WO2021036521A1

WO2021036521A1 - Information sharing method, apparatus, system, electronic device, and storage medium

Info

Publication number: WO2021036521A1
Application number: PCT/CN2020/100754
Authority: WO
Inventors: 程叶霞; 彭晋; 付俊
Original assignee: 中国移动通信有限公司研究院; 中国移动通信集团有限公司
Priority date: 2019-08-30
Filing date: 2020-07-08
Publication date: 2021-03-04
Also published as: CN112448923A; CN112448923B

Abstract

Provided in the present disclosure are an information sharing method, an apparatus, a system, an electronic device, and a computer-readable storage medium. The method comprises: receiving threat intelligence information, the threat intelligence information being information which threatens network security and being sent by a first blockchain node; when the threat intelligence information undergoes consensus by using a first consensus algorithm, generating a first shared block on the basis of the threat intelligence information; and when the first shared block undergoes consensus by means of multiple blockchain nodes which receive the first shared block, writing the first shared block into a blockchain.

Description

Information sharing method, device, system, electronic equipment and storage medium

Cross-references to related applications

This application claims the priority of Chinese Patent Application No. 201910817069.6 filed in China on August 30, 2019, the entire content of which is incorporated herein by reference.

Technical field

The embodiments of the present disclosure relate to the field of network security technologies, and in particular, to an information sharing method, device, system, electronic device, and computer-readable storage medium.

Background technique

With the rapid development of computer and network technology, various network security incidents occur frequently, and new vulnerabilities are emerging one after another, spawning a large number of new security risks, posing serious threats to network security and business security.

In the traditional network security model, each security subsystem is independent of each other, and security protection works independently, making various threat intelligence information relatively isolated, causing an island effect; thus, each security subsystem cannot obtain or analyze the latest and most updated information in a timely and effective manner. Valuable threat intelligence information prevents timely protection and emergency response, leading to security risks and security attacks.

Therefore, in order to make the various security subsystems work together for efficient protection, the construction of a threat intelligence information sharing platform is a very important task in the construction of network security. At the same time, in the sharing mechanism in related technologies, the threat intelligence information shared may be tampered with.

Summary of the invention

The embodiments of the present disclosure provide an information sharing method, device, system, electronic device, and computer-readable storage medium to solve the problem of mutual independence and lack of sharing of threat intelligence information in related technologies. At the same time, it solves the problem of the sharing mechanism in related technologies. , Its shared threat intelligence information has the possibility of being tampered with.

In the first aspect, embodiments of the present disclosure provide an information sharing method, the method including:

Receiving threat intelligence information, where the threat intelligence information is information threatening network security, and the threat intelligence information is sent by the first blockchain node;

In the case where the threat intelligence information is agreed by the first consensus algorithm, generate a first shared block based on the threat intelligence information;

In the case where the first shared block is received by the consensus of multiple blockchain nodes of the first shared block, the first shared block is written into the blockchain.

In the above solution, the threat intelligence information includes at least one of the following:

Internet Protocol IP address information that threatens network security;

Domain name information that threatens network security;

Uniform resource locator URL information that threatens network security;

Information on security incidents that threaten network security;

Information on vulnerabilities that threaten network security.

In the above solution, after the first shared block is written into the corresponding blockchain, the method further includes:

Receive the calling information sent by the second blockchain node for the target threat intelligence information;

Based on the call information, the rating parameters in the target shared block are updated. The target shared block is the latest shared block on the time axis generated based on the target threat intelligence information, and the rating parameter is the shared block. The parameters used for evaluation by the blockchain node of the target threat intelligence information;

In the case where the updated rating parameters are agreed by the second consensus algorithm, generate a second shared block based on the target shared block and the updated rating parameters;

In the case where the second shared block is received by the consensus of multiple blockchain nodes of the second shared block, the second shared block is written into the blockchain.

In the above solution, the step of updating the rating parameters in the target shared block based on the calling information includes:

Based on the calling information, determining the target parameters for calling the target threat intelligence information;

Based on the target parameter, the rating parameter in the target shared block is updated.

In the above solution, the target parameter includes at least one of the following:

Number of calls

An evaluation parameter used by the second blockchain node to evaluate the call of the target threat intelligence information.

In a second aspect, embodiments of the present disclosure provide an information sharing device, the device including:

The first receiving module is configured to receive threat intelligence information, where the threat intelligence information is information that threatens network security, and the threat intelligence information is sent by the first blockchain node;

The first generation module is configured to generate a first shared block based on the threat intelligence information when the threat intelligence information is agreed by the first consensus algorithm;

The first writing module is used to write the first shared block to the block when the first shared block is received by the consensus of multiple blockchain nodes of the first shared block Chain.

Internet Protocol IP address information that threatens network security;

Domain name information that threatens network security;

Uniform resource locator URL information that threatens network security;

Information on security incidents that threaten network security;

Information on vulnerabilities that threaten network security.

In the above solution, the device further includes:

The second receiving module is used to receive the calling information sent by the second blockchain node for the target threat intelligence information;

The update module is configured to update the rating parameters in the target shared block based on the call information, the target shared block being the latest shared block on the time axis generated based on the target threat intelligence information, the The rating parameters are parameters for evaluating the blockchain nodes sharing the target threat intelligence information;

The second generation module is configured to generate a second shared block based on the target shared block and the updated rating parameter when the updated rating parameter is agreed by the second consensus algorithm;

The second writing module is used to write the second shared block to the second shared block when the second shared block is received by the consensus of multiple blockchain nodes of the second shared block In the blockchain.

In the above solution, the update module is specifically configured to determine the target parameter for calling the target threat intelligence information based on the calling information; and to update the rating parameter in the target shared block based on the target parameter.

Number of calls

In a third aspect, an embodiment of the present disclosure provides an electronic device, the electronic device including: a transceiver and a processor;

The transceiver is configured to receive threat intelligence information, where the threat intelligence information is information that threatens network security, and the threat intelligence information is sent by a first blockchain node;

The processor is configured to generate a first shared block based on the threat intelligence information when the threat intelligence information is agreed by the first consensus algorithm; the first shared block is received in the first shared block In the case of consensus among multiple blockchain nodes sharing a block, the first shared block is written into the blockchain.

Internet Protocol IP address information that threatens network security;

Domain name information that threatens network security;

Uniform resource locator URL information that threatens network security;

Information on security incidents that threaten network security;

Information on vulnerabilities that threaten network security.

In the above solution, the transceiver is also used to receive the calling information sent by the second blockchain node for the target threat intelligence information;

The processor is further configured to update the rating parameters in the target shared block based on the call information, the target shared block being the latest shared block on the time axis generated based on the target threat intelligence information , The rating parameter is a parameter for evaluating the blockchain nodes that share the target threat intelligence information; in the case that the updated rating parameter is agreed by the second consensus algorithm, based on the target shared block and the update The second shared block is generated by the rating parameters of the second shared block; in the case where the second shared block is received by the consensus of multiple blockchain nodes of the second shared block, the second shared block is written To the blockchain.

In the above solution, the processor is specifically configured to determine the target parameter for calling the target threat intelligence information based on the calling information; and to update the rating parameter in the target shared block based on the target parameter.

Number of calls

In a fourth aspect, embodiments of the present disclosure provide an information sharing system, the system including: a first blockchain node, a plurality of blockchain nodes that can interact with the first blockchain node, and electronic devices;

The first blockchain node is used to send threat intelligence information, where the threat intelligence information is information that threatens network security;

The electronic device is used to receive the threat intelligence information; when the threat intelligence information is agreed by the first consensus algorithm, generate a first shared block based on the threat intelligence information; and transfer the first shared area The block is sent to the multiple blockchain nodes that can interact with the first blockchain node;

The multiple blockchain nodes that can interact with the first blockchain node are used to receive the first shared block; and make a consensus on the first shared block;

The electronic device is further configured to write the first shared block to the block when the first shared block is received by the consensus of multiple blockchain nodes of the first shared block Chain.

Internet Protocol IP address information that threatens network security;

Domain name information that threatens network security;

Uniform resource locator URL information that threatens network security;

Information on security incidents that threaten network security;

Information on vulnerabilities that threaten network security.

In the above solution, the system further includes: a second blockchain node and multiple blockchain nodes that can interact with the second blockchain node;

The second blockchain node is used to send call information for target threat intelligence information;

The electronic device is also used to receive the calling information sent by the second blockchain node for the target threat intelligence information; based on the calling information, the rating parameters in the target shared block are updated, and the target shared block is Based on the latest shared block on the time axis generated by the target threat intelligence information, the rating parameter is a parameter for evaluating the blockchain nodes that share the target threat intelligence information; the updated rating parameter is determined by the second consensus In the case of algorithm consensus, generate a second shared block based on the target shared block and the updated rating parameters; send the second shared block to the node that can interact with the second blockchain Of multiple blockchain nodes;

The multiple blockchain nodes that can interact with the second blockchain node are used to receive the second shared block; and make a consensus on the second shared block;

The electronic device is further configured to write the second shared block to the second shared block when the second shared block is received by the consensus of multiple blockchain nodes of the second shared block In the blockchain.

In the above solution, the electronic device is specifically configured to determine the target parameter for calling the target threat intelligence information based on the calling information; and to update the rating parameter in the target shared block based on the target parameter.

Number of calls

In a fifth aspect, an embodiment of the present disclosure provides an electronic device including a processor, a memory, a computer program stored on the memory and capable of running on the processor, and when the computer program is executed by the processor Steps to implement the above information sharing method.

In a sixth aspect, embodiments of the present disclosure provide a computer-readable storage medium having a computer program stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the above-mentioned information sharing method are implemented.

In the embodiment of the present disclosure, firstly, threat intelligence information is received. The threat intelligence information is information that threatens network security. The threat intelligence information is sent by the first blockchain node; then, the threat intelligence information is received by the first consensus. In the case of algorithm consensus, the first shared block is generated based on the threat intelligence information; finally, in the case where the first shared block is received by the consensus of multiple blockchain nodes of the first shared block, Write the first shared block into the blockchain. In this way, a blockchain of threat intelligence information and threat intelligence sources can be constructed through blockchain technology to realize the sharing of threat intelligence information. At the same time, because the blockchain has the characteristic of being non-tamperable, the possibility of tampering with the threat intelligence information can be avoided.

Description of the drawings

In order to explain the technical solutions of the embodiments of the present disclosure more clearly, the following will briefly introduce the accompanying drawings used in the description of the embodiments of the present disclosure. Obviously, the accompanying drawings in the following description are only some embodiments of the present disclosure. For those of ordinary skill in the art, without creative labor, other drawings can be obtained based on these drawings.

FIG. 1 is one of the schematic flowcharts of the information sharing method provided by an embodiment of the present disclosure;

2 is a schematic diagram of each blockchain node in the information sharing method provided by an embodiment of the present disclosure;

3 is a schematic diagram of the structure of a shared block in the information sharing method provided by an embodiment of the present disclosure;

Figure 4 is a schematic diagram of the chain of the blockchain;

FIG. 5 is the second schematic flowchart of the information sharing method provided by an embodiment of the present disclosure;

FIG. 6 is a schematic structural diagram of an information sharing device provided by an embodiment of the present disclosure;

FIG. 7 is a schematic structural diagram of an electronic device provided by an embodiment of the present disclosure;

FIG. 8 is one of the structural schematic diagrams of an information sharing system provided by an embodiment of the present disclosure;

Fig. 9 is a second structural diagram of an information sharing system provided by an embodiment of the present disclosure.

detailed description

In the background art, in the sharing mechanism in the related art, the threat intelligence information shared may be tampered with.

For example, in the related technology, the unknown data table in the intranet is polled according to a preset period to obtain the unknown data in the unknown data table; the query request is sent to the intelligence cloud server based on the unknown data, and the information returned by the intelligence cloud server is received. The query result of threat intelligence information; the query result is pushed to the threat intelligence platform of the intranet, so that the threat intelligence platform can store the query result to realize the sharing of threat intelligence information.

In the process of realizing sharing, the above scheme requires the intelligence cloud server to query and push the query results. In these processes, the threat intelligence information is at risk of being tampered with.

Based on this, the embodiments of the present disclosure propose a scheme for sharing threat intelligence information based on the blockchain.

The technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of the present disclosure.

The following first describes the information sharing method provided by the embodiments of the present disclosure.

It should be noted that the information sharing method provided by the embodiments of the present disclosure can be applied to an information sharing system, and the information sharing system includes multiple blockchain nodes and electronic devices. The electronic device may be an information sharing server for sharing the threat intelligence information provided by the first blockchain node based on the blockchain.

Refer to FIG. 1, which shows one of the schematic flowcharts of the information sharing method provided by an embodiment of the present disclosure. As shown in Figure 1, the method may include the following steps:

Step 101: Receive threat intelligence information, where the threat intelligence information is information threatening network security, and the threat intelligence information is sent by a first blockchain node.

Here, the logical relationship between the various blockchain nodes involved in the embodiment of the present disclosure is first introduced. Referring to FIG. 2, a schematic diagram of each blockchain node in the information sharing method provided by the embodiment of the present disclosure is shown in the figure.

As shown in Figure 2, Node 1, Node 2, Node 3, Node n-1, and Node n are blockchain nodes, and each blockchain node forms a point-to-point communication on a logical level. For example, Node 1 can interact with n-1 nodes such as Node 2, Node 3, Node n-1, Node n; Node 2 can interact with n-1 nodes such as Node 1, Node 3, Node n-1, Node n, etc. Nodes interact; Node 3 can interact with n-1 nodes such as Node 1, Node 2, Node n-1, Node n; Node n-1 can interact with Node 1, Node 2, Node 3, Node n, etc. n- One node interacts; Node n can interact with n-1 nodes such as Node 1, Node 2, Node 3, Node n-1.

It should be noted that although 5 blockchain nodes are shown in Figure 2, the number of blockchain nodes in the figure is only used as an indication, not as a restriction on the specific number of blockchain nodes . In practical applications, the number of blockchain nodes may be far more than 5.

In the embodiments of the present disclosure, the blockchain nodes are functionally divided, and there may be multiple types, each type of blockchain node may include multiple, and the first blockchain node is a block that provides threat intelligence information. The chain node can be called a threat intelligence provider or a threat intelligence source. The first blockchain node can be a professional threat intelligence manufacturer, an antivirus manufacturer, an anti-APT manufacturer, a detection product manufacturer, and a free Roles such as intelligence alliances and customers.

If the first blockchain node learns unknown data that threatens network security, it generates threat intelligence information based on the unknown data; and calls the upload interface to upload the threat intelligence information to the electronic threat intelligence information sharing. equipment. Correspondingly, the electronic device receives the threat intelligence information.

The threat intelligence information includes at least one of the following:

Internet Protocol IP address information that threatens network security;

Domain name information that threatens network security;

Uniform resource locator URL information that threatens network security;

Information on security incidents that threaten network security;

Information on vulnerabilities that threaten network security.

The IP address information is threat intelligence information related to IP addresses, the domain name information is threat intelligence information related to domain names, the URL information is threat intelligence information related to URLs, and the security event information is related to security events. Related threat intelligence information, where the vulnerability information is threat intelligence information related to the vulnerability.

Step 102: In a case where the threat intelligence information is agreed by the first consensus algorithm, generate a first shared block based on the threat intelligence information.

Here, in the embodiments of the present disclosure, after receiving the threat intelligence information, the electronic device agrees on the threat intelligence information based on the first consensus algorithm. After the consensus, the threat intelligence information is recorded, and the time when the threat intelligence information is acquired can be recorded. In order to realize the synchronization of blocks in the blockchain.

After the threat intelligence information is recorded, the shared block in the blockchain can be constructed. Refer to FIG. 3, which shows a schematic structural diagram of a sharing block in an information sharing method provided by an embodiment of the present disclosure.

As shown in Figure 3, the shared block includes a block header and a block body. Among them, the block header is composed of the hash value of the previous shared block, Merkle root, random number, and timestamp. The block body may include at least one of IP address information threatening network security, domain name information threatening network security, URL information threatening network security, security event information threatening network security, and vulnerability information threatening network security.

At the same time, in order to solve the problem that there are many threat intelligence sources, it is impossible to effectively determine whether the threat intelligence source is credible, and the contribution rate is high or low, the block body can also include the rating parameters of the threat intelligence source, and the rating parameters can be based on the second zone. The block chain node is updated in response to the invocation of the threat intelligence information shared by the threat intelligence source, and the specific update process will be described in detail in the following embodiments.

Specifically, the hash value of the previous shared block is the value generated by hashing from all the information of the previous shared block plus the previous timestamp.

The Merkle root is a Merkle tree composed of all the information in the block body, and the hash value of the Merkle tree root is calculated. This value can bind the block header and the block body.

A random number is a random number generated by the current node through the SHA256 hash algorithm based on all public key information and the current timestamp. This random number requires the hash value of the next shared block to start with this number. Number, through which the random number can prevent the attacker from forging the block of the blockchain.

The timestamp is the time stamp stamped by the node that released the shared block at the time of release, starting at 00:00 UTC on January 1, 1970, and the number of seconds between when the shared block was generated.

The rating parameters of threat intelligence sources include the credibility of threat intelligence sources, the contribution rate of threat intelligence sources, and the level of threat intelligence sources. Threat intelligence source credibility refers to the credibility-related information of the threat intelligence source, the contribution rate of threat intelligence source is the contribution rate related information of the threat intelligence source, and the level of the threat intelligence source is the level-related information of the threat intelligence source.

Based on the threat intelligence information, the first shared block is generated according to the structural characteristics of the shared block construction.

At the same time, based on each shared block constructed, a blockchain link can be constructed, as shown in Figure 4, which shows a chain diagram of the blockchain. As shown in Figure 4, the blockchain is composed of a creation block, a shared block 1, a shared block 2, and a shared block m-1, and a shared block m.

It should be noted that the first shared block is the initial block constructed based on the threat intelligence information provided by the threat intelligence source. Therefore, the rating parameter for the threat intelligence source can be 0 by default.

Step 103: In the case where the first shared block is received by the consensus of multiple blockchain nodes of the first shared block, write the first shared block into the blockchain.

After the electronic device generates the first shared block, it will broadcast the first shared block. Specifically, the first shared block is sent to all blockchain nodes of the same type as the first blockchain node. After these blockchain nodes receive the first shared block, they will reach a consensus on the first shared block. After the consensus is passed, the result is sent to the electronic device.

In the case where the first shared block is approved by a consensus of multiple blockchain nodes, the first shared block is written into the blockchain.

It should be noted that the prerequisite for writing the first shared block to the blockchain, that is, the number of the first shared block passed by the consensus of the blockchain nodes can be set according to the specific situation, and can be set to The preset percentage relative to the number of all blockchain nodes, such as 50%, can also be set to a preset value, such as 6. In short, as long as the first shared block is approved by the consensus of a preset number of blockchain nodes, the electronic device will write the first shared block into the blockchain.

The above describes in detail the construction of the sharing platform based on the threat intelligence information provided by the threat intelligence source. The following will describe in detail how to share the threat intelligence information based on the sharing platform, and how to rate the rating in the shared block constructed in the sharing platform. The parameters are updated.

Further, based on the first embodiment, referring to FIG. 5, the figure shows the second schematic flowchart of the information sharing method provided by the embodiment of the present disclosure. As shown in Figure 5, after the step 103, the method may further include the following steps:

Step 501: Receive the call information sent by the second blockchain node for the target threat intelligence information.

Here, in terms of functions, the second blockchain node is a blockchain node that calls threat intelligence information, and can be called a threat intelligence caller or a threat intelligence sharer.

The second blockchain node is usually different from the first blockchain node, but the same situation exists. For example, the detection product manufacturer can provide threat intelligence information as a threat intelligence source, and can also call others as a threat intelligence caller. Threat intelligence information provided by threat intelligence sources.

The second blockchain node calls the shared record of the target threat intelligence information to generate call information; and calls the upload interface to upload the call information to the electronic device. Correspondingly, the electronic device receives the call information.

Step 502, based on the call information, update the rating parameters in the target shared block, the target shared block being the latest shared block on the time axis generated based on the target threat intelligence information, the rating parameter It is a parameter for evaluating the blockchain nodes sharing the target threat intelligence information.

The rating parameters may include the credibility of the threat intelligence source, the contribution rate of the threat intelligence source, and the level of the threat intelligence source. Threat intelligence source credibility refers to the credibility-related information of the threat intelligence source, the contribution rate of threat intelligence source is the contribution rate related information of the threat intelligence source, and the level of the threat intelligence source is the level-related information of the threat intelligence source.

The level of the threat intelligence source can be calculated by the credibility of the threat intelligence source and the contribution rate of the threat intelligence source. For example, when the credibility of the threat intelligence source is between 10% and 20%, and the contribution rate of the threat intelligence source is 10%. %-20%, the level of the threat intelligence source is at the fifth level. Of course, the above method of setting the level of threat intelligence sources is just an example, and cannot be used to limit the method of setting the level of threat intelligence sources.

After receiving the calling information, the electronic device queries the blockchain nodes sharing the target threat intelligence information based on the target threat intelligence information in the calling information, that is, queries the threat intelligence source from which the target threat intelligence information comes.

First, based on the target threat intelligence information in the calling information, query and obtain the target shared block, and based on the target shared block, obtain the blockchain nodes that share the target threat intelligence information, and obtain the rating parameters at the same time.

Then, based on the calling information, the rating parameters are updated.

The step of updating the rating parameters in the target shared block based on the calling information includes:

Wherein, the target parameter includes at least one of the following:

Number of calls

The number of invocations can be determined according to the number of statistical invocation information. In addition, the calling information may also include evaluation parameters used by the second blockchain node to evaluate the calling of the target threat intelligence information. For example, a feedback mechanism may be set to provide a feedback interface for threat intelligence callers to feed back threats. The quality of the intelligence information is high or low; accordingly, the evaluation parameters in the calling information are obtained.

Specifically, there are the following three ways to update the rating parameters.

The first method is to update the rating parameters based on the number of times the second blockchain node calls the target threat intelligence information.

For example, when the number of calls reaches a preset value, the rating parameter is increased by a preset percentage. For example, when the number of calls reaches 1, the rating parameter is increased by 1%.

The second type: the evaluation parameter of the second blockchain node for evaluating the call of the target threat intelligence information, and the evaluation parameter is updated.

For example, when the evaluation parameter indicates that the target threat intelligence information is useful, its rating parameter is correspondingly increased by a preset percentage; when the evaluation parameter indicates that the target threat intelligence information is not useful, its rating parameter is correspondingly reduced by a preset percentage.

The third type: based on the number of calls of the target threat intelligence information by the second blockchain node and the evaluation parameters for the second blockchain node to evaluate the calling of the target threat intelligence information, the rating parameters are evaluated Update.

For example, the rating parameter is updated according to the ratio of the number of evaluation parameters that indicate the usefulness of the target threat intelligence information and the number of calls. The larger the ratio, the more the rating parameter increases accordingly.

Step 503: In the case where the updated rating parameters are agreed by the second consensus algorithm, a second shared block is generated based on the target shared block and the updated rating parameters.

The second consensus algorithm may be the same as or different from the first consensus algorithm, and there is no restriction here.

Here, after updating the rating parameters, based on the second consensus algorithm, a consensus is made on the updated rating parameters. After the consensus, the updated rating parameters are recorded, and the time when the rating parameters are updated can be recorded, so as to realize the regionalization in the blockchain. Synchronization of blocks.

After recording the updated rating parameters, based on the target shared block and the updated rating parameters, a second shared block can be generated according to the structural characteristics of the shared block construction.

It should be noted that the second shared block and the target shared block may differ only in rating parameters.

Step 504: In the case where the second shared block is received by the consensus of multiple blockchain nodes of the second shared block, write the second shared block into the blockchain.

After the electronic device generates the second shared block, it will broadcast the second shared block. Specifically, the second shared block is sent to all blockchain nodes of the same type as the second blockchain node. After these blockchain nodes receive the second shared block, they will reach a consensus on the second shared block. After the consensus is passed, the result is sent to the electronic device.

In the case where the second shared block is approved by a consensus of multiple blockchain nodes, the second shared block is written into the blockchain.

It should be noted that the prerequisite for writing the second shared block to the blockchain, that is, the number of second shared blocks that are passed by the consensus of the blockchain nodes can be set according to the specific situation, and can be set to The preset percentage relative to the number of all blockchain nodes, such as 50%, can also be set to a preset value, such as 6. In short, as long as the second shared block is approved by the consensus of a preset number of blockchain nodes, the electronic device will write the second shared block into the blockchain.

In the embodiment of the present disclosure, the rating parameters are updated by setting the rating parameters in the shared block in the blockchain, and using the calling information sent by the second blockchain node for the target threat intelligence information,

Therefore, the credibility, contribution and level of threat intelligence sources can be determined according to the rating parameters, and the problem of numerous threat intelligence sources can be solved, so that threat intelligence callers cannot effectively determine whether the threat intelligence source is credible and the contribution rate is high or low. At the same time, a feedback mechanism can be set up to feed back the quality of the threat intelligence information shared to the threat intelligence caller. In this way, it can solve the problem that there is no corresponding feedback mechanism for the quality of the threat intelligence information provided by the threat intelligence source. In turn, it can be beneficial to the continuous and effective development of the closed loop of the entire threat intelligence ecosystem.

The information sharing device provided by the embodiments of the present disclosure will be described below.

Referring to FIG. 6, the figure shows a schematic structural diagram of an information sharing device provided by an embodiment of the present disclosure. As shown in FIG. 6, the information sharing device 600 includes:

The first receiving module 601 is configured to receive threat intelligence information, where the threat intelligence information is information that threatens network security, and the threat intelligence information is sent by a first blockchain node;

The first generation module 602 is configured to generate a first shared block based on the threat intelligence information when the threat intelligence information is agreed by the first consensus algorithm;

The first writing module 603 is configured to write the first shared block to the zone when the first shared block is received by the consensus of multiple blockchain nodes of the first shared block Block chain.

Optionally, the threat intelligence information includes at least one of the following:

Internet Protocol IP address information that threatens network security;

Domain name information that threatens network security;

Uniform resource locator URL information that threatens network security;

Information on security incidents that threaten network security;

Information on vulnerabilities that threaten network security.

Optionally, the device further includes:

Optionally, the update module is specifically configured to determine the target parameter for calling the target threat intelligence information based on the calling information; and to update the rating parameter in the target shared block based on the target parameter.

Optionally, the target parameter includes at least one of the following:

Number of calls

The information sharing device 600 can implement the various processes implemented in the foregoing method embodiments. To avoid repetition, details are not described herein again.

The electronic equipment provided by the embodiments of the present disclosure will be described below.

Referring to FIG. 7, the figure shows a schematic structural diagram of an electronic device provided by an embodiment of the present disclosure. As shown in FIG. 7, the electronic device 700 includes: a bus 701, a transceiver 702, an antenna 703, a bus interface 704, a processor 705, and a memory 706.

The transceiver 702 is configured to receive threat intelligence information, where the threat intelligence information is information that threatens network security, and the threat intelligence information is sent by a first blockchain node;

The processor 705 is configured to generate a first shared block based on the threat intelligence information when the threat intelligence information is agreed by the first consensus algorithm; the first shared block is received in the first shared block In the case of a consensus among multiple blockchain nodes sharing a block, the first shared block is written into the blockchain.

Internet Protocol IP address information that threatens network security;

Domain name information that threatens network security;

Uniform resource locator URL information that threatens network security;

Information on security incidents that threaten network security;

Information on vulnerabilities that threaten network security.

In the above solution, the transceiver 702 is also used to receive the call information sent by the second blockchain node for the target threat intelligence information;

The processor 705 is further configured to update the rating parameters in the target shared block based on the call information, the target shared block being the latest shared zone on the time axis generated based on the target threat intelligence information Block, the rating parameter is a parameter for evaluating the blockchain nodes that share the target threat intelligence information; in the case where the updated rating parameter is agreed by the second consensus algorithm, based on the target shared block and the The updated rating parameters are used to generate a second shared block; in the case where the second shared block is received by the consensus of multiple blockchain nodes of the second shared block, the second shared block is written Into the blockchain.

In the above solution, the processor 705 is specifically configured to determine the target parameter for calling the target threat intelligence information based on the calling information; and to update the rating parameter in the target shared block based on the target parameter.

Number of calls

In Figure 7, the bus architecture (represented by bus 701), bus 701 can include any number of interconnected buses and bridges, bus 701 will include one or more processors represented by processor 705 and memory represented by memory 706 The various circuits are linked together. The bus 701 may also link various other circuits such as peripheral devices, voltage regulators, power management circuits, etc., which are all known in the art, and therefore, no further description will be given herein. The bus interface 704 provides an interface between the bus 701 and the transceiver 702. The transceiver 702 may be one element or multiple elements, such as multiple receivers and transmitters, and provide a unit for communicating with various other devices on a transmission medium. The data processed by the processor 705 is transmitted on the wireless medium through the antenna 703, and further, the antenna 703 also receives the data and transmits the data to the processor 705.

The processor 705 is responsible for managing the bus 701 and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. The memory 706 may be used to store data used by the processor 705 when performing operations.

Optionally, the processor 705 may be a CPU, ASIC, FPGA or CPLD.

Optionally, an embodiment of the present disclosure further provides an electronic device, including a processor 705, a memory 706, a computer program stored on the memory 706 and running on the processor 705, and the computer program is executed by the processor 705 Each process of the above-mentioned information sharing method embodiment can be realized at a time, and the same technical effect can be achieved. In order to avoid repetition, it will not be repeated here.

In the embodiment of the present disclosure, firstly, threat intelligence information is received. The threat intelligence information is information that threatens network security. The threat intelligence information is sent by the first blockchain node; then, the threat intelligence information is received by the first consensus. In the case of algorithm consensus, the first shared block is generated based on the threat intelligence information; finally, in the case where the first shared block is received by the consensus of multiple blockchain nodes of the first shared block, Write the first shared block into the blockchain. In this way, a blockchain of threat intelligence information and threat intelligence sources can be constructed through blockchain technology to realize the sharing of threat intelligence information. At the same time, because the blockchain has the characteristic of being non-tamperable, it can avoid the possibility of the threat intelligence information being tampered with.

The information sharing system provided by the embodiments of the present disclosure will be described below.

Referring to FIG. 8, the figure shows one of the structural schematic diagrams of the information sharing system provided by an embodiment of the present disclosure. As shown in Figure 8, the information sharing system 800 includes: an underlying blockchain module 801, a blockchain-based threat intelligence sharing module 802, and a blockchain-based threat intelligence rating module 803; among them,

The underlying blockchain module 801 is used to support and implement blockchain technology for all blockchain nodes of the threat intelligence source, such as consensus algorithms.

The block chain-based threat intelligence sharing module 802 is used to share threat intelligence information such as IP address information, domain name information, URL information, security event information, and vulnerability information in the block chain.

The block chain-based threat intelligence rating module 803 is used to calculate the credibility of the threat intelligence source and the contribution rate of the threat intelligence source in the block chain, and to rate the level of the threat intelligence source.

Refer to FIG. 9, which shows the second structural diagram of an information sharing system provided by an embodiment of the present disclosure. As shown in FIG. 9, the information sharing system 900 includes: a first blockchain node 901, a plurality of blockchain nodes 902 that can interact with the first blockchain node, and an electronic device 903;

The first blockchain node 901 is configured to send threat intelligence information, where the threat intelligence information is information that threatens network security;

The electronic device 903 is configured to receive the threat intelligence information; in the case that the threat intelligence information is agreed by the first consensus algorithm, generate a first shared block based on the threat intelligence information; Sending the block to the multiple blockchain nodes that can interact with the first blockchain node;

The multiple blockchain nodes 902 capable of interacting with the first blockchain node are used to receive the first shared block; and make a consensus on the first shared block;

The electronic device 903 is further configured to write the first shared block to the zone when the first shared block is received by multiple blockchain nodes of the first shared block. Block chain.

Internet Protocol IP address information that threatens network security;

Domain name information that threatens network security;

Uniform resource locator URL information that threatens network security;

Information on security incidents that threaten network security;

Information on vulnerabilities that threaten network security.

In the above solution, the system further includes: a second blockchain node 904 and a plurality of blockchain nodes 905 that can interact with the second blockchain node;

The second blockchain node 904 is used to send call information for target threat intelligence information;

The electronic device 903 is also used to receive the call information sent by the second blockchain node for the target threat intelligence information; based on the call information, update the rating parameters in the target shared block, the target shared block Is the latest shared block on the time axis generated based on the target threat intelligence information, the rating parameter is a parameter for evaluating the blockchain nodes sharing the target threat intelligence information; the updated rating parameter is the second In the case of consensus algorithm consensus, based on the target shared block and the updated rating parameters, generate a second shared block; send the second shared block to the node that can communicate with the second blockchain Multiple blockchain nodes that interact;

The multiple blockchain nodes 905 that can interact with a second blockchain node are used to receive the second shared block; and make a consensus on the second shared block;

The electronic device 903 is further configured to write the second shared block to all blockchain nodes when the second shared block is received by multiple blockchain nodes of the second shared block. Said in the blockchain.

In the above solution, the electronic device 903 is specifically configured to determine the target parameter for calling the target threat intelligence information based on the calling information; and to update the rating parameter in the target shared block based on the target parameter.

Number of calls

The embodiments of the present disclosure also provide a computer-readable storage medium, and a computer program is stored on the computer-readable storage medium. When the computer program is executed by a processor, each process of the above-mentioned information sharing method embodiment is realized, and the same technology can be achieved. The effect, in order to avoid repetition, will not be repeated here. Wherein, the computer-readable storage medium, such as read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk, or optical disk, etc.

A person of ordinary skill in the art may realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed by hardware or software depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of the present disclosure.

Those skilled in the art can clearly understand that, for the convenience and conciseness of description, the specific working process of the system, device and unit described above can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the embodiments provided in this application, it should be understood that the disclosed system and method may be implemented in other ways. For example, the system embodiment described above is only illustrative. For example, the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or It can be integrated into another system, or some features can be ignored or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments of the present disclosure.

In addition, the functional units in the various embodiments of the present disclosure may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.

If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solution of the present disclosure essentially or the part that contributes to the related technology or the part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several The instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present disclosure. The aforementioned storage media include: U disk, mobile hard disk, ROM, RAM, magnetic disk or optical disk and other media that can store program codes.

The above are only specific implementations of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present disclosure. It should be covered within the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be subject to the protection scope of the claims.

Claims

A method of information sharing, including:

Receiving threat intelligence information, where the threat intelligence information is information that threatens network security, and the threat intelligence information is sent by the first blockchain node;

In the case where the threat intelligence information is agreed by the first consensus algorithm, generate a first shared block based on the threat intelligence information;

In the case where the first shared block is received by the consensus of multiple blockchain nodes of the first shared block, the first shared block is written into the blockchain.
The method according to claim 1, wherein the threat intelligence information includes at least one of the following:

Internet Protocol IP address information that threatens network security;

Domain name information that threatens network security;

Uniform resource locator URL information that threatens network security;

Information on security incidents that threaten network security;

Information on vulnerabilities that threaten network security.
The method according to claim 1, wherein, after the writing the first shared block into the corresponding blockchain, the method further comprises:

Receive the calling information sent by the second blockchain node for the target threat intelligence information;

Based on the call information, the rating parameters in the target shared block are updated. The target shared block is the latest shared block on the time axis generated based on the target threat intelligence information, and the rating parameter is the shared block. The parameters used for evaluation by the blockchain node of the target threat intelligence information;

In the case where the updated rating parameters are agreed by the second consensus algorithm, generate a second shared block based on the target shared block and the updated rating parameters;

In the case where the second shared block is received by the consensus of multiple blockchain nodes of the second shared block, the second shared block is written into the blockchain.
The method according to claim 3, wherein the step of updating the rating parameters in the target shared block based on the calling information comprises:

Based on the calling information, determining the target parameters for calling the target threat intelligence information;

Based on the target parameter, the rating parameter in the target shared block is updated.
The method according to claim 4, wherein the target parameter includes at least one of the following:

Number of calls

An evaluation parameter used by the second blockchain node to evaluate the call of the target threat intelligence information.
An information sharing device includes:

The first receiving module is configured to receive threat intelligence information, where the threat intelligence information is information that threatens network security, and the threat intelligence information is sent by the first blockchain node;

The first generation module is configured to generate a first shared block based on the threat intelligence information when the threat intelligence information is agreed by the first consensus algorithm;

The first writing module is used to write the first shared block to the block when the first shared block is received by the consensus of multiple blockchain nodes of the first shared block Chain.
An electronic device, including: a transceiver and a processor;

The transceiver is configured to receive threat intelligence information, where the threat intelligence information is information that threatens network security, and the threat intelligence information is sent by a first blockchain node;

The processor is configured to generate a first shared block based on the threat intelligence information when the threat intelligence information is agreed by the first consensus algorithm; the first shared block is received in the first shared block In the case of consensus among multiple blockchain nodes sharing a block, the first shared block is written into the blockchain.
An electronic device, comprising: a processor, a memory, a computer program stored on the memory and running on the processor, and the computer program is executed by the processor to implement claims 1 to 5 The steps of any one of the information sharing method.
An information sharing system includes: a first block chain node, a plurality of block chain nodes that can interact with the first block chain node, and electronic equipment;

The first blockchain node is used to send threat intelligence information, where the threat intelligence information is information that threatens network security;

The electronic device is configured to receive the threat intelligence information; in the case that the threat intelligence information is agreed by the first consensus algorithm, generate a first shared block based on the threat intelligence information; divide the first shared area Block, sent to the multiple blockchain nodes that can interact with the first blockchain node;

The multiple blockchain nodes that can interact with the first blockchain node are used to receive the first shared block; and make a consensus on the first shared block;

The electronic device is further configured to write the first shared block to the block when the first shared block is received by the consensus of multiple blockchain nodes of the first shared block Chain.
A computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the information sharing method according to any one of claims 1 to 5 is implemented step.