Information processing method and related equipment

Abstract

The invention provides an information processing method and related equipment, which are used for verifying to-be-proved information of a first entity based on an evaluation index and historical behavior information, and can improve the credibility of a verification process so as to improve network security. In the method, first information and second information are obtained, the first information indicates an evaluation rule of whether to-be-proved information of a first entity is valid or not, the second information indicates historical behavior information, associated with the to-be-proved information, of the first entity, and the to-be-proved information comprises capability and / or qualification; and verifying the to-be-proved information of the first entity based on the first information and the second information to obtain a verification result.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an information processing method and related equipment. Background Art

[0002] With the improvement of network coverage and the popularization of application scenarios, user needs have become more diversified, the number of various devices has increased sharply, and the network environment has become more complex. Therefore, how to establish trust between different devices in the network environment is a technical problem that needs to be solved urgently. Summary of the invention

[0003] The present application provides an information processing method and related equipment for verifying information to be verified of a first entity based on evaluation rules and historical behavior information, which can improve the credibility of the verification process to improve network security.

[0004] The first aspect of the present application provides an information processing method, which is executed by a first device, or the method is executed by some components in the first device (such as a processor, a chip or a chip system, etc.), or the method can also be implemented by a logic module or software that can realize all or part of the functions of the first device. In the first aspect and its possible implementation, the method is described as being executed by the first device as an example, and the first device can be a server, a device running (or having) a virtual machine, a device running (or having) a container, a desktop computer, a notebook, etc. In the method, the first device obtains first information and second information, the first information indicates the evaluation rules of whether the information to be proved of the first entity is valid, and the second information indicates the historical behavior information of the first entity associated with the information to be proved, and the information to be proved includes capabilities and / or qualifications; the first device verifies the information to be proved of the first entity based on the first information and the second information to obtain a verification result.

[0005] Based on the above technical solution, the first information obtained by the first device indicates the evaluation rules of whether the information to be proved of the first entity is valid, and the second information obtained by the first device indicates the historical behavior information of the first entity associated with the information to be proved, and the information to be proved includes capabilities and / or qualifications, and the first device can verify the information to be proved based on the first information and the second information to obtain a verification result. In other words, the verification process of the information to be proved of the first entity can be implemented based on the evaluation rules corresponding to the information to be proved and the associated historical behavior information. Therefore, in the above technical solution, the first device can verify the information to be proved of the first entity based on the evaluation rules and the historical behavior information, which can improve the credibility of the verification process and improve network security.

[0006] Optionally, in the above technical solution, the first device can verify the information to be proved of the first entity based on the evaluation rules and associated historical behavior information, without relying on other nodes (such as digital certificates provided by CA servers, indirect reputations provided by other nodes, etc.), thereby improving the credibility of the verification process.

[0007] Optionally, the evaluation rule is used to evaluate whether the information to be proved is valid, which can be understood as: the evaluation rule is used to evaluate whether the information to be proved is legal, or the evaluation rule is used to evaluate whether the information to be proved is compliant, etc. In other words, the subsequent process of the first device performing verification can be understood as the first device evaluating whether the information to be proved of the first entity is valid (or legal, compliant, etc.) based on the evaluation rule indicated by the first information and the historical behavior information indicated by the second information. In addition, the evaluation rule can also be understood as: evaluation index, legal index, legal rule, compliance rule, compliance index, etc.

[0008] It should be noted that the above technical solution can be applied to a communication network system, and accordingly, the first entity can be a physical device or a virtual device in the communication network system, such as a terminal device, a network device, etc. In other words, the above technical solution can be applied to the verification process of the information to be proved of the device in the communication network system.

[0009] Optionally, the information to be proved may include at least one piece of information such as capability and qualification, that is, the information to be proved of the first entity may indicate the capability and / or qualification possessed by the first entity. For example, when the first entity is a network device (or terminal device), the information to be proved of the first entity may indicate that the network device (or terminal device) has at least one of 6G / 5G / 4G / 3G communication capability, encryption capability, integrity protection capability or privacy protection capability, or the information to be proved of the first entity may indicate that the network device (or terminal device) has at least one of 6G / 5G / 4G / 3G communication qualification, encryption qualification, integrity protection qualification or privacy protection qualification. Exemplarily, the information to be proved of the first entity may be replaced by a claim (or claim information) of the first entity, the capability (or capability information) of the first entity, or the qualification (or qualification information) of the first entity, etc.

[0010] Optionally, the historical behavior information may be replaced by the historical information.

[0011] In a possible implementation manner of the first aspect, the first device verifies the information to be proved of the first entity based on the first information and the second information, and obtains a verification result including: when the support degree of the first information and the second information is greater than or equal to a first threshold, the first device determines that the verification result is a passed verification; and / or, when the support degree of the first information and the second information is less than or equal to a second threshold, the first device determines that the verification result is a failed verification.

[0012] Based on the above technical solution, during the verification process performed by the first device, the first device can determine the verification result based on the support of the first information and the second information to provide a specific implementation method of the verification process.

[0013] Optionally, the support can be replaced by similarity or other descriptions.

[0014] Optionally, the first device may implement the above verification process through an artificial intelligence (AI) algorithm (or AI model, AI operation, etc.), for example, the first device verifies the information to be proved of the first entity based on the first information and the second information, and the process of obtaining the verification result may include: the first device uses the first information and the second information as inputs of the AI ​​algorithm (or AI model, AI operation, etc.), and outputs the verification result after verification processing by the AI ​​algorithm. Thus, the first device implements the above verification process through the AI ​​algorithm (or AI model, AI operation, etc.), so that the verification process has the characteristics of objectivity, transparency and intelligence, which can further improve the credibility of the verification process.

[0015] In a possible implementation manner of the first aspect, the first device acquiring the first information and the second information includes: the first device receiving the first information and the second information.

[0016] Based on the above technical solution, the first device can obtain the first information and the second information by receiving the first information and the second information, so that the first device can perform a verification process on the information to be proved of the first entity based on the received first information and the second information.

[0017] It is understandable that in the above technical solution, the first device can perform the verification process based on the received first information and second information. Among them, the first device (or the hardware module and / or software module in the first device for performing the verification process) can be called an attestation engine (AE), an attestation node, etc.

[0018] In a possible implementation of the first aspect, the first device obtains the first information and the second information, including: the first device receives third information, and the third information is used to indicate the information to be proved of the first entity; the first device determines the first information based on the third information, and determines the second information based on the third information.

[0019] Based on the above technical solution, after receiving the third information, the first device can determine the first information and the second information based on the third information to obtain the first information and the second information, so that the first device can perform a verification process for the information to be proved of the first entity based on the determined first information and the second information.

[0020] It can be understood that in the above technical solution, the first device obtains the first information and the second information based on the received third information, and then performs the verification process based on the first information and the second information. Among them, the first device (or the hardware module and / or software module in the first device used to perform the determination of the first information based on the third information) can be called a rule mining module (Rule Mining Module, RMM), a rule mining node, etc.; the first device (or the hardware module and / or software module in the first device used to perform the determination of the second information based on the third information) can be called a knowledge embedding module (KEM), a knowledge embedding node, etc.; the first device (or the hardware module and / or software module in the first device used to perform the verification process) can be called an attestation engine (AE), an attestation node, etc.

[0021] In a possible implementation of the first aspect, the first device determines the first information based on the third information, including: the first device determines the first information from a first data set based on the third information, the first data set indicating N evaluation rules for whether the information to be proved is valid, and N is a positive integer.

[0022] Based on the above technical solution, after the first device receives the third information indicating the information to be proved of the first entity, the first device can determine the first information from the first data set based on the third information. In other words, after the first device receives the third information, the first device can determine the corresponding evaluation rule based on the information to be proved indicated by the third information, so as to perform the verification process based on the evaluation rule later.

[0023] In a possible implementation of the first aspect, the first device determines the first information from the first data set based on the third information, including: the first device determines the first information from the first data set based on the triple information corresponding to the information to be proved of the first entity; the triple information includes the identifier of the first entity, the relationship between the first entity and the information to be proved, and the identifier of the information to be proved; wherein the third information includes the triple information, or the triple information is obtained by performing semantic analysis processing on the third information.

[0024] Based on the above technical solution, in the process of determining the first information, the first device can obtain the triple information corresponding to the information to be proved based on the third information, and then further determine the first information from the first data set based on the triple information. In addition, the first device can obtain the triple information through the above multiple methods to improve the flexibility of the solution implementation.

[0025] It can be understood that, when the triple information obtained by the first device is obtained by performing semantic analysis processing on the third information, the first device (or the hardware module and / or software module in the first device for performing the semantic analysis processing) can be called a semantic processing module (Semantic Processing Module, SPM), a semantic processing node, a semantic analysis module, a semantic analysis node, etc.

[0026] Optionally, the first device may implement the above-mentioned semantic analysis process through an AI algorithm (or AI model, AI operation, etc.). For example, the process in which the first device obtains the triple information by performing semantic analysis on the third information may include: the first device uses the third information as the input of the AI ​​algorithm (or AI model, AI operation, etc.), and outputs the triple information after semantic analysis by the AI ​​algorithm. Thus, the first device implements the above-mentioned semantic analysis process through an AI algorithm (or AI model, AI operation, etc.), so that the semantic analysis process has the characteristics of security, transparency, explainability and unbiasedness, which can further enhance the credibility of the subsequent verification process.

[0027] In a possible implementation of the first aspect, the first device determines the second information based on the third information, including: the first device sends request information based on the third information, and the request information is used to request historical behavior information of the first entity; the first device receives the second information; or, the first device receives the historical behavior information of the first entity and determines the second information based on the historical behavior information of the first entity.

[0028] Based on the above technical solution, in the process of determining the second information, the first device can send request information based on the third information, and then obtain the second information based on a response to the request information (for example, the response includes the second information, or the response includes historical behavior information of the first entity), so as to provide a specific implementation method for the first device to obtain the second information.

[0029] Optionally, after the first device sends the request information based on the third information, the device that receives the request information and sends a response to the request information to the first device may be a second device, and the second device may store historical behavior information of one or more entities (the one or more entities include the first entity). For example, the second device may be an access device to a public database (such as a server, workstation, etc.), an access device to a blockchain (such as a server, workstation, desktop, laptop, etc.), or other devices, which are not limited here.

[0030] It can be understood that when the second device is an access device of the blockchain, the combination with blockchain technology can improve data security.

[0031] Optionally, the first device may locally store historical behavior information of one or more entities, and accordingly, the first device determines the second information based on the third information, including: the first device may determine the second information from the information stored locally based on the third information.

[0032] In a possible implementation manner of the first aspect, the third information is generated based on a template provided by a consortium blockchain (CB), or the third information is generated based on a template provided by a centralized node.

[0033] Based on the above technical solution, the third information indicating the information to be proved of the first entity can be generated based on a template to reduce the implementation complexity of determining triplet information from the third information and improve the accuracy of determining triplet information.

[0034] Optionally, the template may be provided by a distributed node (such as a CB), a centralized node (such as a third-party authority), or other nodes, which are not limited here.

[0035] In a possible implementation manner of the first aspect, the method further includes: the first device updating the first data set based on the verification result.

[0036] Based on the above technical solution, after the first device executes the verification process and obtains the verification result, the first device can also update the first data set based on the verification result, and can subsequently use the updated first data set to execute other verification processes in order to improve the accuracy of the other verification processes.

[0037] In a possible implementation manner of the first aspect, the method further includes: the first device sending indication information indicating the verification result.

[0038] Based on the above technical solution, after the first device executes the verification process and obtains the verification result, the first device can also send indication information indicating the verification result, so that the recipient of the indication information can clarify the verification result of the information to be proved of the first entity based on the indication information, and determine whether to establish a trust relationship with the first entity based on the verification result.

[0039] In addition, when the first data set is stored in another device other than the first device, the other device can perform the above process of determining the first information based on the third information based on the first data set. Accordingly, after the first device sends the indication information indicating the verification result, the other device can serve as the recipient of the indication information and update the first data set based on the indication information.

[0040] The second aspect of the present application provides an information processing device, which can implement the method in the above-mentioned first aspect or any possible implementation of the first aspect. The communication device includes corresponding units or modules for executing the above-mentioned method. The units or modules included in the communication device can be implemented by software and / or hardware. For example, the device can be a first device, or the device can be a component in the first device (such as a processor, a chip or a chip system, etc.), or the device can also be a logic module or software that can implement all or part of the functions of the first device. Among them, the first device can be a server, a device running (or having) a virtual machine, a device running (or having) a container, etc.

[0041] Among them, the device includes an acquisition unit and a verification unit; the acquisition unit is used to acquire first information and second information, the first information indicates the evaluation rules of whether the information to be proved of the first entity is valid, and the second information indicates the historical behavior information of the first entity associated with the information to be proved, and the information to be proved includes capabilities and / or qualifications; the verification unit is used to verify the information to be proved of the first entity based on the first information and the second information to obtain a verification result.

[0042] In a possible implementation manner of the second aspect, the acquisition unit is used to acquire the first information and the second information, including: the acquisition unit is used to receive the first information and the second information.

[0043] In a possible implementation of the second aspect, the acquisition unit is used to acquire the first information and the second information, including: the acquisition unit receives third information, and the third information is used to indicate the information to be proved of the first entity; the acquisition unit determines the first information based on the third information; the acquisition unit determines the second information based on the third information.

[0044] In a possible implementation of the second aspect, the acquisition unit determines the first information based on the third information, including: the acquisition unit determines the first information from a first data set based on the third information, the first data set indicating N evaluation rules for whether the information to be proved is valid, and N is a positive integer.

[0045] In a possible implementation of the second aspect, the acquisition unit determines the first information from the first data set based on the third information, including: the acquisition unit determines the first information from the first data set based on the triple information corresponding to the information to be proved of the first entity; the triple information includes the identifier of the first entity, the relationship between the first entity and the information to be proved, and the identifier of the information to be proved; wherein the third information includes the triple information, or the triple information is obtained by performing semantic analysis on the third information.

[0046] In a possible implementation of the second aspect, the acquisition unit determines the second information based on the third information, including: the acquisition unit sends request information based on the third information, and the request information is used to request historical behavior information of the first entity; the acquisition unit receives the second information; or, the acquisition unit receives the historical behavior information of the first entity and determines the second information based on the historical behavior information of the first entity.

[0047] In a possible implementation manner of the second aspect, the third information is generated based on a template provided by the consortium chain CB, or the third information is generated based on a template provided by a centralized node.

[0048] In a possible implementation manner of the second aspect, the device further includes an updating unit; the updating unit is configured to update the first data set based on the verification result.

[0049] In a possible implementation manner of the second aspect, the device also includes a sending unit; the sending unit is used to send indication information indicating the verification result.

[0050] In a possible implementation of the second aspect, the verification unit is used to verify the information to be proved of the first entity based on the first information and the second information, and the verification result obtained includes: when the support degree of the first information and the second information is greater than or equal to a first threshold, the verification unit determines that the verification result is a passed verification; and / or, when the support degree of the first information and the second information is less than or equal to a second threshold, the verification unit determines that the verification result is a failed verification.

[0051] In a possible implementation manner of the second aspect, the information to be proved includes capabilities and / or qualifications.

[0052] In the second aspect of the present application, the constituent modules of the communication device can also be used to execute the steps performed in each possible implementation method of the first aspect and achieve corresponding technical effects. For details, please refer to the fourth aspect and will not be repeated here.

[0053] The third aspect of the present application provides a device, comprising at least one processor, which is coupled to a memory; the memory is used to store programs or instructions; the at least one processor is used to execute the program or instructions so that the device implements the method in the aforementioned first aspect and any possible implementation method thereof.

[0054] In a fourth aspect, the present application provides a device, including at least one logic circuit and an input / output interface; the logic circuit is used to execute the method described in the first aspect and any possible implementation thereof.

[0055] A fifth aspect of an embodiment of the present application provides a system, which includes the device of the second aspect, or the device of the third aspect, or the device of the fourth aspect.

[0056] Optionally, the system also includes a possible second device, a third device, etc.

[0057] A sixth aspect of an embodiment of the present application provides a computer-readable storage medium, which is used to store one or more computer-executable instructions. When the computer-executable instructions are executed by a processor, the processor executes the method described in the first aspect above and any possible implementation method thereof.

[0058] A seventh aspect of an embodiment of the present application provides a computer program product (or computer program), which includes instructions. When the instructions in the computer program product are executed by the processor, the processor executes the method described in the first aspect and any possible implementation method thereof.

[0059] An eighth aspect of an embodiment of the present application provides a chip system, which includes at least one processor for supporting a device to implement the method described in the first aspect and any possible implementation method thereof.

[0060] In a possible design, the chip system may also include a memory for storing program instructions and data necessary for the device. The chip system may be composed of a chip, or may include a chip and other discrete devices. Optionally, the chip system also includes an interface circuit for providing program instructions and / or data to the at least one processor.

[0061] Among them, the technical effects brought about by any design method in the second to eighth aspects can refer to the technical effects brought about by different design methods in the above-mentioned first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 A schematic diagram of the trust established for this application;

[0063] Figure 2 A schematic diagram of the information processing method provided for this application;

[0064] Figure 3 Another schematic diagram of the information processing method provided by this application;

[0065] Figure 4 Another schematic diagram of the information processing method provided by this application;

[0066] Figure 5 Another schematic diagram of the information processing method provided by this application;

[0067] Figure 6 Another schematic diagram of the information processing method provided by the present application;

[0068] Figure 7 Another schematic diagram of the information processing method provided by this application;

[0069] Figure 8 Another schematic diagram of the information processing method provided by this application;

[0070] Fig. 9 A schematic diagram of the device provided for this application;

[0071] Fig.10 Another schematic diagram of the device provided for this application;

[0072] Fig.11 Another schematic diagram of the device provided for this application;

[0073] Fig.12Another schematic diagram of the device provided in the present application. DETAILED DESCRIPTION

[0074] First, the terms involved in the embodiments of the present application are explained to facilitate understanding by those skilled in the art.

[0075] 1. Terminal device: It can be a wireless terminal device capable of receiving network device scheduling and instruction information. The wireless terminal device can be a device that provides voice and / or data connectivity to users, or a handheld device with wireless connection function, or other processing devices connected to a wireless modem.

[0076] Exemplarily, the terminal device may be any communication kit (a kit may include, for example, an antenna, a power supply template, a cable, and a Wi-Fi module) with wireless communication functions. The terminal device may also be a communication module with satellite communication functions, a satellite phone or its components, or a very small aperture terminal (VSAT). The terminal device may be a mobile terminal device, such as a mobile phone (or a "cellular" phone, mobile phone), a computer, and a data card. For example, it may be a portable, pocket-sized, handheld, computer-built-in, or vehicle-mounted mobile device that exchanges language and / or data with a wireless access network. For example, personal communication service (PCS) phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDAs), tablet computers, computers with wireless transceiver functions, and other devices. Wireless terminal equipment can also be called system, subscriber unit (subscriberunit), subscriber station (subscriberstation), mobile station (mobilestation), mobile station (mobilestation, MS), remote station (remotestation), access point (accesspoint, AP), remote terminal equipment (remoteterminal), access terminal equipment (accessterminal), user terminal equipment (userterminal), user agent (useragent), subscriber station (subscriberstation, SS), customer premises equipment (customerpremisesequipment, CPE), terminal (terminal), user equipment (userequipment, UE), mobile terminal (mobileterminal, MT), drone, etc. The terminal equipment can also be a wearable device and a next-generation communication system, for example, a terminal equipment in a 6G communication system or a terminal equipment in a future evolved public land mobile network (publiclandmobilenetwork, PLMN), etc. Of course, the terminal equipment in this application can also refer to a chip, a modem, a system-on-a-chip (systemonachip, SoC) that is mainly responsible for the relevant communication functions in the device, or a communication platform that can include a radio frequency (radiofrequency, RF) part, etc.

[0077] 2. Network equipment: It may include equipment in a wireless network, for example, a network equipment may be a radio access network (RAN) node (or device) that connects a terminal device to a wireless network, which may also be called a base station. At present, some examples of RAN equipment are: a new generation of base stations in future communication systems, a transmission reception point (TRP), an evolved Node B (eNB), a radio network controller (RNC), a Node B (NB), a base station controller (BSC), a base transceiver station (BTS), a home base station (e.g., home evolved Node B, or home Node B, HNB), a baseband unit (BBU), or a wireless fidelity (Wi-Fi) access point (AP), etc. In addition, in a network structure, a network equipment may include a centralized unit (CU) node, a distributed unit (DU) node, or a RAN device including a CU node and a DU node.

[0078] In addition, in other possible cases, the network device may be other devices that provide wireless communication functions for the terminal device. The embodiments of the present application do not limit the specific technology and specific device form used by the network device. For the convenience of description, the embodiments of the present application do not limit.

[0079] In addition, the network equipment may also include core network equipment, which may include, for example, an access and mobility management function (AMF), a user plane function (UPF) or a session management function (SMF).

[0080] It should be understood that the terminal equipment and network equipment involved in the present application can be applied to a variety of communication systems, for example, the communication system may include a fourth generation (4th generation, 4G) mobile communication system, a fifth generation (5th generation, 5G) mobile communication system, or a future-oriented evolution system (such as a 6G mobile communication system). Alternatively, the communication system may also include an open access network (openRAN, O-RAN or ORAN), a cloud radio access network (cloud radio access network, CRAN), etc. Alternatively, the communication system may include a communication system in which two or more of the above systems are integrated.

[0081] The terms "system" and "network" in this application can be used interchangeably. "At least one" means one or more, and "plurality" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B, which can represent: the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one of the following" or its similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, "at least one of A, B or C" includes A, B, C, AB, AC, BC or ABC. And, unless otherwise specified, the ordinal numbers such as "first" and "second" mentioned in the embodiments of the present application are used to distinguish multiple objects, and are not used to limit the order, timing, priority or importance of multiple objects.

[0082] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0083] With the improvement of network coverage and the popularization of application scenarios, user needs have become more diversified, the number of various devices has increased sharply, and the network environment has become more complex. For example, the integration of heterogeneous networks has become the trend of future network development. In the future, networks will move from independent and closed networks to heterogeneous interconnection. Cellular networks, Internet Protocol (IP) networks, and satellite networks will be highly integrated. For another example, in the future 6G era, the network environment will be more open than in the 5G era. Different networks use different equipment, and different equipment may come from different manufacturers. In addition, the same network (such as open access network (openRAN, O-RAN or ORAN)) may also use equipment from different manufacturers, even including some "white-label" equipment.

[0084] However, as the network environment becomes more open, new security issues arise: the interfaces between different devices lack adequate protection, user data and privacy information may be overused, data transmission between entities has inherent fragility, the network may be more vulnerable to malicious attacks, and users will face higher security risks.

[0085] Therefore, in a network environment, how to establish trust between different devices is a technical problem that needs to be solved urgently. Among them, in order to establish a trusted network environment and ensure the security of user information, we should consider how to establish trust between heterogeneous related entities including people, devices, applications and services. For example, in the future 6G network, the trust establishment scheme under the 5G background may not meet the needs of the 6G open network era in terms of adaptability, transparency and scalability, and cannot be applied to the increasingly diverse scenarios. Therefore, in the context of 6G open networks, how to establish trust between different network devices and how to establish trust between devices of different equipment vendors in the same network are problems that need to be solved urgently.

[0086] One possible implementation is to establish trust based on certificates. A device can obtain a digital certificate from a certificate authority (CA) server. When the device interacts with other devices, the device can provide the digital certificate so that the other device can perform verification based on the digital certificate. If the verification is successful, the other device can determine that the device is a trusted object, thereby establishing a trust relationship between different devices.

[0087] In this technical solution, trust is established between entities by verifying certificates. At present, the implementation of this technical solution mainly relies on the public key infrastructure (PKI) architecture. The technical system is mature and has a wide range of application scenarios in the 5G era. In this system, the trust certificate is issued to the applicant by an authoritative third-party certificate authority (such as a CA server) and digitally signed. When a node applies to interact with another node, the node can present a certificate signed by the CA. The other node reads the CA information in the certificate, confirms that the CA is in its built-in trusted CA list, and verifies the CA's public key to ensure that the certificate has not been modified and is truly issued by the CA. If the authentication is successful, the node can be confirmed as a trusted object, and a trust relationship is established. The following will be based on Figure 1 Taking the PKI architecture in as an example, the certificate-based trust establishment process is described exemplarily.

[0088] Step 1. Node A applies for a certificate from the CA server. For example, the node A may submit information such as a public key, organization information, and personal information (domain name) to the CA server and apply for certification.

[0089] Step 2. The CA server performs an audit based on the audit information. For example, the CA server verifies the authenticity of the information provided by the applicant through various means, such as whether the organization exists, whether the enterprise is legal, whether it owns the domain name, etc. If the audit is passed, the CA server will proceed to step 3.

[0090] Step 3. The CA server issues a signed certificate to Node A.

[0091] Step 4. Node A returns the certificate to Node B.

[0092] Step 5. Node B verifies the certificate. For example, Node B reads the relevant plaintext information in the certificate, calculates the information digest, and then uses the corresponding CA's public key to decrypt the signature data and compare the certificate's information digest. If they are consistent, the legitimacy of the certificate can be confirmed. Among them, Node B verifies the domain name, validity period and other information related to the certificate, and queries the certificate information (including the public key) of the built-in trusted CA. If the CA of the certificate is not included, the certificate will be judged to be illegal. If the CA is confirmed to be trustworthy, step 6 is executed.

[0093] Step 6. Node B determines that node A is trustworthy and interacts with it, such as performing key negotiation and other operations.

[0094] Depend on Figure 1 As shown in the certificate-based trust establishment method, the trust system established by this solution is relatively closed, and cross-CA and cross-heterogeneous trust domain authentication is difficult. At the same time, this solution is heavily dependent on third-party CAs, with high centralization and poor scalability. In addition, this solution is susceptible to single point failure problems. If a CA is unreliable, attacked by external forces, or there are loopholes in its certificate issuance process, and a fraudulent certificate is issued to an untrustworthy node, it may have an extremely serious negative impact on the entire trust system and affect network security.

[0095] Another possible implementation method is a reputation-based trust establishment method (which can be called the RepTrust model). This technical solution is mainly applicable to peer-to-peer (P2P) network scenarios. The main node actively collects information about the target node's past behavior performance (ie, direct reputation) and interaction records with other nodes (ie, indirect reputation) from the evaluation of associated nodes, and then evaluates the trust in the target node through reputation calculation. If the trust of the target node is higher than a certain threshold set in advance, it is authenticated as trustworthy, thereby establishing a trust relationship. Compared with the certificate-based trust establishment method, this technical solution is more flexible and open, has better scalability, and better reflects the dynamic nature of trust. The following is an exemplary description of the reputation-based trust establishment method.

[0096] 1) Before the subject node A interacts with the target node B, the trust of B is first evaluated. If B has interacted with B many times before, the composite reputation and trust are calculated in the form of arithmetic average based on the local direct reputation.

[0097] 2) If A and B have not interacted before, A needs to search for B's indirect reputation in the network, and finally calculate B's composite reputation and trust based on the local direct reputation and the searched indirect reputation.

[0098] 3) If B's ​​trust is greater than the set trust threshold, then interact with him, otherwise reselect other interaction objects. After the interaction, A gives B a reputation evaluation and saves it locally.

[0099] From the above-mentioned trust system based on reputation, it can be seen that whether the reputation of a node is credible depends largely on whether the feedback provided by the associated nodes is true and effective. False reputation evaluation will have a significant negative impact on credibility. Therefore, if this technical solution is adopted, it is necessary to establish additional relevant security mechanisms to prevent malicious attacks (such as intermittent attacks (On-offattacks), collusion attacks (collusion attacks)), and at the same time, it is necessary to establish an incentive mechanism to encourage nodes to provide real feedback, so as to ensure that the reputation of the node can be correctly evaluated. It can be seen that the complexity of this implementation method is relatively high, and if there are untrustworthy nodes that give direct or indirect reputation, it may also have an extremely serious negative impact on the entire trust system, thereby affecting network security.

[0100] In order to solve the above problems, the present application provides an information processing method and related equipment for verifying the information to be proved of the first entity based on evaluation rules and historical behavior information, which can improve the credibility of the verification process to improve network security.

[0101] See also Figure 2 , is a schematic diagram of an implementation of the information processing method provided in this application, and the method includes the following steps.

[0102] It should be noted that Figure 2In the following and other figures, the first device (or the possible second device) is used as an example to illustrate the method, but the present application does not limit the execution subject of the interaction. For example, the execution subject can be the first device (or the possible second device), and the execution subject can also be a chip, a chip system, or a processor that supports the first device (or the possible second device) to implement the method, or a logic module or software that can implement all or part of the functions of the first device (or the possible second device). Among them, the first device (or the possible second device) can be a server, a device running (or having) a virtual machine, a device running (or having) a container, a desktop computer, a notebook, etc.

[0103] S201. A first device acquires first information and second information, wherein the first information indicates an evaluation rule of whether information to be proved of a first entity is valid, and the second information indicates historical behavior information of the first entity associated with the information to be proved, wherein the information to be proved includes capability and / or qualification.

[0104] It should be noted that Figure 2 The technical solution shown can be applied to a communication network system. Accordingly, the first entity can be a physical device or a virtual device in the communication network system, such as a terminal device, a network device, etc. In other words, Figure 2 The technical solution shown can be applied to the verification process of the information to be verified of the equipment in the communication network system. Figure 2 The technical solution shown can be applied to the process of establishing a trust system between heterogeneous entities in an open network environment, such as the process of establishing trust between different network devices, or the process of establishing trust between devices of different equipment vendors in the same network.

[0105] Optionally, the information to be proved may include at least one piece of information such as capability, qualification, etc. Exemplarily, the information to be proved of the first entity may be replaced by a claim (or claim information) of the first entity, the capability (or capability information) of the first entity, or the qualification (or qualification information) of the first entity, etc.

[0106] Optionally, the historical behavior information may be replaced by the historical information.

[0107] S202. The first device verifies the information to be proved based on the first information and the second information to obtain a verification result.

[0108] In a possible implementation, in step S202, the first device verifies the information to be verified of the first entity based on the first information and the second information, and the process of obtaining the verification result may include: when the support of the first information and the second information is greater than or equal to the first threshold, the first device determines that the verification result is a passed verification; and / or, when the support of the first information and the second information is less than or equal to the second threshold, the first device determines that the verification result is a failed verification. Specifically, during the verification process performed by the first device, the first device may determine the verification result based on the support of the first information and the second information to provide a specific implementation of the verification process.

[0109] Optionally, the support can be replaced by similarity or other descriptions.

[0110] Optionally, in step S202, the first device may implement the above verification process through an artificial intelligence (AI) algorithm (or AI model, AI operation, etc.), for example, the first device verifies the information to be proved of the first entity based on the first information and the second information, and the process of obtaining the verification result may include: the first device uses the first information and the second information as inputs of the AI ​​algorithm (or AI model, AI operation, etc.), and outputs the verification result after verification processing by the AI ​​algorithm. Thus, the first device implements the above verification process through the AI ​​algorithm (or AI model, AI operation, etc.), so that the verification process has the characteristics of objectivity, transparency and intelligence, which can further improve the credibility of the verification process.

[0111] Based on the above technical solution, the first information obtained by the first device in step S201 indicates the evaluation rules for whether the information to be proved of the first entity is valid, and the second information obtained by the first device in step S201 indicates the historical behavior information of the first entity associated with the information to be proved, and the information to be proved includes capabilities and / or qualifications, and in step S202, the first device can verify the information to be proved of the first entity based on the first information and the second information to obtain a verification result. In other words, the verification process of the information to be proved of the first entity can be implemented based on the evaluation rules corresponding to the information to be proved and the associated historical behavior information. Therefore, in the above technical solution, the first device can verify the information to be proved of the first entity based on the evaluation rules and the historical behavior information, which can improve the credibility of the verification process to improve network security.

[0112] Optionally, in the above technical solution, the first device can verify the information to be proved of the first entity based on the evaluation rules and associated historical behavior information, without relying on other nodes (such as digital certificates provided by CA servers, indirect reputations provided by other nodes, etc.), thereby improving the credibility of the verification process.

[0113] From the above description, it can be seen that the information to be proved may include at least one item of information such as capability and qualification, that is, the information to be proved of the first entity may indicate the capability and / or qualification possessed by the first entity. For example, when the first entity is a network device (or terminal device), the information to be proved of the first entity may indicate that the network device (or terminal device) has at least one of 6G / 5G / 4G / 3G communication capability, encryption capability, integrity protection capability or privacy protection capability, or the information to be proved of the first entity may indicate that the network device (or terminal device) has at least one of 6G / 5G / 4G / 3G communication qualification, encryption qualification, integrity protection qualification or privacy protection qualification.

[0114] Optionally, the evaluation rule is used to evaluate whether the information to be proved is valid, which can be understood as: the evaluation rule is used to evaluate whether the information to be proved is legal, or the evaluation rule is used to evaluate whether the information to be proved is compliant, etc. In other words, the process of the first device performing verification in step S202 can be understood as the first device evaluating whether the information to be proved of the first entity is valid (or legal, compliant, etc.) based on the evaluation rule indicated by the first information and the historical behavior information indicated by the second information. In addition, the evaluation rule can also be understood as: evaluation index, legal index, legal rule, compliance rule, compliance index, etc.

[0115] As an implementation example, the first entity is a network device, and the information to be proved of the first entity is the 5G communication capability of the first entity. In step S201, the evaluation rule indicated by the first information is used to evaluate whether the first entity has 5G communication capability. The first information can specifically indicate the evaluation rule of "a certain entity has 5G communication capability (or qualification)". For example, the evaluation rule indicated by the first information can be that the certain entity performs broadcast communication based on 5G communication capability (or qualification), and / or, the evaluation rule indicated by the first information can be that the certain entity performs unicast communication with another entity based on 5G communication capability (or qualification). Correspondingly, in step S202, the historical behavior information indicated by the second information may include "the first entity has sent a broadcast message based on 5G communication capability (or qualification) at a certain time point in history", and / or "the first entity has sent a unicast message to another entity based on 5G communication capability (or qualification) at a certain time point in history". Thereafter, in step S202, the first device can verify the historical behavior information indicated by the second information based on the evaluation rule indicated by the first information, and obtain the verification result.

[0116] Optionally, the historical behavior information of the first entity may include historical behavior information associated with the information to be proved of the first entity, and may also include historical behavior information not associated with the information to be proved of the first entity. Taking the example described in the previous paragraph as an example, the historical behavior information not associated with the information to be proved of the first entity may include: the first entity has sent a unicast message / broadcast message to another entity based on 3G / 4G communication capabilities at a certain point in time in history.

[0117] exist Figure 2 In the technical solution shown, the first device can obtain the first information and the second information in step S201 through a variety of methods, which will be described below in conjunction with some implementation examples.

[0118] Implementation example 1, such as Figure 3 As shown, the process of the first device acquiring the first information and the second information includes: Step S301. The first device receives the first information and the second information. The implementation process of step S302 can refer to the implementation process of the aforementioned step S202.

[0119] Specifically, the first device may obtain the first information and the second information by receiving the first information and the second information, so that the first device can perform a verification process on the information to be proved of the first entity based on the received first information and the second information.

[0120] It is understandable that in implementation example 1, the first device can perform the verification process based on the received first information and second information. The first device (or the hardware module and / or software module in the first device for performing the verification process) can be called an attestation engine (AE), an attestation node, etc. Figure 3 In the example shown, the second device that sends the first information and the second information may be a device having a rule mining module (RMM) and a knowledge embedding module (KEM).

[0121] Implementation example 2, such as Figure 4 As shown, the process of the first device acquiring the first information and the second information includes: the first device receives the third information in step S401, and the third information is used to indicate the information to be proved of the first entity; the first device determines the first information based on the third information in step S402, and determines the second information based on the third information. The implementation process of step S403 can refer to the implementation process of the aforementioned step S202.

[0122] Specifically, after receiving the third information, the first device can determine the first information and the second information based on the third information to obtain the first information and the second information, so that the first device can perform a verification process for the information to be proved of the first entity based on the determined first information and second information.

[0123] It can be understood that in implementation example two, the first device obtains the first information and the second information based on the received third information, and then performs the verification process based on the first information and the second information. Among them, the first device (or the hardware module and / or software module in the first device used to perform the determination of the first information based on the third information) can be called a rule mining module (Rule mining module, RMM), a rule mining node, etc.; the first device (or the hardware module and / or software module in the first device used to perform the determination of the second information based on the third information) can be called a knowledge embedding module (KEM), a knowledge embedding node, etc.; the first device (or the hardware module and / or software module in the first device used to perform the verification process) can be called an attestation engine (AE), an attestation node, etc. Correspondingly, in Figure 4 In the example shown, the second device that sends the third information may be the first entity, or a device that includes the first entity.

[0124] In a possible implementation of Example 2, the first device determines the first information based on the third information, including: the first device determines the first information from a first data set based on the third information, the first data set indicating N evaluation rules for whether the information to be proved is valid, and N is a positive integer. Specifically, after the first device receives the third information indicating the information to be proved of the first entity, the first device can determine the first information from the first data set based on the third information. In other words, after the first device receives the third information, the first device can determine the corresponding evaluation rule based on the information to be proved indicated by the third information, so as to facilitate the subsequent execution of the verification process based on the evaluation rule.

[0125] In a possible implementation of Example 2, the first device determines the first information from the first data set based on the third information, including: the first device determines the first information from the first data set based on the triple information corresponding to the information to be proved of the first entity; the triple information includes the identifier of the first entity, the relationship between the first entity and the information to be proved, and the identifier of the information to be proved; wherein the third information includes the triple information, or the triple information is obtained by semantically analyzing the third information. Specifically, in the process of determining the first information, the first device can obtain the triple information corresponding to the information to be proved based on the third information, and then further determine the first information from the first data set based on the triple information. In addition, the first device can obtain the triple information through the above-mentioned multiple methods to enhance the flexibility of the implementation of the solution.

[0126] It can be understood that, when the triple information obtained by the first device is obtained by performing semantic analysis processing on the third information, the first device (or the hardware module and / or software module in the first device for performing the semantic analysis processing) can be called a semantic processing module (Semantic Processing Module, SPM), a semantic processing node, a semantic analysis module, a semantic analysis node, etc.

[0127] Optionally, the first device may implement the above-mentioned semantic analysis process through an AI algorithm (or AI model, AI operation, etc.). For example, the process in which the first device obtains the triple information by performing semantic analysis on the third information may include: the first device uses the third information as the input of the AI ​​algorithm (or AI model, AI operation, etc.), and outputs the triple information after semantic analysis by the AI ​​algorithm. Thus, the first device implements the above-mentioned semantic analysis process through an AI algorithm (or AI model, AI operation, etc.), so that the semantic analysis process has the characteristics of security, transparency, explainability and unbiasedness, which can further enhance the credibility of the subsequent verification process.

[0128] In a possible implementation of Example 2, the first device determines the second information based on the third information, including: the first device sends request information based on the third information, the request information is used to request the historical behavior information of the first entity; the first device receives the second information; or, the first device receives the historical behavior information of the first entity and determines the second information based on the historical behavior information of the first entity. Specifically, in the process of determining the second information, the first device can send request information based on the third information, and then obtain the second information based on the response to the request information (for example, the response includes the second information, or the response includes the historical behavior information of the first entity), so as to provide a specific implementation method for the first device to obtain the second information.

[0129] Optionally, the request information sent by the first device to request the historical behavior information of the first entity can be implemented in multiple ways. For example, the request information can carry the identifier of the first entity, so that the receiving end of the request information sends the historical behavior information of the first entity to the first device based on the identifier. For another example, the request information can carry the identifier of the first entity and / or the identifier of the information to be proved of the first entity, so that the receiving end of the request information sends the second information (i.e., the historical behavior information associated with the information to be proved of the first entity) to the first device based on the identifier.

[0130] Optionally, after the first device sends the request information based on the third information, the device that receives the request information and sends a response to the request information to the first device may be a second device, and the second device may store historical behavior information of one or more entities (the one or more entities include the first entity). For example, the second device may be an access device to a public database (such as a server, workstation, etc.), an access device to a blockchain (such as a server, workstation, desktop, laptop, etc.), or other devices, which are not limited here.

[0131] It can be understood that when the second device is an access device of the blockchain, the combination with blockchain technology can improve data security.

[0132] Optionally, the first device may locally store historical behavior information of one or more entities, and accordingly, the first device determines the second information based on the third information, including: the first device may determine the second information from the information stored locally based on the third information.

[0133] In a possible implementation of Example 2, the third information is generated based on a template provided by a consortium blockchain (CB), or the third information is generated based on a template provided by a centralized node. Specifically, the third information indicating the information to be proved of the first entity can be generated based on a template to reduce the implementation complexity of determining triple information from the third information and improve the accuracy of determining triples.

[0134] Optionally, the template may be provided by a distributed node (such as a CB), a centralized node (such as a third-party authority), or other nodes, which are not limited here.

[0135] In a possible implementation of Example 2, the method further includes: the first device updates the first data set based on the verification result. Specifically, after the first device performs the verification process to obtain the verification result, the first device may also update the first data set based on the verification result, and may subsequently use the updated first data set to perform other verification processes in order to improve the accuracy of the other verification processes.

[0136] In a possible implementation manner of implementation example 1 or implementation example 2, the method further includes: the first device sends indication information indicating the verification result. Specifically, after the first device performs the verification process to obtain the verification result, the first device may also send indication information indicating the verification result, so that the recipient of the indication information can clarify the verification result of the information to be proved of the first entity based on the indication information, and determine whether to establish a trust relationship with the first entity based on the verification result.

[0137] In addition, when the first data set is stored in another device other than the first device (such as the aforementioned implementation example 1), the other device can perform the above process of determining the first information based on the third information based on the first data set. Accordingly, after the first device sends the indication information indicating the verification result, the other device can serve as the recipient of the indication information and update the first data set based on the indication information.

[0138] It can be seen from the above implementation process that the key points of the embodiments of the present application are: the entity can make a declaration about its identity according to a template (such as a target provided by a distributed node (such as a CB), or a template provided by a centralized node (such as a third-party authority), etc.), and then based on the declaration, the evaluation criteria for determining whether the declaration is credible are automatically extracted from the dynamic knowledge graph through a rule mining algorithm, and at the same time, information about the entity in multiple nodes of the public chain is extracted as evidence, which is input into a proof engine supported by a trusted AI language model to verify whether the entity meets the evaluation criteria, and then by integrating the compliance status, it is finally predicted whether the entity's declaration is credible. In addition, the dynamic knowledge graph is updated in real time, and the declaration verified to be valid will be added to the knowledge graph as new factual information. In other words, the technical means provided by the embodiments of the present application include one or more of the following:

[0139] 1. Extract the declaration keyword triple information (including subject, relation, and object) based on the information provided by the entity.

[0140] 2. Generate indicators required for verification based on the declaration triple information (such as the evaluation rules mentioned in the previous embodiment).

[0141] 3. Obtain the identity of the entity from the declaration triplet, and obtain its historical information (such as the historical behavior information mentioned in the previous embodiment) based on the entity's identity (such as from the blockchain).

[0142] 4. Generate evidence required for verification based on historical information (e.g., the process of determining the second information based on the historical behavior information of the first entity), and perform the verification process of the statement.

[0143] like Figure 5 As shown, taking the storage of historical behavior information through blockchain as an example, the system architecture of the embodiment of the present application includes three parts: declaration, proof, and evidence, which are mainly supported by knowledge graph, AI algorithm, and blockchain technology respectively.

[0144] Statement (i.e., the third information in the preceding embodiment): a statement issued by an entity according to standards established by a trusted authority, and converted by an AI algorithm (e.g., a natural language processing (NLP) tool) into triple information - the identifier of the first entity, the relationship between the first entity and the information to be proved, and the identifier of the information to be proved, respectively denoted as "Subject, Relationship, Object" in the figure.

[0145] Evidence (i.e. historical behavior information in the previous example): original data generated by the entity and stored in the blockchain (public chain), which is open and transparent and cannot be tampered with at will.

[0146] Proof (i.e. the verification process in the previous embodiment): Verify whether the statement is valid based on evidence, supported by a trusted AI algorithm, which can automatically generate corresponding evaluation rules for different statements and automatically verify them. Trusted AI algorithms must be safe, transparent, explainable and unbiased.

[0147] Optionally, in some implementations, the process involved may include:

[0148] 1. The entity provides a statement and extracts keyword triples (subject, relation, object) from the statement through semantic role labeling, such as the process of performing semantic analysis on the third information to obtain triple information in the previous article.

[0149] 2. The rule mining algorithm extracts rules from the knowledge graph to evaluate whether a statement is valid based on the statement, such as the process of determining the first information through the third information mentioned above.

[0150] 3. Extract the original data about the entity from the public chain and process it into evidence that can be used to verify the claim, such as the process of determining the second information through the third information mentioned above.

[0151] 4. The proof engine uses relevant evidence to verify whether the entity satisfies the previously extracted rules, such as the process of verifying the information to be proved of the first entity based on the first information and the second information.

[0152] 5. Add the verified true statements as new knowledge to the knowledge graph, such as the process of updating the first data set based on the verification results mentioned above.

[0153] The following will be Figures 6 to 8 The examples shown are used to exemplify the above embodiments. Figures 6 to 8 In the example, the first entity is recorded as "entity (EN)", and the first device executing the above method may include Figures 6 to 8 "AE" or including Figures 6 to 8 The “SPM, RMM, KEM and AE” and other logic modules in the first device are described in detail in the following embodiments.

[0154] See also Figure 6 , is a schematic diagram of the information processing method provided in this application, and the method includes the following steps.

[0155] Step 1. CB sends its stored claim template (claimtemplate(stored on CB)) to EN.

[0156] Step 2.EN fills in the claim generation according to the template.

[0157] Step 3. EN sends the claim in the template format (EN's claim (in template's format)) to SPM.

[0158] Optionally, in the case where the first device includes logic modules such as SPM, RMM, KEM and AE, step 3 is an implementation example of receiving the third information in the above step S401.

[0159] Step 4. SPM extracts keyword triplets from the claim through semantic analysis (claim triplets generated by semantic processing).

[0160] Step 5. SPM sends EN's claim triplets to RMM.

[0161] Step 6. RMM uses rule mining algorithms to extract evaluation indicators for EN statements from the knowledge graph (rule extraction based on Knowledge graph and rule mining algorithms).

[0162] Step 7. RMM sends the extracted evaluation metrics (metrics for attestation) to AE.

[0163] Optionally, in the case where the first device includes an AE, step 7 is an implementation example of receiving the first information in the aforementioned step S301.

[0164] Step 8. SPM sends EN's identity information to KEM.

[0165] Step 9. KEM provides PB with EN identity information and requests raw data related to EN (request for EN's raw data (given identity info)).

[0166] Step 10. PB sends the raw data about EN stored on multiple nodes (EN's raw data (stored on multiple PBs)) to KEM.

[0167] Step 11. KEM embeds the original data and extracts relevant knowledge and evidence (knowledge and evidence generated by embedding).

[0168] Step 12. KEM sends EN's evidence to AE.

[0169] Optionally, in the case where the first device includes an AE, step 12 is an implementation example of receiving the second information in the aforementioned step S301.

[0170] Step 13. AE conducts claim at testing based on metrics and evidences extracted previously.

[0171] Optionally, step 13 is an implementation example of performing the verification process in the above step S202 (or step S302 or step S403).

[0172] Step 14. AE sends the attestation results to PB.

[0173] Step 15. PB updates the knowledge graph and algorithms in RMM with the newly received knowledge, that is, PB sends the verification results and information involved in the verification process (such as triples, evidence, etc.) to RMM.

[0174] based on Figure 6 As can be seen from the implementation process, EN initiates the statement by itself and uses EN's own relevant information as the corresponding evidence, unlike the traditional solution that needs to rely on other nodes. Trusted AI (ie AE) automatically determines whether EN's relevant evidence can support its statement, and the process is more objective, transparent and intelligent. At the same time, the combination with blockchain technology also ensures the security of user data.

[0175] See also Figure 7 , is a schematic diagram of the information processing method provided in this application, and the method includes the following steps.

[0176] Step 1. EN generates a claim (claim generation).

[0177] Step 2. EN sends the claim to SPM (EN's claim).

[0178] Optionally, in the case where the first device includes logic modules such as SPM, RMM, KEM and AE, step 3 is an implementation example of receiving the third information in the above step S401.

[0179] Step 3. SPM extracts keyword triplets from the claim through semantic analysis (claim triplets generated by semantic processing).

[0180] Step 4. SPM sends EN's claim triplets to RMM.

[0181] Step 5. RMM uses rule mining algorithms to extract evaluation indicators for EN statements from the knowledge graph (rule extraction based on Knowledge graph and rule mining algorithms).

[0182] Step 6. RMM sends the extracted evaluation metrics (metrics for attestation) to AE.

[0183] Optionally, in the case where the first device includes an AE, step 7 is an implementation example of receiving the first information in the aforementioned step S301.

[0184] Step 7. RMM sends EN's identity information to KEM.

[0185] Step 8. KEM provides PB with EN identity information and requests raw data related to EN (request for EN's raw data (given identity info)).

[0186] Step 9. PB sends the raw data about EN stored on multiple nodes to KEM data (EN'srawdata(stored on multiplePBs)).

[0187] Step 10. KEM embeds the original data and extracts relevant knowledge and evidence (evidences generated by embedding).

[0188] Step 11. KEM sends EN's evidence to AE.

[0189] Optionally, in the case where the first device includes an AE, step 12 is an implementation example of receiving the second information in the aforementioned step S301.

[0190] Step 12. AE conducts claim at testing based on metrics and evidences extracted previously.

[0191] Optionally, step 12 is an implementation example of performing the verification process in the above step S202 (or step S302 or step S403).

[0192] Step 13. AE sends the attestation results to PB.

[0193] Step 14. PB updates the knowledge graph and algorithms in RMM with the newly received knowledge, that is, PB sends the verification results and information involved in the verification process (such as triples, evidence, etc.) to RMM.

[0194] Figure 7 The embodiment shown and Figure 6 The differences of the shown embodiments are: Figure 7 The illustrated embodiments do not require declarations that a specific template must be followed. Figure 6 For the illustrated embodiment, a more free-form declaration is supported.

[0195] See also Figure 8 , is a schematic diagram of the information processing method provided in this application, and the method includes the following steps.

[0196] Step 1. Third party authorities provide EN with a claim template.

[0197] Step 2.EN fills in the claim generation according to the template.

[0198] Step 3. EN sends the claim in the template format (EN's claim (in template's format)) to SPM.

[0199] Optionally, in the case where the first device includes logic modules such as SPM, RMM, KEM and AE, step 3 is an implementation example of receiving the third information in the above step S401.

[0200] Step 4. SPM extracts keyword triplets from the claim through semantic analysis (claim triplets generated by semantic processing).

[0201] Step 5. SPM sends EN's claim triplets to RMM.

[0202] Step 6. RMM uses rule mining algorithms to extract evaluation indicators for EN statements from the knowledge graph (rule extraction based on Knowledge graph and rule mining algorithms).

[0203] Step 7. RMM sends the extracted evaluation metrics (metrics for attestation) to AE.

[0204] Optionally, in the case where the first device includes an AE, step 7 is an implementation example of receiving the first information in the aforementioned step S301.

[0205] Step 8. SPM sends EN's identity information to KEM.

[0206] Step 9. KEM provides EN identity information to a publicly accessible database and requests for EN's raw data (given identity info) related to EN.

[0207] Step 10. The publicly accessible database sends the raw data about EN to KEM (EN's raw data (stored on multiple PBs)).

[0208] Step 11. KEM embeds the original data and extracts relevant knowledge and evidence (knowledge and evidence generated by embedding).

[0209] Step 12. KEM sends EN's evidence to AE.

[0210] Optionally, in the case where the first device includes an AE, step 12 is an implementation example of receiving the second information in the aforementioned step S301.

[0211] Step 13. AE conducts claim at testing based on metrics and evidences extracted previously.

[0212] Optionally, step 13 is an implementation example of performing the verification process in the above step S202 (or step S302 or step S403).

[0213] Step 14. AE sends the attestation results to a publicly accessible database.

[0214] Step 15. The publicly accessible database updates the knowledge graph and algorithms in the RMM with the newly received knowledge, that is, sends the verification results and the information involved in the verification process (such as triples, evidence, etc.) to the RMM.

[0215] exist Figure 8 In the illustrated embodiment, the use of blockchain is not emphasized, and a publicly accessible database may be used to enhance the flexibility of the solution implementation.

[0216] based on Figures 6 to 8 It can be seen from the embodiments shown that the main beneficial effects are as follows:

[0217] In some implementations, the solution can be made more open, that is, more scalable, and the dependence on a single node can be avoided.

[0218] In some implementations, the solution can be made more autonomous, that is, it emphasizes self-certification and does not need to rely on other nodes.

[0219] In some implementations, the solution can be made more intelligent, that is, the trustor has lower requirements and does not need to have relevant professional knowledge.

[0220] The present application is described above from the perspective of methods and systems. The device provided by the present application will be introduced below based on more drawings.

[0221] See also Fig. 9 , an embodiment of the present application provides a device 900, which includes an acquisition unit 901 and a verification unit 902.

[0222] It should be understood that the device 900 can implement the functions of the first device in the above method embodiment, and thus can also achieve the beneficial effects of the above method embodiment. In the embodiment of the present application, the device 900 can be the first device in the above method embodiment, or it can be an integrated circuit or component, such as a chip, inside the first device in the above method embodiment.

[0223] In one possible implementation, the acquisition unit 901 is used to acquire first information and second information, the first information indicating an evaluation rule for whether the information to be proved of the first entity is valid, and the second information indicating historical behavior information of the first entity associated with the information to be proved, and the information to be proved includes capabilities and / or qualifications; the verification unit is used to verify the information to be proved of the first entity based on the first information and the second information to obtain a verification result.

[0224] In a possible implementation manner, the acquisition unit 901 is used to acquire the first information and the second information, including: the acquisition unit 901 is used to receive the first information and the second information.

[0225] In a possible implementation, the acquisition unit 901 is used to acquire the first information and the second information, including: the acquisition unit 901 receives third information, and the third information is used to indicate the information to be proved of the first entity; the acquisition unit 901 determines the first information based on the third information; the acquisition unit 901 determines the second information based on the third information.

[0226] In a possible implementation, the acquisition unit 901 determines the first information based on the third information, including: the acquisition unit 901 determines the first information from a first data set based on the third information, the first data set indicating N evaluation rules for whether the information to be proved is valid, and N is a positive integer.

[0227] In a possible implementation, the acquisition unit 901 determines the first information from the first data set based on the third information, including: the acquisition unit 901 determines the first information from the first data set based on the triple information corresponding to the information to be proved of the first entity; the triple information includes the identifier of the first entity, the relationship between the first entity and the information to be proved, and the identifier of the information to be proved; wherein, the third information includes the triple information, or the triple information is obtained by performing semantic analysis on the third information.

[0228] In one possible implementation, the acquisition unit 901 determines the second information based on the third information, including: the acquisition unit 901 sends request information based on the third information, and the request information is used to request the historical behavior information of the first entity; the acquisition unit 901 receives the second information; or, the acquisition unit 901 receives the historical behavior information of the first entity and determines the second information based on the historical behavior information of the first entity.

[0229] In a possible implementation, the third information is generated based on a template provided by the consortium chain CB, or the third information is generated based on a template provided by a centralized node.

[0230] In one possible implementation, Fig.10 As shown, compared to Fig. 9 The device shown further includes an updating unit 903; the updating unit 903 is used to update the first data set based on the verification result.

[0231] In one possible implementation, Fig.10 As shown, compared to Fig. 9The device shown also includes a sending unit 904; the sending unit 904 is used to send indication information indicating the verification result.

[0232] In one possible implementation, the verification unit 902 is used to verify the information to be proved of the first entity based on the first information and the second information, and the verification result obtained includes: when the support degree of the first information and the second information is greater than or equal to a first threshold, the verification unit 902 determines that the verification result is a passed verification; and / or, when the support degree of the first information and the second information is less than or equal to a second threshold, the verification unit determines that the verification result 902 is a failed verification.

[0233] In a possible implementation, the information to be proved includes capabilities and / or qualifications.

[0234] It should be noted that the information execution process of the units of the above-mentioned device 900 and the corresponding technical effects, etc., can be specifically referred to the description in the method embodiment shown in the above-mentioned application, and will not be repeated here.

[0235] See also Fig.11 , is another schematic structural diagram of the device 1100 provided in the present application, and the device 1100 at least includes an input and output interface 1102. The device 1100 may be a chip or an integrated circuit.

[0236] Optionally, the device further includes a logic circuit 1101 .

[0237] in, Fig. 9 or Fig.10 Any of the acquisition unit 901 and the sending unit 904 may be a communication interface, which may be Fig.11 The input / output interface 1102 in the communication interface may include an input interface and an output interface. Alternatively, the communication interface may also be a transceiver circuit, which may include an input interface circuit and an output interface circuit.

[0238] In addition, the logic circuit 1101 and the input-output interface 1102 can execute the method executed by any device (eg, the first device) in the aforementioned method embodiments and achieve corresponding beneficial effects, which will not be described in detail here.

[0239] Optional, Fig. 9 or Fig.10 Any of the acquisition unit 901, the verification unit 902 and the update unit 903 can be Fig.11 The logic circuit 1101 in the embodiment of the present invention can be a processing device, and the functions of the processing device can be partially or completely implemented by software. The functions of the processing device can be partially or completely implemented by software.

[0240] Optionally, the processing device may include a memory and a processor, wherein the memory is used to store a computer program, and the processor reads and executes the computer program stored in the memory to perform corresponding processing and / or steps in any one of the method embodiments.

[0241] Alternatively, the processing device may include only a processor. A memory for storing a computer program is located outside the processing device, and the processor is connected to the memory via a circuit / wire to read and execute the computer program stored in the memory. The memory and the processor may be integrated together, or may be physically independent of each other.

[0242] Optionally, the processing device may be one or more chips, or one or more integrated circuits. For example, the processing device may be one or more field-programmable gate arrays (FPGA), application specific integrated circuits (ASIC), system on chip (SoC), central processor unit (CPU), network processor (NP), digital signal processor (DSP), microcontroller unit (MCU), programmable logic device (PLD) or other integrated chips, or any combination of the above chips or processors.

[0243] See also Fig.12 , is the device 1200 involved in the above embodiments provided in an embodiment of the present application, and the device 1200 can specifically be the first device in the above embodiments.

[0244] Herein, a possible logical structure diagram of the device 1200 is shown. The device 1200 may include but is not limited to at least one processor 1201 and a communication port 1202 .

[0245] Further optionally, the device may also include at least one of a memory 1203 and a bus 1204 . In an embodiment of the present application, the at least one processor 1201 is used to control and process the actions of the device 1200 .

[0246] In addition, the processor 1201 can be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It can implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and the like. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0247] It should be noted that Fig.12 The device 1200 shown can be specifically used to implement the steps implemented by any device (such as the first device) in the aforementioned method embodiment, and achieve the technical effects corresponding to any device. Fig.12 The specific implementation methods of the device shown can all be referred to the description in the aforementioned method embodiment, and will not be described in detail here.

[0248] An embodiment of the present application also provides a computer-readable storage medium. When the computer execution instruction is executed by a processor, the processor executes the method described in the possible implementation manner of any device (for example, the first device) in the aforementioned method embodiment.

[0249] An embodiment of the present application also provides a computer program product (or computer program). When the computer program product is executed by the processor, the processor executes a method that may be implemented by any device (such as the first device) in the above method embodiment.

[0250] An embodiment of the present application also provides a chip system, which includes at least one processor for implementing the functions involved in the possible implementation methods of any device (such as the first device) in the above method embodiment.

[0251] Optionally, the chip system further includes an interface circuit, which provides program instructions and / or data for the at least one processor. In a possible design, the chip system may also include a memory, which is used to store program instructions and data necessary for the terminal device. The chip system may be composed of a chip, or may include a chip and other discrete devices.

[0252] In a possible design, the chip system may also include a memory, which is used to store the necessary program instructions and data of any device in the above method embodiment. The chip system may be composed of a chip, or may include a chip and other discrete devices.

[0253] An embodiment of the present application also provides a system, which includes the first device in any of the above embodiments and a possible second device.

[0254] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are schematic. For example, the division of the units is a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0255] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0256] In addition, each functional unit in each embodiment of the present application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the part of the technical solution of the present application that essentially contributes or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a disk or an optical disk.

[0257] The above is only a specific implementation of the embodiment of the present application, but the protection scope of the embodiment of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or replacements within the technical scope disclosed in the embodiment of the present application, which should be included in the protection scope of the embodiment of the present application. Therefore, the protection scope of the embodiment of the present application should be based on the protection scope of the claims.

Claims

1. An information processing method, characterized in that: include: The first device acquires first information and second information, the first information indicating an evaluation rule of whether information to be proved of the first entity is valid, and the second information indicating historical behavior information of the first entity associated with the information to be proved, the information to be proved including capability and / or qualification; The first device verifies the information to be verified based on the first information and the second information to obtain a verification result.

2. The method according to claim 1, characterized in that The first device acquiring the first information and the second information includes: The first device receives the first information and the second information.

3. The method according to claim 1, characterized in that The first device acquiring the first information and the second information includes: The first device receives third information, where the third information is used to indicate the information to be proved of the first entity; The first device determines the first information based on the third information, and determines the second information based on the third information.

4. The method according to claim 3, characterized in that The first device determining the first information based on the third information includes: The first device determines the first information from a first data set based on the third information, where the first data set indicates N evaluation rules for whether the information to be proved is valid, where N is a positive integer.

5. The method according to claim 4, characterized in that The first device determines the first information from the first data set based on the third information, including: The first device determines the first information from the first data set based on triple information corresponding to the information to be proved of the first entity; the triple information includes an identifier of the first entity, a relationship between the first entity and the information to be proved, and an identifier of the information to be proved; The third information includes the triple information, or the triple information is obtained by performing semantic analysis on the third information.

6. The method according to any one of claims 3 to 5, characterized in that: The first device determining the second information based on the third information includes: The first device sends request information based on the third information, where the request information is used to request historical behavior information of the first entity; The first device receives the second information; Alternatively, the first device receives historical behavior information of the first entity, and determines the second information based on the historical behavior information of the first entity.

7. The method according to any one of claims 3 to 6, characterized in that: The third information is generated based on a template provided by the alliance chain CB, or the third information is generated based on a template provided by a centralized node.

8. The method according to any one of claims 4 to 7, characterized in that: The method further comprises: The first device updates the first data set based on the verification result.

9. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: The first device sends indication information indicating the verification result.

10. The method according to any one of claims 1 to 9, characterized in that: The first device verifies the information to be verified based on the first information and the second information, and obtains a verification result including: When the support degree of the first information and the second information is greater than or equal to a first threshold, the first device determines that the verification result is verification passed; and / or, When the support degree of the first information and the second information is less than or equal to a second threshold, the first device determines that the verification result is verification failure.

11. An information processing device, characterized in that: It includes an acquisition unit and a verification unit; The acquisition unit is used to acquire first information and second information, the first information indicating an evaluation rule of whether the information to be proved of the first entity is valid, and the second information indicating historical behavior information of the first entity associated with the information to be proved, the information to be proved including capability and / or qualification; The verification unit is used to verify the information to be verified of the first entity based on the first information and the second information to obtain a verification result.

12. A device, characterized in that: The device comprises at least one processor, wherein the at least one processor is coupled to a memory; the memory is used to store programs or instructions; The at least one processor is configured to execute the program or instruction so that the apparatus implements the method according to any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that: The medium stores instructions; When the instructions are executed by a computer, the method according to any one of claims 1 to 10 is implemented.

14. A computer program product, characterized in that The computer program product comprises computer instructions; When part or all of the computer instructions are executed on a computer, the method according to any one of claims 1 to 10 is executed.

15. A chip, characterized in that: The chip includes a processor and a communication interface; The communication interface is coupled to the processor, and the processor is used to run a computer program or instruction to implement the method as claimed in any one of claims 1 to 10.

Images