Trusted data circulation method based on dynamic slice topology

Abstract

The invention discloses a trusted data flow method based on dynamic slice topology, relates to the technical field of data security and communication, and solves the problem that an existing data flow technical scheme exposes many limitations when facing complex and changeable network environments and increasingly fine security compliance requirements. The invention discloses a trusted data circulation method based on dynamic slice topology. The method comprises the following steps: S1, receiving a data access request from a data requester; s2, performing initial trust evaluation on the data requester based on a predefined trust evaluation model to generate an initial trust score; and S3, discovering a plurality of candidate nodes from the network resource pool, and calculating a dynamic trust score of each candidate node based on the running state and the security data acquired in real time. According to the method, real-time and automatic adjustment can be realized along with the change of a network environment and a node state, data transmission on a current most credible path is always strived, and the elasticity of resisting internal threats and potential attacks is greatly improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data security and communication technology, in particular to a trusted data flow method based on dynamic slicing topology. BACKGROUND

[0002] Dynamic slicing topology refers to the study of the law of the change of the module space with the stability parameter (linearization) under the group action, especially the mathematical theory of the flip transformation of the corresponding module space when the parameter passes through the wall in the linearization space. Trusted data flow refers to a new data circulation paradigm that ensures the source of data is trusted, the process is controllable, the destination is traceable, the content is verifiable, and the rights and interests are protected through technical and management means in the process of data flow from the provider to the user. In the era of digital economy, data as a key production factor has an increasingly urgent demand for cross-organizational and cross-security domain circulation, which often requires the use of dynamic slicing topology for trusted data flow.

[0003] The existing data flow technology solution has many limitations when facing complex and variable network environments and increasingly detailed security compliance requirements. Therefore, it does not meet the existing needs, and for this we propose a trusted data flow method based on dynamic slicing topology. SUMMARY

[0004] The purpose of the present application is to provide a trusted data flow method based on dynamic slicing topology to solve the problem of the limitations of the existing data flow technology solution in the face of complex and variable network environments and increasingly detailed security compliance requirements as described in the background.

[0005] To achieve the above purpose, the present application provides the following technical solution: a trusted data flow method based on dynamic slicing topology, comprising the following steps:

[0006] S1: receiving a data access request from a data requester;

[0007] S2: performing initial trust evaluation on the data requester based on a predefined trust evaluation model to generate an initial trust score;

[0008] S3: discovering a plurality of candidate nodes from a network resource pool and calculating the dynamic trust score of each candidate node based on the real-time acquired running state and security data;

[0009] S4: selecting high-trust nodes from the candidate node set according to the initial trust score and the dynamic trust score of each candidate node to construct a logically isolated trusted slice;

[0010] S5: calculating the data flow path from the data source node to the data requester in the trusted slice to form a dynamic slicing topology;

[0011] S6: controlling the data to flow along the dynamic slice topology from the data source node to the data requester.

[0012] Preferably, the trusted slice is constructed according to the initial trust score and the dynamic trust score of each candidate node, specifically including:

[0013] 1) comparing the initial trust score with a first preset threshold;

[0014] 2) comparing the dynamic trust score of each candidate node with a second preset threshold;

[0015] 3) only when the initial trust score is higher than the first preset threshold and the dynamic trust score of the candidate node is higher than the second preset threshold, the candidate node is included in the trusted slice.

[0016] Preferably, before the data flows, further comprising the steps of:

[0017] 1) the data source node determines the granularity of the provided data according to the initial trust score of the data requester;

[0018] 2) wherein, when the initial trust score is higher than a third preset threshold, complete data is provided;

[0019] 3) when the initial trust score is lower than the third preset threshold but higher than a fourth preset threshold, the original data is desensitized or field filtered to generate and provide a data slice.

[0020] Preferably, during the data flow process, further comprising the steps of:

[0021] 1) continuously monitoring the dynamic trust scores and running behaviors of all nodes in the dynamic slice topology;

[0022] 2) when the dynamic trust score of any node is detected to be below a fifth preset threshold or abnormal behavior is detected, triggering reconstruction of the dynamic slice topology;

[0023] 3) the reconstruction of the dynamic slice topology includes removing the node with an unsatisfactory trust degree from the current trusted slice and recalculating a new data flow path.

[0024] Preferably, the step of triggering reconstruction is performed in real time and automatically, and during the reconstruction process, the continuity of the data flow service is ensured by enabling a pre-calculated backup path or rediscovering candidate nodes.

[0025] Preferably, the control of the data to flow along the dynamic slice topology specifically includes:

[0026] The current node needs to provide a proof of the trustworthiness of its running environment to the next node before the data packet is forwarded to the next node in the dynamic slicing topology.

[0027] The next node verifies the validity of the proof before receiving the data.

[0028] Preferably, the proof is a remote proof based on a trusted execution environment, which is used to verify the software state and the integrity of the running environment of the current node.

[0029] Preferably, the trust evaluation model is continuously updated, and the evaluation dimensions include but are not limited to: identity authentication strength, historical behavior log, real-time performance load, security vulnerability information and compliance status.

[0030] Compared with the prior art, the present application has the following beneficial effects:

[0031] 1. The present application uses continuous dynamic trust evaluation as the decision core of data flow, so that the data flow path is no longer static, but can be automatically adjusted in real time according to the changes in network environment and node state, always striving to transmit data on the "most trusted" path, greatly improving the resilience to internal threats and potential attacks.

[0032] 2. The present application directly links the trust score of the data requester with the data granularity that can be obtained, realizing the leap from extensive "access control" to fine "data control", which can protect data privacy in low-trust scenarios and release data value in high-trust scenarios, achieving a precise balance between security and utility.

[0033] 3. The present application introduces a verification mechanism between nodes based on TEE remote proof, which extends trust from single-point authentication to the entire transmission chain. Each intermediate node needs to prove its innocence, thereby building a verifiable end-to-end trust chain from the data source to the requester, effectively preventing "malicious relay" attacks.

[0034] 4. The present application uses dynamic slicing topology as a logical network overlaid on the physical network, which realizes the decoupling of data flow path and underlying infrastructure, allowing network administrators to define how data flows through policies, greatly enhancing the system's ability to cope with complex business scenarios and future evolution. BRIEF DESCRIPTION OF DRAWINGS

[0035] Figure 1 The figure is a flowchart of the present application based on dynamic slicing topology for trusted data flow. DETAILED DESCRIPTION

[0036] With reference to the drawings of the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described, obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application.

[0037] A trusted data flow conversion system comprises:

[0038] A trust management engine configured to perform dynamic and continuous trust evaluation on a data requester and candidate nodes in a network, and output a trust score;

[0039] A path calculation engine in communication connection with the trust management engine, configured to construct and dynamically maintain the dynamic slicing topology based on the trust score;

[0040] A data security processing module configured to perform corresponding granularity processing on data obtained from a data source according to the trust score of the data requester;

[0041] A plurality of node agents deployed on each candidate node, configured to collect local trust evidence, perform security proof, and forward data according to the instructions of the dynamic slicing topology.

[0042] In the embodiment, the path calculation engine further comprises:

[0043] A slicing management unit configured to create and manage the logically isolated trusted slice based on a trust score threshold;

[0044] A path calculation unit configured to calculate an optimal or security policy satisfying data flow conversion path within the trusted slice;

[0045] A monitoring and reconstruction unit configured to monitor the state of nodes within the slice, and start a topology reconstruction process when the trigger condition is met.

[0046] The data security processing module is integrated in the data source node or exists as an independent trusted service, and the data processing operations it supports include full data output, field-level data slicing, data desensitization, and data encapsulation based on attribute-based encryption.

[0047] The node agent runs in a trusted execution environment and can generate a trustworthiness proof of its current running environment in response to a request from the trust management engine or an adjacent node.

[0048] As shown in Figure 1 The trusted data flow conversion method based on the dynamic slicing topology comprises the following steps:

[0049] S1: receiving a data access request from a data requester;

[0050] S2: performing initial trust assessment on the data requester based on a predefined trust assessment model, and generating an initial trust score;

[0051] S3: discovering a plurality of candidate nodes from a network resource pool, and calculating a dynamic trust score of each candidate node based on real-time acquired running state and security data;

[0052] S4: screening out high-trust nodes from the candidate nodes based on the initial trust score and the dynamic trust score of each candidate node, so as to construct a logically isolated trusted slice;

[0053] S5: calculating a data flow path from a data source node to the data requester in the trusted slice, and forming a dynamic slice topology;

[0054] S6: controlling data to flow from the data source node to the data requester along the dynamic slice topology.

[0055] In S2, the trusted slice is constructed based on the initial trust score and the dynamic trust score of each candidate node, and the content specifically includes:

[0056] 1) comparing the initial trust score with a first preset threshold;

[0057] 2) comparing the dynamic trust score of each candidate node with a second preset threshold;

[0058] 3) only when the initial trust score is higher than the first preset threshold and the dynamic trust score of the candidate node is higher than the second preset threshold, the candidate node is included in the trusted slice.

[0059] As a preferred scheme of the embodiment, before the data flow, the method further includes the steps of:

[0060] 1) the data source node determines the granularity of the provided data according to the initial trust score of the data requester;

[0061] 2) when the initial trust score is higher than a third preset threshold, complete data is provided;

[0062] 3) when the initial trust score is lower than the third preset threshold but higher than a fourth preset threshold, desensitization or field screening processing is performed on the original data to generate and provide a data slice.

[0063] In the data flow process, the method further includes the steps of:

[0064] 1) continuously monitoring the dynamic trust score and running behavior of all nodes in the dynamic slice topology;

[0065] 2) When the dynamic trust score of any node is monitored to drop below the fifth preset threshold, or abnormal behavior is detected, the reconstruction of the dynamic slicing topology is triggered;

[0066] 3) The reconstruction of the dynamic slicing topology includes: removing the node with substandard trust degree from the current trusted slice, and recalculating a new data flow transfer path.

[0067] The step of triggering reconstruction is executed in real time and automatically, and during the reconstruction process, the continuity of the data flow transfer service is ensured by enabling the pre-calculated backup path or rediscovering the candidate node.

[0068] Among them, the control data flows along the dynamic slicing topology, specifically including:

[0069] Before the data packet is forwarded by any node of the dynamic slicing topology to the next node, the current node needs to provide the next node with a proof of the trustworthiness of its own running environment;

[0070] The next node verifies the validity of the proof before receiving the data.

[0071] The proof is a remote proof based on a trusted execution environment, used to verify the software state and integrity of the running environment of the current node.

[0072] The trust evaluation model is continuously updated, and the evaluation dimensions include but are not limited to: identity authentication strength, historical behavior log, real-time performance load, security vulnerability information and compliance status.

[0073] It is obvious to those skilled in the art that the present application is not limited to the details of the above exemplary embodiments, and can be implemented in other specific forms without departing from the spirit or essential characteristics of the present application. Therefore, from any point of view, the embodiments should be regarded as exemplary and non-limiting, and the scope of the present application is defined by the appended claims rather than the above description, and therefore all changes falling within the meaning and scope of the equivalent elements of the claims are intended to be included in the present application. Any reference signs in the claims should not be considered as limiting the claims involved.

Claims

1. A reliable data transfer method based on dynamic slice topology, characterized in that, Includes the following steps: S1: Receive data access requests from the data requester; S2: Based on a predefined trust assessment model, perform an initial trust assessment on the data requester and generate an initial trust score; S3: Discover multiple candidate nodes from the network resource pool and calculate the dynamic trust score of each candidate node based on the real-time acquired running status and security data; S4: Based on the initial trust score and the dynamic trust score of each candidate node, select high-trust nodes from the candidate node set to construct a logically isolated trusted slice. S5: Within a trusted slice, calculate the data flow path from the data source node to the data requester to form a dynamic slice topology; S6: Controls the flow of data from the data source node to the data requester along the dynamic slice topology.

2. The trusted data transfer method based on dynamic slice topology according to claim 1, characterized in that, The process of constructing a trusted slice based on the initial trust score and the dynamic trust score of each candidate node specifically includes: 1) Compare the initial trust score with a first preset threshold; 2) Compare the dynamic trust score of each candidate node with the second preset threshold; 3) A candidate node is included in a trusted slice only if its initial trust score is higher than the first preset threshold and its dynamic trust score is higher than the second preset threshold.

3. The trusted data transfer method based on dynamic slice topology according to claim 1, characterized in that, Before the data flows, further steps are included: 1) The data source node determines the granularity of the data it provides based on the initial trust score of the data requester; 2) When the initial trust score is higher than the third preset threshold, complete data is provided; 3) When the initial trust score is lower than the third preset threshold but higher than the fourth preset threshold, the original data is anonymized or field-filtered to generate and provide data slices.

4. The trusted data transfer method based on dynamic slice topology according to claim 1, characterized in that, The data transfer process further includes the following steps: 1) Continuously monitor the dynamic trust score and operational behavior of all nodes in the dynamic slice topology; 2) When the dynamic trust score of any node drops below the fifth preset threshold, or when abnormal behavior is detected, the reconstruction of the dynamic slice topology is triggered. 3) The reconstruction of dynamic slice topology includes: removing nodes with insufficient trust from the current trusted slice and recalculating a new data flow path.

5. The trusted data transfer method based on dynamic slice topology according to claim 4, characterized in that, The steps to trigger the reconstruction are executed in real time and automatically. During the reconstruction process, the continuity of data flow services is ensured by enabling pre-calculated alternative paths or rediscovering candidate nodes.

6. The trusted data transfer method based on dynamic slice topology according to claim 1, characterized in that, The control data flows along the dynamic slice topology, specifically including: Before a data packet is forwarded from any node in a dynamic slice topology to the next node, the current node must provide the next node with proof that its own operating environment is trustworthy. Before receiving data, the next node verifies the validity of the proof.

7. The trusted data transfer method based on dynamic slice topology according to claim 6, characterized in that, The proof is a remote proof based on a trusted execution environment, used to verify the integrity of the software state and operating environment of the current node.

8. The trusted data transfer method based on dynamic slice topology according to claim 1, characterized in that, The trust assessment model is continuously updated, and its assessment dimensions include, but are not limited to: identity authentication strength, historical behavior logs, real-time performance load, security vulnerability information, and compliance status.

Images