ISSN 1000-1239 CN 11-1777/TP

计算机研究与发展 ›› 2020, Vol. 57 ›› Issue (4): 836-846.doi: 10.7544/issn1000-1239.2020.20190404

• 信息安全 • 上一篇    下一篇

基于区块链的网络安全威胁情报共享模型

黄克振1,2,连一峰1,冯登国1,张海霞1,刘玉岭1,2,马向亮1,2   

  1. 1(中国科学院软件研究所可信计算与信息保障实验室 北京 100190);2(中国科学院大学 北京 100049) (huangkezhen@tca.iscas.ac.cn)
  • 出版日期: 2020-04-01
  • 基金资助: 
    国家自然科学基金项目(U1836211);公安部技术研究计划项目(2018JSYJA08)

Cyber Security Threat Intelligence Sharing Model Based on Blockchain

Huang Kezhen1,2, Lian Yifeng1, Feng Dengguo1, Zhang Haixia1, Liu Yuling1,2, Ma Xiangliang1,2   

  1. 1(Trusted Computing and Information Assurance Laboratory, Institute of Software, Chinese Academy of Sciences, Beijing 100190);2(University of Chinese Academy of Sciences, Beijing 100049)
  • Online: 2020-04-01
  • Supported by: 
    This work was supported by the National Natural Science Foundation of China (U1836211) and the Ministry of Public Security Technology Research Projects (2018JSYJA08).

摘要: 在不断加剧的网络安全攻防对抗过程中,攻防双方存在着天然的不对称性,网络安全威胁情报共享利用是一种有效提高防护方响应能力和效果的手段.然而威胁情报共享利用中的隐私保护需求与构建完整攻击链的需求之间存在矛盾.针对上述矛盾点,提出一种基于区块链的网络安全威胁情报共享模型,利用了区块链技术的账户匿名性和不可篡改性,使用单向加密函数保护情报中的隐私信息,基于加密后的情报构建完整攻击链,借助区块链的回溯能力完成攻击链中攻击源的解密.最后,通过实验验证了该模型的可行性和有效性.

关键词: 网络安全, 网络安全威胁情报, 攻击链, 隐私保护, 区块链

Abstract: In the process of increasing cyber security attack and defense confrontation, there is a natural asymmetry between the offensive and defensive sides. The CTI (cyber security threat intelligence) sharing is an effective method to improve the responsiveness and effectiveness of the protection party. However, there is a contradiction between the privacy protection requirements of CTI sharing and the need to build a complete attack chain. Aiming at the above contradiction, this paper proposes a blockchain-based CTI sharing model, which uses the account anonymity of the blockchain technology to protect the privacy of CTI sharing party, and at the same time utilizes the tamper-free and accounting of the blockchain technology to prevent the “free-riding” behavior in CTI sharing and guarantee the benefit of CTI sharing party. The one-way encryption function is used to protect the private information in CTI, then the model uses the encrypted CTI to build a complete attack chain, and uses the traceability of the blockchain technology to complete the decryption of the attack source in the attack chain. The smart contract mechanism of the blockchain technology is used to implement an automated early warning and response against cyber security threats. Finally, the feasibility and effectiveness of the proposed model are verified by simulation experiments.

Key words: cyber security, cyber security threat intelligence, attack chain, privacy protection, blockchain

中图分类号: