Railway internal network cloud center mimicry security scheduling system and method based on entropy weight

Abstract

The invention discloses a railway internal network cloud center mimicry security scheduling system and method based on entropy weight, and relates to the technical field of network information security. An access proxy server is deployed in a road bureau center network aggregation node information machine room and used for receiving access requests from a road bureau service system and a station section service system and distributing the access requests to corresponding service gateways according to service types, and the service gateways make mimicry scheduling strategies according to the received access requests. The method comprises the following steps: dynamically selecting a corresponding number of information-creative cloud heterogeneous redundant bodies and non-information-creative cloud heterogeneous redundant bodies to respectively perform redundancy calculation, receiving calculation results of all heterogeneous redundant bodies by a voter, and designing weight parameters of the redundant bodies under an entropy reduction condition to perform mimicry judgment in combination with the calculation results; and an obtained final judgment result is returned to the access proxy server.

Description

Technical Field

[0001] The present invention relates to the field of network information security technology, and in particular to a railway internal service network cloud center mimetic security dispatching system and method based on entropy weight. Background Art

[0002] The Railway Internal Service Network Cloud Center (hereinafter referred to as the Cloud Center) is an important part of the new generation of railway information network. It is mainly responsible for the construction and deployment of various systems that carry China Railway’s internal services, production, management, office and other businesses at the National Railway Group nodes, regional center nodes and station nodes. Its main construction feature is the deployment of unified computing resources and unified security protection resources based on the National Railway Group center nodes. At the same time, in response to the terminal access requirements of various business systems in regional center nodes and station nodes, unified security protection strategies and unified access aggregation strategies are set at the network edge of regional center nodes and station nodes to achieve security protection for data access in different application domains.

[0003] In recent years, as the scale of information system construction carried by cloud centers continues to expand, the risk of various attacks has also increased, including the following two aspects:

[0004] 1. The attack surface of various application systems is gradually increasing, and the probability of encountering risks is also increasing. With the rapid expansion of various production, office, and service system applications in railways, various intelligent terminals in regional center nodes and station nodes are also constantly enriched, and the overall external attack surface of the system is gradually increasing. There are many types of personnel gathered in the station itself. Once the management is not careful, attacks on the cloud center through the terminal may occur;

[0005] 2. As the international Internet network security situation becomes increasingly severe, the risk that the system may be attacked by unknown means, targeted APT attacks, and 0-day vulnerability attacks is also increasing; the current international Internet network security situation is becoming increasingly severe, and APT attacks against important key infrastructure such as public transportation, electricity, and core technology are increasing. Railway passenger stations are important public transportation venues, and their internal information systems are vulnerable to external attacks by unknown means, targeted APT attacks, and 0-day vulnerability attacks, which seriously affect the reliability of the entire cloud center. Summary of the invention

[0006] The purpose of the present invention is to provide a railway internal service network cloud center pseudo-security dispatching system and method based on entropy weight to solve the problems raised in the above background technology.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions: a railway internal service network cloud center pseudo-security dispatching system based on entropy weight, the system deploys a DHR architecture in the railway internal service network cloud center, including an access proxy module, a business gateway module, a trusted cloud redundant heterogeneous module, a non-trusted cloud redundant heterogeneous module, and a voting module; the railway internal service network cloud center accesses the access request of the railway bureau business system and the station section business system;

[0008] The access proxy module deploys an access proxy server in the information room of the railway bureau's central network aggregation node to receive business access requests from the railway bureau's business system and the station section business system, aggregates the access requests and parses the corresponding parameters to form a standard JSON string related to the business content, and distributes it to the corresponding business gateway for processing according to the business type of the access request.

[0009] In the above technical solution, by deploying the input access proxy server, the access proxy module can efficiently collect access requests from the railway bureau business system and the station section business system and perform parameter parsing to form a standardized JSON string, which not only simplifies the data processing process, but also improves the response speed and accuracy of the request.

[0010] Furthermore, the business gateway module is composed of a group of microservice gateway clusters, including production-class 1-4 level systems, service-class 1-4 systems, and office-class 1-2 systems commonly used in the railway internal service network; the microservice gateway is differentiated according to the railway bureau based on the business load, and each microservice gateway cluster publishes the request to the heterogeneous redundant bodies of the trusted cloud and the non-trusted cloud according to the parsing results of the access request; before issuing the request, the business gateway selects the m non-trusted cloud heterogeneous redundant bodies with the least scheduling times and n trusted cloud redundant isomers according to the scheduling times of different redundant bodies in the redundant resource pool, for subsequent redundant isomer calculations.

[0011] In the above technical solution, a microservice gateway cluster design is adopted, which can flexibly respond to different business load conditions and ensure the high availability and scalability of the system; before issuing a request, the redundant body with the least scheduling times is intelligently selected for calculation based on the scheduling times of different redundant bodies in the redundant resource pool, which effectively balances the load of each redundant body and improves the overall performance and stability of the system.

[0012] Furthermore, the trusted cloud redundant heterogeneous module includes a trusted cloud redundant resource pool unit, a trusted cloud heterogeneous executor unit and a trusted cloud redundant heterogeneous computing unit; the trusted cloud redundant resource pool unit provides basic environment support for the trusted cloud heterogeneous executor unit, including CPU architecture, operating system and database resources in the trusted field; the trusted cloud heterogeneous executor unit is composed of virtual machine resources of the trusted cloud redundant resource pool and deploys application services on the virtual machines, and the application services use the trusted cloud redundant resource pool to perform specific business calculations; the trusted cloud redundant heterogeneous computing unit is used to receive business requests in JSON string format transmitted by HTTP from the business gateway, apply functions to perform business logic calculations, and calculate the results d m It is output in the form of a JSON string and finally sent to the voting module for decision.

[0013] In the above technical solution, the redundant heterogeneous module of the trusted cloud integrates a variety of heterogeneous resources in the trusted cloud environment and deploys business-related application services. By using the redundant resources of the trusted cloud to perform specific business calculations, it can ensure business continuity and security in the trusted cloud environment. At the same time, due to the use of heterogeneous resources and application services, the flexibility and scalability of the system are also improved, and it can cope with different business needs.

[0014] Furthermore, the non-trusted cloud redundant heterogeneous module includes a non-trusted cloud redundant resource pool unit, a non-trusted cloud heterogeneous executor unit and a non-trusted cloud redundant heterogeneous computing unit; the non-trusted cloud redundant resource pool unit provides basic environment support for the non-trusted cloud heterogeneous executor unit, including CPU architecture, operating system and database resources in the non-trusted cloud field; the non-trusted cloud heterogeneous executor unit is composed of virtual machine resources in the non-trusted cloud redundant resource pool and deploys application services with the same functions as the trusted cloud application but heterogeneous on the virtual machine, and the application services use the non-trusted cloud redundant resource pool to perform specific business calculations; the non-trusted cloud redundant heterogeneous computing unit is used to receive business requests in JSON string format transmitted by HTTP from the business gateway, apply heterogeneous functions with the same functions as the trusted cloud redundant heterogeneous computing unit functions to perform business logic calculations, and calculate the results d m It is output in database flat file format and finally sent to the voting module for decision making.

[0015] In the above technical solution, corresponding to the trusted cloud redundant heterogeneous module, the non-trusted cloud redundant heterogeneous module integrates a variety of heterogeneous resources in the non-trusted cloud environment, and deploys application services with the same functions as the trusted cloud but with heterogeneous implementation. This setting provides redundancy and diversity of business computing, which helps to enhance the reliability and fault tolerance of the system.

[0016] Furthermore, the voting server module is used to design an entropy reduction situation, by mobilizing the weight parameters of the redundant body, combining the calculation results of the redundant heterogeneous module of the trusted cloud and the redundant heterogeneous module of the non-trusted cloud, to perform a mimetic decision; wherein the calculation result d of the redundant heterogeneous module of the trusted cloud is n The calculation results of redundant heterogeneous modules of non-trusted cloud d m , which is uniformly represented as d in the voting module i , represents the calculation result of each redundant body;

[0017] First, construct a function g of the redundant weight w about the scheduling times t and the information entropy change ΔH(x), according to the formula:

[0018] w = g(t, ΔH(x));

[0019] Where t represents the number of redundant body scheduling, ΔH(x) represents the change in information entropy, and w represents the redundant body weight;

[0020] Then, based on the m non-trusted cloud heterogeneous redundant bodies and n trusted cloud redundant heterogeneous bodies selected by the business gateway module, an entropy weight interval is determined according to the scheduling times of each scheduled redundant body and w is arbitrarily selected in the interval. i :

[0021] w i ∈(w-ε,w+ε);

[0022] Where ε is a weight compensation parameter, ε <w i (t)-w i (t-1);

[0023] Before making a mimicry decision, the calculated result d i Compared with the previous calculation result, if they are the same, it takes 1, if they are different, it takes -1; all weights are within their change interval w i The sum of the maximum values ​​of ∈(w-ε, w+ε) should be greater than 1:

[0024]

[0025] At each redundant body scheduling, the calculation result d for each redundant body i The sum of the products and accumulations of the corresponding weights is recorded as the final result V, which is the final result of the mimicry adjudication. The adjudication model is:

[0026]

[0027] Finally, the decision result V is returned to the access agent module.

[0028] In the above technical solution, by designing a redundant weight parameter under entropy reduction, the voter can comprehensively consider the scheduling times of the redundant body and the change of information entropy, so as to make a more reasonable and accurate decision. This decision mechanism not only improves the security and reliability of the system, but also enhances the system's defense capabilities against potential threats.

[0029] A railway internal service network cloud center mimic security scheduling method based on entropy weight, the method comprises the following steps:

[0030] Step S100: deploying the DHR architecture in the railway internal service network cloud center, receiving access requests from the railway bureau business system and the station-section business system and distributing them to the corresponding business gateway according to the business type;

[0031] Step S200: The service gateway formulates a mimic scheduling strategy according to the received access request, and dynamically selects a corresponding number of trusted cloud heterogeneous redundant entities and non-trusted cloud heterogeneous redundant entities for redundant calculation;

[0032] Step S300: Perform parallel calculations on the selected trusted cloud heterogeneous redundant entities and non-trusted cloud heterogeneous redundant entities respectively to obtain respective calculation results;

[0033] Step S400: The voting server receives the calculation results from all heterogeneous redundant entities, and performs a pseudo-decision according to the decision weight of each redundant entity to obtain a final decision result.

[0034] The step S100 deploys a DHR architecture in the railway internal service network cloud center, and deploys an access proxy server in the information room of the railway bureau center network aggregation node to receive service access requests from the railway bureau business system and the station section business system, collects the access requests and parses the corresponding parameters to form a standard JSON string related to the business content, and distributes it to the corresponding business gateway for processing according to the business type of the access request;

[0035] The business gateway in step S200 is composed of a group of microservice gateway clusters. The microservice gateways are differentiated according to the road bureaus based on the business load conditions. Each microservice gateway cluster publishes the request to the heterogeneous redundant bodies of the trusted cloud and the non-trusted cloud according to the parsing results of the access request. Before issuing the request, the business gateway selects the m non-trusted cloud heterogeneous redundant bodies with the least scheduling times and n trusted cloud redundant isomers according to the scheduling times of different redundant bodies in the redundant resource pool, for subsequent redundant isomer calculations.

[0036] The step S300 calculates n trusted cloud heterogeneous redundant bodies and m non-trusted cloud heterogeneous redundant bodies respectively, and obtains calculation results respectively; the trusted cloud redundant resource pool provides basic environment support for the trusted cloud heterogeneous execution body unit, including the CPU architecture, operating system and database resources in the trusted field; the trusted cloud heterogeneous execution body is composed of virtual machine resources of the trusted cloud redundant resource pool and application services are deployed on the virtual machines. The application services use the trusted cloud redundant resource pool to perform specific business calculations; receive the business request in JSON string format transmitted by HTTP from the business gateway, apply the function to perform business logic calculations, and calculate the results d n It is output in the form of a JSON string and finally sent to the voting module for decision.

[0037] The non-trusted cloud redundant resource pool provides basic environment support for the non-trusted cloud heterogeneous executor unit, including the CPU architecture, operating system and database resources in the non-trusted cloud field; the non-trusted cloud heterogeneous executor is composed of virtual machine resources in the non-trusted cloud redundant resource pool and deploys application services with the same functions as the trusted cloud application but heterogeneous on the virtual machine. The application service uses the non-trusted cloud redundant resource pool to perform specific business calculations; it receives business requests in JSON string format transmitted by HTTP from the business gateway, applies heterogeneous functions with the same functions as the trusted cloud redundant heterogeneous computing unit functions to perform business logic calculations, and calculates the results d m It is output in database flat file format and finally sent to the voting module for decision making.

[0038] The step S400 is used to design an entropy reduction case, by mobilizing the weight parameters of the redundant body, combining the calculation results from the redundant heterogeneous module of the trusted cloud and the redundant heterogeneous module of the non-trusted cloud to perform a mimic judgment; wherein the calculation result d of the redundant heterogeneous module of the trusted cloud n The calculation results of redundant heterogeneous modules of non-trusted cloud d m , which is uniformly represented as d in the voting module i , represents the calculation result of each redundant body;

[0039] Step S401: First, construct a function g of the redundant weight w with respect to the scheduling times t and the information entropy change ΔH(x), according to the formula:

[0040] w = g(t, ΔH(x));

[0041] Where t represents the number of redundant body scheduling, ΔH(x) represents the change in information entropy, and w represents the redundant body weight;

[0042] Step S402: Then, based on the m non-trusted cloud heterogeneous redundant entities and n trusted cloud redundant heterogeneous entities selected by the business gateway module, an entropy weight interval is determined according to the scheduling times of each scheduled redundant entity and w is randomly selected in the interval.i :

[0043] w i ∈(w-ε,w+ε);

[0044] Where ε is a weight compensation parameter, ε <w i (t)-w i (t-1);

[0045] Step S403: Before the mimicry decision is made, the calculation result d i Compared with the previous settlement result, if they are the same, it takes 1, if they are different, it takes -1; all weights are within their change range w i The sum of the maximum values ​​of ∈(w-ε, w+ε) should be greater than 1:

[0046]

[0047] Step S405: Perform mimicry decision based on the entropy weight and the redundant body calculation result. In each redundant body scheduling, for each redundant body calculation result d i The sum of the products and accumulations of the corresponding weights is recorded as the final result V, which is the final result of the mimicry adjudication. The adjudication model is:

[0048]

[0049] Finally, the decision result V is returned to the access proxy server.

[0050] Compared with the prior art, the beneficial effects achieved by the present invention are:

[0051] The present invention introduces the DHR architecture to divide the system into multiple highly modular components with clear functions. This architecture design not only improves the flexibility and scalability of the system, but also enables each module to perform its duties and work together, thereby achieving overall optimization of system performance;

[0052] The present invention adopts microservice gateway cluster technology in the business gateway module, and distinguishes by road bureau according to the business load, realizing intelligent distribution and load balancing of requests. This design effectively avoids the overload phenomenon of a single node and improves the stability and response speed of the system. At the same time, by intelligently selecting the redundant body with the least number of scheduling times for calculation, the system resources are further balanced and the service life of the system is extended.

[0053] The present invention realizes dynamic adjustment of weights under entropy reduction by constructing a functional relationship between redundant weights, information entropy changes, and scheduling times. This entropy weight mechanism fully considers the uncertainty factors in the system operation process, can more accurately reflect the real-time status of the system, and improve the accuracy and scientificity of decision-making.

[0054] The present invention introduces entropy weight and mimetic arbitration mechanism, which not only ensures the accuracy of system decision-making, but also enhances the security and reliability of the system. On the one hand, the entropy weight mechanism can ensure that redundant bodies with better performance and stronger stability are given priority for calculation during redundant body scheduling. On the other hand, the mimetic arbitration mechanism can reduce the impact of a single redundant body failure on the overall system by comprehensively evaluating the calculation results of multiple redundant bodies. This dual protection mechanism enables the system to operate more robustly when facing various potential threats and challenges. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0056] Figure 1 This is the system module diagram of the railway internal service network cloud center mimicry safety dispatching system based on entropy weight;

[0057] Figure 2 It is a method flow chart of the railway internal service network cloud center mimic security dispatching method based on entropy weight;

[0058] Figure 3 It is a redundant isomer selection diagram of the railway internal service network cloud center mimic security dispatching system based on entropy weight;

[0059] Figure 4 It is a delay control calculation diagram of the railway internal service network cloud center mimic safety dispatching system based on entropy weight;

[0060] Figure 5 This is a function analysis diagram of the railway internal service network cloud center mimic security dispatching system based on entropy weight;

[0061] Figure 6 This is an entropy weight value diagram of the railway internal service network cloud center pseudo-safety dispatching system based on entropy weight. DETAILED DESCRIPTION

[0062] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] See also Figure 1-Figure 6, the present invention provides a technical solution: a railway internal service network cloud center mimic security dispatching system based on entropy weight, the system deploys a DHR architecture in the railway internal service network cloud center, including an access proxy module, a business gateway module, a trusted cloud redundant heterogeneous module, a non-trusted cloud redundant heterogeneous module, and a voting module; the railway internal service network cloud center accesses the access request of the railway bureau business system and the station section business system;

[0064] The access proxy module deploys an access proxy server in the information room of the railway bureau's central network aggregation node to receive business access requests from the railway bureau's business system and the station section business system, aggregates the access requests and parses the corresponding parameters to form a standard JSON string related to the business content, and distributes it to the corresponding business gateway for processing according to the business type of the access request.

[0065] In the above technical solution, by deploying the input access proxy server, the access proxy module can efficiently collect access requests from the railway bureau business system and the station section business system and perform parameter parsing to form a standardized JSON string, which not only simplifies the data processing process, but also improves the response speed and accuracy of the request.

[0066] The business gateway module is composed of a group of microservice gateway clusters, including production-class 1-4 level systems, service-class 1-4 systems, and office-class 1-2 systems commonly used in the railway internal service network; the microservice gateway is differentiated according to the railway bureau based on the business load, and each microservice gateway cluster publishes the request to the heterogeneous redundant bodies of the trusted cloud and the non-trusted cloud according to the parsing results of the access request; before issuing the request, the business gateway selects the m non-trusted cloud heterogeneous redundant bodies with the least scheduling times and n trusted cloud redundant isomers according to the scheduling times of different redundant bodies in the redundant resource pool for subsequent redundant isomer calculations.

[0067] In the above technical solution, a microservice gateway cluster design is adopted, which can flexibly respond to different business load conditions and ensure the high availability and scalability of the system; before issuing a request, the redundant body with the least scheduling times is intelligently selected for calculation based on the scheduling times of different redundant bodies in the redundant resource pool, which effectively balances the load of each redundant body and improves the overall performance and stability of the system.

[0068] The trusted cloud redundant heterogeneous module includes a trusted cloud redundant resource pool unit, a trusted cloud heterogeneous executor unit and a trusted cloud redundant heterogeneous computing unit; the trusted cloud redundant resource pool unit provides basic environment support for the trusted cloud heterogeneous executor unit, including CPU architecture, operating system and database resources in the trusted field; the trusted cloud heterogeneous executor unit is composed of virtual machine resources of the trusted cloud redundant resource pool and deploys application services on the virtual machines, and the application services use the trusted cloud redundant resource pool to perform specific business calculations; the trusted cloud redundant heterogeneous computing unit is used to receive business requests in JSON string format transmitted by HTTP from the business gateway, apply functions to perform business logic calculations, and calculate the results d m It is output in the form of a JSON string and finally sent to the voting module for decision.

[0069] In the above technical solution, the redundant heterogeneous module of the trusted cloud integrates a variety of heterogeneous resources in the trusted cloud environment and deploys business-related application services. By using the redundant resources of the trusted cloud to perform specific business calculations, it can ensure business continuity and security in the trusted cloud environment. At the same time, due to the use of heterogeneous resources and application services, the flexibility and scalability of the system are also improved, and it can cope with different business needs.

[0070] The non-trusted cloud redundant heterogeneous module includes a non-trusted cloud redundant resource pool unit, a non-trusted cloud heterogeneous executor unit and a non-trusted cloud redundant heterogeneous computing unit; the non-trusted cloud redundant resource pool unit provides basic environment support for the non-trusted cloud heterogeneous executor unit, including CPU architecture, operating system and database resources in the non-trusted field; the non-trusted cloud heterogeneous executor unit is composed of virtual machine resources in the non-trusted cloud redundant resource pool and deploys application services with the same functions as the trusted cloud application but heterogeneous on the virtual machine, and the application services use the non-trusted cloud redundant resource pool to perform specific business calculations; the non-trusted cloud redundant heterogeneous computing unit is used to receive business requests in JSON string format transmitted by HTTP from the business gateway, apply heterogeneous functions with the same functions as the trusted cloud redundant heterogeneous computing unit functions to perform business logic calculations, and calculate the results d m It is output in database flat file format and finally sent to the voting module for decision making.

[0071] In the above technical solution, corresponding to the trusted cloud redundant heterogeneous module, the non-trusted cloud redundant heterogeneous module integrates a variety of heterogeneous resources in the non-trusted cloud environment, and deploys application services with the same functions as the trusted cloud but with heterogeneous implementation. This setting provides redundancy and diversity of business computing, which helps to enhance the reliability and fault tolerance of the system.

[0072] The voting server module is used to design an entropy reduction situation, by mobilizing the weight parameters of the redundant body, combining the calculation results of the redundant heterogeneous module of the trusted cloud and the redundant heterogeneous module of the non-trusted cloud, to perform a mimic decision; wherein the calculation result d n The calculation results of redundant heterogeneous modules of non-trusted cloud d m , which is uniformly represented as d in the voting module i , represents the calculation result of each redundant body;

[0073] First, construct a function g of the redundant weight w about the scheduling times t and the information entropy change ΔH(x), according to the formula:

[0074] w = g(t, ΔH(x));

[0075] Where t represents the number of redundant body scheduling, ΔH(x) represents the change in information entropy, and w represents the redundant body weight;

[0076] Then, based on the m non-trusted cloud heterogeneous redundant bodies and n trusted cloud redundant heterogeneous bodies selected by the business gateway module, an entropy weight interval is determined according to the scheduling times of each scheduled redundant body and w is arbitrarily selected in the interval. i :

[0077] w i ∈(w-ε,w+ε);

[0078] Where ε is a weight compensation parameter, ε <w i (t)-w i (t-1);

[0079] Before making a mimicry decision, the calculated result d i Compared with the previous calculation result, if they are the same, it takes 1, if they are different, it takes -1; all weights are within their change interval w i The sum of the maximum values ​​of ∈(w-ε, w+ε) should be greater than 1:

[0080]

[0081] At each redundant body scheduling, the calculation result d for each redundant body i The sum of the products and accumulations of the corresponding weights is recorded as the final result V, which is the final result of the mimicry adjudication. The adjudication model is:

[0082]

[0083] Finally, the decision result V is returned to the access agent module.

[0084] In the above technical solution, by designing a redundant weight parameter under entropy reduction, the voter can comprehensively consider the scheduling times of the redundant body and the change of information entropy, so as to make a more reasonable and accurate decision. This decision mechanism not only improves the security and reliability of the system, but also enhances the system's defense capabilities against potential threats.

[0085] A railway internal service network cloud center mimic security scheduling method based on entropy weight, the method comprises the following steps:

[0086] Step S100: deploying the DHR architecture in the railway internal service network cloud center, receiving access requests from the railway bureau business system and the station-section business system and distributing them to the corresponding business gateway according to the business type;

[0087] Step S200: The service gateway formulates a mimic scheduling strategy according to the received access request, and dynamically selects a corresponding number of trusted cloud heterogeneous redundant entities and non-trusted cloud heterogeneous redundant entities for redundant calculation;

[0088] Step S300: Perform parallel calculations on the selected trusted cloud heterogeneous redundant entities and non-trusted cloud heterogeneous redundant entities respectively to obtain respective calculation results;

[0089] Step S400: The voting server receives the calculation results from all heterogeneous redundant entities, and performs a pseudo-decision according to the decision weight of each redundant entity to obtain a final decision result.

[0090] The step S100 deploys a DHR architecture in the railway internal service network cloud center, and deploys an access proxy server in the information room of the railway bureau center network aggregation node to receive service access requests from the railway bureau business system and the station section business system, collects the access requests and parses the corresponding parameters to form a standard JSON string related to the business content, and distributes it to the corresponding business gateway for processing according to the business type of the access request;

[0091] The business gateway in step S200 is composed of a group of microservice gateway clusters. The microservice gateways are differentiated according to the road bureaus based on the business load conditions. Each microservice gateway cluster publishes the request to the heterogeneous redundant bodies of the trusted cloud and the non-trusted cloud according to the parsing results of the access request. Before issuing the request, the business gateway selects the m non-trusted cloud heterogeneous redundant bodies with the least scheduling times and n trusted cloud redundant isomers according to the scheduling times of different redundant bodies in the redundant resource pool, for subsequent redundant isomer calculations.

[0092] The step S300 calculates n trusted cloud heterogeneous redundant bodies and m non-trusted cloud heterogeneous redundant bodies respectively, and obtains calculation results respectively; the trusted cloud redundant resource pool provides basic environment support for the trusted cloud heterogeneous execution body unit, including the CPU architecture, operating system and database resources in the trusted field; the trusted cloud heterogeneous execution body is composed of virtual machine resources of the trusted cloud redundant resource pool and application services are deployed on the virtual machines. The application services use the trusted cloud redundant resource pool to perform specific business calculations; receive the business request in JSON string format transmitted by HTTP from the business gateway, apply the function to perform business logic calculations, and calculate the results d n It is output in the form of a JSON string and finally sent to the voting module for decision.

[0093] The non-trusted cloud redundant resource pool provides basic environment support for the non-trusted cloud heterogeneous executor unit, including the CPU architecture, operating system and database resources in the non-trusted cloud field; the non-trusted cloud heterogeneous executor is composed of virtual machine resources in the non-trusted cloud redundant resource pool and deploys application services with the same functions as the trusted cloud application but heterogeneous on the virtual machine. The application service uses the non-trusted cloud redundant resource pool to perform specific business calculations; it receives business requests in JSON string format transmitted by HTTP from the business gateway, applies heterogeneous functions with the same functions as the trusted cloud redundant heterogeneous computing unit functions to perform business logic calculations, and calculates the results d m It is output in database flat file format and finally sent to the voting module for decision making.

[0094] The step S400 is used to design an entropy reduction case, by mobilizing the weight parameters of the redundant body, combining the calculation results from the redundant heterogeneous module of the trusted cloud and the redundant heterogeneous module of the non-trusted cloud to perform a mimic judgment; wherein the calculation result d of the redundant heterogeneous module of the trusted cloud n The calculation results of redundant heterogeneous modules of non-trusted cloud d m , which is uniformly represented as d in the voting module i , represents the calculation result of each redundant body;

[0095] Step S401: First, construct a function g of the redundant weight w with respect to the scheduling times t and the information entropy change ΔH(x), according to the formula:

[0096] w = g(t, ΔH(x));

[0097] Where t represents the number of redundant body scheduling, ΔH(x) represents the change in information entropy, and w represents the redundant body weight;

[0098] Step S402: Then, based on the m non-trusted cloud heterogeneous redundant entities and n trusted cloud redundant heterogeneous entities selected by the business gateway module, an entropy weight interval is determined according to the scheduling times of each scheduled redundant entity and w is randomly selected in the interval.i :

[0099] w i ∈(w-ε,w+ε);

[0100] Where ε is a weight compensation parameter, ε <w i (t)-w i (t-1);

[0101] Step S403: Before the mimicry decision is made, the calculation result d i Compared with the previous settlement result, if they are the same, it takes 1, if they are different, it takes -1; all weights are within their change range w i The sum of the maximum values ​​of ∈(w-ε, w+ε) should be greater than 1:

[0102]

[0103] Step S405: Perform mimicry decision based on the entropy weight and the redundant body calculation result. In each redundant body scheduling, for each redundant body calculation result d i The sum of the products and accumulations of the corresponding weights is recorded as the final result V, which is the final result of the mimicry adjudication. The adjudication model is:

[0104]

[0105] Finally, the decision result V is returned to the access proxy server.

[0106] Embodiment 1: The business system of the railway bureau and the station section sends the relevant message request data inf of the business access request to the access proxy server according to the business situation. Inf is a standard JSON string related to the business content:

[0107] {"type":"service",

[0108] ″type_class″:″3″,

[0109] ″station″:″Yueyang″,

[0110] ″content″:[″C6025″,″1559982″,″Track 4″,″Platform 4″,″Delayed 5 minutes″]}

[0111] The access proxy server parses the service type "type", service level "type_class", station "station" and service content "content" in the JSON string;

[0112] The business gateway consists of a group of microservice gateway clusters. Each microservice gateway cluster publishes the request to the heterogeneous redundant bodies of the trusted cloud and the non-trusted cloud according to the content analysis of inf. Before publishing the request, the business gateway selects the m non-trusted cloud heterogeneous redundant bodies and n trusted cloud redundant heterogeneous bodies with the least scheduling times according to the scheduling times of different redundant bodies in the redundant resource pool, and then performs calculations respectively. Taking the train delay control in the passenger service system as an example, for the train delay control, two trusted cloud heterogeneous redundant bodies are selected in the trusted cloud redundant heterogeneous module, and one non-trusted cloud heterogeneous redundant body is selected in the non-trusted cloud redundant heterogeneous module, such as Figure 3 As shown;

[0113] The redundant heterogeneous computing unit of the trusted cloud applies the y function to perform business logic calculations, and the redundant heterogeneous computing unit of the non-trusted cloud applies the heterogeneous function f function with the same function as the redundant heterogeneous computing unit function of the trusted cloud to perform business logic calculations, including: input part, business calculation part, output part, where the input part is a JSON string transmitted by HTTP, and the delay control calculation part is as follows Figure 4 As shown;

[0114] Xinchuang Cloud redundant heterogeneous computing unit will calculate the result d n Output in JSON string format, non-trusted cloud redundant heterogeneous computing units will calculate the result d m It is output in database flat file format and finally sent to the voting module for decision making.

[0115] Embodiment 2: In the voting module, in this embodiment, function w=e -ηt , the function is approximated and analyzed, where η is the adjustment parameter, w is the entropy weight, and t is the number of scheduling;

[0116] Taking η as 1 and 0.25 respectively, the results are as follows Figure 5 As shown in the figure, in the two cases, the maximum number of scheduling times is approximately 5 and 10 respectively, and the weight value of each scheduling is as follows: Figure 6 As shown;

[0117] When the value of η continues to decrease, the total number of schedulable times for each redundant body in the system continues to increase, the dynamics of the system continues to improve, and the defense sensitivity of the system against attacks continues to decrease, and vice versa; therefore, the defense capability can be adjusted according to the defense strength by selecting the parameter η. When the defense strength is high, the scheduling of redundant bodies may cause a large loss of their entropy value. A larger η value can be selected to make the cardinality of the number of times a single redundant body is scheduled smaller; when the defense strength is low, the scheduling of redundant bodies may cause a small loss of their entropy value. A smaller η value can be selected to make the cardinality of the number of times a single redundant body is scheduled larger.

[0118] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0119] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. The railway internal service network cloud center mimic security dispatching system based on entropy weight is characterized by: The system deploys a DHR architecture in the railway internal service network cloud center, including an access proxy module, a business gateway module, a trusted cloud redundant heterogeneous module, a non-trusted cloud redundant heterogeneous module, and a voting module; The access proxy module is used to receive and aggregate access requests and send them to the service gateway module; The business gateway module dynamically formulates a scheduling strategy based on the request content and system resource status and distributes the access request to the redundant heterogeneous modules of the Xinchuang cloud and the non-Xinchuang cloud redundant heterogeneous modules for redundant heterogeneous calculations; The redundant heterogeneous module of the Xinchuang cloud integrates various heterogeneous resources in the Xinchuang cloud environment and deploys business-related application services, uses functions to perform business calculations, and outputs the calculation results to the voting module; The non-trusted cloud redundant heterogeneous module integrates various heterogeneous resources in the non-trusted cloud environment and deploys application services with the same functions as the trusted cloud but with heterogeneous implementations, uses heterogeneous functions to perform business calculations, and outputs the calculation results to the voting module; The voter module is used to design a weight parameter of the redundant body under entropy reduction conditions and perform a mimetic decision based on the calculation results from the trusted cloud redundant heterogeneous module and the non-trusted cloud redundant heterogeneous module, and obtain the final decision result and return it to the access proxy module.

2. According to claim 1, the railway internal service network cloud center mimic security dispatching system based on entropy weight is characterized by: The access proxy module deploys an access proxy server in the information room of the railway bureau's central network aggregation node to receive business access requests from the railway bureau's business system and the station section business system, aggregates the access requests and parses the corresponding parameters to form a standard JSON string related to the business content, and distributes it to the corresponding business gateway for processing according to the business type of the access request.

3. The railway internal service network cloud center mimic security dispatching system based on entropy weight according to claim 1 is characterized by: The business gateway module is composed of a group of microservice gateway clusters. The microservice gateways are differentiated according to the road bureau according to the business load. Each microservice gateway cluster publishes the request to the heterogeneous redundant bodies of the trusted cloud and the non-trusted cloud according to the parsing result of the access request; Before issuing a request, the business gateway selects m non-trusted cloud heterogeneous redundant entities and n trusted cloud redundant isomers with the least scheduling times according to the scheduling times of different redundant entities in the redundant resource pool for subsequent redundant isomer calculations.

4. The railway internal service network cloud center mimic security dispatching system based on entropy weight according to claim 1 is characterized by: The credible cloud redundant heterogeneous module includes a credible cloud redundant resource pool unit, a credible cloud heterogeneous execution unit and a credible cloud redundant heterogeneous computing unit; The credible cloud redundant resource pool unit provides basic environment support for the credible cloud heterogeneous execution unit, including CPU architecture, operating system and database resources in the credible cloud field; The Xinchuang Cloud heterogeneous execution unit is composed of virtual machine resources of the Xinchuang Cloud redundant resource pool and deploys application services on the virtual machines. The application services use the Xinchuang Cloud redundant resource pool to perform specific business calculations; The Xinchuang Cloud redundant heterogeneous computing unit is used to receive a business request in the JSON string format transmitted by HTTP from the business gateway, apply a function to perform business logic calculations, and calculate the results d n It is output in the form of a JSON string and finally sent to the voting module for decision.

5. The railway internal service network cloud center mimic security dispatching system based on entropy weight according to claim 1 is characterized by: The non-trusted cloud redundant heterogeneous module includes a non-trusted cloud redundant resource pool unit, a non-trusted cloud heterogeneous execution unit and a non-trusted cloud redundant heterogeneous computing unit; The non-trusted cloud redundant resource pool unit provides basic environment support for the non-trusted cloud heterogeneous execution unit, including CPU architecture, operating system and database resources in the non-trusted cloud field; The non-trusted cloud heterogeneous execution unit is composed of virtual machine resources in the non-trusted cloud redundant resource pool and deploys application services on the virtual machine that have the same application functions as the trusted cloud but implement heterogeneity. The application services use the non-trusted cloud redundant resource pool to perform specific business calculations; The non-trusted cloud redundant isomerism computing unit is used to receive a business request in the JSON string format transmitted by HTTP from the business gateway, apply a heterogeneous function with the same function as the trusted cloud redundant isomerism computing unit function to perform business logic calculations, and calculate the result d m It is output in database flat file format and finally sent to the voting module for decision making.

6. The railway internal service network cloud center mimic security dispatching system based on entropy weight according to claim 1 is characterized by: The voting server module is used to design an entropy reduction situation, by mobilizing the weight parameters of the redundant body, combining the calculation results of the redundant heterogeneous module of the Xinchuang cloud and the redundant heterogeneous module of the non-Xinchuang cloud, to perform a mimic decision; The calculation result of Xinchuang Cloud redundant heterogeneous module is d n The calculation results of redundant heterogeneous modules of non-trusted cloud d m , which is uniformly represented as d in the voting module i , represents the calculation result of each redundant body; First, construct a function g of the redundant weight w about the scheduling times t and the information entropy change ΔH(x), according to the formula: w = g(t, ΔH(x)); Where t represents the number of redundant body scheduling, ΔH(x) represents the change in information entropy, and w represents the redundant body weight; Then, based on the m non-trusted cloud heterogeneous redundant bodies and n trusted cloud redundant heterogeneous bodies selected by the business gateway module, an entropy weight interval is determined according to the scheduling times of each scheduled redundant body and w is arbitrarily selected in the interval. i : w i ∈(w-ε,w+ε); Where ε is a weight compensation parameter, ε <w i (t)-w i (t-1); Before making a mimicry decision, the calculated result d i Compared with the previous calculation result, if they are the same, it takes 1, if they are different, it takes -1; all weights are within their change interval w i The sum of the maximum values ​​of ∈(w-ε, w+ε) should be greater than 1: At each redundant body scheduling, the calculation result d for each redundant body i The sum of the products and accumulations of the corresponding weights is recorded as the final result V, which is the final result of the mimicry adjudication. The adjudication model is: Finally, the decision result V is returned to the access agent module.

7. A railway internal service network cloud center mimic security dispatching method based on entropy weight, characterized by: The method comprises the following steps: Step S100: deploying the DHR architecture in the railway internal service network cloud center, receiving access requests from the railway bureau business system and the station-section business system and distributing them to the corresponding business gateway according to the business type; Step S200: The service gateway formulates a mimic scheduling strategy according to the received access request, and dynamically selects a corresponding number of trusted cloud heterogeneous redundant entities and non-trusted cloud heterogeneous redundant entities for redundant calculation; Step S300: Perform parallel calculations on the selected trusted cloud heterogeneous redundant entities and non-trusted cloud heterogeneous redundant entities respectively to obtain respective calculation results; Step S400: The voting server receives the calculation results from all heterogeneous redundant entities, and performs a pseudo-decision according to the decision weight of each redundant entity to obtain a final decision result.

8. The entropy weight-based railway internal service network cloud center mimic security scheduling method according to claim 7 is characterized by: The step S100 deploys a DHR architecture in the railway internal service network cloud center, and deploys an access proxy server in the information room of the railway bureau center network aggregation node to receive service access requests from the railway bureau business system and the station section business system, collects the access requests and parses the corresponding parameters to form a standard JSON string related to the business content, and distributes it to the corresponding business gateway for processing according to the business type of the access request; The business gateway of step S200 is composed of a group of microservice gateway clusters. The microservice gateways are differentiated according to the road bureau according to the business load. Each microservice gateway cluster publishes the request to the heterogeneous redundant bodies of the trusted cloud and the non-trusted cloud according to the parsing result of the access request; Before issuing a request, the business gateway selects m non-trusted cloud heterogeneous redundant entities and n trusted cloud redundant isomers with the least scheduling times according to the scheduling times of different redundant entities in the redundant resource pool for subsequent redundant isomer calculations.

9. The entropy weight-based railway internal service network cloud center mimic security scheduling method according to claim 7 is characterized by: The step S300 calculates n trusted cloud heterogeneous redundant entities and m non-trusted cloud heterogeneous redundant entities respectively, and obtains calculation results respectively; The redundant resource pool of Xinchuang Cloud provides basic environment support for the heterogeneous execution units of Xinchuang Cloud, including CPU architecture, operating system and database resources in the field of Xinchuang. The Xinchuang Cloud heterogeneous execution body is composed of virtual machine resources of the Xinchuang Cloud redundant resource pool and deploys application services on the virtual machines. The application services use the Xinchuang Cloud redundant resource pool to perform specific business calculations; receive business requests in JSON string format transmitted by HTTP from the business gateway, apply functions to perform business logic calculations, and send the calculation results to the server. n Output in the form of JSON string and finally sent to the voting module for decision; The non-trusted cloud redundant resource pool provides basic environment support for the non-trusted cloud heterogeneous execution units, including CPU architecture, operating system and database resources in the non-trusted cloud field; The non-trusted cloud heterogeneous execution body is composed of virtual machine resources in the non-trusted cloud redundant resource pool and deploys application services with the same functions as the trusted cloud application but with heterogeneity on the virtual machine. The application service uses the non-trusted cloud redundant resource pool to perform specific business calculations; it receives business requests in JSON string format transmitted by HTTP from the business gateway, applies heterogeneous functions with the same functions as the trusted cloud redundant heterogeneous computing unit functions to perform business logic calculations, and sends the calculation results to the server. m It is output in database flat file format and finally sent to the voting module for decision making.

10. The entropy weight-based railway internal service network cloud center mimic security scheduling method according to claim 7, characterized in that: The step S400 is used to design an entropy reduction case, by mobilizing the weight parameters of the redundant body, combining the calculation results from the redundant heterogeneous module of the Xinchuang cloud and the redundant heterogeneous module of the non-Xinchuang cloud to perform a mimic judgment; The calculation result of Xinchuang Cloud redundant heterogeneous module is d n The calculation results of redundant heterogeneous modules of non-trusted cloud d m , which is uniformly represented as d in the voting module i , represents the calculation result of each redundant body; Step S401: First, construct a function g of the redundant weight w with respect to the scheduling times t and the information entropy change ΔH(x), according to the formula: w = g(t, ΔH(x)); Where t represents the number of redundant body scheduling, ΔH(x) represents the change in information entropy, and w represents the redundant body weight; Step S402: Then, based on the m non-trusted cloud heterogeneous redundant entities and n trusted cloud redundant heterogeneous entities selected by the business gateway module, an entropy weight interval is determined according to the scheduling times of each scheduled redundant entity and w is randomly selected in the interval. i : w i ∈(w-ε,w+ε); Where ε is a weight compensation parameter, ε <w i (t)-w i (t-1); Step S403: Before the mimicry decision is made, the calculation result d i Compared with the previous settlement result, if they are the same, it takes 1, if they are different, it takes -1; all weights are within their change range w i The sum of the maximum values ​​of ∈(w-ε, w+ε) should be greater than 1: Step S405: Perform mimicry decision based on the entropy weight and the redundant body calculation result. In each redundant body scheduling, for each redundant body calculation result d i The sum of the products and accumulations of the corresponding weights is recorded as the final result V, which is the final result of the mimicry adjudication. The adjudication model is: Finally, the decision result V is returned to the access proxy server.

Images