requests and assign them to a server. The second is VM placement after dynamic migration, which requires selecting a suitable server for the VM to be migrated according to the migration and allocation rules at each migration. The following introduces the VM migration, allocation strategy, and attack and defense process in turn.

[0313] Fig.12The virtualization system of the cloud computing platform is presented. The system consists of a management node and multiple servers. Whenever a new task is received, the system will create a corresponding virtual machine and assign it to a physical server. The management node is responsible for creating virtual machines, collecting information about each server, and assigning virtual machines to specific servers according to the allocation strategy. If the management node receives n′ tasks sent by users and m requests with malware sent by attackers, it is difficult for the management node to distinguish them. Therefore, corresponding virtual machines will be created for the same batch of requests to process the tasks. The management node will create n′ defender's VM (DVM) and m attacker's VM (AVM) and assign them to s physical servers together. When a task is executed on a server, it may coexist with the AVM, during which the attacker will try to establish a side channel to steal information. To avoid the risk of such information leakage, the management node will dynamically migrate its DVM between servers during task execution.

[0314] In terms of virtual machine allocation, existing strategies can be divided into the following two categories: stacking and dispersion. The stacking strategy concentrates the created virtual machines on some physical servers to reduce the total power consumption of the server cluster. Commonly used stacking strategies include priority fit, workload stacking, energy / cost consumption strategy and their variants. The dispersion strategy is to distribute virtual machines discretely throughout the data center to achieve load balancing and improve system reliability. Commonly used dispersion strategies include random, next match, load balancing strategy and their variants.

[0315] Consider a multi-tasking scenario, where the system may be assigned multiple tasks at the same time, and they are executed independently in the system. Each task that enters the system may have two results when leaving: one is to successfully migrate between several servers and eventually be executed; or to coexist with the attacker during the migration process and have information stolen, resulting in task execution failure. Fig.13 Describes the execution process of each task before leaving the system.

[0316] More specifically, this embodiment adopts an adaptive defense network architecture, and the execution process of each task before leaving the virtualization system includes the following steps:

[0317] Step E1, the management node receives a request from the user and creates a VM, i.e., a virtual machine;

[0318] Step E2, allocate the VM to a server according to the allocation strategy; if the selected server has enough space, jump to step E3; otherwise, return to reselect a server;

[0319] Step E3: After selecting a suitable server, the VM will stay on that server.server time; during the stay, if the VM cohabits with the attacker for longer than the time t required to establish the side channel attack , then the DVM will be attacked and cause information leakage; if the corresponding attack obtains some confidential information of the DVM, the attack is considered successful; if the DVM is successfully destroyed, the corresponding task will fail immediately; if the attack is not successful, jump to step E4;

[0320] Step E4, if the DVM is not effectively attacked before the migration is required, the execution on the server is successfully completed. Preferably, at this time, it is further determined whether the task has been completed. If not, jump to step E2 and select the next server for VM migration until the task is completed or failed due to an attack.

[0321] In this process, the task execution time T task and the migration interval T server is random. The task execution time follows a certain distribution, and its cumulative distribution function cdf is denoted by F ta (t), the probability density function pdf is denoted as F ta (t). Similarly, the migration interval follows cdf = F m (t) and pdf = F m The distribution of (t).

[0322] In order to increase the probability of successful attack, the attacker may inject multiple malicious requests into the system to generate multiple AVMs. After entering the system, the malicious AVMs migrate between multiple servers along with the normal DVMs until all tasks leave the system.

[0323] When starting AVMs, attackers also have two corresponding strategies: stacking strategy and dispersion strategy. The stacking strategy is to start as many virtual machines as possible at one time, while the dispersion strategy is to start virtual machines in batches and try to spread the created virtual machines to as many servers as possible. Fig.14 The process of generating AVM, migrating, and launching attacks for each malicious request is shown, which includes the following steps:

[0324] Step F1, similar to the creation process of the DVM in step E1, in step F1, the management node creates an AVM after receiving the request and assigns it to find a legitimate server;

[0325] In step F2, the attacker obtains information from the legitimate server. If there is a co-resident DVM, then proceed to step F3; if there is no co-resident DVM, then wait for the managed node to migrate to other servers.

[0326] Step F3: The attacker selects one of the DVMs to attack, which takes time tattack After that, the side channel is successfully established. During this period, if the DVM is not migrated, the attack is successful and the task executed in the DVM fails. Otherwise, the DVM avoids the attack and the attack fails.

[0327] Regardless of whether the attack is successful or not, the attacker can continue to attack the tasks that are still being executed in the system. That is, wait for the management node to migrate them to other servers at a fixed migration cycle. After being migrated, the attacker returns to step F1 to continue the attack. If all tasks have left the system, then the attack is meaningless and stops.

[0328] Time required for attack attack Contains the time required to build a side channel and steal data, which is also a random variable and follows cdf = F m (t) and pdf = F m The distribution of (t).

[0329] Therefore, this embodiment can be based on the future network architecture composed of the MIN system, support the top-level identification to be jointly managed by various countries to support interconnection, and the lower-level identification to be independently managed by various countries, and use digital customs to ensure cross-border data security. In addition, it also adopts mimetic defense, martingale quantization model, adaptive defense network architecture, high-performance blockchain, quantum technology, embedded identity authentication, multi-identity coexistence, digital passports and digital visas and other technical features to form an overall technical solution. On this basis, it can combine the management of each subject system, and the internal and global international legal arbitration system of each country to propose a method and system to ensure the trustworthiness, security, order, rule of law and peace of cyberspace.

[0330] Mathematical model analysis shows that the future network realized by multi-identity network can be 10 times more efficient than the traditional IP network. 20 -30 The exponential security improvement makes the probability of insecurity very small. Even if an attack occurs, the identity and behavior log of the active attacker will be recorded and locked in the blockchain log managed by the global multilateral co-operation. The attacked party can sue in the cyberspace court of the international cyber court or the domestic cyber court. The domestic / international cyber court will judge the attacker's attack behavior based on the tamper-proof log records. By combining online and offline through technology, it can ensure that the cyberspace supported by rules, laws and technical systems is safe and reliable, and the cyberspace can maintain order and rule of law on the basis of technical solutions.

[0331] Therefore, in order to provide a method and system to ensure that the cyberspace is trustworthy and secure, Figure 2 and Fig.15As shown, this embodiment also preferably includes step S7, which is used to establish a cyberspace management system; perform AI detection management in the cyberspace management system, and when the cyberspace is disturbed or attacked, monitor and analyze network traffic, user behavior and system logs through at least one of data analysis, deep learning, reinforcement learning and model training, and store them in blockchain log records.

[0332] More specifically, the cyberspace management system described in this embodiment is also called a cyberspace security, peace and rule of law management system.

[0333] Cyberspace is the collection of all information systems and the information environment for human survival. Humans interact and influence each other with information in it. Therefore, there are more prominent information security issues in cyberspace, and its core connotation is still information security. In the face of growing network threats and violations, it is necessary to establish a strong cyberspace management system based on security technology.

[0334] like Figure 2 As shown in the figure, if the cyberspace is disturbed and attacked, technologies such as big data (such as data analysis), deep learning, reinforcement learning, and large models (such as model training) will monitor and analyze network traffic, user behavior, and system logs to promptly detect potential security threats and violations. AI systems can learn and identify common network attack patterns, malware characteristics, and illegal content, so that they can automatically warn and block such activities. In addition, user behavior patterns can be analyzed to identify abnormal activities and prompt administrators for further investigation. Secondly, the network management team or administrator is responsible for handling AI warnings and other security incidents. When an AI warning is triggered, the administrator will intervene in time to investigate and take appropriate measures to respond to the threat. For example, blocking malicious websites, disabling infected computers or network accounts, or working with law enforcement agencies for further investigation. In addition, human administrators can also handle complex problems that AI cannot solve, such as responding to new types of network attacks, investigating internal security violations, and assisting users in solving security-related problems. The management system will be reviewed regularly and improved based on the results of each incident to adapt to the ever-changing network threats and technological evolution and maintain sensitivity to network security threats.

[0335] In the cyberspace management system, when the attacker corresponding to the interference or attack cannot be found, compensation is made through the insurance service company in the cyberspace, or emergency assistance and support are provided through the cyberspace emergency department, which includes the domestic emergency department and the international emergency department in the cyberspace; the insurance service company and the cyberspace emergency department both implement embedded identity authentication based on the multi-identity network, and access blockchain log records through multi-identity addressing, thereby providing a reliable and secure data foundation for compensation, emergency assistance and support.

[0336] In the unlikely event that the responsible party cannot be found, or the damage is caused by force majeure, in order to reasonably solve these problems, in the overall solution based on the multi-identity network, it is also possible to rely on cyberspace security insurance service companies or cyberspace emergency departments (also known as cyberspace security emergency departments) to provide compensation and processing. The cyberspace security insurance service companies legally introduced through the multi-identity network will provide corresponding compensation according to the conditions and terms agreed in the insurance contract, providing a remedy mechanism for the injured party. The cyberspace emergency department can provide emergency assistance and support to promote the recovery and reconstruction of the affected party; the cyberspace emergency department includes domestic emergency departments and international emergency departments in cyberspace. If it is a domestic interference or attack incident, the domestic emergency department will be used to provide emergency assistance and support by default; if it is a cross-border interference or attack incident, the international emergency department will be used to provide emergency assistance and support by default, such as the United Nations security emergency department. Such a design can ensure that in the face of the situation where the responsible party cannot be determined, the injured party can still receive appropriate compensation and support.

[0337] like Figure 2 and Fig.15 As shown, this embodiment also includes step S8, which is used to establish a cyberspace adjudication system; in the cyberspace adjudication system, when disputes and conflicts involving data assets, data privacy or cyberspace are involved, investigations are conducted based on blockchain log records, and the investigation results are sent to the corresponding domestic cyber court or international cyber court; and the relevant judgment records are published in the blockchain cyberspace.

[0338] Step S7 and step S8 described in this embodiment are not sequential steps, but are implemented in parallel, so as to jointly provide a complete, safe, peaceful and law-based cyberspace from the management level and the legal level. Figure 2 shown.

[0339] The cyberspace adjudication system described in this embodiment is also called the cyberspace security, peace, rule of law, and legal court adjudication system.

[0340] In the future, with the development of the Internet, the complexity of network security issues will also increase significantly, and the number of disputes caused by network data and data transactions will continue to rise. For disputes involving network data that administrators cannot resolve, it is necessary to use the legal court system on the Internet to resolve the dispute. When it comes to disputes and conflicts involving data assets, data privacy or other cyberspace, the parties involved in the dispute can resolve it through reporting to the police, arbitration or litigation.

[0341] In order to identify the parties involved in the dispute, the cyber police will conduct investigations based on the logs recorded in the blockchain system. If the parties belong to the same country, the case will be tried by the domestic cyber court of that country. If there are foreign elements such as foreign entities, foreign countries, regions / local laws and regulations, international bilateral / multilateral agreements / treaties, and foreign-related contracts, the case can be transferred to the international cyber court for trial. In the methods and systems for ensuring the trustworthiness and security of cyberspace achieved through multi-identity networks, judicial organs can conduct judicial practices in accordance with relevant legal provisions to ensure the fairness and timeliness of trials, so that individuals or organizations that have committed negligence or crimes will be subject to legal sanctions, economic compensation or imprisonment, and relevant judgment records will be executed and published in the blockchain cyberspace.

[0342] In practical applications, functions can be expanded based on multi-identity networks, and laws can be improved based on judicial practice and existing legislative experience to fill legal loopholes, amend outdated clauses, and establish new rules. This improvement process will continue to adapt to the ever-changing network environment and technological development needs, and provide more reliable protection for the security and fairness of cyberspace.

[0343] like Figures 1 to 14 As shown, this embodiment also provides a system for ensuring that a network space is trustworthy and secure, which adopts the method for ensuring that a network space is trustworthy and secure as described above, and includes:

[0344] The identity authentication and multi-identity addressing module implements multi-identity addressing with embedded identity authentication and packet signature based on the multi-identity network. After the user completes the registration, he / she first signs each data packet published with his / her own private key and writes it into the signature area of ​​the multi-identity network packet. The intermediate router regularly maintains the user information table obtained from the multi-identity management system, extracts the signature information of the corresponding user from the message after receiving it, and then authenticates the received multi-identity network packet through the public key information obtained from the multi-identity management system; and after the identity authentication is passed, the corresponding multi-identity addressing is performed through the message format that supports variable message length;

[0345] Define modules to define digital customs, digital passports and digital visas based on a multi-identity network;

[0346] The digital visa module performs a bitwise XOR operation on the time data and the digital visa key, and performs a one-way mapping of the data after the bitwise XOR operation through a hash function to obtain a digital visa based on a multi-identity network;

[0347] The digital passport module calculates the digital passport based on the multi-identity network according to the hash value of the digital visa and the multinational passport key;

[0348] Using and maintaining the exit table module, realizing digital customs through a multi-identity network router, and using and maintaining the exit table through the digital customs;

[0349] The module for using and updating the entry form verifies the digital passport through the digital customs using the entry form and updates the entry form.

[0350] In summary, this embodiment first implements multi-identity addressing with embedded identity authentication and package signature based on a multi-identity network, and then uses and maintains the exit form through a digital visa, digital passport, and digital customs based on a multi-identity network, and uses and updates the entry form, thereby effectively providing a network system, method, and system that adapts to the current development speed through a multi-identity network and a multi-identity network management system, so as to more effectively ensure the credibility and security of cyberspace, and provide a better foundation for ensuring the order, rule of law, and peace of cyberspace. When it comes to disputes and conflicts involving data assets, data privacy, or cyberspace, the victim can conduct an investigation based on the blockchain log records, and send the investigation results to the corresponding domestic cyber court or international cyber court, providing a reliable basis for conducting domestic or international cyber court litigation. The present invention can be better applied in the global cyberspace, facilitating the management of the cyberspace boundaries of various countries, protecting the cyberspace sovereignty of various countries, and combating transnational cyber attacks and crimes.

[0351] On this basis, this embodiment further implements mimetic defense based on a weighted centrality algorithm so as to improve the efficiency of network protection in a targeted manner according to user security needs; establishes an anti-attack random process martingale quantization model to enhance the flexibility of the hierarchical analysis structure of cyberspace and further improve the integrity of the network; establishes a cyberspace management system and a cyberspace adjudication system to provide guarantees for the security and trustworthiness of cyberspace, and provide a good foundation for ensuring the security, peace, rule of law and orderly management of cyberspace.

[0352] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A method to ensure that cyberspace is trustworthy and secure, It is characterized in that The following steps are involved: Step S1, based on the multi-identity network, multi-identity addressing with embedded identity authentication and packet signature is implemented. After the user completes the registration, he first signs each data packet published with his own private key and writes it into the signature area of ​​the multi-identity network packet. The intermediate router regularly maintains the user information table obtained from the multi-identity management system, extracts the signature information of the corresponding user from it after receiving the message, and then authenticates the received multi-identity network packet through the public key information obtained from the multi-identity management system; After the identity authentication is passed, the corresponding multi-identity addressing is performed through the message format that supports variable message length; Step S2, defining digital customs, digital passports and digital visas based on a multi-identity network; Step S3, performing a bitwise XOR operation on the time data and the digital visa key, and performing a one-way mapping on the data after the bitwise XOR operation through a hash function to obtain a digital visa based on a multi-identity network; Step S4, calculating and obtaining a digital passport based on a multi-identity network according to the hash value of the digital visa and the transnational passport key; Step S5, implementing digital customs through a multi-identity network router, and using and maintaining the exit table through the digital customs; Step S6, verifying the digital passport using the entry form through the digital customs and updating the entry form.

2. The method for ensuring the trustworthiness and security of cyberspace according to claim 1, It is characterized in that The step S1 comprises the following sub-steps: Step S101, the multi-identity network client generates a public key and a private key for the user locally, and then submits the public key and the identity information signed with the private key to any node in the multi-identity management system; when the node receives the request, it verifies it, and after the verification is successful, the accounting node of the multi-identity management system alliance chain generates a transaction and sends it to all blockchain nodes; when the voting node in the blockchain receives a pre-block, it will vote on whether to allow this pre-block to become a formal block, the leader node collects the voting results, counts them and generates a voting certificate, stores the block information of the pre-block that has passed the vote, and extracts the user registration information from the block information and stores it in the user registration table; Step S102: The registered user signs each published data packet with his / her own private key, and writes the digital signature into the signature area of ​​the multi-identity network packet using the SM2 elliptic curve algorithm. The intermediate router regularly maintains the user information table obtained from the multi-identity management system, extracts the signature information of the corresponding user from the received message, and then authenticates the received multi-identity network packet using the public key information obtained from the multi-identity management system. Step S103, after the identity authentication is passed, the corresponding multi-identifier addressing is performed through the message format supporting variable message length; the data packet of the message format includes four areas, namely, the identification area, the signature area, the read-only area and the variable area, the identification area is used to store one or more identifications to distinguish different network groups; the signature area is used to store one or more digital signatures, each digital signature is composed of signature information and signature value, the signature information refers to the signature type and the location of the certificate used to verify the signature; the read-only area is used to store the data block filled by the network sender; the variable area includes a protection area and a danger area, the protection area is used to store the modifiable fields that need to be signed, and the danger area is used to store the modifiable fields that do not need to be signed; In step S2, the digital customs based on the multi-identity network refers to a border router for processing inbound and outbound multi-identity network packets, issuing digital passports for outbound multi-identity network packets, and verifying digital visas for inbound multi-identity network packets from foreign countries; The digital passport and digital visa based on the multi-identity network refer to different specific fields carried on the multi-identity network packet, and the specific fields are generated and verified by any one or more of encryption, hash calculation and certificate.

3. The method for ensuring the trustworthiness and security of cyberspace according to claim 1 or 2, It is characterized in that The step S3 comprises the following sub-steps: Step S301, calculating the time parameter Time by the formula Time=UNIX Time and 0xFFFFFFFFFFFFFFF0, wherein UNIX Time is a 64-bit integer used to represent the number of seconds elapsed since the preset time, and the lowest 4 bits of the second UNIX Time in binary are set to 0; Step S302, by the formula Time256=Time×(1+2 64 +2 128 +2 192 )Get 256-bit time data Time256; Step S303, perform bitwise XOR operation on the time data Time256 and the digital visa key CVK through the formula Visa=SHA256(Time256 xor CVK), and perform one-way mapping of the hash function to obtain a digital visa Visa based on a multi-identity network; the digital visa key CVK is a 256-bit key, and the digital visa key CVK is associated with the user's multi-identity network identity information and real identity information.

4. The method for ensuring the trustworthiness and security of cyberspace according to claim 3, It is characterized in that In step S4, the digital passport Pass based on the multi-identity network is calculated by the formula Pass=SHA256 (Visa xor CPK), wherein CPK refers to a pre-agreed 256-bit transnational passport key.

5. The method for ensuring the trustworthiness and security of cyberspace according to claim 4, It is characterized in that In step S5, the digital customs stores a plurality of exit tables, each of which corresponds to a target country. When the digital customs receives a multi-identification network packet forwarded by the forwarding table, the digital customs first checks the target country corresponding to the multi-identification network packet, and then assigns the multi-identification network packet to the exit table of the corresponding country for processing. The processing process includes the following sub-steps: Step A1, the digital customs discards the multi-identification network packets of users without exit permit; Step A2: When the digital visa Visa carried in the multi-identity network packet is the same as the LastVisa in the exit table, the digital customs directly signs the digital passport in the multi-identity network packet using the LastPass in the exit table and forwards the multi-identity network packet. LastVisa refers to the digital visa of the user's previous multi-identity network packet, and LastPass refers to the digital passport calculated based on the digital visa LastVisa of the user's previous multi-identity network packet. Step A3, when the digital visa Visa carried in the multi-identity network packet is different from the LastVisa in the exit table, determine whether the difference between the current time and LastTime is less than 8 seconds. If so, the digital customs directly uses LastPass as the digital passport, fills the digital passport into the multi-identity network packet and forwards it immediately. LastTime refers to the time when the user's last multi-identity network packet arrived; if not, calculate the new digital passport according to the current time, update the exit table according to the new digital passport, and issue the new digital passport into the multi-identity network packet.

6. The method for ensuring the trustworthiness and security of cyberspace according to claim 4, It is characterized in that In step S6, an entry table is used and maintained in the digital customs. When a multi-identification network packet is about to enter the network border, the digital customs performs verification processing through the entry table. The verification processing process includes the following sub-steps: Step B1, if the sender does not hold a digital passport and is not in a visa-free situation, the multi-identification network packet is directly discarded by the digital customs; Step B2: If the sender holds a digital passport, the validity of the digital passport is verified by the digital customs. If it is determined to be invalid, the digital customs discards the multi-identification network packet with the invalid digital passport; if it is determined to be valid, the digital passport and its digital visa corresponding to the multi-identification network packet are verified; The process of updating the entry table in step S6 includes any of the following steps: Step C, the digital customs traverses all entries in the entry table, and calculates and updates the LastPass, Pass, and NextPass fields at fixed intervals, where LastPass refers to the digital passport calculated based on the digital visa LastVisa of the user's previous multi-identity network packet, Pass refers to the digital passport calculated based on the digital visa Visa calculated based on a fixed time after LastTime, and NextPass refers to the digital passport calculated based on twice the fixed time after LastTime; Step D: When the digital customs receives the multi-identification network packet, it determines whether the LastPass in the entry table entry has expired. If so, LastPass is replaced with Pass, and Pass is replaced with NextPass; if not, it returns.

7. The method for ensuring the trustworthiness and security of cyberspace according to claim 1 or 2, It is characterized in that It also includes a mimetic defense step based on a weighted centrality algorithm. In the mimetic defense step, first obtain the indicators of each device in the multi-identity network, the indicators including point degree centrality, proximity centrality and betweenness centrality; after obtaining the above three indicators, sort each indicator separately to serve as the score of the indicator, then add the scores of the three indicators to obtain the sum value sum, sort the sum value sum to obtain the final centrality rank value Rank; for the storage server, assign a first weight, and divide its sum value sum by 3 to obtain a new sum value sum'; for the border router, assign a second weight, and divide its sum value sum by 2 to obtain a new sum value sum'; For the forwarding server, a third weight is assigned, and the sum value sum remains unchanged; the first weight is greater than the second weight, and the second weight is greater than the third weight.

8. The method for ensuring the trustworthiness and security of cyberspace according to claim 1 or 2, It is characterized in that It also includes step S7, which is used to establish a cyberspace management system; perform AI detection management in the cyberspace management system, and when the cyberspace is disturbed or attacked, monitor and analyze network traffic, user behavior and system logs through at least one of data analysis, deep learning, reinforcement learning and model training, and store them in blockchain log records.

9. The method for ensuring the trustworthiness and security of cyberspace according to claim 8, It is characterized in that In the cyberspace management system, when the attacker corresponding to the interference or attack cannot be found, compensation is made through the insurance service company in the cyberspace, or emergency assistance and support is provided through the cyberspace emergency department, which includes the domestic emergency department and the international emergency department in the cyberspace; the insurance service company and the cyberspace emergency department both implement embedded identity authentication based on the multi-identity network, and access blockchain log records through multi-identity addressing.

10. The method for ensuring the trustworthiness and security of cyberspace according to claim 1 or 2, It is characterized in that It also includes step S8, which is used to establish a cyberspace adjudication system; in the cyberspace adjudication system, when disputes and conflicts involving data assets, data privacy or cyberspace are involved, investigations are conducted based on blockchain log records, and the investigation results are sent to the corresponding domestic cyber court or international cyber court; and the relevant judgment records are published in the blockchain cyberspace.

11. A system to ensure that cyberspace is trustworthy and secure. It is characterized in that The method for ensuring the trustworthiness and security of a network space as claimed in any one of claims 1 to 10 is adopted, and includes: The identity authentication and multi-identity addressing module implements multi-identity addressing with embedded identity authentication and packet signature based on the multi-identity network. After the user completes the registration, he / she first signs each data packet published with his / her own private key and writes it into the signature area of ​​the multi-identity network packet. The intermediate router regularly maintains the user information table obtained from the multi-identity management system, extracts the signature information of the corresponding user from the message after receiving it, and then authenticates the received multi-identity network packet through the public key information obtained from the multi-identity management system; and after the identity authentication is passed, the corresponding multi-identity addressing is performed through the message format that supports variable message length; Define modules to define digital customs, digital passports and digital visas based on a multi-identity network; The digital visa module performs a bitwise XOR operation on the time data and the digital visa key, and performs a one-way mapping of the data after the bitwise XOR operation through a hash function to obtain a digital visa based on a multi-identity network; The digital passport module calculates the digital passport based on the multi-identity network according to the hash value of the digital visa and the multinational passport key; Using and maintaining the exit table module, realizing digital customs through a multi-identity network router, and using and maintaining the exit table through the digital customs; The module for using and updating the entry form verifies the digital passport through the digital customs using the entry form and updates the entry form.

Images