Network security service cooperation method based on double chains of block chains

Abstract

The invention discloses a network security service cooperation method based on double chains of a block chain, and the method guarantees the rights and interests of a user through constructing a universal network security cooperation and service platform, employing a double-chain cross-chain architecture in which a public chain and an alliance chain are combined, providing a unified security strategy, and combining digital asset right confirmation and legal safeguard measures. In the network security protection process, the platform realizes the functions of abnormal alarm, alarm sharing, hacker behavior detection and tracking, judicial crime and punishment, network security crime disposal, asset loss claim settlement and the like; meanwhile, a complete anonymous technology is adopted, the privacy of the user is protected, anonymous cooperation and service are supported, and the flexibility and processing efficiency of the security service are improved; according to the method, by constructing an efficient and low-cost collaboration platform, the collaboration capability of all parties in processing network security events is enhanced, and a complete guarantee system is provided for network space security.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and specifically relates to a network security service collaboration method based on a double-chain blockchain, which can realize the confirmation of user network security resources, the protection of user identity privacy, and the effective realization of abnormal alarm of messages, sharing of alarms, detection and tracking of hacker news, judicial conviction, punishment of network security crimes, and protection of network assets in the process of network security confrontation. Background Art

[0002] Blockchain is a distributed database technology, whose main features are to achieve data distribution, decentralization, tamper-proof, permanent storage and transparency through distributed networks and cryptography. Since its emergence, in just over a decade, blockchain has been combined with many industries and created new sparks, such as finance, supply chain management, healthcare, logistics, energy, real estate, education and public services.

[0003] The anonymity of blockchain is a guarantee of users’ basic private information, but in order to ensure the traceability of data recorded on the blockchain, blockchain cannot be completely anonymous.

[0004] Onion routing is a technology designed to achieve anonymous online communication. It achieves anonymity through multiple layers of encryption (similar to the multi-layer structure of an onion) and routing through a series of network nodes. Each routing node only decrypts one layer of encryption and knows the previous and next nodes, but cannot determine the starting and end points of the communication, thus protecting the privacy of users.

[0005] As for blockchain technology, different blockchains have different consensus mechanisms and different bookkeeping speeds. The public chain forms a consensus mechanism by competing for the right to bookkeeping through algorithms. The bookkeeping rights of each node in the private chain are granted by the central organization. The consensus mechanism of the alliance chain is the mutual trust between each node.

[0006] Existing blockchain technologies mainly use private chains and consortium chains because they allow more control and customization while also providing higher data privacy and security. However, without the decentralization of public chains, security information will not be transparent enough. Summary of the invention

[0007] In view of the above-mentioned deficiencies in the prior art, the network security service collaboration method based on blockchain dual-chain provided by the present invention solves the problems in the existing network security service system, such as increased investment costs, frequent hacker attacks, deteriorating security situation, and difficulty in information sharing.

[0008] In order to achieve the above-mentioned invention object, the technical solution adopted by the present invention is: a network security service collaboration method based on blockchain dual chain, comprising the following steps:

[0009] Initialization phase: The user sends a request message, obtains a list of active nodes based on the service information of the onion routing node, and selects three onion routing nodes as message links based on the load balancing strategy; the user's request message is packaged with three layers of encryption, and transmitted layer by layer using the message link, and forwarded to the public chain by the third onion routing node;

[0010] Release and collaboration phase: The security service provider obtains task information from the public chain, formulates a cooperation plan and sends it to the third-party security warehouse that stores security services. The third-party security warehouse then forwards the cooperation plan to the blockchain.

[0011] Solution selection stage: The user obtains the cooperation plan through the blockchain, selects a security service solution, obtains a new onion routing path, and sends the selected security service solution to the public chain through the new onion routing path;

[0012] Solution collaboration stage: The security service provider obtains the security service solution selected by the user through the public chain, sends it to the third-party security warehouse, and sends it to the public chain after inspection and confirmation; the user obtains the confirmed security service solution from the public chain and adds the security service provider to the pipeline of the first alliance chain, and then the security service provider establishes the pipeline of the second alliance;

[0013] Solution release stage: The security service provider stores the security service solution in a third-party security warehouse, and sends the address of the security service solution and the unique password generated for the user's key to the user through the pipeline of the first alliance chain; the user sends the address, unique password and security service solution request to the third-party security warehouse, and after the third-party security warehouse completes the verification, it sends the security service solution response to the user.

[0014] Furthermore, in the initialization phase, the request message is packaged with three layers of encryption to obtain encrypted information sent by the user and transmitted to the three onion routing nodes in sequence. During the transmission process, after each onion routing node receives the information, it uses its private key to decrypt the received information to obtain the address of the next node. Finally, the third onion routing node obtains the request information and forwards it to the public chain.

[0015] Furthermore, in the initialization phase, the process of performing three-layer encryption on the user's request information is expressed as follows:

[0016]

[0017] M0=H(warningMsg);

[0018]

[0019] D3={M0,PublicChain,J,Seqi}K3;

[0020] M1={D3,d3};

[0021] D2={M1,TorNode3,J,Seq i}K2;

[0022] M2={D2,d2};

[0023] D1={M2,TorNode2,J,Seq i}K1;

[0024] EncryptMsg = M3 = {D1, d1};

[0025] Where K1, K2 and K3 represent the symmetric encryption keys randomly generated by the first to third onion routing nodes, respectively. and They represent the generation of algorithm keys according to security parameters λ1, λ2 and λ3 respectively; M0, M1, M2 and M3 represent the hash encryption processing of the warning message WarningMsg; d1, d2 and d3 represent the encryption password package of the symmetric encryption key encrypted with the node public key. and They represent the public keys of the first to third onion routing nodes respectively. D3, D2 and D1 represent data packets encrypted by the previously generated symmetric encryption keys. PublicChain represents the blockchain public chain. J represents whether the data is uploaded to the public chain. 1 means yes and 0 means no. Seq i It represents the number of sequences shared between the i-th user and the onion routing node. TorNode3 and TorNode2 represent the third onion routing node and the second onion routing node selected. EncryptMsg represents the encrypted information generated after three layers of encryption.

[0026] Furthermore, in the network security service collaboration method:

[0027] The public chain is used for node communication between security service providers, users, and third-party security warehouses;

[0028] The first alliance chain is used for alarm information sharing and key exchange between users and security service providers;

[0029] The second alliance chain is used for security service providers and judicial authorities to collaborate in processing alarm information.

[0030] Furthermore, during the solution release phase, the information verified by the third-party security warehouse includes the address of the security service solution and the unique password generated for the user key.

[0031] Furthermore, the network security service collaboration method further includes:

[0032] Service alert stage: When a user is attacked, an alarm is generated and sent to the pipeline of the first alliance chain, and then forwarded by the security service provider to the pipeline of the second alliance chain for collaborative processing.

[0033] Furthermore, the service warning stage also includes:

[0034] When a user is attacked, the user extracts a summary of the alert and sends the alert summary to the public chain through the new onion routing path obtained, thus achieving collaboration between the public chain and the alliance chain.

[0035] The beneficial effects of the present invention are:

[0036] (1) The network security collaboration method based on the blockchain double chain of the present invention utilizes the transmission efficiency of different blockchains to process different data information, thereby improving the information processing efficiency of the blockchain.

[0037] (2) The network security collaboration method based on the blockchain double chain of the present invention utilizes the second-generation onion routing in the process of uploading security information to the chain, encrypts it three times, and decrypts and transmits it layer by layer through three different onion routing nodes, thereby completing the anonymization processing and ensuring that the source of the security information can be kept confidential. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 Flowchart of the network security service collaboration method based on blockchain dual chains provided by the present invention.

[0039] Figure 2 This is a simulation schematic diagram of the initialization phase provided by the present invention.

[0040] Figure 3 This is a simulation diagram of the release collaboration phase provided by the present invention.

[0041] Figure 4 This is a simulation schematic diagram of the solution selection stage provided by the present invention.

[0042] Figure 5 This is a simulation diagram of the collaboration phase of the solution provided by the present invention.

[0043] Figure 6 This is a simulation diagram of the solution release phase provided by the present invention.

[0044] Figure 7 This is a simulation diagram of the service warning stage provided by the present invention. DETAILED DESCRIPTION

[0045] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0046] The embodiment of the present invention provides a network security service collaboration method based on a blockchain double chain, such as Figure 1 As shown, the following steps are included:

[0047] Initialization phase: The user Client sends a request message, obtains the active node list IPListResponse according to the service information of the onion routing node Client, and selects three onion routing nodes as the message link according to the load balancing strategy; the user's request message is packaged with three layers of encryption, and transmitted layer by layer using the message link, and forwarded to the public chain by the third onion routing node;

[0048] Release collaboration phase: The security service provider Provider obtains task information from the public chain, formulates a cooperation plan CooperatePlainMsg and sends it to the third-party security warehouse ThirdPartyWarehouse that stores security services, and the third-party security warehouse forwards the cooperation plan to the blockchain;

[0049] Solution selection stage: The user Client obtains the cooperation plan through the blockchain, selects a security service solution, and obtains a new onion routing path. The selected security service solution SelectedPlainMsg is sent to the public chain through the new onion routing path;

[0050] Solution collaboration stage: The security service provider obtains the security service solution selected by the user through the public chain, sends it to the third-party security warehouse, and sends it to the public chain after inspection and confirmation; the user obtains the confirmed security service solution from the public chain and adds the security service provider to the pipeline of the first alliance chain AllianceChain, and then the security service provider establishes the pipeline of the second alliance;

[0051] Solution release stage: The security service provider stores the security service solution in a third-party security warehouse, and sends the address Addr of the security service solution and the unique password Key generated for the user key to the user through the pipeline of the first alliance chain; the user sends the address, unique password and security service solution request SolutionRequest to the third-party security warehouse, and after the third-party security warehouse completes the verification, it sends the security service solution response SolutionResponse to the user.

[0052] In the embodiment of the present invention, in the initialization phase, onion routing is a technology designed to achieve online anonymous communication, which achieves anonymity through multi-layer encryption (similar to the multi-layer structure of onions) and routing through a series of network nodes. Each routing node only decrypts one layer of encryption, knows the previous node and the next node, but cannot determine the starting point and end point of the communication, thereby protecting the privacy of users.

[0053] Based on this, in this embodiment, the onion routing node needs to register service information, that is, the IP address and public key information, which are represented as TorNodei, Ki respectively. The user Client selects three onion routing nodes TorNode1, TorNode2, and TorNode3 as the transmission nodes in the message link according to the load balancing strategy. During the initialization process, the request message is packaged with three layers of encryption to obtain encrypted information sent by the user and transmitted to the three onion routing nodes in turn. During the transmission process, after each onion routing node receives the information, it uses its private key to decrypt the received information and obtain the address of the next node. Finally, the third onion routing node obtains the request information and forwards it to the public chain.

[0054] Furthermore, in the initialization phase, the process of performing three-layer encryption on the user's request information is expressed as

[0055]

[0056] M0 = H (WarningMsg);

[0057]

[0058] D3={M0,PublicChain,J,Seq i}K3;

[0059] M1={D3,d3};

[0060] D2={M1,TorNode3,J,Seq i}K2;

[0061] M2={D2,d2};

[0062] D1={M2,TorNode2,J,Seq i}K1;

[0063] EncryptMsg = M3 = {D1, d1};

[0064] Where K1, K2 and K3 represent the symmetric encryption keys randomly generated by the first to third onion routing nodes, respectively. and They represent the generation of algorithm keys according to security parameters λ1, λ2 and λ3 respectively; M0, M1, M2 and M3 represent the hash encryption processing of the warning message WarningMsg; d1, d2 and d3 represent the encryption password package of the symmetric encryption key encrypted with the node public key. and They represent the public keys of the first to third onion routing nodes respectively. D3, D2 and D1 represent data packets encrypted by the previously generated symmetric encryption keys. PublicChain represents the blockchain public chain. J represents whether the data is uploaded to the public chain. 1 means yes and 0 means no. Seq i It represents the number of sequences shared between the i-th user and the onion routing node. TorNode3 and TorNode2 represent the third onion routing node and the second onion routing node selected. EncryptMsg represents the encrypted information generated after three layers of encryption.

[0065] The six communication channels involved in the initialization phase are C1, C, C3, C4, C5, and C6;

[0066] The roles involved in the initialization phase include: TorNode1, TorNode2, TorNode3, Client, TorNodeNet, PublicChain;

[0067] The 9 communication interaction messages in the initialization phase are:

[0068] 1.TorNode1->TorNodeNet:TorNode1,K1

[0069] 2.TorNode2->TorNodeNet:TorNode2,K2

[0070] 3.TorNode3->TorNodeNet:TorNode3,K3

[0071] 4.Client->TorNodeNet:RS

[0072] 5.TorNodeNet->Client:TorNode1,TorNode2,TorNode3,K1,K2,K3

[0073] 6.Client->TorNode1:{{{H(WarningMsg),PublicChain,J,Seqi}K3p,{K3p}K3,TorNode3,J,Seqi}K23,{K23}K2,TorNode2,J,Seqi}K12,{K12}K1

[0074] 7.TorNode1->TorNode2:{{H(WarningMsg),PublicChain,J,Seqi}K3p,{K3p}K3,TorNode3,J,Seqi}K23,{K23}K2

[0075] 8.TorNode2->TorNode3:{H(WarningMsg),PublicChain,J,Seqi}K3p,{K3p}K3

[0076] 9.TorNode3->PublicChain:H(WarningMsg)

[0077] The security goals that need to be met during the initialization phase are: RealMsg can be correctly transmitted to PublicChain, and the implementation method is:

[0078] 1. Flower in TorNode sends its own IP and public key K through channel C1 P Send to Leader to register encryption service;

[0079] 2. The Client sends the message IPListRequest to the TorNode Leader through channel C2;

[0080] 3. The Leader in TorNode returns IPListResponse to the Client through channel C2;

[0081] 4. The Client selects three nodes in IPListResponse according to the load balancing strategy;

[0082] 5. The Client uses the selected node to encrypt the data to be sent layer by layer, generates a message EncryptMsg and sends it to TorNode[IP] through the C3 channel;

[0083] 6.TorNode[IP] checks the received EncryptMsg, then {EncryptMsg}_K, generates a new EncryptMsg, and then TorNode forwards it to TorNode[IP] through channel C3;

[0084] 7. Repeat step 6) once more;

[0085] 8.TorNode[IP] checks the received EncryptMsg, then {EncryptMsg}K, generates RealMsg, and TorNode forwards RealMsg to PublicChain through channel C4;

[0086] 9. PublicChain verifies the received M0 and then executes M0 internally;

[0087] In an embodiment of the present invention, during the collaboration release phase, after the third-party security warehouse confirms and stores the cooperation plan CooperatePlainMsg, it can be correctly uploaded to the public chain PblicChain.

[0088] The three communication channels involved in the release collaboration phase are C5, C6, and C7;

[0089] The roles involved in the release collaboration phase include: Provider, PublicChain, ThirdPartyWarehouse;

[0090] The two communication interaction messages involved in the release collaboration phase are:

[0091] 1.Provider->PublicChain:Provider,RS

[0092] 2.PublicChain->Provider:TaskMsg

[0093] 3.Provider->ThirdPartyWarehouse:PublicChain,CooperatePlainMsg

[0094] 4.ThirdPartyWarehouse->PublicChain:CooperatePlainMsg;

[0095] The implementation process is:

[0096] 1) Provider obtains TaskMsg from PublicChain through channel C5;

[0097] 2) Provider sends CooperatePlainMsg to ThirdPartyWarehouse through channel C6;

[0098] 3) rdPartyWarehouse saves the received CooperatePlainMsg and forwards it to PublicChain through the C7 channel

[0099] 4) blicChain checks the received CooperatePlainMsg and then executes it internally.

[0100] The security goal that needs to be met in the release collaboration phase is that CooperatePlainMsg can be correctly transmitted to PublicChain.

[0101] In the solution selection stage in the embodiment of the present invention, the user needs to re-select a new onion routing path through the load balancing strategy and upload the selected solution SelectedPlainMsg to the public chain.

[0102] The four communication channels involved in the scheme selection phase are C2, C5, C3, and C4;

[0103] The roles involved in the solution selection phase include Client, PublicChain, TorNodeNet, TorNode1, TorNode2, and TorNode3;

[0104] The 8 communication interaction information in the scheme selection phase are:

[0105] 1.Client->PublicChain:RS

[0106] 2.PublicChain->Client:CooperatePlainMsg

[0107] 3.Client->TorNodeNet:RS

[0108] 4.TorNodeNet->Client:TorNode1,TorNode2,TorNode3,K1,K2,K3

[0109] 5.Client->TorNode1:{{{H(SelectedPlainMsg),PublicChain,J,Seqi}K3p,{K3p}K3,TorNode3,J,Seqi}K23,{K23}K2,TorNode2,J,Seqi}K12,{K12}K1

[0110] 6.TorNode1->TorNode2:{{H(SelectedPlainMsg),PublicChain,J,Seqi}K3p,{K3p}K3',TorNode3,J,Seqi}K23,{K23}K2

[0111] 7.TorNode2->TorNode3:{H(SelectedPlainMsg),PublicChain,J,Seqi}K3p,{K3p}K3

[0112] 8.TorNode3->PublicChain:H(SelectedPlainMsg);

[0113] The implementation process is:

[0114] 1) Client obtains CooperatePlainMsg from PublicChain through channel C5;

[0115] 2) The Client sends the message IPListRequest to the Leader of TorNode through channel C2;

[0116] 3) The Leader in TorNode returns IPListResponse to the Client through channel C2;

[0117] 4) Client selects three nodes in IPListResponse according to the load balancing strategy;

[0118] 5) The client selects one of the CooperatePlainMsgs, and uses the selected node to encrypt the scheme confirmation message SelectedPlainMsg layer by layer, generating a message EncryptMsg and sending it to TorNode[IP] through the C3 channel;

[0119] 6) TorNode[IP] checks the received EncryptMsg, then {EncryptMsg}_K, generates a new EncryptMsg, and then TorNode forwards it to TorNode[IP] through channel C3;

[0120] 7) Repeat step 6) once more;

[0121] 8) TorNode[IP] checks the received EncryptMsg, then {EncryptMsg}_K, generates SelectedPlainMsg, and TorNode forwards SelectedPlainMsg to PublicChain through channel C4;

[0122] 9) PublicChain checks the received SelectedPlainMsg and then executes SelectedPlainMsg internally.

[0123] The security goal that needs to be met in the solution selection phase is: SelectedPlainMsg can be correctly transmitted to PublicChain.

[0124] In the embodiment of the present invention, three communication links are involved in the solution release stage; among them, the public chain is used for node communication between security service providers and users and third-party security warehouses; the first alliance chain is used for alarm information sharing and key exchange between users and security service providers; the second alliance chain is used for security service providers and judicial authorities to collaborate in processing alarm information.

[0125] The four communication channels involved in the solution collaboration phase are C5, C6, C7, and C8;

[0126] The 12 communication interaction messages in the solution collaboration phase are:

[0127] 1.Provider->PublicChain:RS

[0128] 2.PublicChain->Provider:SelectedPlainMsg

[0129] 3.Provider->ThirdPartyWarehouse:PublicChain,AffirmMsg

[0130] 4.ThirdPartyWarehouse->PublicChain:AffirmMsg

[0131] 5.Client->PublicChain:Client,RS

[0132] 6.PublicChain->Client:AllianceChain,Provider,AffirmMsg

[0133] 7.Client->AllianceChain:Provider,RS

[0134] 8.Channel1->Provider:CooperatePlainMsg

[0135] 9.Client->Channel1:WarningMsg

[0136] 10.Provider->Channel1:RS

[0137] 11.Channel1->Provider:Channel2,WarningMsg

[0138] 12.Provider->Channel2:WarningMsg;

[0139] The implementation process is:

[0140] 1) Provider obtains SelectedPlainMsg from PublicChain through channel C5;

[0141] 2) Provider sends AffirmMsg to ThirdPartyWarehouse via channel C6;

[0142] 3) ThirdPartyWarehouse saves the received AffirmMsg and forwards it to PublicChain through the C7 channel;

[0143] 4) PublicChain checks the received AffirmMsg and then executes it internally (the public chain will);

[0144] 5) Client obtains AffirmMsg from PublicChain through channel C5;

[0145] 6) Client adds Provider to the channel Channel_1 of AllianceChain, allowing it to share alarm messages and exchange keys;

[0146] 7) Provider will get WarningMsg through channel C8;

[0147] 8) Provider will send WarningMsg to another channel Channel_2 of AllianceChain through channel C8 for collaboration.

[0148] The two security goals that need to be met during the solution collaboration phase are:

[0149] 1) AffirmMsg can be correctly transmitted to PublicChain;

[0150] 2) WarningMsg can be transmitted correctly and not be eavesdropped.

[0151] During the above-mentioned solution release phase, the information verified by the third-party security warehouse includes the address of the security service solution and the unique password generated for the user key.

[0152] The three communication channels involved in the solution release phase are: C8, C9, and C10;

[0153] The six communication interaction messages in the solution release phase are:

[0154] 1.Provider->ThirdPartyWarehouse:Solution

[0155] 2.Provider->Channel1:Addr,Key

[0156] 3.Client->Channel1:Client,RS

[0157] 4.Channel1->Client:Addr,Key

[0158] 5.Client->ThirdPartyWarehouse:Key,SolutionRequest

[0159] 6.ThirdPartyWarehouse->Client:SolutionResponse

[0160] The implementation process is:

[0161] 1) Provider stores the generated solution to ThirdPartyWarehouse through channel C9;

[0162] 2) Provider obtains the address Addr of the solution from the channel Channel_1 of AllianceChain through channel C8 and the unique password Key generated for the Client key;

[0163] 3) The Client obtains the address Addr of the solution of the channel Channel_1 of AllianceChain through channel C8 and the unique password Key generated for the Client key;

[0164] 4) Client sends SolutionRequest to ThirdPartyWarehouse using channel C10;

[0165] 5) ThirdPartyWarehouse verifies SolutionRequest and returns SolutionResponse to Client through C10.

[0166] The four security goals that need to be met during the solution release phase are:

[0167] 1) {Addr, Key} can be transmitted correctly;

[0168] 2) SolutionRequest can be sent correctly;

[0169] 3) SolutionResponse can be transmitted correctly;

[0170] 4)Key is private.

[0171] The network security service collaboration method in the embodiment of the present invention further includes:

[0172] Service warning stage: When a user is attacked, an alarm WarningMsg is generated and sent to the pipeline of the first alliance chain, and then forwarded by the security service provider to the pipeline of the second alliance chain for collaborative processing.

[0173] In another embodiment of the present invention, the service alert stage further includes:

[0174] When a user is attacked, the user extracts a summary of the alert and sends the alert summary to the public chain through the new onion routing path obtained, thus achieving collaboration between the public chain and the alliance chain.

[0175] The communication channel involved in the service alert phase is C8;

[0176] The 10 communication interaction messages in the service alert phase include:

[0177] 1.Client->AllianceChain:WarningMsg

[0178] 2.TorNode1->TorNodeNet:TorNode1,K1

[0179] 3.TorNode2->TorNodeNet:TorNode2,K2

[0180] 4.TorNode3->TorNodeNet:TorNode3,K3

[0181] 5.Client->TorNodeNet:RS

[0182] 6.TorNodeNet->Client:TorNode1,TorNode2,TorNode3,K1,K2,K3

[0183] 7.Client->TorNode1:{{{H(WarningMsg),PublicChain,J,Seqi}K3p,{K3p}K3,TorNode3,J,Seqi}K23,{K23}K2,TorNode2,J,Seqi}K12,{K12}K1

[0184] 8.TorNode1->TorNode2:{{H(WarningMsg),PublicChain,J,Seqi}K3p,{K3p}K3,TorNode3,J,Seqi}K23,{K23}K2

[0185] 9.TorNode2->TorNode3:{H(WarningMsg),PublicChain,J,Seqi}K3p,{K3p}K3

[0186] 10.TorNode3->PublicChain:H(WarningMsg).

[0187] The implementation process is:

[0188] 1) When the Client's service is attacked, an alarm is generated, the Client reads the WarningMsg, and sends it to the AllianceChain's channel Channel_1 through the C8 channel;

[0189] 2) The client extracts the summary of WarningMsg and generates M0, and the client starts the first stage;

[0190] 3) The Client sends the message IPListRequest to the Leader of TorNode through channel C2;

[0191] 4) The Leader in TorNode returns IPListResponse to the Client through channel C2;

[0192] 5) Client selects three nodes in IPListResponse according to the load balancing strategy;

[0193] 6) The Client uses the selected node to encrypt the M0 to be sent layer by layer, generates a message EncryptMsg and sends it to TorNode[IP] through the C3 channel;

[0194] 7) TorNode[IP] checks the received EncryptMsg, then {EncryptMsg}_K, generates a new EncryptMsg, and then TorNode forwards it to TorNode[IP] through channel C3;

[0195] 8) Repeat step 6) once more;

[0196] 9) TorNode[IP] checks the received EncryptMsg, then {EncryptMsg}K, generates RealMsg, and TorNode forwards RealMsg to PublicChain through channel C4;

[0197] 10) PublicChain verifies the received M0 and then executes M0 internally.

[0198] The two security goals that need to be met during the service alert phase are:

[0199] 1) WarningMsg can be transmitted correctly;

[0200] 2) RealMsg can be transmitted correctly.

[0201] In the embodiment of the present invention, experiments were conducted on the above method to verify the effect of the solution.

[0202] Experimental tool selection: AVISPA (Automated Validation of Internet Security Protocols and Applications) is a tool for verifying Internet security protocols. It uses the High-Level Protocol Specification Language (HLPSL) to describe the protocol and uses a set of internal tools to analyze the protocol. AVISPA is capable of handling large protocols and can support various security properties, including confidentiality, authentication, and integrity. Specifically, the AVISPA tool can verify whether the security protocol meets the predefined security properties at an abstract level. It can perform model checking of the protocol in a finite state space and can also perform theorem proof in an infinite state space. The choice of these two methods depends on the accuracy and efficiency requirements of the analysis.

[0203] Since the experimental scheme is too large, it is divided into six stages. The final simulation results are as follows: Figure 2-7As shown, it can be seen that in the first three steps of the first stage, the registration of the onion node is completed. In Step 6, the user sends a message to Step 9 to realize the correct transmission of the message to the public chain; in the second stage, the cooperation plan can be correctly transmitted from the security vendor to the public chain; in the third stage, Step 1 and Step 2 realize the user pulling the cooperation plan from the blockchain, and in Step 3, the user sends a message to Step 8 to realize uploading the security service plan selected by the user to the public chain; in the fourth stage, Step 1 to Step 4 realize the security service confirmation and upload to the blockchain. The user determines the security service plan through Step 5 and Step 6. At the same time, the user and the security service vendor establish alliance chain channel 1 and channel 2 to facilitate subsequent work; in the fifth stage, the security service vendor sends the password to the alliance chain channel 1 and Step 2 to upload the security service plan to the third-party security warehouse. The user extracts the password through Step 3 to Step 4 and realizes the pulling of security services through Step 5 and Step 6; in the sixth stage, Step 6, the user sends a message to Step 9 to realize the correct transmission of the message to the public chain, and at the same time sends it to the pipeline channel 1 of the alliance chain through the channel.

[0204] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

[0205] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the principles of the present invention, and should be understood that the protection scope of the present invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific variations and combinations that do not deviate from the essence of the present invention based on the technical revelations disclosed by the present invention, and these variations and combinations are still within the protection scope of the present invention.

Claims

1. A network security service collaboration method based on blockchain dual chains, characterized in that: The following steps are involved: Initialization phase: The user sends a request message, obtains a list of active nodes based on the service information of the onion routing node, and selects three onion routing nodes as message links based on the load balancing strategy; the user's request message is packaged with three layers of encryption, and transmitted layer by layer using the message link, and forwarded to the public chain by the third onion routing node; Release and collaboration phase: The security service provider obtains task information from the public chain, formulates a cooperation plan and sends it to the third-party security warehouse that stores security services. The third-party security warehouse then forwards the cooperation plan to the blockchain. Solution selection stage: The user obtains the cooperation plan through the blockchain, selects a security service solution, obtains a new onion routing path, and sends the selected security service solution to the public chain through the new onion routing path; Solution collaboration stage: The security service provider obtains the security service solution selected by the user through the public chain, sends it to the third-party security warehouse, and sends it to the public chain after inspection and confirmation; the user obtains the confirmed security service solution from the public chain and adds the security service provider to the pipeline of the first alliance chain, and then the security service provider establishes the pipeline of the second alliance; Solution release stage: The security service provider stores the security service solution in a third-party security warehouse, and sends the address of the security service solution and the unique password generated for the user's key to the user through the pipeline of the first alliance chain; the user sends the address, unique password and security service solution request to the third-party security warehouse, and after the third-party security warehouse completes the verification, it sends the security service solution response to the user.

2. The network security service collaboration method based on blockchain dual chain according to claim 1 is characterized in that: In the initialization phase, the request message is packaged with three layers of encryption to obtain encrypted information sent by the user and transmitted to the three onion routing nodes in sequence. During the transmission process, after each onion routing node receives the information, it uses its private key to decrypt the received information to obtain the address of the next node. Finally, the third onion routing node obtains the request information and forwards it to the public chain.

3. The network security service collaboration method based on blockchain dual chain according to claim 1 is characterized in that: In the initialization phase, the process of performing three-layer encryption on the user's request information is expressed as follows: M o =H(WarningMsg); D3={M o ,PublicChain,J,Seq i }K3; M1 = {D3, d3}; D2={M1,TorNode3,J,Seq i }K2; M2 = {D2, d2}; <h2 style=";text-align:left;direction:ltr">D1 = {M2, TorNode2, J, Seq<h2 style=";text-align:left;direction:ltr"> i <h2 style=";text-align:left;direction:ltr">}K1; EncryptMsg=M3={D1, d1}; Where K1, K2 and K3 represent the symmetric encryption keys randomly generated by the first to third onion routing nodes, respectively. and They represent the generation of algorithm keys according to security parameters λ1, λ2 and λ3 respectively; M0, M1, M2 and M3 represent the hash encryption processing of the warning message WarningMsg; d1, d2 and d3 represent the encryption password package of the symmetric encryption key encrypted with the node public key. and They represent the public keys of the first to third onion routing nodes respectively. D3, D2 and D1 represent data packets encrypted by the previously generated symmetric encryption keys. PublicChain represents the blockchain public chain. J represents whether the data is uploaded to the public chain. 1 means yes and 0 means no. Seq i It represents the number of sequences shared between the i-th user and the onion routing node. TorNode3 and TorNode2 represent the third onion routing node and the second onion routing node selected. EncryptMsg represents the encrypted information generated after three layers of encryption.

4. The network security service collaboration method based on blockchain dual chain according to claim 1 is characterized in that: In the network security service collaboration method: The public chain is used for node communication between security service providers, users, and third-party security warehouses; The first alliance chain is used for alarm information sharing and key exchange between users and security service providers; The second alliance chain is used for security service providers and judicial authorities to collaborate in processing alarm information.

5. The network security service collaboration method based on blockchain dual chain according to claim 1 is characterized in that: During the solution release phase, the information verified by the third-party security warehouse includes the address of the security service solution and the unique password generated for the user key.

6. The blockchain-based network security service collaboration method according to claim 1 is characterized in that: The network security service collaboration method further includes: Service alert stage: When a user is attacked, an alarm is generated and sent to the pipeline of the first alliance chain, and then forwarded by the security service provider to the pipeline of the second alliance chain for collaborative processing.

7. The blockchain-based network security service collaboration method according to claim 6 is characterized in that: The service alert stage also includes: When a user is attacked, the user extracts a summary of the alert and sends the alert summary to the public chain through the new onion routing path obtained, thus achieving collaboration between the public chain and the alliance chain.

Images