CN101753565A - Construction method crossing trust domain and trust relationship in computer network - Google Patents

Abstract

The invention discloses a construction method crossing trust domain and trust relationship in a computer network, a computer which acts for the trust domain and interacts with a center server, the computer is called as the agent node of the trust domain, and the agent node is connected with the center server. The user registers in at least one trust domain, the center server builds relationship among different identities at different trust domains of the user. When the user sends a trust value query request into another user to the center server, the center server obtains the trust value of the trust domain where the agent nodes are located for the queried user from all the agent nodes of the trust domains. The center server converts the trust value of the queried user in the trust domain into the general trust value, and integrates a plurality of general trust values which correspond to different domains, and calculates the integrated trust value of the user, and realizes the construction of the trust relationship cross the trust domains.

Description

Stride the construction method of trust domain trusting relationship in the computer network

Technical field

The present invention relates to applications of computer network system and safety issue thereof, relate in particular to the construction method of striding the trust domain trusting relationship in a kind of computer network.

Background technology

Expansion along with the range of application of the development of new technology and Internet, various new network application and service have appearred, also brought simultaneously a series of new safety problems, as network fraud, virus and wooden horse etc., these problems have a strong impact on normal network order.Traditional centralized digital certificate system, the symmetry or hard safe practices such as asymmetrical data encryption, Access Control List (ACL) can not satisfy demand for security.

Current, network application system generally adopts faith mechanism effectively the replenishing as the conventional security technology of user and resource.Wherein, user's trust value is meant the tolerance of user's credibility, constitutes a single trust domain by the node of the tolerance that adopts same trust value, is called for short single domain.Existing system all belongs to the single domain system, does not also have cross-domain belief system at present.In many cases, may simultaneously there be different identity respectively in the user in different single domain system applies, and the trust data that is scattered in multiple trusting domains in a large number is actually can be related according to identity.Yet, the user does not also know the incidence relation of these identity, different trust semanteme and computation model are often adopted in different application simultaneously, interoperability is poor between the system, even therefore each system had formed a large amount of trust data already, but it is when the user enters new application system, very difficult used for it in the trust data of other system accumulation.Along with the accumulation of network trust data, the value of cross-domain trust data exchange will improve gradually, and for suppressing the cross-domain malicious act of user, the excitation user keeps good prestige in a plurality of territories, thereby the fail safe that improves whole network has positive role.

At present, the research of setting up the trusting relationship of crossing over multiple trusting domains also is in the starting stage, is badly in need of solving following problem: the authentication of (1) multiple domain user identification relevancy; (2) trust the conversion of estimating between the territory, make the trust in a territory estimate and to be understood by the user of another trust domain.

Summary of the invention

The invention provides the construction method of striding the trust domain trusting relationship in a kind of computer network, this method is provided with this trust domain of agency and the mutual computer of central server at each trust domain, this computer is called the agent node of this trust domain, and agent node links to each other with central server.Each user is at least one trust domain registration, the foundation association of central server between the different identity of this user's different trust domain.When a user when central server is initiated trust value query requests to another user, central server obtains by the trust value of inquiring user at this agent node place trust domain to the agent node of all trust domain.Central server will be converted to general trust value by the trust value of inquiring user in each trust domain, and should carry out comprehensively calculating this user's comprehensive trust value corresponding to a plurality of general trust value of same area not, and the structure of the trusting relationship of trust domain is striden in realization.

The association of above-mentioned user between the different identity of different trust domain set up according to the following steps:

(1) user directly proposes the application for registration of generic identity to central server, proposes the related request between the different identity of this user in a plurality of trust domain;

(2) central server authenticates this related authenticity.

The comprehensive trust value that above-mentioned central server calculates the user adopts following steps:

(1) the users to trust value that obtains from each agent node is carried out preliminary treatment, be converted into the numerical value of [0,1] scope.

(2) trust value of each trust domain is the vector value with at least one component, is mapped as general trust value by matrix operation;

(3) adopt existing single domain to trust computational methods, gather the comprehensive trust value that all general trust values calculate the user.

Advantage of the present invention and remarkable result: the information source of can the value of enhancing trust calculating, improve the accuracy that the users to trust value is calculated; Can better suppress to stride the malicious act of trust domain, guarantee the fail safe of user in a plurality of trust domain mutual.

Description of drawings

Fig. 1 is the organization chart of the structure of cross-domain trusting relationship;

Fig. 2 is for trusting calculation process.

Embodiment

For related trust data, must be clear and definite from the corresponding relation between a plurality of identity of different trust domain.The related passive mode that adopts of identity is promptly initiated the identity association request by the user, and the relevant authentication mode is provided, then central server A _UTMAssociation request authenticates to identity by automatic or manual mode.

The association request that the user submits to comprises:

The generic identity that the applicant applies for the registration of, this application people is in the existing identity 1 in other territories, the authentication way of identity 1, this application people is in the existing identity 2 in other territories, the authentication way of identity 2 ....

The identity association of process authentication is recorded in central server A with the form of identity contingency table _UTMIn, wherein each list item has following content:

Generic identity, associated trust domain identity, associated trust domain,

A plurality of trust domain identity are associated by identical generic identity in the table, and each associated trust domain identity can only have a generic identity.

With reference to Fig. 1 and Fig. 2, A _xThe agent node of expression trust domain X, trust domain 1,2,3 is corresponding trust domain agent node A respectively ₁, A ₂, A ₃Agent node and central server A _UTMSet up communication, the users to trust value in this territory is handed to A _UTMBy service requester to A _UTMInitiate the request of users to trust value, A _UTMHandle this user's request and the trust value inquiry of sending corresponding identity to the agent node of each trust domain that is associated according to the identity contingency table, this agent node returns to A with the trust value of respective identity _UTM

A _UTMThe trust value of receiving is scaled general trust value T (I _x);

If there is related identity in generic identity I at trust domain X, the identification presentation of described association is I _xFrom trust domain X about user I _xTrust data be expressed as T _x(I _x).A _UTMAdopt following steps with trust value T _x(I _x) be converted into general trust value T (I _x):

(1) trust data T (I _x) preliminary treatment

Each component of trust data designs normalization algorithm respectively according to the physical meaning of this component.

Common example has:

Component value is the successive value that is evenly distributed of [a, b] scope, and normalized is mapped as [(x-a)/(b-a), (y-a)/(b-a)] with former data [x, y];

Component value represents to serve total time t, and normalized is 1-1/t;

To the discrete type component, have " on ", " in " as certain component, three kinds of values of D score can be mapped as 0,0.5,1.

(2) A _UTMAccording to the regular M (X) that converts, ask T _x(I _x) general trust value T (I _x)

A _UTMEach trust domain X is manually determined a conversion matrix M (X), has:

T _x(I _x)·M(X)＝T(I _x)

For example: T _x(I _x)={ x ₁, x ₂, x ₃,

$M\left(X\right)=\left(\begin{array}{ccccccc}1& 0& 0& 0& 0& 0& 0.5\\ 0& 0& 1& 0& 1& 0& 0\\ 0& 0& 0& 0& 0& 1& 0.5\end{array}\right),$

T (I then _x)={ x ₁, 0, x ₂, 0, x ₂, x ₃, (x ₁+ x ₃)/2}

At last, A _UTMThe general trust value that gathers this all users gathers and calculated population trust value T (I), and I is I _xRelated generic identity.Calculated population trust value T (I) can adopt existing single domain to trust computing formula.As example, introduce a kind of simple accumulation calculating method here:

Wherein, there be the identity related with his generic identity I in the user at least one trust domain, described trust domain add up to n.

Claims (3)

1. stride the construction method of trust domain trusting relationship in the computer network, it is characterized in that: this trust domain of agency and the mutual computer of central server are set at each trust domain, this computer is called the agent node of this trust domain, agent node links to each other with central server, each user is at least one trust domain registration, the foundation association of central server between the different identity of this user's different trust domain, when a user when central server is initiated trust value query requests to another user, central server obtains by the trust value of inquiring user at this agent node place trust domain to the agent node of all trust domain, central server will be converted to general trust value by the trust value of inquiring user in each trust domain, and should carry out comprehensively corresponding to a plurality of general trust value of same area not, calculate this user's comprehensive trust value, the structure of the trusting relationship of trust domain is striden in realization.

2. stride the construction method of trust domain trusting relationship in the computer network according to claim 1, it is characterized in that: the association of user between the different identity of different trust domain set up according to the following steps:

(1) user directly proposes the application for registration of generic identity to central server, proposes the related request between the different identity of this user in a plurality of trust domain;

(2) central server authenticates this related authenticity.

3. stride the construction method of trust domain trusting relationship in the computer network according to claim 1, it is characterized in that: the comprehensive trust value that central server calculates the user adopts following steps:

(1) the users to trust value that obtains from each agent node is carried out preliminary treatment, be converted into the numerical value of [0,1] scope;

(2) trust value of each trust domain is the vector value with at least one component, is mapped as general trust value by matrix operation;

(3) adopt existing single domain to trust computational methods, gather the comprehensive trust value that all general trust values calculate the user.

Images