Face recognition-based alarm host virtualization control method and system

Abstract

The application discloses an alarm host virtualization control method and system based on face recognition, relates to the field of security protection, and comprises the following steps: calling a security topology map, performing topology constraint embedding processing on a target park alarm host virtual control engine to obtain a topology linkage control engine; receiving a user's operation request through a mobile terminal, determining a target security area to be accessed, collecting the user's face biological characteristics, obtaining an initial operation permission set through the topology linkage control engine; acquiring real-time topology running parameters, verifying each operation item in the initial operation permission set, and screening to obtain an effective operation permission set; generating a virtual operation interface and pushing it to the mobile terminal to receive the operation instruction triggered by the user; and performing secondary face biological characteristic verification on the user, and sequentially issuing entity protocol instructions to the corresponding target alarm host when the verification is passed. Through the adaptation of the park topology, the security, stability and traceability of the alarm host control are improved.

Description

Technical Field

[0001] This application relates to the field of security protection, specifically to a virtualized control method and system for alarm hosts based on facial recognition. Background Technology

[0002] With the continuous advancement of smart park construction, intrusion alarm systems have become a core component of large parks such as industrial parks and commercial parks. As the core control unit of the intrusion alarm system, the alarm control panel undertakes critical security operations such as arming, disarming, bypassing, and deactivation. Existing large parks generally employ distributed deployment of multi-brand alarm control panels, with multiple nested defense zones within the park. Security personnel operate in both fixed-point duty and mobile patrol modes, placing extremely high demands on the unified virtualized management, operational security, and behavior tracing of the alarm control panels. Therefore, in a multi-brand heterogeneous environment, achieving secure, unified, and efficient management of alarm control panels for park scenarios becomes particularly important.

[0003] Currently, the industry primarily uses a unified virtualization management platform for centralized management of alarm hosts. This platform employs centralized permission configuration, a fixed user interface, and a pool of general protocol adapters for command conversion and distribution, relying on ordinary logs to record operational behavior. However, this approach has significant shortcomings when applied to complex park scenarios: permission determination is static and reactive, making it difficult to match multi-layered defense zone linkage rules with dynamic personnel operation characteristics, easily leading to cross-regional unauthorized operations; the centralized protocol architecture is difficult to adapt to distributed host clusters and older equipment, resulting in poor command communication stability; furthermore, operation logs lack tamper-proof design, and traceability information is limited in scope, failing to meet the control and auditing requirements of high-level security in parks. Summary of the Invention

[0004] To address the aforementioned issues, this application proposes a virtualized control method for an alarm host based on face recognition, comprising: The pre-built security topology map of the target park is invoked, and the topology constraint embedding process is performed on the virtual control engine of the alarm host of the target park to obtain the topology linkage control engine; the security topology map includes the topology nodes of the defense zone, the topology nodes of the alarm host cluster, and the association constraints between each node; The system receives user operation requests via mobile terminals, determines the target zone to be accessed, collects the user's facial biometric features, and obtains the user's initial set of operation permissions for the alarm host cluster corresponding to the target zone through the topology linkage control engine. Obtain the real-time topology operation parameters of the target defense zone at the current moment, verify each operation item in the initial operation permission set based on the real-time topology operation parameters, and filter to obtain a valid operation permission set; The topology linkage control engine generates virtual operation interfaces grouped according to the alarm host cluster based on the set of valid operation permissions, and pushes them to the mobile terminal to receive operation commands triggered by the user. In response to the operation command, the user undergoes a second facial biometric verification. Once the verification is successful, the operation command is mapped to an entity protocol command executable by each target alarm host in the alarm host cluster. Based on the host command dependency relationship in the security topology diagram, the command issuance order is arranged, and the entity protocol commands are sequentially issued to the corresponding target alarm hosts.

[0005] On the other hand, this application also proposes a virtualized control system for an alarm host based on face recognition, characterized in that it includes: The topology constraint embedding module is used to call a pre-built security topology map of the target park and perform topology constraint embedding processing on the virtual control engine of the alarm host of the target park to obtain a topology linkage control engine; the security topology map includes zone topology nodes, alarm host cluster topology nodes and the association constraints between each node; The permission generation module is used to receive user operation requests through a mobile terminal, determine the target defense zone to be accessed, collect the user's facial biometric features, and obtain the user's initial operation permission set for the alarm host cluster corresponding to the target defense zone through the topology linkage control engine. The topology verification module is used to obtain the real-time topology operation parameters of the target defense zone at the current moment, and to verify each operation item in the initial operation permission set based on the real-time topology operation parameters, and to filter out the valid operation permission set. The interface generation module is used to generate virtual operation interfaces grouped according to the alarm host cluster based on the effective operation permission set through the topology linkage control engine, and push them to the mobile terminal to receive operation instructions triggered by the user. The linkage instruction scheduling module is used to respond to the operation instruction, perform secondary facial biometric verification on the user, and after the verification is successful, map the operation instruction to the entity protocol instruction that can be executed by each target alarm host in the alarm host cluster, arrange the instruction issuance order based on the host instruction dependency relationship in the security topology diagram, and issue the entity protocol instruction to the corresponding target alarm host in sequence.

[0006] The virtualized control method for alarm host based on face recognition proposed in this application can bring the following benefits: By embedding the constraints of the park's security topology into the alarm host's virtual control engine, the control engine is natively adapted to the park's multi-layered nested defense zones and distributed host clusters, breaking the limitations of the traditional static planar management and control architecture in terms of scenario adaptability.

[0007] Initial operating permissions are generated for the host cluster in the target defense zone based on the security topology. The permissions are dynamically verified and filtered in combination with the real-time topology operation parameters of the target defense zone. This avoids unauthorized operations across levels and regions from the root of the control logic, and greatly improves the accuracy and compliance of permission control.

[0008] A grouped virtual operation interface is generated according to the alarm host cluster topology. The operation entry corresponds one-to-one with the cluster topology node, which is suitable for the on-site operation scenario of mobile inspection, reduces operation complexity, and reduces the probability of misoperation.

[0009] By orchestrating the order of multi-host linkage commands based on the host command dependencies in the security topology, the timing conflict problem of distributed cluster linkage operations is resolved, and the execution stability of multi-host linkage operations is improved. At the same time, combined with secondary facial biometric verification, the legitimacy of the operator's identity is guaranteed throughout the process, meeting the security control requirements of high-level security in the park. Attached Figure Description

[0010] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a flowchart illustrating a face recognition-based alarm host virtualization control method in an embodiment of this application. Figure 2 This is a schematic diagram of the structure of a face recognition-based alarm host virtualization control system in an embodiment of this application. Detailed Implementation

[0011] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0012] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0013] like Figure 1 As shown in the figure, this application provides a virtualized control method for an alarm host based on face recognition, including: S101. Call the pre-built security topology map of the target park, and perform topology constraint embedding processing on the virtual control engine of the alarm host of the target park to obtain the topology linkage control engine; the security topology map includes the topology nodes of the defense zone, the topology nodes of the alarm host cluster, and the association constraints between the nodes.

[0014] Specifically, the system reads all nodes and associated constraint information from the pre-built security topology diagram of the target park, extracts topology constraint items, and then writes the topology constraint items into the three logical units corresponding to the alarm host virtual control engine: permission judgment, interface rendering, and instruction scheduling. This completes the embedding of topology constraints into the entire execution process of the control engine, ultimately resulting in a topology linkage control engine with built-in zone permission rules, interface grouping rules, and instruction timing rules.

[0015] The security topology map is a pre-built structured graph dataset. Zone topology nodes correspond to the various levels of zone entities within the park, including the overall park, functional zones, buildings, and independent zones, storing zone level, security level, and effective time period attributes. Alarm host cluster topology nodes correspond to each physical alarm host within the park, storing device model, communication address, and zone number attributes. The association constraints between nodes store the hierarchical relationships, linkage dependencies, and personnel access scope relationships between each node.

[0016] In specific implementation, the pre-construction process of the security topology map is as follows: Based on the official zone division filing data of the target park, extract the entities of each level of the park, functional zones, buildings, and independent zones as zone topology nodes, bind zone level, security level, and effective time period attributes, define the subordinate association rules of upper and lower level zones, and generate multi-layer nested zone topology subsets; Based on the park alarm equipment ledger and network construction data, extract each physical alarm host as an alarm host cluster topology node, bind the device model, communication address, and zone number attributes, define the linkage dependency association rules between hosts, and generate a distributed alarm host cluster topology subset; Based on the park patrol route planning and post responsibility data, extract patrol check-in points and patrol line boundaries as patrol movement topology nodes, bind the access post and inspection time period attributes, define the access association rules of personnel movement, and generate a personnel patrol movement topology subset; Map and bind the nodes of the three types of topology subsets according to their zone numbers, establish cross-subset association constraints, and finally generate a complete security topology map.

[0017] Among them, the zone topology node stores the full attributes of the corresponding zone entity, the alarm host cluster topology node stores the full attributes of the corresponding physical alarm host, and the association constraints between nodes store the hierarchical subordinate relationship, linkage dependency relationship, and personnel access scope relationship of each node.

[0018] Furthermore, the topology constraint embedding process specifically involves: parsing the security topology diagram and extracting three types of topology constraint items based on the association constraints between nodes: zone-level permission constraints, alarm host cluster grouping constraints, and linkage command timing constraints. Zone-level permission constraints define the rules governing the subordinate operation permissions of upper and lower level zones; alarm host cluster grouping constraints define the grouping correspondence rules between host nodes and interface controls; and linkage command timing constraints define the execution order rules for multi-host linkage operations.

[0019] The zone-level permission constraints are written into the permission determination logic unit of the alarm host virtual control engine. Each type of operation permission is bound to the corresponding zone topology node identifier, and an access mapping relationship between various operation permissions and the corresponding zone topology node is established, so that the permission output automatically converges with the zone topology level.

[0020] The alarm host cluster grouping constraints are written into the interface rendering logic unit of the alarm host virtual control engine. Each interface interaction control is bound to the corresponding alarm host cluster topology node identifier, and the display mapping relationship between the interface interaction control and the corresponding alarm host cluster topology node is established, so that the interface layout automatically groups according to the host cluster topology.

[0021] The timing constraints of the linkage instructions are written into the instruction scheduling logic unit of the alarm host virtual control engine. The execution dependency rules of the corresponding host topology node are bound to each type of linkage operation, and the timing mapping relationship between various linkage operation instructions and the corresponding host topology node is established, so that the linkage instructions are automatically sorted according to the host topology dependency relationship.

[0022] Once all three types of topology constraints are embedded into their corresponding logic units, the topology constraint embedding process is completed, resulting in the topology linkage control engine.

[0023] S102. Receive the user's operation request through the mobile terminal, determine the target defense zone to be accessed, collect the user's facial biometric features, and obtain the user's initial operation permission set for the alarm host cluster corresponding to the target defense zone through the topology linkage control engine.

[0024] Specifically, the system receives on-site operation requests via mobile terminals held by inspection personnel, locates the target zone requested by the user, collects the user's on-site facial biometrics, inputs the facial features and target zone information into the generated topology linkage control engine, and completes identity verification, permission matching and hierarchical filtering through the engine's built-in permission determination logic unit, ultimately generating the user's initial operation permission set for the corresponding alarm host cluster under the current target zone.

[0025] In practice, the mobile terminal receives alarm control operation requests triggered by the user, automatically matches the current security zone via GPS positioning, or allows the user to manually select the target security zone to determine the target zone for this request; it then uses the terminal's front-facing camera to capture the user's real-time facial image, performs blink and head-turning liveness detection, extracts facial biometric features, and uploads them to the topology linkage control engine. It should be noted that the mobile terminal is a dedicated explosion-proof handheld terminal or portable smart terminal (Portable Android Device, PAD) for park security patrols, supporting GPS positioning and facial recognition functions.

[0026] The collected facial biometric features and the identified target defense zone information are input into the permission determination logic unit of the topology linkage control engine. The target defense zone topology node is matched, and the pre-established access mapping relationship between operation permissions and defense zone topology nodes is invoked within the permission determination logic unit. Combined with the user's facial features and corresponding identity, all executable operation permissions for the user under the current target defense zone topology node are obtained.

[0027] By using pre-embedded zone-level permission constraints, the matched executable operation permission items are filtered hierarchically, eliminating operation items that exceed the current zone level or the user's authorized scope. The filtered executable operation permission items are then associated with the alarm host cluster topology nodes corresponding to the target zone, binding each operation item to a corresponding operable alarm host device, thus generating the user's initial operation permission set for the alarm host cluster corresponding to the target zone.

[0028] It should be noted that the initial operation permission set is different from the static permission set based on user roles. It is a dynamic permission set that is bound to the target zone and the corresponding alarm host cluster topology node. It only corresponds to the scope of operation of the current user in the current zone and does not include invalid permissions across zones or beyond the level.

[0029] For example, the park is divided into two primary defense zones: Production Zone A and Production Zone B. Production Zone A is equipped with three alarm hosts to form an alarm host cluster. Patrolman Zhang San's job responsibility is daily patrol of Zone A. He only has the authority to arm, extinguish, and bypass the alarm in Zone A, but does not have the authority to disarm the entire Zone A, nor does he have any operating authority in Zone B.

[0030] When inspector Zhang San arrives at the entrance of Area A and triggers an alarm host operation request via his handheld terminal: the terminal automatically determines the target area as Production Area A using GPS positioning, collects Zhang San's facial features, completes liveness detection, and uploads the data; the engine's permission determination logic unit receives the facial features and Area A information, matches the corresponding area topology node; it calls the access mapping relationship to match the executable operations for Zhang San's identity in Area A: arming, disarming, deactivating the alarm, and bypassing; through area-level permission constraints, the "Area A general disarming" operation, which exceeds Zhang San's job authority, is removed, leaving the remaining executable operations: arming, deactivating the alarm, and bypassing; the remaining three operations are associated with the three alarm host cluster nodes in Area A, generating Zhang San's initial operation permission set for the Area A alarm host cluster.

[0031] S103. Obtain the real-time topology operation parameters of the target defense zone at the current moment, and verify each operation item in the initial operation permission set based on the real-time topology operation parameters to obtain a valid operation permission set.

[0032] Specifically, the system calls the security topology map to obtain three types of real-time operating status parameters of the target zone at the current moment, identifies the type of each operation item in the initial permission set, performs compliance verification by matching the corresponding real-time topology parameters according to the type, eliminates illegal operation items with state conflicts, and filters out the set of valid operation permissions that can be legally executed at the current moment.

[0033] In practical implementation, the security topology map is invoked to obtain the real-time topology operation parameters at the current moment. These parameters include: the operating status of the topology nodes of the parent zone corresponding to the target zone, the pending operation queue of the alarm host cluster corresponding to the target zone, and the patrol route topology node to which the user's current location belongs. It should be noted that the real-time topology operation parameters are dynamic operational data bound to the three types of topology nodes: zone, host cluster, and patrol route.

[0034] The system identifies the operation type corresponding to each operation item in the initial operation permission set and matches the corresponding real-time topology operation parameters based on the operation type. The operation types include three categories: cross-level operations, mutually exclusive operations, and cross-region operations. It should be noted that cross-level operations refer to operations involving the linkage of the status of upper and lower level defense zones, mutually exclusive operations refer to operations that have a timing conflict with operations to be executed within the cluster, and cross-region operations refer to operations that exceed the user's authorized patrol range.

[0035] By matching real-time topology operation parameters, the operation items of the corresponding operation type are verified, and operation items with state conflicts are eliminated to obtain a valid set of operation permissions. The specific verification rule is as follows: when an operation type of cross-level operation is identified, it is determined whether there is a conflict of hierarchical permission constraints between the operation status of the upper-level defense zone topology node and the cross-level operation item; if so, the operation item is determined to be a state conflict operation item and is eliminated. It should be noted that the hierarchical permission constraint conflict is a mutual exclusion rule for upper and lower-level defense zone operations that is pre-embedded with defense zone hierarchical permission constraints. For example, when the upper-level main zone is in a defended state, the lower-level zone is prohibited from performing disarming operations to avoid confusion in the defense zone hierarchical status.

[0036] When an operation type is identified as a mutual exclusion operation, it is determined whether there is an operation in the queue of operations to be executed that has a linkage and mutual exclusion relationship with the current mutual exclusion operation item; if so, the operation item is determined to be a state conflict operation item and is removed; when an operation type is identified as a cross-region operation, it is determined whether the topology node of the target defense zone is within the range of the user's current patrol route topology node; if not, the operation item is determined to be a state conflict operation item and is removed.

[0037] For example, Zhang San's initial set of operation permissions is "Arm A", "Alarm Defuse A", and "Bypass A". The specific verification process is as follows: Obtain real-time topology operation parameters: the upper-level main park topology node is currently armed, the queue of the alarm host cluster in Zone A is empty, and Zhang San's current location is within the patrol route of Zone A; Identify the types of the three operation items: "Arm A" is a cross-level operation, "Alarm Defuse A" is a mutually exclusive operation, and "Bypass A" is a regular operation; the main park is already armed, and lower-level defense zones are prohibited from performing arming operations, so the "Arm A" operation item with hierarchical conflicts is removed; the queue of items to be executed is empty, and there are no mutually exclusive conflicts; Zhang San's location is within the patrol range, and there are no cross-zone conflicts; the effective set of operation permissions obtained is "Alarm Defuse A" and "Bypass A".

[0038] S104. Through the topology linkage control engine, a virtual operation interface is generated according to the grouping of the alarm host cluster based on the valid operation permission set, and pushed to the mobile terminal to receive the operation instructions triggered by the user.

[0039] Specifically, the interface rendering logic unit in the topology linkage control engine is invoked to match the corresponding interactive controls based on the display mapping relationship. The controls are arranged according to the grouping constraints of the alarm host cluster to generate a grouped virtual operation interface that only includes the current user's valid operation permissions, which is then pushed to the mobile terminal for user operation.

[0040] In practice, the interface rendering logic unit of the topology linkage control engine is invoked to read the target alarm host cluster topology node corresponding to the valid operation permission set.

[0041] By establishing a pre-defined display mapping relationship between the interface interaction controls and the corresponding alarm host cluster topology nodes, the target interface interaction controls corresponding to the target alarm host cluster topology nodes are matched.

[0042] By using pre-embedded alarm host cluster grouping constraints, the target interface interactive controls are grouped and arranged to generate virtual operation interfaces grouped according to the alarm host clusters. It should be noted that the virtual operation interface arranges controls in groups based on the alarm host cluster topology nodes, and only displays the valid operation entry points for the current user under the corresponding cluster, with no redundant or invalid controls.

[0043] The generated grouped virtual operation interface is pushed to the user's mobile terminal, waiting to receive operation commands triggered by the user.

[0044] For example, Zhang San's valid operation permission set is "Area A Alarm Defusing, Area A Bypass", corresponding to the cluster nodes composed of 3 alarm hosts in Area A. The specific process of generating the virtual operation interface is as follows: The interface rendering logic unit reads the cluster topology nodes of the alarm hosts in Area A; it matches the two types of interactive controls, alarm defusing and bypass, through the display mapping relationship; according to the cluster grouping constraints, the alarm defusing and bypass controls are divided into 3 independent groups according to the 3 hosts, and each group only displays the alarm defusing and bypass buttons of the corresponding host, without invalid controls such as disarming; the generated group interface is pushed to Zhang San's handheld terminal, and Zhang San can directly click the controls under the corresponding host group to trigger the operation.

[0045] S105. In response to the operation command, perform secondary facial biometric verification on the user. After successful verification, map the operation command to the entity protocol command executable by each target alarm host in the alarm host cluster. Arrange the command issuance order based on the host command dependency relationship in the security topology diagram, and issue the entity protocol command to the corresponding target alarm host in sequence.

[0046] Specifically, the user's facial biometric features are collected again and a second identity verification is performed. After the verification is successful, the operation instructions are converted into private protocols that can be recognized by each target alarm host. Then, based on the predefined host instruction dependency relationship in the security topology, the timing of the instructions is arranged and the instructions are sent out in sequence.

[0047] In practice, in response to the operation command triggered by the virtual operation interface of the mobile terminal, the front-facing camera of the mobile terminal is automatically activated to collect the user's real-time facial image for a second time. After completing the blink and micro-expression liveness detection, the facial biometric vector is extracted and compared with the pre-stored user-authorized facial features to complete the second facial biometric verification.

[0048] Once the secondary facial biometric verification is successful, the device model and private communication protocol type of each target alarm host in the alarm host cluster corresponding to the operation command are read. The control actions and parameter information included in the operation command are parsed, converted according to the protocol format of the corresponding host, and an entity protocol command that can be directly recognized and executed by each target alarm host is generated.

[0049] The instruction scheduling logic unit of the topology linkage control engine is invoked to arrange the instruction issuance order based on the host instruction dependency relationship in the security topology diagram. It should be noted that the host instruction dependency relationship is a predefined instruction execution order rule based on the zone hierarchy and cluster linkage relationship. For example, instructions from lower-level zones are issued before instructions from upper-level zones, thus avoiding cluster timing conflicts at the source.

[0050] Following the pre-arranged order of instruction issuance, the communication address and port of each target alarm host are matched sequentially, and the entity protocol instructions are sent to the corresponding target alarm hosts for execution. The host then returns an execution result acknowledgment. It should be noted that the next instruction is only issued after the previous instruction has been executed and an acknowledgment has been returned, to avoid instruction congestion and execution errors in the distributed cluster.

[0051] After all instructions are issued and a successful execution confirmation is received, the user's facial biometric features, operation instruction information, target zone topology node identifier, and target host topology node identifier corresponding to this operation are extracted. The historical hash value corresponding to the previous operation is retrieved, and a SHA-256 hash operation is performed on all of them to generate the current operation hash value bound to the topology node. This hash value is then stored in the security audit log, completing the closed loop of the entire operation process. It should be noted that the current operation hash value, in addition to the usual personnel and operation information, is additionally bound to two types of topology node identifiers: zone and host. This can be directly used as compliance evidence for security auditing without the need to additionally retrieve topology logs to verify the legality of the operation scenario.

[0052] This application embeds the constraints of the park's security topology into the alarm host's virtual control engine, enabling the control engine to natively adapt to the park's multi-layered nested defense zones and distributed host cluster's exclusive topology architecture, breaking the scenario adaptability limitations of the traditional static planar management and control architecture.

[0053] Initial operating permissions are generated for the host cluster in the target defense zone based on the security topology. The permissions are dynamically verified and filtered in combination with the real-time topology operation parameters of the target defense zone. This avoids unauthorized operations across levels and regions from the root of the control logic, and greatly improves the accuracy and compliance of permission control.

[0054] A grouped virtual operation interface is generated according to the alarm host cluster topology. The operation entry corresponds one-to-one with the cluster topology node, which is suitable for the on-site operation scenario of mobile inspection, reduces operation complexity, and reduces the probability of misoperation.

[0055] By orchestrating the order of multi-host linkage commands based on the host command dependencies in the security topology, the timing conflict problem of distributed cluster linkage operations is resolved, and the execution stability of multi-host linkage operations is improved. At the same time, combined with secondary facial biometric verification, the legitimacy of the operator's identity is guaranteed throughout the process, meeting the security control requirements of high-level security in the park.

[0056] In addition, embodiments of the present invention also provide a virtualized control system for an alarm host based on facial recognition, such as... Figure 2 As shown, the face recognition-based alarm host virtualization control system 200 specifically includes: The topology constraint embedding module 210 is used to call the pre-built security topology map of the target park and perform topology constraint embedding processing on the virtual control engine of the alarm host of the target park to obtain the topology linkage control engine; the security topology map includes the topology nodes of the defense zone, the topology nodes of the alarm host cluster, and the association constraints between the nodes. The permission generation module 220 is used to receive user operation requests through a mobile terminal, determine the target defense zone requested for access, collect the user's facial biometric features, and obtain the user's initial operation permission set for the alarm host cluster corresponding to the target defense zone through the topology linkage control engine. The topology verification module 230 is used to obtain the real-time topology operation parameters of the target defense zone at the current moment, and to verify each operation item in the initial operation permission set based on the real-time topology operation parameters, and to filter out the valid operation permission set. The interface generation module 240 is used to generate a virtual operation interface grouped according to the alarm host cluster based on the effective operation permission set through the topology linkage control engine, and push it to the mobile terminal to receive the operation instructions triggered by the user. The linkage instruction scheduling module 250 is used to respond to the operation instruction, perform secondary facial biometric verification on the user, and after the verification is successful, map the operation instruction to the entity protocol instruction that can be executed by each target alarm host in the alarm host cluster, arrange the instruction issuance order based on the host instruction dependency relationship in the security topology diagram, and issue the entity protocol instruction to the corresponding target alarm host in sequence.

[0057] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0058] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware components.

[0059] Those skilled in the art will understand that the various embodiments in this application are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the device and medium embodiments are basically similar to the method embodiments, so the description is relatively simple, and the relevant parts can be referred to the description of the method embodiments.

[0060] The devices and media provided in this application are one-to-one with the methods. Therefore, the devices and media also have similar beneficial technical effects as their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the devices and media will not be repeated here.

[0061] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0062] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0063] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1The function specified in one or more boxes.

[0064] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0065] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0066] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0067] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0068] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0069] The above description is merely an embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of this application should be included within the scope of the claims of this application.

Claims

1. A virtualized control method for an alarm host based on face recognition, characterized in that, include: The pre-built security topology map of the target park is invoked, and the topology constraint embedding process is performed on the virtual control engine of the alarm host of the target park to obtain the topology linkage control engine. The security topology diagram includes zone topology nodes, alarm host cluster topology nodes, and the associated constraints between each node; The system receives user operation requests via mobile terminals, determines the target zone to be accessed, collects the user's facial biometric features, and obtains the user's initial set of operation permissions for the alarm host cluster corresponding to the target zone through the topology linkage control engine. Obtain the real-time topology operation parameters of the target defense zone at the current moment, verify each operation item in the initial operation permission set based on the real-time topology operation parameters, and filter to obtain a valid operation permission set; The topology linkage control engine generates virtual operation interfaces grouped according to the alarm host cluster based on the set of valid operation permissions, and pushes them to the mobile terminal to receive operation commands triggered by the user. In response to the operation command, the user undergoes a second facial biometric verification. Once the verification is successful, the operation command is mapped to an entity protocol command executable by each target alarm host in the alarm host cluster. Based on the host command dependency relationship in the security topology diagram, the command issuance order is arranged, and the entity protocol commands are sequentially issued to the corresponding target alarm hosts.

2. The virtualized control method for an alarm host based on face recognition according to claim 1, characterized in that, The process of embedding topological constraints into the virtual control engine of the alarm host in the target park to obtain a topological linkage control engine specifically includes: Based on the association constraints between nodes in the security topology diagram, topology constraint items are extracted; the topology constraint items include zone level permission constraints, alarm host cluster grouping constraints, and linkage command timing constraints. The hierarchical permission constraints of the defense zone are embedded into the permission determination logic unit in the virtual control engine of the alarm host of the target park, and an access mapping relationship between various operation permissions and the corresponding defense zone topology nodes is established. The alarm host cluster grouping constraints are embedded into the interface rendering logic unit in the alarm host virtual control engine, and a display mapping relationship between the interface interactive controls and the corresponding alarm host cluster topology nodes is established. The timing constraints of the linkage instructions are embedded into the instruction scheduling logic unit in the virtual control engine of the alarm host, and a timing mapping relationship between various linkage operation instructions and corresponding host topology nodes is established. Once all the topology constraints are embedded, the topology linkage control engine is obtained.

3. The virtualized control method for an alarm host based on face recognition according to claim 2, characterized in that, The initial set of operation permissions for the user regarding the alarm host cluster corresponding to the target zone is obtained through the topology linkage control engine, specifically including: The facial biometrics and the target defense zone are input into the topology linkage control engine; The target defense zone topology node corresponding to the target defense zone is determined, and the executable operation permission item corresponding to the target defense zone topology node is matched based on the access mapping relationship through the permission determination logic unit of the topology linkage control engine. Based on the zone-level permission constraints, the executable operation permission items are filtered hierarchically. The selected executable operation permission items are associated and matched with the alarm host cluster node corresponding to the target zone to obtain the user's initial operation permission set for the alarm host cluster corresponding to the target zone.

4. The virtualized control method for an alarm host based on face recognition according to claim 2, characterized in that, The process of generating virtual operation interfaces grouped according to the alarm host cluster through the topology linkage control engine based on the valid operation permission set specifically includes: The interface rendering logic unit of the topology linkage control engine is invoked to read the target alarm host cluster topology node corresponding to the set of valid operation permissions; The target interface interaction controls corresponding to the target alarm host cluster topology nodes are matched using the display mapping relationship. By using the alarm host cluster grouping constraints, the target interface interactive controls are grouped and arranged to generate virtual operation interfaces grouped according to the alarm host cluster.

5. The virtualized control method for an alarm host based on face recognition according to claim 2, characterized in that, The method of orchestrating the instruction delivery order based on the host instruction dependency relationship in the security topology diagram, and sequentially sending the entity protocol instructions to the corresponding target alarm hosts, specifically includes: Extract the preset protocol delay parameters of the host topology nodes corresponding to each target alarm host; The execution priority of each entity's protocol instruction is determined by the linkage instruction timing constraints, and the time interval between the issuance of adjacent entity protocol instructions is calculated. Based on the execution priority and the sending time interval, the protocol instructions of each entity are sent sequentially to the corresponding target alarm host.

6. The virtualized control method for an alarm host based on face recognition according to claim 1, characterized in that, The process of obtaining the real-time topology operation parameters of the target defense zone at the current moment, and verifying each operation item in the initial operation permission set based on the real-time topology operation parameters to obtain a valid operation permission set, specifically includes: The security topology map is invoked to obtain the real-time topology operation parameters at the current moment; the real-time topology operation parameters include the operation status of the topology nodes of the upper-level defense zone corresponding to the target defense zone, the queue of operations to be executed of the alarm host cluster corresponding to the target defense zone, and the patrol area to which the user's current location belongs; Identify the operation type corresponding to each operation item in the initial operation permission set, and match the corresponding real-time topology operation parameters based on the operation type; the operation type includes cross-level operation, mutual exclusion operation, and cross-region operation. By using the real-time topology operation parameters, the operation items of the corresponding operation type are verified, and operation items with state conflicts are eliminated to obtain a set of valid operation weights.

7. The virtualized control method for an alarm host based on face recognition according to claim 6, characterized in that, The step of verifying operation items of corresponding operation types and eliminating operation items with conflicting states using the real-time topology operation parameters specifically includes: When an operation type is identified as a cross-level operation, the running status of the upper-level defense zone topology node is determined to see if there is a conflict with the cross-level operation item in terms of hierarchical permission constraints. If so, then the cross-level operation item is determined to be a state conflict operation item and is removed; When an operation type is identified as a mutual exclusion operation, it is determined whether there is an operation to be executed in the queue of operations to be executed that has a mutual exclusion relationship with the mutual exclusion operation item. If so, then the mutual exclusion operation is determined to be a state conflict operation and is removed; When an operation type is identified as a cross-regional operation, it is determined whether the target defense zone topology node corresponding to the target defense zone is within the range of the patrol area; If not, then the corresponding cross-region operation item is identified as a state conflict operation item and removed.

8. The virtualized control method for an alarm host based on face recognition according to claim 7, characterized in that, After the push to the mobile terminal to receive the user-triggered operation command, it further includes: The user's current actual location is collected periodically based on a preset cycle, and the corresponding patrol route topology nodes are matched. Determine whether the patrol route topology node corresponding to the current actual location still belongs to the authorized range of the target defense zone; If not, immediately revoke the user's valid operating permissions and close the virtual operating interface of the mobile terminal.

9. The virtualized control method for an alarm host based on face recognition according to claim 1, characterized in that, The process of performing secondary facial biometric verification on the user, after successful verification, further includes: Extract the secondary facial biometric features of the user corresponding to this operation, the operation command, the historical hash value corresponding to the previous operation, and the target defense zone topology node corresponding to the target defense zone, perform hash operation, and generate the hash value of the current operation. The current operation hash value is associated with the target defense zone topology node and stored in the security audit log.

10. A virtualized control system for an alarm host based on facial recognition, characterized in that, include: The topology constraint embedding module is used to call a pre-built security topology map of the target park and perform topology constraint embedding processing on the virtual control engine of the alarm host of the target park to obtain a topology linkage control engine; the security topology map includes zone topology nodes, alarm host cluster topology nodes and the association constraints between each node; The permission generation module is used to receive user operation requests through a mobile terminal, determine the target defense zone to be accessed, collect the user's facial biometric features, and obtain the user's initial operation permission set for the alarm host cluster corresponding to the target defense zone through the topology linkage control engine. The topology verification module is used to obtain the real-time topology operation parameters of the target defense zone at the current moment, and to verify each operation item in the initial operation permission set based on the real-time topology operation parameters, and to filter out the valid operation permission set. The interface generation module is used to generate virtual operation interfaces grouped according to the alarm host cluster based on the effective operation permission set through the topology linkage control engine, and push them to the mobile terminal to receive operation instructions triggered by the user. The linkage instruction scheduling module is used to respond to the operation instruction, perform secondary facial biometric verification on the user, and after the verification is successful, map the operation instruction to the entity protocol instruction that can be executed by each target alarm host in the alarm host cluster, arrange the instruction issuance order based on the host instruction dependency relationship in the security topology diagram, and issue the entity protocol instruction to the corresponding target alarm host in sequence.

Images