Trust evaluation method and system and related equipment

Abstract

The invention provides a trust evaluation method and system and related equipment, the method is applied to the trust evaluation system comprising evaluation equipment, first equipment and second equipment, and the first equipment sends a trust evaluation request comprising identity information of the second equipment to the evaluation equipment for obtaining a trust evaluation result of the second equipment; the evaluation module obtains trust evaluation data of the second equipment according to the identity information of the second equipment after receiving the trust evaluation request; and then performing trust evaluation on the second equipment according to the trust evaluation model for trust evaluation and the trust evaluation data of the second equipment to obtain a trust evaluation result of the second equipment, and sending the trust evaluation result to the first equipment so that the first equipment determines whether to trust the second equipment or not. The trust evaluation of different devices is realized through the centralized evaluation module, the trust evaluation problem between devices adopting different trust evaluation models can be solved, and a trust relationship is established between two devices adopting different trust evaluation models.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a trust evaluation method, system and related equipment. Background Art

[0002] With the diversification of network functions and services, security authentication alone can no longer meet the trust requirements between network devices and services. Therefore, the concepts of trust evaluation and grading need to be introduced in future networks, and the information interaction between network devices should be managed based on the results of trust evaluation and trust levels.

[0003] In the field of information and communications technology (ICT), trust is the belief that a physical device or an object in cyberspace will complete a given task in a specified manner, thereby achieving a specified goal. Currently, there is no unified standard for trust evaluation. Different manufacturers may use different trust evaluation models for different devices and application scenarios. Therefore, the results of trust evaluation vary depending on the trust evaluation model. Therefore, how to enable any two devices in the network to establish a trust relationship is a technical problem that needs to be solved. Summary of the invention

[0004] The present application provides a trust evaluation method, system and related devices, which can establish a trust relationship between two devices using different trust evaluation models.

[0005] In a first aspect, the present application provides a trust assessment method, including: an assessment device receives a trust assessment request including identity information of a second device sent by a first device, the trust assessment request is used to obtain a trust assessment result of the second device; then the assessment device obtains trust assessment data of the second device based on the identity information of the second device; trust assessment is performed on the second device based on a trust assessment model and the trust assessment data of the second device to obtain a trust assessment result of the second device, and the trust assessment result of the second device is sent to the first device.

[0006] By deploying a centralized evaluation device capable of performing trust evaluation in the trust evaluation system and implementing the above method, when any two devices in the trust evaluation system need to establish a connection, the evaluation device performs a trust evaluation on the devices through a trust evaluation model, so that the devices determine whether to establish a connection based on the trust evaluation results, which can solve the trust evaluation problem between devices using different trust evaluation models and establish a trust relationship between two devices using different trust evaluation models.

[0007] In a possible implementation, the method further includes: the evaluation device receives and records the registration information of the first device sent by the first device, wherein the registration information of the first device includes the identity information of the first device and the trust evaluation model of the first device; wherein the result obtained by performing the trust evaluation using the trust evaluation model of the first device will be recognized by the first device. The evaluation data attribute of the first device indicates the attribute of the data of the second device required when performing the trust evaluation on the second device according to the trust evaluation model of the first device.

[0008] All devices in the trust evaluation system need to send their registration information to the evaluation device, which is then saved by the evaluation device. For example, both the first device and the second device need to upload registration information to the evaluation device. When the first device requests a trust evaluation on the second device, the evaluation device can perform a trust evaluation on the second device based on the saved trust evaluation model of the first device and the information of the second device.

[0009] In a possible implementation, the evaluation device performs a trust evaluation on the second device according to the trust evaluation model and the trust evaluation data of the second device to obtain a trust evaluation result of the second device, including: the evaluation device obtains a trust evaluation model of the first device according to the identity information of the first device; then performs a trust evaluation on the second device according to the trust evaluation model of the first device and the trust evaluation data of the second device to obtain a first trust evaluation result of the second device, and uses the first trust evaluation result as the trust evaluation result of the second device; wherein the trust evaluation request includes the identity information of the first device.

[0010] Since only the result obtained by using the trust assessment model of the first device will be recognized by the first device, when the first device requests a trust assessment on the second device, only the result obtained by using the trust assessment model of the first device and the trust assessment data of the second device will be accepted by the first device, thereby improving the security of the system and the device.

[0011] In a possible implementation, the registration information of the first device further includes a presentation form of an evaluation result corresponding to the first device, where the presentation form of the evaluation result corresponding to the first device refers to a presentation form of an evaluation result obtained by performing a trust evaluation using a trust evaluation model of the first device;

[0012] The above-mentioned trust assessment is performed on the second device according to the trust assessment model and the trust assessment data of the second device to obtain the trust assessment result of the second device, including: the assessment device performs a trust assessment on the second device according to the trust assessment model of the second device and the trust assessment data of the second device to obtain a second trust assessment result of the second device; according to the assessment result presentation form corresponding to the first device, the second trust assessment result is converted into the assessment result presentation form corresponding to the first device to obtain the trust assessment result of the second device.

[0013] The evaluation device can also perform a trust evaluation on the second device according to the trust evaluation model of the second device. Since the trust evaluation model of the second device may be different from the trust evaluation model of the first device, the presentation form of the evaluation result may be different. For example, the trust evaluation model of the first device is a decision model, and the evaluation result obtained is a trust level. The trust evaluation model of the second device is a numerical model, and the evaluation result obtained is a numerical value. Then, the evaluation device converts the second trust evaluation result into the presentation form of the evaluation result corresponding to the first device according to the presentation form of the evaluation result corresponding to the first device, so that the first device can recognize it.

[0014] In a possible implementation, the registration information of the first device also includes evaluation data attributes of the first device, and the evaluation data attributes of the first device indicate attributes of data of the second device required when trust evaluation is performed on the second device according to the trust evaluation model of the first device; that is, when the trust evaluation model of the first device evaluates a device, data of attributes of the device is required.

[0015] Before the trust assessment model of the second device and the trust assessment data of the second device are used to perform trust assessment on the second device, the method further includes: the assessment device obtains the trust assessment model of the first device based on the identity information of the first device, and when the trust assessment data of the second device does not meet the assessment data attributes of the first device, obtains the trust assessment model of the second device and the assessment result presentation form corresponding to the first device, and then performs trust assessment on the second device based on the trust assessment model of the second device.

[0016] In the case where the trust evaluation data of the second device does not satisfy the data required by the trust evaluation model of the first device for trust evaluation, the trust evaluation of the second device can be performed using the trust evaluation model of the second device.

[0017] In a possible implementation, the method further includes: the evaluation device receives and records an access control policy of the first device sent by the management device, where the access control policy of the first device indicates devices that the first device can access and devices that can access the first device.

[0018] By configuring the access control policy of the first device, when the first device requests to perform a trust evaluation on other devices, for example, the other device is the above-mentioned second device, the evaluation device can determine whether the first device can access the second device according to the access control policy of the first device, and the evaluation device will perform a trust evaluation on the second device only when the first device can access the second device; when other devices request to perform a trust evaluation on the first device, the evaluation device can also determine whether other devices can access the first device according to the access control policy of the first device, and the evaluation device will perform a trust evaluation on the first device only when other devices can access the first device. By configuring the access control policy, the security of each device in the trust evaluation system can be improved, and the normal operation of each device in the system can be guaranteed. For example, if a device with low security is configured not to access certain important devices in the system, intrusion into these important devices through devices with low security can be prevented.

[0019] In a possible implementation, the above-mentioned recording of the registration information of the first device includes: the evaluation device sends the registration information of the first device to the management device; the evaluation device receives the registration result of the first device returned by the management device, and the registration result includes approval of the registration or disapproval of the registration; when the registration result is approval of the registration, the evaluation device records the registration information of the first device and returns a response message of successful registration to the first device.

[0020] After the device joining the trust evaluation system sends the registration information to the evaluation module, the management device determines whether each device can join the trust evaluation system. Only when the management device determines that the device can join the trust evaluation system, the evaluation device will record the registration information of the device. This can prevent illegal devices from joining the trust evaluation system and causing security risks to other devices in the trust evaluation system.

[0021] In a possible implementation, the method further includes: the evaluation device receives and records the access control policy of the first device returned by the management device, the access control policy of the first device is configured by the management device when the registration result is approval of the registration, and the access control policy of the first device indicates the devices that the first device can access and the devices that can access the first device.

[0022] When the management device determines that a device can be added to the trust evaluation system, it will configure the access control policy of the device to avoid wasting computing resources.

[0023] In a possible implementation, the above-mentioned obtaining trust evaluation data of the second device according to the identity information of the second device includes: when the evaluation device determines according to the access control policy of the first device that the first device can obtain the trust evaluation result of the second device, obtaining the trust evaluation data of the second device according to the identity information of the second device.

[0024] The evaluation module can determine whether the first device can access the second device based on the access control policy of the first device. Only when the first device can access the second device will the evaluation module perform a trust evaluation on the second device to avoid establishing a connection between devices that cannot access each other, thereby improving the security of the system.

[0025] In a possible implementation, the evaluation device and the management device may be the same device or different devices. It should be understood that if the evaluation device and the management device are the same device, there will be no interaction process between the evaluation device and the management device.

[0026] In a second aspect, the present application provides a trust assessment method, which is applied to a trust assessment system including an assessment device, a first device, and a second device, wherein the first device sends a trust assessment request including identity information of the second device to the assessment device, and the trust assessment request is used to obtain a trust assessment result of the second device; after receiving the above-mentioned trust assessment request, the assessment device obtains trust assessment data of the second device according to the identity information of the second device; then the assessment device performs a trust assessment on the second device according to a trust assessment model used for trust assessment and the trust assessment data of the second device, obtains the trust assessment result of the second device, and sends the trust assessment result of the second device to the first device, so that the first device determines whether to establish a connection with the second device according to the trust assessment result.

[0027] The above-mentioned trust evaluation system can be a system in an Internet of Things scenario, for example, the trust evaluation system is a smart home scenario, and the above-mentioned evaluation device is deployed in a centralized device in the trust evaluation system that can perform calculations according to the trust evaluation model. By implementing the above-mentioned method, when any two devices in the trust evaluation system need to establish a connection, the evaluation device performs a trust evaluation on the devices through the trust evaluation model, so that the devices determine whether to establish a connection based on the trust evaluation results, which can solve the trust evaluation problem between devices using different trust evaluation models and establish a trust relationship between two devices using different trust evaluation models.

[0028] In a possible implementation, the method further includes: the first device sends registration information of the first device to the evaluation device, and after the evaluation device receives the registration information of the first device, the registration information of the first device is saved. The registration information of the first device includes the identity information of the first device, the trust evaluation model of the first device, and the evaluation data attribute of the first device; the result obtained by the trust evaluation model of the first device will be recognized by the first device; the evaluation data attribute of the first device indicates the attribute of the data of the second device required when the trust evaluation of the second device is performed according to the trust evaluation model of the first device.

[0029] All devices in the trust evaluation system need to send their registration information to the evaluation device, which then saves it. For example, both the first device and the second device need to upload their registration information to the evaluation device. When the first device requests a trust evaluation on the second device, the evaluation device can perform a trust evaluation on the second device based on the saved trust evaluation model of the first device and the information of the second device.

[0030] In a possible implementation, the trust assessment system further includes a management device; the method further includes: the management device obtains the identity information of the first device and configures an access control policy for the first device, the access control policy for the first device indicating the devices that the first device can access and the devices that can access the first device; the management device sends the identity information of the first device and the access control policy of the first device to the assessment device.

[0031] By configuring the access control policy of the first device, when the first device requests to perform a trust evaluation on other devices, for example, the other device is the above-mentioned second device, the evaluation device can determine whether the first device can access the second device according to the access control policy of the first device, and the evaluation device will perform a trust evaluation on the second device only when the first device can access the second device; when other devices request to perform a trust evaluation on the first device, the evaluation device can also determine whether other devices can access the first device according to the access control policy of the first device, and the evaluation device will perform a trust evaluation on the first device only when other devices can access the first device. By configuring the access control policy, the security of each device in the trust evaluation system can be improved, and the normal operation of each device in the system can be guaranteed. For example, if a device with low security is configured not to access certain important devices in the system, intrusion into these important devices through devices with low security can be prevented.

[0032] In a possible implementation, the trust evaluation system further includes a management device; before the evaluation device saves the registration information of the first device, it also includes: the evaluation device sends the registration information of the first device to the management device; the management device determines the registration result of the first device based on the registration information of the first device, and the registration result includes approval of the registration or disapproval of the registration; the evaluation device receives the registration result of the first device, and when the registration result is approval of the registration, saves the registration information of the first device, and returns a response message of successful registration to the first device.

[0033] After the device joining the trust evaluation system sends the registration information to the evaluation device, the management device determines whether each device can join the trust evaluation system. Only when the management device determines that the device can join the trust evaluation system will the evaluation device record the registration information of the device. This can prevent illegal devices from joining the trust evaluation system and causing security risks to other devices in the trust evaluation system.

[0034] In a possible implementation, the method further includes: when the registration result is approval of the registration, the management device configures an access control policy for the first device, the access control policy for the first device indicating devices that the first device can access and devices that can access the first device; and the management device sends the access control policy for the first device to the evaluation device.

[0035] When the management device determines that a device can be added to the trust evaluation system, it will configure the access control policy of the device to avoid wasting computing resources.

[0036] In a possible implementation, before the evaluation device performs a trust evaluation on the second device according to the trust evaluation model and the trust evaluation data of the second device, the process further includes: the evaluation device obtains a trust evaluation model of the first device according to the identity information of the first device in the trust evaluation request; and then performs a trust evaluation on the second device according to the trust evaluation model of the first device and the trust evaluation data of the second device to obtain a first trust evaluation result of the second device, and uses the first trust evaluation result as the trust evaluation result of the second device.

[0037] Since only the result obtained by trust assessment using the trust assessment model of the first device will be recognized by the first device, when the first device requests a trust assessment on the second device, only the result obtained by trust assessment on the second device using the trust assessment model of the first device and the trust assessment data of the second device will be accepted by the first device.

[0038] In a possible implementation, the evaluation device obtains the trust evaluation data of the second device according to the identity information of the second device, including: when the evaluation device determines according to the access control policy of the first device that the first device can obtain the trust evaluation result of the second device, obtaining the trust evaluation data of the second device according to the identity information of the second device.

[0039] The evaluation device can determine whether the first device can access the second device based on the access control policy of the first device. Only when the first device can access the second device will the evaluation device perform a trust evaluation on the second device to avoid establishing a connection between devices that cannot access each other, thereby improving the security of the system.

[0040] In a possible implementation, the registration information of the first device also includes an evaluation result presentation form corresponding to the first device, and the evaluation result presentation form corresponding to the first device refers to a presentation form of the evaluation result obtained by performing a trust evaluation using the trust evaluation model of the first device; the evaluation device obtains the trust evaluation model of the first device according to the identity information of the first device; if the trust evaluation data of the second device does not satisfy the trust evaluation model of the first device, the evaluation device obtains the trust evaluation model of the second device and the evaluation result presentation form corresponding to the first device; then a trust evaluation is performed on the second device according to the trust evaluation model of the second device and the trust evaluation data of the second device to obtain a second trust evaluation result of the second device; and according to the evaluation result presentation form corresponding to the first device, the second trust evaluation result is converted into the evaluation result presentation form corresponding to the first device to obtain the trust evaluation result of the second device.

[0041] In the case where the trust assessment data of the second device does not satisfy the trust assessment model of the first device, the trust assessment model of the second device can be used to perform a trust assessment on the second device. Since the trust assessment model of the second device may be different from the trust assessment model of the first device, the presentation form of the assessment result may be different. For example, the trust assessment model of the first device is a decision model, and the obtained assessment result is a trust level; the trust assessment model of the second device is a numerical model, and the obtained assessment result is a numerical value. The assessment device then converts the second trust assessment result into the assessment result presentation form corresponding to the first device according to the assessment result presentation form corresponding to the first device, and obtains the assessment result of the second device.

[0042] In a possible implementation, the evaluation device and the management device may be the same device or different devices. It should be understood that if the evaluation device and the management device are the same device, there will be no interaction process between the evaluation device and the management device.

[0043] In a third aspect, the present application provides a trust assessment system, including an assessment device, a first device, and a second device, wherein: the first device is used to send a trust assessment request including identity information of the second device to the assessment device, and the trust assessment request is used to obtain a trust assessment result of the second device; the assessment device is used to obtain trust assessment data of the second device according to the identity information of the second device after receiving the above-mentioned trust assessment request; then the assessment device performs a trust assessment on the second device according to a trust assessment model used for trust assessment and the trust assessment data of the second device, obtains the trust assessment result of the second device, and sends the trust assessment result of the second device to the first device, so that the first device determines whether to establish a connection with the second device according to the trust assessment result.

[0044] In a possible implementation, the trust assessment system further includes a management device, which is used to obtain identity information of the first device and configure an access control policy for the first device, wherein the access control policy of the first device indicates devices that the first device can access and devices that can access the first device; the management device sends the identity information of the first device and the access control policy of the first device to the assessment device.

[0045] Each device in the above-mentioned trust evaluation system can implement the operations performed by the corresponding device in the above-mentioned second aspect and any possible implementation manner of the second aspect.

[0046] In a fourth aspect, an embodiment of the present application provides a trust assessment device, comprising a communication module and an assessment module; wherein the communication module is used to receive a trust assessment request sent by a first device and including identity information of a second device, and the trust assessment request is used to obtain a trust assessment result of the second device; the assessment module is used to obtain trust assessment data of the second device based on the identity information of the second device; trust assessment is performed on the second device based on a trust assessment model and the trust assessment data of the second device to obtain a trust assessment result of the second device; and the communication module is further used to send the trust assessment result of the second device to the first device.

[0047] In a possible implementation, the communication module is further used to receive registration information of the first device sent by the first device; the recording module is used to record the registration information of the first device; wherein the registration information of the first device includes identity information of the first device, a trust assessment model of the first device and evaluation data attributes of the first device; the result obtained by performing trust assessment using the trust assessment model of the first device will be recognized by the first device; the evaluation data attributes of the first device indicate the attributes of the data of the second device required when performing trust assessment on the second device according to the trust assessment model of the first device.

[0048] In one possible implementation, the evaluation module is specifically used to: obtain a trust evaluation model of the first device according to the identity information of the first device; the trust evaluation request includes the identity information of the first device; perform a trust evaluation on the second device according to the trust evaluation model of the first device and the trust evaluation data of the second device to obtain a first trust evaluation result of the second device, and use the first trust evaluation result as the trust evaluation result of the second device.

[0049] In a possible implementation, the registration information of the first device further includes a presentation form of an evaluation result corresponding to the first device, where the presentation form of the evaluation result corresponding to the first device refers to a presentation form of an evaluation result obtained by performing a trust evaluation using a trust evaluation model of the first device;

[0050] The evaluation module is specifically used to: perform a trust evaluation on the second device according to the trust evaluation model of the second device and the trust evaluation data of the second device to obtain a second trust evaluation result of the second device; and convert the second trust evaluation result into an evaluation result presentation form corresponding to the first device according to the evaluation result presentation form corresponding to the first device to obtain a trust evaluation result of the second device.

[0051] In a possible implementation, the registration information of the first device also includes the evaluation data attributes of the first device, and the evaluation data attributes of the first device indicate the attributes of the data of the second device required when the trust evaluation model of the first device is used to perform a trust evaluation on the second device; that is, when the trust evaluation model of the first device is used to evaluate a device, the data of the attributes of the device is required. The evaluation module is also used to: obtain the trust evaluation model of the first device according to the identity information of the first device, and when the trust evaluation data of the second device does not meet the evaluation data attributes of the first device, obtain the trust evaluation model of the second device and the evaluation result presentation form corresponding to the first device, and then perform a trust evaluation on the second device according to the trust evaluation model of the second device.

[0052] In a possible implementation, the communication module is further used to receive an access control policy of the first device sent by the management device, the access control policy of the first device indicating devices that the first device can access and devices that can access the first device; the recording module is further used to record the access control policy of the first device.

[0053] In a possible implementation, the communication module is also used to send the registration information of the first device to the management device; receive the registration result of the first device returned by the management device, the registration result including approval of the registration or disapproval of the registration; the evaluation module is also used to send the registration information of the first device to the recording module when the registration result is approval of the registration, so that the recording module records the registration information of the first device; the communication module is also used to return a response message of successful registration to the first device.

[0054] In a possible implementation, the access control policy of the first device is configured by the management device when the registration result is approval of the registration.

[0055] In the fifth aspect, an embodiment of the present application provides a management device, including a communication module and a management module. The management module is used to implement the operation of the management device in the above-mentioned first aspect or any possible implementation method of the first aspect, and the communication module is used to receive information or data sent to the management device by other devices.

[0056] In a sixth aspect, an embodiment of the present application provides a computing device, comprising a processor and a memory, the memory being used to store instructions, and the processor being used to execute the instructions. When the processor executes the instructions, the method described in the first aspect or any possible implementation of the first aspect is implemented.

[0057] In the seventh aspect, an embodiment of the present application provides a management device, including a processor and a memory, the memory is used to store instructions, and the processor is used to execute the instructions. When the processor executes the instructions, it implements the method implemented by the management device in the second aspect or any possible implementation method of the second aspect.

[0058] In an eighth aspect, the present application provides a computer program product, which, when executed on a computing device, enables the computing device to execute the method described in the first aspect or any possible implementation of the first aspect.

[0059] In a ninth aspect, the present application provides another computer program product, which, when executed on a computing device, enables the computing device to execute the method implemented by the management device in the second aspect or any possible implementation of the second aspect.

[0060] In a tenth aspect, the present application provides a computer-readable storage medium, which stores instructions. When the instructions are executed on a server, the server executes the method described in the first aspect or any possible implementation of the first aspect.

[0061] In the eleventh aspect, the present application provides a computer-readable storage medium, which stores instructions. When the instructions are executed on a server, the server executes the method implemented by the management device in the second aspect or any possible implementation of the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0063] Figure 1 is a schematic diagram of a trust evaluation system provided in an embodiment of the present application;

[0064] Figure 2 is an interactive schematic diagram of a trust assessment method provided in an embodiment of the present application;

[0065] Figure 3 is a schematic diagram of a trust assessment device provided in an embodiment of the present application;

[0066] Figure 4 is a schematic diagram of a management device provided in an embodiment of the present application;

[0067] Figure 5 It is a schematic diagram of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0068] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0069] like Figure 1 As shown, Figure 1 It is a schematic diagram of a trust evaluation system provided by an embodiment of the present application, and the trust evaluation system includes an evaluation device, a first device, and a second device. When the first device needs to perform a trust evaluation on the second device to determine whether a connection can be established with the second device, the first device sends a trust evaluation request to the evaluation device, and the trust evaluation request includes the identity information of the second device, such as the identity (ID) of the second device, and the trust evaluation request is used to obtain the trust evaluation result of the second device. After receiving the above trust evaluation request, the evaluation device obtains the trust evaluation data of the second device from the database, and then the evaluation device performs a trust evaluation on the second device according to the trust evaluation model and the trust evaluation data of the second device, obtains the trust evaluation result of the second device, and finally sends the trust evaluation result of the second device to the first device.

[0070] After joining the trust evaluation system, the first device and the second device will send their respective registration information to the evaluation device. The registration information of the first device includes the identity information of the first device, the trust evaluation model of the first device, and the evaluation data attributes of the first device. Among them, the result obtained by using the trust evaluation model of the first device for trust evaluation will be recognized by the first device. The evaluation data attributes of the first device indicate the attributes of the data of the device to be evaluated required by the trust evaluation model of the first device when the trust evaluation of the device to be evaluated is performed through the trust evaluation model of the first device, that is, the attributes of the data that the device to be evaluated needs to provide. The registration information of the second device includes the identity information of the second device, the trust evaluation model of the second device, and the evaluation data attributes of the second device. Among them, the result obtained by using the trust evaluation model of the second device for trust evaluation will be recognized by the second device. The evaluation data attributes of the second device indicate the attributes of the data of the device to be evaluated required by the trust evaluation model of the second device when the trust evaluation of the device to be evaluated is performed through the trust evaluation model of the second device. After obtaining the registration information of the first device and the registration information of the second device, the device to be evaluated writes the registration information into the database for storage.

[0071] Optionally, the registration information also includes the device information of the device, and the device information of the first device includes one or more of the device role, device function, device ownership, device geographic information, manufacturer, known threat list, social attribute list, trust assessment model type, and trust measurement method. The device role indicates the role of the device in the trust assessment system. In the embodiment of the present application, the roles include administrator, member, and guest; the device function indicates the main function of the device; and the known threat list includes software vulnerabilities of the device.

[0072] Trust assessment model types include direct trust assessment models and indirect trust assessment models; trust measurement methods include numerical measurement methods and decision-based measurement methods. Numerical measurement methods refer to the evaluation results of trust assessment models as numerical values, and decision-based measurement methods refer to the evaluation results of trust assessment models as trust levels, which can directly indicate the degree of trust. For example, trust levels include no trust, low trust, medium trust, high trust, and fully trust. It should be noted that trust assessment model types can also be divided into numerical models and decision-based models. The evaluation results of numerical models are presented in numerical values, i.e., the result presentation form in the above numerical measurement methods; the evaluation results of decision-based models are presented in trust levels, i.e., the result presentation form in the above decision-based measurement methods.

[0073] Exemplarily, in a trust evaluation system composed of devices in a home network, the evaluation device can be a network access point (NAP), such as a router; or other computing devices with storage and computing functions. The first device and the second device can be smart home devices such as refrigerators, televisions, washing machines, sweeping robots, and cameras, smart phones, projectors, laptops, head-mounted devices, etc. The administrator can be a smart phone or laptop used by a user in the home network, and the roles of other devices in the home network are members; when other users' devices are added to the home network, the roles of other users' devices are guests.

[0074] It should be understood that after joining the trust evaluation system, the second device will also report the device information of the second device to the evaluation device, which will not be described in detail here.

[0075] In a possible implementation, the trust evaluation system further includes a management device; the management device is used to obtain the identity information of each device in the trust evaluation system, and then configure the access control policy of each device, and send the access control policy to the evaluation device. The access control policy of a device is used to indicate the devices that the device can access and the devices that can access the device. For example, the control policy of the first device indicates the devices that the first device can access and the devices that can access the first device.

[0076] In the embodiment of the present application, the management device and the evaluation device may be the same device or different devices. For example, in the above-mentioned home network, the management device may be the device whose role is the administrator. Figure 1 As shown in the figure, the trust evaluation system and method provided by the present application are introduced by taking the management device and the evaluation device as different devices as an example.

[0077] Based on the above Figure 1 The trust evaluation system shown introduces the trust evaluation method provided by the embodiment of the present application, such as Figure 2 As shown, Figure 2 1 is an interactive schematic diagram of a trust evaluation method provided in an embodiment of the present application. The trust evaluation method includes S201 to S206.

[0078] S201. The first device sends registration information of the first device to the evaluation device.

[0079] When the first device joins the trust evaluation system, it will send registration information to the evaluation device for registration. The registration information of the first device and the registration information of the second device include the contents described above, which will not be repeated here.

[0080] S202. The evaluation device records the registration information of the first device.

[0081] After receiving the registration information of the first device, the evaluation device saves the registration information of the first device.

[0082] In a possible implementation, the first device also sends registration information to the management device, and after receiving the registration information of the first device, the management device configures an access control policy for the first device, where the access control policy for the first device indicates devices that the first device can access and devices that can access the first device. The management device then sends the access control policy for the first device to the evaluation device.

[0083] In a possible implementation, after receiving the registration information of the first device sent by the first device, the evaluation device sends a registration request to the management device, and the registration request includes the registration information of the first device. After receiving the above registration request, the management device determines whether to agree to the registration of the first device based on the registration information of the first device. If the management device determines that it agrees to the registration request of the first device, it sends a response message of agreeing to the registration to the evaluation device; if the management device determines that it does not agree to the registration request of the first device, it sends a response message of not agreeing to the registration to the evaluation device. After receiving the response message from the management device, if the response message indicates that the registration is agreed, the evaluation device records the registration information of the first device in the database and returns a message of successful registration to the first device; if the response message indicates that the registration is not agreed, the evaluation device does not record the registration information of the first device and returns a message of failed registration to the first device.

[0084] When the management device determines that the registration of the first device is approved, the management device configures an access control policy for the first device, and then sends the access control policy for the first device to the evaluation device.

[0085] It should be noted that when the second device joins the trust evaluation system, the second device, the evaluation device and the management device will also perform the above operations, which will not be repeated here. In addition, in the embodiment of the present application, the trust evaluation method provided by the present application is introduced by taking the successful registration of the first device and the second device as an example.

[0086] S203. The first device sends a trust evaluation request to the evaluation device.

[0087] The trust evaluation request includes the identity information of the second device, such as the ID of the second device; the trust evaluation request is used to obtain the trust evaluation result of the second device. That is, the trust evaluation request instructs the evaluation device to perform a trust evaluation on the second device and send the trust evaluation result to the first device.

[0088] S204. The evaluation device obtains trust evaluation data of the second device according to the identity information of the second device.

[0089] The trust evaluation data is relevant information of the second device, such as the device information of the second device, and is used to perform a trust evaluation on the second device. After receiving the trust evaluation request sent by the first device, the evaluation device determines that the first device needs to obtain the trust evaluation result of the second device based on the identity information of the second device in the trust evaluation request. The evaluation device obtains the trust evaluation data of the second device from the database based on the identity information of the second device.

[0090] It should be noted that if the management device is configured with an access control policy of the first device, the evaluation device first determines whether the first device can access the second device according to the access control policy of the first device before obtaining the trust evaluation data of the second device according to the identity information of the second device. If the first device can access the second device, the evaluation device obtains the trust evaluation data of the second device from the database according to the identity information of the second device. It should be understood that in the embodiments of the present application, the example of the first device being able to access the second device is used for introduction.

[0091] S205. The evaluation device performs a trust evaluation on the second device according to the trust evaluation model and the trust evaluation data of the second device, and obtains a trust evaluation result of the second device.

[0092] After obtaining the trust evaluation data of the second device, the evaluation device performs a trust evaluation on the second device using the trust evaluation model and the trust evaluation data of the second device to obtain a trust evaluation result of the second device. The trust evaluation model may be a trust evaluation model of the first device or a trust evaluation model of the second device.

[0093] Solutions for two cases, in which the trust assessment model is a trust assessment model of a first device and the trust assessment model is a trust assessment model of a second device, are respectively introduced below.

[0094] In a possible implementation, the trust assessment request also includes identity information of the first device. After receiving the trust assessment request of the first device, the assessment device obtains the trust assessment model of the first device from the database according to the identity information of the first device, and obtains the trust assessment data of the second device from the database according to the identity information of the second device.

[0095] After acquiring the trust assessment model of the first device and the trust assessment data of the second device, the evaluation device performs a trust assessment on the second device according to the trust assessment model of the first device and the trust assessment data of the second device, and obtains a first trust assessment result of the second device. Since the first trust assessment result is determined by evaluating the trust assessment model of the first device, the first device can recognize the presentation form of the trust assessment result, and therefore the first trust assessment result is used as the trust assessment result of the second device.

[0096] Specifically, if the trust assessment data of the second device can meet the requirements of the trust assessment model of the first device for trust assessment, that is, the trust assessment data of the second device includes data corresponding to the assessment data attributes of the first device. It means that the evaluation device can complete the trust assessment of the second device based on the trust assessment model of the first device and the trust assessment data of the second device. Among them, the assessment data attributes of the first device indicate the attributes of the data of the second device required when the trust assessment of the second device is performed according to the trust assessment model of the first device. For example, the assessment data attributes of the first device include identity information, security protocol name, manufacturer, cryptographic algorithm, etc. If the trust assessment data of the second device includes data of the above attributes of the second device, it means that the trust assessment of the second device can be completed based on the trust assessment model of the first device and the trust assessment data of the second device.

[0097] In the case where the trust assessment data of the second device can meet the trust assessment requirements of the trust assessment model of the first device, the evaluation device performs a trust assessment on the second device according to the trust assessment model of the first device and the trust assessment data of the second device, obtains a first trust assessment result of the second device, uses the first trust assessment result as the trust assessment result of the second device, and sends the trust assessment result of the second device to the first device. In the case where the trust assessment data of the second device does not meet the trust assessment requirements of the trust assessment model of the first device, the evaluation device determines that the trust assessment result is an assessment failure, and returns a trust assessment result of an assessment failure to the first device.

[0098] In a possible implementation, the registration information of the first device further includes a presentation form of the evaluation result corresponding to the first device, wherein the presentation form of the evaluation result corresponding to the first device refers to a presentation form of the trust evaluation result obtained by performing a trust evaluation using a trust evaluation model of the first device. The presentation form of the trust evaluation result includes a numerical value and a trust level. The numerical value means that the trust evaluation result is a numerical value, and the trust level means that the trust evaluation result is a trust level, for example, the trust levels include no trust, low trust, medium trust, high trust, and fully trust.

[0099] When the evaluation device determines that the trust assessment data of the second device does not meet the requirements for trust assessment of the trust assessment model of the first device, the evaluation device can obtain the trust assessment model of the second device from the database, and then perform a trust assessment on the second device based on the trust assessment model of the second device and the trust assessment data of the second device to obtain a trust assessment result of the second device.

[0100] When the evaluation device determines that the trust evaluation data of the second device does not meet the requirements for trust evaluation of the trust evaluation model of the first device, if the evaluation device determines that the first device can accept the evaluation result obtained by the trust evaluation model of the second device, the evaluation device obtains the trust evaluation model of the second device and the evaluation result presentation form corresponding to the first device. The evaluation device performs a trust evaluation on the second device according to the trust evaluation model of the second device and the trust evaluation data of the second device, and obtains a second trust evaluation result of the second device.

[0101] Since the trust assessment model of the second device may be different from the trust assessment model of the first device, the presentation form of the assessment result may be different, and the first device cannot recognize the assessment result of the trust assessment model of the second device. For example, the trust assessment model of the first device is a decision model, and the obtained assessment result is a trust level, while the trust assessment model of the second device is a numerical model, and the obtained assessment result is a numerical value. The assessment device converts the second trust assessment result into the assessment result presentation form corresponding to the first device according to the assessment result presentation form corresponding to the first device, and obtains the assessment result of the second device.

[0102] Exemplarily, if the trust evaluation model of the first device is a decision model, the evaluation result obtained is a trust level, which includes no trust, low trust, medium trust, high trust, and fully trust. The trust evaluation model of the second device is a numerical model, and the evaluation result obtained is a numerical value. The conversion relationship between the numerical model and the evaluation result obtained by the decision model can be as shown in Table 1 below.

[0103] Table 1

[0104]

[0105]

[0106] S206. The evaluation device sends the trust evaluation result of the second device to the first device.

[0107] After obtaining the trust evaluation result of the second device, the evaluation device sends the trust evaluation result of the second device to the first device, so that the first device determines whether to establish a connection with the second device according to the trust evaluation result of the second device. For example, if the trust evaluation result of the second device is a trust level below medium trust, the first device determines not to establish a connection with the second device; if the trust evaluation result of the second device is a trust level of medium trust or above medium trust, the first device determines to establish a connection with the second device.

[0108] For the above method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present invention is not limited by the order of the actions described. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the present invention. Other reasonable step combinations that can be thought of by those skilled in the art based on the above description also fall within the scope of protection of the present invention. For example, if the above management device and the evaluation device are the same device, there will be no interaction process between the above management device and the evaluation device, and the operations performed by the above management device are performed by the evaluation device.

[0109] The present application also provides a trust evaluation device, such as Figure 3 As shown, Figure 3 It is a schematic diagram of a trust assessment device provided in an embodiment of the present application. The trust assessment device is used to implement the operations implemented in the above-mentioned trust assessment system; the trust assessment device 300 includes a communication module 310 and an evaluation module 320. Among them, the communication module 310 is used to receive a trust assessment request for a second device sent by a first device, the trust assessment request includes the identity information of the second device, and the trust assessment request is used to obtain the trust assessment result of the second device; the evaluation module 320 is used to obtain the trust assessment data of the second device according to the identity information of the second device; the trust assessment is performed on the second device according to the trust assessment model and the trust assessment data of the second device to obtain the trust assessment result of the second device. The communication module 310 is also used to send the trust assessment result of the second device to the first device.

[0110] In a possible implementation, the trust evaluation device 300 further includes a recording module 330. The communication module 310 is further used to receive the registration information of the first device sent by the first device; the recording module 330 is used to record the registration information of the first device; wherein the registration information of the first device includes the identity information of the first device, the trust evaluation model of the first device and the evaluation data attribute of the first device; the result obtained by performing the trust evaluation using the trust evaluation model of the first device will be recognized by the first device; the evaluation data attribute of the first device indicates the attribute of the data of the second device required when performing the trust evaluation on the second device according to the trust evaluation model of the first device.

[0111] When the evaluation module 320 performs a trust evaluation on the second device, the evaluation module 320 sends a first query request to the recording module 330, the first query request includes the identity information of the first device, and the first query request is used to obtain the trust evaluation model of the first device. After obtaining the first query request, the recording module 330 obtains the trust evaluation model of the first device from the database according to the first query request and sends it to the evaluation module 320. The evaluation module 320 sends a second query request to the recording module 330, the second query request includes the identity information of the second device, and the second query request is used to obtain the trust evaluation data of the second device. After receiving the second query request, the recording module obtains the trust evaluation data of the second device from the database according to the second query request and sends it to the evaluation module 320.

[0112] In the case of determining that the trust evaluation data of the second device does not meet the trust evaluation requirements of the trust evaluation model of the first device, the evaluation module 320 sends a third query request to the recording module 330, the third query request includes the identity information of the first device, and is used to obtain the evaluation result presentation form corresponding to the first device; the recording module 330 obtains the evaluation result presentation form corresponding to the first device from the database according to the third query request and sends it to the evaluation module 320. The evaluation module 320 also sends a fourth query request to the recording module 330, the fourth query request includes the identity information of the second device; and is used to obtain the trust evaluation model of the second device; the recording module 330 obtains the trust evaluation model of the second device from the database according to the fourth query request and sends it to the evaluation module 320. The evaluation module 320 performs a trust evaluation on the second device according to the trust evaluation model of the second device and the trust evaluation data of the second device, and obtains a second trust evaluation result of the second device.

[0113] In one possible implementation, the communication module 310 is also used to receive an access control policy of the first device sent by the management device, where the access control policy of the first device indicates the devices that the first device can access and the devices that can access the first device; the recording module 330 is also used to record the access control policy of the first device.

[0114] In a possible implementation, the communication module 310 is also used to send the registration information of the first device to the management device; receive the registration result of the first device returned by the management device, the registration result including approval of the registration or disapproval of the registration; the evaluation module 320 is also used to send the registration information of the first device to the recording module 330 when the registration result is approval of the registration, so that the recording module 330 records the registration information of the first device; the communication module is also used to return a response message of successful registration to the first device.

[0115] Specifically, the operations performed by each module in the trust assessment apparatus 300 may be the operations performed by the assessment device in the above-mentioned embodiment, for example, the communication module 310 performs the operations of the assessment device receiving and sending data, and the assessment module 320 is used to perform trust assessment on the second device, which will not be described in detail here.

[0116] In the embodiment of the present application, if the management device and the evaluation device are different devices, the embodiment of the present application further provides a management device, such as Figure 4 As shown, Figure 4 4 is a schematic diagram of a management device provided in an embodiment of the present application, wherein the management device 400 includes a management module 410 and a communication module 420. The communication module 420 is used to receive registration information of a first device, such as receiving registration information sent by the first device or registration information sent by the above-mentioned evaluation device; the management module 410 configures an access control policy of the first device, and then sends the access control policy of the first device to the evaluation device through the communication module 420.

[0117] Optionally, the management module 410 determines a registration result of the first device based on the registration information of the first device, where the registration result includes approval of registration or disapproval of registration; the communication module 420 is also used to send the registration result to the evaluation device, and when the registration result is approval of registration, the evaluation device saves the registration information of the first device.

[0118] When the management module 410 determines that the device can join the trust evaluation system, the management module 410 is further used to configure an access control policy for the first device, and the communication module 420 is further used to send the access control policy for the first device to the evaluation device.

[0119] Specifically, each module of the management device 400 is used to execute the operations completed by the above-mentioned management device, which will not be described in detail here.

[0120] The present application also provides a trust evaluation device, such as Figure 5 As shown, Figure 5 It is a schematic diagram of a computing device provided in an embodiment of the present application.

[0121] The computing device 500 includes one or more processors 510, a communication interface 520, and a memory 530, wherein the one or more processors 510, the communication interface 520, and the memory 530 are interconnected via a bus 540.

[0122] The processor 510 may be used to implement operations corresponding to those performed by the evaluation device in the method embodiment. The method by which the processor 510 implements trust evaluation of the second device may refer to the introduction in the method embodiment, which will not be described in detail herein.

[0123] The communication interface 520 may be a wired interface or a wireless interface, and is used to communicate with other modules or devices, such as receiving a trust evaluation request, sending a trust evaluation result of a second device to a first device, etc. The wired interface may be an Ethernet interface, a local interconnect network (LIN), etc., and the wireless interface may be a cellular network interface or a wireless local area network interface, etc.

[0124] The memory 530 may be a non-volatile memory, such as a read-only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The memory 530 may also be a volatile memory, which may be a random access memory (RAM) used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0125] The memory 530 may also be used to store program instructions and data, so that the processor 510 calls the program instructions stored in the memory 530 to perform the operation steps of the evaluation device in the above method embodiment. In addition, the computing device 500 may include a Figure 5 Show more or fewer components, or have different component configurations.

[0126] The bus 540 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus 540 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0127] It should be noted that the above-mentioned processor 510 can be a central processing unit (CPU), and can also include a CPU and other hardware chips. The above-mentioned hardware chips can be of various types. For example, the accelerator card can be a co-processing unit including a graphics processing unit (GPU), a tensor processing unit (TPU), a programmable logic device (PLD), a complex programmable logic device (CPLD), a field programmable gate array (FPGA) or a digital signal processor (DSP). Any one of the chips, the computing device 500 can include one or more of any of the above-mentioned types of hardware chips, and can also include multiple types of the above-mentioned hardware chips, which is not specifically limited in the embodiments of the present application.

[0128] Specifically, the specific implementation of various operations performed by the computing device 500 may refer to the specific operations performed by the evaluation device in the above method embodiment, which will not be described in detail here.

[0129] It should be noted that if the management module and the evaluation module are deployed on different devices, that is, the management device and the evaluation device are not the same device. Then the embodiment of the present application also provides another computing device, the structural diagram of the computing device is similar to the above Figure 5 The structural schematic diagram of the computing device 500 shown in FIG. 1 is the same as that of the computing device 500 shown in FIG. 1 , and is used to execute the operations completed by the above-mentioned management device, which will not be repeated here.

[0130] An embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When the computer-readable storage medium is executed on a processor, the method steps implemented by the evaluation device in the above method embodiment can be implemented. The specific implementation of the processor of the computer-readable storage medium in executing the above method steps can refer to the specific operations of the above method embodiment, which will not be repeated here.

[0131] An embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When the computer-readable storage medium is executed on a processor, the method steps implemented by the management device in the above method embodiment can be implemented. The specific implementation of the processor of the computer-readable storage medium in executing the above method steps can refer to the specific operations of the above method embodiment, which will not be repeated here.

[0132] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0133] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination thereof. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded or executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium, or a semiconductor medium. The semiconductor medium can be a solid state drive (SSD).

[0134] The steps in the method of the embodiment of the present application can be adjusted in order, combined or deleted according to actual needs; the modules in the device of the embodiment of the present application can be divided, combined or deleted according to actual needs.

[0135] The embodiments of the present application are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. At the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A trust evaluation method, characterized in that: include: The evaluation device receives a trust evaluation request sent by the first device, where the trust evaluation request includes identity information of the second device, and the trust evaluation request is used to obtain a trust evaluation result of the second device; The evaluation device obtains trust evaluation data of the second device according to the identity information of the second device; The evaluation device performs a trust evaluation on the second device according to the trust evaluation model and the trust evaluation data of the second device, obtains a trust evaluation result of the second device, and sends the trust evaluation result of the second device to the first device.

2. The method according to claim 1, characterized in that The method further comprises: The evaluation device receives registration information of the first device sent by the first device, where the registration information of the first device includes identity information of the first device and a trust evaluation model of the first device; The evaluation device records the registration information of the first device.

3. The method according to claim 2, characterized in that The evaluation device performs a trust evaluation on the second device according to the trust evaluation model and the trust evaluation data of the second device to obtain a trust evaluation result of the second device, including: The evaluation device obtains a trust evaluation model of the first device according to the identity information of the first device; the trust evaluation request includes the identity information of the first device; The evaluation device performs a trust evaluation on the second device according to the trust evaluation model of the first device and the trust evaluation data of the second device to obtain a first trust evaluation result of the second device, and uses the first trust evaluation result as the trust evaluation result of the second device.

4. The method according to claim 2, characterized in that: The registration information of the first device also includes a presentation form of an evaluation result corresponding to the first device, where the presentation form of the evaluation result corresponding to the first device refers to a presentation form of an evaluation result obtained by performing a trust evaluation using a trust evaluation model of the first device; The evaluation device performs a trust evaluation on the second device according to the trust evaluation model and the trust evaluation data of the second device to obtain a trust evaluation result of the second device, including: The evaluation device performs a trust evaluation on the second device according to the trust evaluation model of the second device and the trust evaluation data of the second device to obtain a second trust evaluation result of the second device; The evaluation device converts the second trust evaluation result into an evaluation result presentation form corresponding to the first device according to the evaluation result presentation form corresponding to the first device, and obtains the trust evaluation result of the second device.

5. The method according to claim 4, characterized in that The registration information of the first device further includes an evaluation data attribute of the first device, where the evaluation data attribute of the first device indicates an attribute of data of the second device required when trust evaluation is performed on the second device according to the trust evaluation model of the first device; Before the evaluation device performs trust evaluation on the second device according to the trust evaluation model of the second device and the trust evaluation data of the second device, the evaluation device further includes: The evaluation device obtains a trust evaluation model of the first device according to the identity information of the first device; wherein the trust evaluation request includes the identity information of the first device; In a case where the trust evaluation data of the second device does not satisfy the evaluation data attribute of the first device, the evaluation device obtains a trust evaluation model of the second device and a presentation form of the evaluation result corresponding to the first device.

6. The method according to any one of claims 3 to 5, characterized in that: The method further comprises: The evaluation device receives and records the access control policy of the first device sent by the management device, where the access control policy of the first device indicates devices that the first device can access and devices that can access the first device.

7. The method according to any one of claims 3 to 5, characterized in that: The evaluation device records the registration information of the first device, including: The evaluation device sends the registration information of the first device to the management device; The evaluation device receives a registration result of the first device returned by the management device, where the registration result includes approval of registration or disapproval of registration; When the registration result is approval of registration, the evaluation device records the registration information of the first device and returns a response message of successful registration to the first device.

8. The method according to claim 7, characterized in that The method further comprises: The evaluation device receives and records the access control policy of the first device returned by the management device, where the access control policy of the first device is configured by the management device when the registration result is approval of registration, and the access control policy of the first device indicates devices that the first device can access and devices that can access the first device.

9. The method according to claim 6 or 8, characterized in that: The evaluation device obtains trust evaluation data of the second device according to the identity information of the second device, including: In a case where it is determined according to the access control policy of the first device that the first device can access the second device, the evaluation device obtains trust evaluation data of the second device according to the identity information of the second device.

10. A trust evaluation system, characterized in that: The device comprises an evaluation device, a first device and a second device, wherein: The first device is used to send a trust evaluation request to the evaluation module, where the trust evaluation request includes identity information of the second device, and the trust evaluation request is used to obtain a trust evaluation result of the second device; The evaluation device obtains trust evaluation data of the second device according to the identity information of the second device; The evaluation device performs a trust evaluation on the second device according to the trust evaluation model and the trust evaluation data of the second device, obtains a trust evaluation result of the second device, and sends the trust evaluation result of the second device to the first device.

11. A trust assessment device, characterized in that: include: a communication module, configured to receive a trust assessment request sent by the first device, wherein the trust assessment request includes identity information of the second device, and the trust assessment request is used to obtain a trust assessment result of the second device; An evaluation module, configured to obtain trust evaluation data of the second device according to the identity information of the second device; Performing a trust evaluation on the second device according to the trust evaluation model and the trust evaluation data of the second device to obtain a trust evaluation result of the second device; The communication module is further used to send the trust evaluation result of the second device to the first device.

12. A computing device, characterized in that: The method comprises a processor and a memory, wherein the memory is used to store instructions, and the processor is used to execute the instructions. When the processor executes the instructions, the method according to any one of claims 1 to 9 is implemented.

13. A computer-readable storage medium, characterized in that: The method comprises computer program instructions, which, when executed by a computing device, implements the method according to any one of claims 1 to 9.

Images